Messages in this thread Patch in this message | | | Date | Wed, 8 Mar 2006 14:52:52 -0600 | From | "Ram Gupta" <> | Subject | [PATCH] capability: Fix bug in checking capabilties in ptrace system call |
| |
This patch fixes a bug of ptrace for PTRACE_TRACEME request. In this case the call is made by the child process & code needs to check the capabilty of the parent process to trace the child process but code incorrectly makes check for the child process.
Signed-off-by: Ram Gupta <ram.gupta5@gmail.com>
--- linux-2.6.14-patch-2.6.15/security/commoncap.c.orig Wed Mar 8 13:54:06 2006 +++ linux-2.6.14-patch-2.6.15/security/commoncap.c Wed Mar 8 13:57:07 2006 @@ -59,9 +59,13 @@ int cap_settime(struct timespec *ts, str int cap_ptrace (struct task_struct *parent, struct task_struct *child) { /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */ - if (!cap_issubset (child->cap_permitted, current->cap_permitted) && - !capable(CAP_SYS_PTRACE)) - return -EPERM; + if (!cap_issubset (child->cap_permitted, current->cap_permitted)){ + if(!security_ops->capable(parent,CAP_SYS_PTRACE)){ + parent->flags |= PF_SUPERPRIV; + } + else + return -EPERM; + } return 0; }
Regards Ram Gupta - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |