Messages in this thread |  | | Date | Thu, 12 Feb 2015 10:45:44 +0300 | From | Cyrill Gorcunov <> | Subject | Re: [RFC][PATCH v3] procfs: Always expose /proc/<pid>/map_files/ and make it readable |
| |
On Wed, Feb 11, 2015 at 06:29:10PM -0800, Calvin Owens wrote: > Currently, /proc/<pid>/map_files/ is restricted to CAP_SYS_ADMIN, and is > only exposed if CONFIG_CHECKPOINT_RESTORE is set. This interface is > useful for enumerating the files mapped into a process when the more > verbose information in /proc/<pid>/maps is not needed. It also allows > access to file descriptors for files that have been deleted and closed > but are still mmapped into a process, which can be very useful for > introspection and debugging. ... > > +/* > + * Enforce stronger PTRACE_MODE_ATTACH permissions on the symlinks under > + * /proc/<pid>/map_files, since these links may refer to deleted or O_TMPFILE > + * files that users might assume are inaccessible regardless of their > + * ownership/permissions. > + */ > +static void *proc_map_files_follow_link(struct dentry *dentry, struct nameidata *nd) > +{ > + struct inode *inode = dentry->d_inode; > + struct task_struct *task; > + int allowed = 0; > + > + task = get_proc_task(inode); > + if (task) { > + allowed = ptrace_may_access(task, PTRACE_MODE_ATTACH); > + put_task_struct(task); > + }
else return ERR_PTR(-ESRCH);
Other than that, looks good to me, thanks!
Rewieved-by: Cyrill Gorcunov <gorcunov@openvz.org>
|  |