Messages in this thread | | | Date | Tue, 13 Jul 2010 21:17:20 -0500 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH] Yama: turn process ancestry check into function |
| |
Quoting Kees Cook (kees.cook@canonical.com): > On Wed, Jul 14, 2010 at 09:19:09AM +0900, Tetsuo Handa wrote: > > > + if (mode == PTRACE_MODE_ATTACH && > > > + ptrace_scope && > > > + !task_is_descendant(current, child) && > > > + !capable(CAP_SYS_PTRACE)) > > > + rc = -EPERM; > > > > I don't know how heavy capable(CAP_SYS_PTRACE) is. > > But checking !capable(CAP_SYS_PTRACE) before > > !task_is_descendant(current, child) might be lighter. > > That's the order I had before, but in looking at some of the other code, it > seemed like moving it to the end made more logical sense. Since checking > PTRACE attach isn't a common or time-sensitive operation, I figured trying > to tune it wasn't critical.
Yes the reason to keep it like this is that capable(CAP_SYS_PTRACE) will set PF_SUPERPRIV if it passes. You don't want to do that unless the capability was actually required.
-serge
| |