diff --git a/1101-ptrace-saner-get_dumpable-logic.patch b/1101-ptrace-saner-get_dumpable-logic.patch new file mode 100644 index 000000000..dce3ebe45 --- /dev/null +++ b/1101-ptrace-saner-get_dumpable-logic.patch @@ -0,0 +1,109 @@ +From: Linus Torvalds +Subject: [PATCH AlmaLinux 10] ptrace: slightly saner 'get_dumpable()' logic + +Backport of upstream commit 31e62c2ebbfd ("ptrace: slightly saner +'get_dumpable()' logic") posted at +https://github.com/torvalds/linux/commit/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a + +The 'dumpability' of a task is fundamentally about the memory image of +the task -- the concept comes from whether it can core dump or not -- +and makes no sense when you don't have an associated mm. + +And almost all users do in fact use it only for the case where the +task has a mm pointer. + +But we have one odd special case: ptrace_may_access() uses 'dumpable' +to check various other things entirely independently of the MM +(typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). +Including for threads that no longer have a VM (and maybe never did, +like most kernel threads). + +The ptrace code does check that the uid/gid matches, so you do have +to be uid-0 to see kernel thread details, but this means that the +traditional "drop capabilities" model doesn't make any difference +for this all. + +Make it all make a bit more sense by saying that if you don't have a +MM pointer, we use a cached "last dumpability" flag if the thread +ever had a MM (it will be zero for kernel threads since it is never +set), and require a proper CAP_SYS_PTRACE capability to override. + +Verified to apply with `patch -p1 -F0` (no offset, no fuzz, no rejects) +against kernel-6.12.0-124.56.1.el10_1. + +Reported-by: Qualys Security Advisory +Cc: Oleg Nesterov +Cc: Kees Cook +Signed-off-by: Linus Torvalds +--- + include/linux/sched.h | 3 +++ + kernel/exit.c | 1 + + kernel/ptrace.c | 22 ++++++++++++++++------ + 3 files changed, 20 insertions(+), 6 deletions(-) + +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1007,6 +1007,9 @@ struct task_struct { + unsigned sched_rt_mutex:1; + #endif + ++ /* Save user-dumpable when mm goes away */ ++ unsigned user_dumpable:1; ++ + /* Bit to tell TOMOYO we're in execve(): */ + unsigned in_execve:1; + unsigned in_iowait:1; +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -561,6 +561,7 @@ static void exit_mm(void) + */ + smp_mb__after_spinlock(); + local_irq_disable(); ++ current->user_dumpable = (get_dumpable(mm) == SUID_DUMP_USER); + current->mm = NULL; + membarrier_update_current_mm(NULL); + enter_lazy_tlb(mm, current); +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -272,11 +272,24 @@ static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode) + return ns_capable(ns, CAP_SYS_PTRACE); + } + ++static bool task_still_dumpable(struct task_struct *task, unsigned int mode) ++{ ++ struct mm_struct *mm = task->mm; ++ if (mm) { ++ if (get_dumpable(mm) == SUID_DUMP_USER) ++ return true; ++ return ptrace_has_cap(mm->user_ns, mode); ++ } ++ ++ if (task->user_dumpable) ++ return true; ++ return ptrace_has_cap(&init_user_ns, mode); ++} ++ + /* Returns 0 on success, -errno on denial. */ + static int __ptrace_may_access(struct task_struct *task, unsigned int mode) + { + const struct cred *cred = current_cred(), *tcred; +- struct mm_struct *mm; + kuid_t caller_uid; + kgid_t caller_gid; + +@@ -337,11 +350,8 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) + * Pairs with a write barrier in commit_creds(). + */ + smp_rmb(); +- mm = task->mm; +- if (mm && +- ((get_dumpable(mm) != SUID_DUMP_USER) && +- !ptrace_has_cap(mm->user_ns, mode))) +- return -EPERM; ++ if (!task_still_dumpable(task, mode)) ++ return -EPERM; + + return security_ptrace_access_check(task, mode); + } +-- +2.43.0 diff --git a/kernel.spec b/kernel.spec index d42060662..9fb6e8417 100644 --- a/kernel.spec +++ b/kernel.spec @@ -176,13 +176,13 @@ Summary: The Linux kernel %define specrpmversion 6.12.0 %define specversion 6.12.0 %define patchversion 6.12 -%define pkgrelease 124.56.3 +%define pkgrelease 124.56.4 %define kversion 6 %define tarfile_release 6.12.0-124.56.1.el10_1 # This is needed to do merge window version magic %define patchlevel 12 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 124.56.3%{?buildid}%{?dist} +%define specrelease 124.56.4%{?buildid}%{?dist} # This defines the kabi tarball version %define kabiversion 6.12.0-124.56.1.el10_1 @@ -1129,6 +1129,7 @@ Patch2008: 0008-Bring-back-deprecated-pci-ids-to-megaraid_sas-driver.patch Patch2009: 0009-Bring-back-deprecated-pci-ids-to-mpt3sas-driver.patch Patch2010: 0010-Bring-back-deprecated-pci-ids-to-aacraid-driver.patch Patch1100: 1100-net-skbuff-propagate-shared-frag-marker.patch +Patch1101: 1101-ptrace-saner-get_dumpable-logic.patch # END OF PATCH DEFINITIONS @@ -1991,6 +1992,7 @@ ApplyPatch 0008-Bring-back-deprecated-pci-ids-to-megaraid_sas-driver.patch ApplyPatch 0009-Bring-back-deprecated-pci-ids-to-mpt3sas-driver.patch ApplyPatch 0010-Bring-back-deprecated-pci-ids-to-aacraid-driver.patch ApplyPatch 1100-net-skbuff-propagate-shared-frag-marker.patch +ApplyPatch 1101-ptrace-saner-get_dumpable-logic.patch %{log_msg "End of patch applications"} # END OF PATCH APPLICATIONS @@ -4379,6 +4381,9 @@ fi\ # # %changelog +* Fri May 15 2026 Andrew Lukoshko - 6.12.0-124.56.4 +- ptrace: slightly saner get_dumpable() logic (upstream 31e62c2ebbfd) + * Thu May 14 2026 Eduard Abdullin - 6.12.0-124.56.3 - net: skbuff: propagate shared-frag marker through frag-transfer helpers