Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756139Ab3IYUXl (ORCPT ); Wed, 25 Sep 2013 16:23:41 -0400 Received: from numidia.opendz.org ([98.142.220.152]:58256 "EHLO numidia.opendz.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755403Ab3IYUXk (ORCPT ); Wed, 25 Sep 2013 16:23:40 -0400 From: Djalal Harouni To: "Eric W. Biederman" , Kees Cook , Al Viro , Andrew Morton , Linus Torvalds , Ingo Molnar , "Serge E. Hallyn" , Cyrill Gorcunov , LKML , linux-fsdevel@vger.kernel.org, Cc: tixxdz@gmail.com, Djalal Harouni Subject: [PATCH 06/12] procfs: make /proc/*/stack 0400 Date: Wed, 25 Sep 2013 21:14:39 +0100 Message-Id: <1380140085-29712-7-git-send-email-tixxdz@opendz.org> X-Mailer: git-send-email 1.7.11.7 In-Reply-To: <1380140085-29712-1-git-send-email-tixxdz@opendz.org> References: <1380140085-29712-1-git-send-email-tixxdz@opendz.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1818 Lines: 50 The /proc/*/stack contains sensitive information and currently its mode is 0444. Change this to 0400 so the VFS will be able to block unprivileged processes to get file descriptors on arbitrary privileged /proc/*/stack files. The /proc/*/stack is a /procfs ONE file that shares the same ->open() file operation with other ONE files. Doing a ptrace_may_access() check during open() might break userspace from accessing other ONE files like /proc/*/stat and /proc/*/statm. Therfore make it 0400 for now, and improve its check during ->read() in the next following patch. Cc: Kees Cook Cc: Eric W. Biederman Signed-off-by: Djalal Harouni --- fs/proc/base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 8d21316..bb90171 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2710,7 +2710,7 @@ static const struct pid_entry tgid_base_stuff[] = { INF("wchan", S_IRUGO, proc_pid_wchan), #endif #ifdef CONFIG_STACKTRACE - ONE("stack", S_IRUGO, proc_pid_stack), + ONE("stack", S_IRUSR, proc_pid_stack), #endif #ifdef CONFIG_SCHEDSTATS INF("schedstat", S_IRUGO, proc_pid_schedstat), @@ -3048,7 +3048,7 @@ static const struct pid_entry tid_base_stuff[] = { INF("wchan", S_IRUGO, proc_pid_wchan), #endif #ifdef CONFIG_STACKTRACE - ONE("stack", S_IRUGO, proc_pid_stack), + ONE("stack", S_IRUSR, proc_pid_stack), #endif #ifdef CONFIG_SCHEDSTATS INF("schedstat", S_IRUGO, proc_pid_schedstat), -- 1.7.11.7 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/