lkml.org 
[lkml]   [2009]   [Dec]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH] Security: Implement prctl(PR_SET_NETWORK, PR_NETWORK_OFF) semantics.
    Michael Stone <michael@laptop.org> writes:

    > diff --git a/kernel/ptrace.c b/kernel/ptrace.c
    > index 23bd09c..5b38db0 100644
    > --- a/kernel/ptrace.c
    > +++ b/kernel/ptrace.c
    > @@ -151,6 +151,8 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
    > dumpable = get_dumpable(task->mm);
    > if (!dumpable && !capable(CAP_SYS_PTRACE))
    > return -EPERM;
    > + if (current->network)
    > + return -EPERM;

    The principle should be: you gain no privileges by ptracing.
    Therefore this check should be:

    if (current->network && !task->network)
    return -EPERM;

    Which keeps the ptrace logic from being a larger hammer than it needs
    to be.

    Eric


    \
     
     \ /
      Last update: 2009-12-17 20:21    [W:0.025 / U:0.736 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site