Messages in this thread | | | Date | Fri, 20 Apr 2018 22:25:46 +0300 | From | Alexey Dobriyan <> | Subject | Re: [PATCH 1/5] proc: make /proc/*/cmdline go through LSM |
| |
On Thu, Apr 19, 2018 at 05:02:17PM -0700, Andrew Morton wrote: > On Wed, 21 Feb 2018 22:23:39 +0300 Alexey Dobriyan <adobriyan@gmail.com> wrote: > > > /proc/*/cmdline is not different from /proc/*/environ as it accesses > > target task's memory (and can access the very same region of memory) > > but it doesn't go through ptrace_may_access() and thus doesn't go through LSM. > > This change can cause existing code to break, no? > > I'd like to see, in the changelog, a full explanation of why this won't > break any existing setup?
It can. In fact, I'm not sure about this patch anymore. Original /proc/*/cmdline hook did get_cmdline() which is basically GUP. It is just nobody said anything when /proc/*/cmdline got rewritten and security folks aren't bitching about it:
$ cat /proc/1/cmdline init [3]
I'll resend the rest of cmdline changes if they gets broken.
| |