• Kees Cook's avatar
    exec/ptrace: fix get_dumpable() incorrect tests · d049f74f
    Kees Cook authored
    The get_dumpable() return value is not boolean.  Most users of the
    function actually want to be testing for non-SUID_DUMP_USER(1) rather than
    SUID_DUMP_DISABLE(0).  The SUID_DUMP_ROOT(2) is also considered a
    protected state.  Almost all places did this correctly, excepting the two
    places fixed in this patch.
    Wrong logic:
        if (dumpable == SUID_DUMP_DISABLE) { /* be protective */ }
        if (dumpable == 0) { /* be protective */ }
        if (!dumpable) { /* be protective */ }
    Correct logic:
        if (dumpable != SUID_DUMP_USER) { /* be protective */ }
        if (dumpable != 1) { /* be protective */ }
    Without this patch, if the system had set the sysctl fs/suid_dumpable=2, a
    user was able to ptrace attach to processes that had dropped privileges to
    that user.  (This may have been partially mitigated if Yama was enabled.)
    The macros have been moved into the file that declares get/set_dumpable(),
    which means things like the ia64 code can see them too.
    Reported-by: default avatarVasily Kulikov <segoon@openwall.com>
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Cc: "Luck, Tony" <tony.luck@intel.com>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: "Eric W. Biederman" <ebiederm@xmission.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
ptrace.c 29.9 KB