ptrace: slightly saner get_dumpable() logic
Backport of upstream commit 31e62c2ebbfd ("ptrace: slightly saner
'get_dumpable()' logic") posted by Linus Torvalds in response to a
Qualys Security Advisory. ptrace_may_access() no longer trusts an
absent mm as 'dumpable enough'; mm-less targets (kernel threads,
exited tasks) now require CAP_SYS_PTRACE. A new user_dumpable bit
in task_struct caches the last user-dumpable state of a task whose
mm has been torn down in exit_mm().
Applies to AlmaLinux 10s as-is (offset-only adjusted for the 227
source base, no fuzz).
This commit is contained in:
parent
2a655dcde0
commit
55ac995a97
109
1103-ptrace-saner-get_dumpable-logic.patch
Normal file
109
1103-ptrace-saner-get_dumpable-logic.patch
Normal file
@ -0,0 +1,109 @@
|
||||
From: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
Subject: [PATCH AlmaLinux 10s] ptrace: slightly saner 'get_dumpable()' logic
|
||||
|
||||
Backport of upstream commit 31e62c2ebbfd ("ptrace: slightly saner
|
||||
'get_dumpable()' logic") posted at
|
||||
https://github.com/torvalds/linux/commit/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a
|
||||
|
||||
The 'dumpability' of a task is fundamentally about the memory image of
|
||||
the task -- the concept comes from whether it can core dump or not --
|
||||
and makes no sense when you don't have an associated mm.
|
||||
|
||||
And almost all users do in fact use it only for the case where the
|
||||
task has a mm pointer.
|
||||
|
||||
But we have one odd special case: ptrace_may_access() uses 'dumpable'
|
||||
to check various other things entirely independently of the MM
|
||||
(typically explicitly using flags like PTRACE_MODE_READ_FSCREDS).
|
||||
Including for threads that no longer have a VM (and maybe never did,
|
||||
like most kernel threads).
|
||||
|
||||
The ptrace code does check that the uid/gid matches, so you do have
|
||||
to be uid-0 to see kernel thread details, but this means that the
|
||||
traditional "drop capabilities" model doesn't make any difference
|
||||
for this all.
|
||||
|
||||
Make it all make a bit more sense by saying that if you don't have a
|
||||
MM pointer, we use a cached "last dumpability" flag if the thread
|
||||
ever had a MM (it will be zero for kernel threads since it is never
|
||||
set), and require a proper CAP_SYS_PTRACE capability to override.
|
||||
|
||||
Verified to apply with `patch -p1 -F0` (no offset, no fuzz, no rejects)
|
||||
against kernel-6.12.0-227.el10.
|
||||
|
||||
Reported-by: Qualys Security Advisory <qsa@qualys.com>
|
||||
Cc: Oleg Nesterov <oleg@redhat.com>
|
||||
Cc: Kees Cook <kees@kernel.org>
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
include/linux/sched.h | 3 +++
|
||||
kernel/exit.c | 1 +
|
||||
kernel/ptrace.c | 22 ++++++++++++++++------
|
||||
3 files changed, 20 insertions(+), 6 deletions(-)
|
||||
|
||||
--- a/include/linux/sched.h
|
||||
+++ b/include/linux/sched.h
|
||||
@@ -1005,6 +1005,9 @@ struct task_struct {
|
||||
unsigned sched_rt_mutex:1;
|
||||
#endif
|
||||
|
||||
+ /* Save user-dumpable when mm goes away */
|
||||
+ unsigned user_dumpable:1;
|
||||
+
|
||||
/* Bit to tell TOMOYO we're in execve(): */
|
||||
unsigned in_execve:1;
|
||||
unsigned in_iowait:1;
|
||||
--- a/kernel/exit.c
|
||||
+++ b/kernel/exit.c
|
||||
@@ -563,6 +563,7 @@ static void exit_mm(void)
|
||||
*/
|
||||
smp_mb__after_spinlock();
|
||||
local_irq_disable();
|
||||
+ current->user_dumpable = (get_dumpable(mm) == SUID_DUMP_USER);
|
||||
current->mm = NULL;
|
||||
membarrier_update_current_mm(NULL);
|
||||
enter_lazy_tlb(mm, current);
|
||||
--- a/kernel/ptrace.c
|
||||
+++ b/kernel/ptrace.c
|
||||
@@ -272,11 +272,24 @@ static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
|
||||
return ns_capable(ns, CAP_SYS_PTRACE);
|
||||
}
|
||||
|
||||
+static bool task_still_dumpable(struct task_struct *task, unsigned int mode)
|
||||
+{
|
||||
+ struct mm_struct *mm = task->mm;
|
||||
+ if (mm) {
|
||||
+ if (get_dumpable(mm) == SUID_DUMP_USER)
|
||||
+ return true;
|
||||
+ return ptrace_has_cap(mm->user_ns, mode);
|
||||
+ }
|
||||
+
|
||||
+ if (task->user_dumpable)
|
||||
+ return true;
|
||||
+ return ptrace_has_cap(&init_user_ns, mode);
|
||||
+}
|
||||
+
|
||||
/* Returns 0 on success, -errno on denial. */
|
||||
static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
|
||||
{
|
||||
const struct cred *cred = current_cred(), *tcred;
|
||||
- struct mm_struct *mm;
|
||||
kuid_t caller_uid;
|
||||
kgid_t caller_gid;
|
||||
|
||||
@@ -337,11 +350,8 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
|
||||
* Pairs with a write barrier in commit_creds().
|
||||
*/
|
||||
smp_rmb();
|
||||
- mm = task->mm;
|
||||
- if (mm &&
|
||||
- ((get_dumpable(mm) != SUID_DUMP_USER) &&
|
||||
- !ptrace_has_cap(mm->user_ns, mode)))
|
||||
- return -EPERM;
|
||||
+ if (!task_still_dumpable(task, mode))
|
||||
+ return -EPERM;
|
||||
|
||||
return security_ptrace_access_check(task, mode);
|
||||
}
|
||||
--
|
||||
2.43.0
|
||||
@ -1146,6 +1146,7 @@ Patch2010: 0001-Keep-fs-btrfs-files-in-modules-package.patch
|
||||
Patch1100: 1100-xfrm-esp-avoid-in-place-decrypt-shared-skb-frags.patch
|
||||
Patch1101: 1101-rxrpc-linearize-paged-frags.patch
|
||||
Patch1102: 1102-net-skbuff-propagate-shared-frag-marker.patch
|
||||
Patch1103: 1103-ptrace-saner-get_dumpable-logic.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
@ -2044,6 +2045,7 @@ ApplyPatch 0001-Keep-fs-btrfs-files-in-modules-package.patch
|
||||
ApplyPatch 1100-xfrm-esp-avoid-in-place-decrypt-shared-skb-frags.patch
|
||||
ApplyPatch 1101-rxrpc-linearize-paged-frags.patch
|
||||
ApplyPatch 1102-net-skbuff-propagate-shared-frag-marker.patch
|
||||
ApplyPatch 1103-ptrace-saner-get_dumpable-logic.patch
|
||||
|
||||
%{log_msg "End of patch applications"}
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
Loading…
Reference in New Issue
Block a user