proc: force dcache drop on unauthorized access

The patch "proc: fix races against execve() of /proc/PID/fd**" is still a
partial fix for a setxid problem.  link(2) is a yet another way to
identify whether a specific fd is opened by a privileged process.  By
calling link(2) against /proc/PID/fd/* an attacker may identify whether
the fd number is valid for PID by analysing link(2) return code.

Both getattr() and link() can be used by the attacker iff the dentry is
present in the dcache.  In this case ->lookup() is not called and the only
way to check ptrace permissions is either operation handler or
->revalidate().  The easiest solution to prevent any unauthorized access
to /proc/PID/fd*/ files is to force the dentry drop on each unauthorized
access attempt.

If an attacker keeps opened fd of /proc/PID/fd/ and dcache contains a
specific dentry for some /proc/PID/fd/XXX, any future attemp to use the
dentry by the attacker would lead to the dentry drop as a result of a
failed ptrace check in ->revalidate().  Then the attacker cannot spawn a
dentry for the specific fd number because of ptrace check in ->lookup().

The dentry drop can be still observed by an attacker by analysing
information from /proc/slabinfo, which is addressed in the successive
patch.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Cc: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christoph Lameter <cl@linux-foundation.org>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Matt Mackall <mpm@selenic.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 851ba3dcdc290ab6b750793c2840bdffac755de7..0007efd973fcc7d074a9d41d60be2d0f0136671d 100644 (file)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1954,6 +1954,11 @@ static int tid_fd_revalidate(struct dentry *dentry, struct nameidata *nd)
        task = get_proc_task(inode);
        fd = proc_fd(inode);
 
+       if (!ptrace_may_access(task, PTRACE_MODE_READ)) {
+               put_task_struct(task);
+               task = NULL;
+       }
+
        if (task) {
                files = get_files_struct(task);
                if (files) {