From a1365a83ec8b15c2a1d728d9cf11c555e9615f24 Mon Sep 17 00:00:00 2001 From: Vasiliy Kulikov Date: Tue, 8 Nov 2011 11:20:23 +1100 Subject: [PATCH] proc: force dcache drop on unauthorized access The patch "proc: fix races against execve() of /proc/PID/fd**" is still a partial fix for a setxid problem. link(2) is a yet another way to identify whether a specific fd is opened by a privileged process. By calling link(2) against /proc/PID/fd/* an attacker may identify whether the fd number is valid for PID by analysing link(2) return code. Both getattr() and link() can be used by the attacker iff the dentry is present in the dcache. In this case ->lookup() is not called and the only way to check ptrace permissions is either operation handler or ->revalidate(). The easiest solution to prevent any unauthorized access to /proc/PID/fd*/ files is to force the dentry drop on each unauthorized access attempt. If an attacker keeps opened fd of /proc/PID/fd/ and dcache contains a specific dentry for some /proc/PID/fd/XXX, any future attemp to use the dentry by the attacker would lead to the dentry drop as a result of a failed ptrace check in ->revalidate(). Then the attacker cannot spawn a dentry for the specific fd number because of ptrace check in ->lookup(). The dentry drop can be still observed by an attacker by analysing information from /proc/slabinfo, which is addressed in the successive patch. Signed-off-by: Vasiliy Kulikov Cc: Cyrill Gorcunov Cc: Al Viro Cc: Christoph Lameter Cc: Pekka Enberg Cc: Matt Mackall Cc: Alexey Dobriyan Signed-off-by: Andrew Morton --- fs/proc/base.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index 851ba3dcdc29..0007efd973fc 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1954,6 +1954,11 @@ static int tid_fd_revalidate(struct dentry *dentry, struct nameidata *nd) task = get_proc_task(inode); fd = proc_fd(inode); + if (!ptrace_may_access(task, PTRACE_MODE_READ)) { + put_task_struct(task); + task = NULL; + } + if (task) { files = get_files_struct(task); if (files) { -- 2.39.5