Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753061AbbLLUW1 (ORCPT ); Sat, 12 Dec 2015 15:22:27 -0500 Received: from thejh.net ([37.221.195.125]:45307 "EHLO thejh.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751496AbbLLUWZ (ORCPT ); Sat, 12 Dec 2015 15:22:25 -0500 From: Jann Horn To: Roland McGrath , Oleg Nesterov Cc: linux-kernel@vger.kernel.org, security@kernel.org, Serge Hallyn , Jann Horn Subject: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids Date: Sat, 12 Dec 2015 21:12:41 +0100 Message-Id: <1449951161-4850-1-git-send-email-jann@thejh.net> X-Mailer: git-send-email 2.1.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3606 Lines: 95 ptrace_has_cap() checks whether the current process should be treated as having a certain capability for ptrace checks against another process. Until now, this was equivalent to has_ns_capability(current, target_ns, CAP_SYS_PTRACE). However, if a root-owned process wants to enter a user namespace for some reason without knowing who owns it and therefore can't change to the namespace owner's uid and gid before entering, as soon as it has entered the namespace, the namespace owner can attach to it via ptrace and thereby gain access to its uid and gid. While it is possible for the entering process to switch to the uid of a claimed namespace owner before entering, causing the attempt to enter to fail if the claimed uid is wrong, this doesn't solve the problem of determining an appropriate gid. With this change, the entering process can first enter the namespace and then safely inspect the namespace's properties, e.g. through /proc/self/{uid_map,gid_map}, assuming that the namespace owner doesn't have access to uid 0. Signed-off-by: Jann Horn --- kernel/ptrace.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) diff --git a/kernel/ptrace.c b/kernel/ptrace.c index b760bae..c27770d 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -207,12 +207,32 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state) return ret; } -static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode) +static bool ptrace_has_cap(const struct cred *tcred, unsigned int mode) { + struct user_namespace *tns = tcred->user_ns; + struct user_namespace *curns = current_cred()->user_ns; + + /* When a root-owned process enters a user namespace created by a + * malicious user, the user shouldn't be able to execute code under + * uid 0 by attaching to the root-owned process via ptrace. + * Therefore, similar to the capable_wrt_inode_uidgid() check, + * verify that all the uids and gids of the target process are + * mapped into the current namespace. + * No fsuid/fsgid check because __ptrace_may_access doesn't do it + * either. + */ + if (!kuid_has_mapping(curns, tcred->euid) || + !kuid_has_mapping(curns, tcred->suid) || + !kuid_has_mapping(curns, tcred->uid) || + !kgid_has_mapping(curns, tcred->egid) || + !kgid_has_mapping(curns, tcred->sgid) || + !kgid_has_mapping(curns, tcred->gid)) + return false; + if (mode & PTRACE_MODE_NOAUDIT) - return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE); + return has_ns_capability_noaudit(current, tns, CAP_SYS_PTRACE); else - return has_ns_capability(current, ns, CAP_SYS_PTRACE); + return has_ns_capability(current, tns, CAP_SYS_PTRACE); } /* Returns 0 on success, -errno on denial. */ @@ -241,7 +261,7 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) gid_eq(cred->gid, tcred->sgid) && gid_eq(cred->gid, tcred->gid)) goto ok; - if (ptrace_has_cap(tcred->user_ns, mode)) + if (ptrace_has_cap(tcred, mode)) goto ok; rcu_read_unlock(); return -EPERM; @@ -252,7 +272,7 @@ ok: dumpable = get_dumpable(task->mm); rcu_read_lock(); if (dumpable != SUID_DUMP_USER && - !ptrace_has_cap(__task_cred(task)->user_ns, mode)) { + !ptrace_has_cap(__task_cred(task), mode)) { rcu_read_unlock(); return -EPERM; } -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/