Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758586AbcKCUVo (ORCPT ); Thu, 3 Nov 2016 16:21:44 -0400 Received: from mail-ua0-f179.google.com ([209.85.217.179]:35771 "EHLO mail-ua0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752485AbcKCUVn (ORCPT ); Thu, 3 Nov 2016 16:21:43 -0400 MIME-Version: 1.0 In-Reply-To: <20161103182441.GA29904@laptop.thejh.net> References: <1478187038-19954-2-git-send-email-wluikil@gmail.com> <20161103182441.GA29904@laptop.thejh.net> From: Lafcadio Wluiki Date: Thu, 3 Nov 2016 14:21:41 -0600 Message-ID: Subject: Re: [2/2] procfs/tasks: add a simple per-task procfs hidepid= field To: Jann Horn Cc: linux-kernel@vger.kernel.org, Andrew Morton , Kees Cook , kernel-hardening@lists.openwall.com Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1175 Lines: 32 On Thu, Nov 3, 2016 at 12:24 PM, Jann Horn wrote: >> + case PR_SET_HIDEPID: >> + if (arg2 < HIDEPID_OFF || arg2 > HIDEPID_INVISIBLE) >> + return -EINVAL; >> + if (arg2 < me->hide_pid) >> + return -EPERM; >> + me->hide_pid = arg2; >> + break; > > Should we test for ns_capable(CAP_SYS_ADMIN)||no_new_privs here? > I think it wouldn't hurt, and I'd like to avoid adding new ways in which > the execution of setuid programs can be influenced. OTOH, people already > use hidepid now, and it's not an issue... I'm not sure. Opinions? Hmm, the existing hidepid= thing is a mount option and that you you of course can only change with root privs so far, hence the NNP thing doesn't really apply so far on hidepid. > @Lafcadio: Do you think that requiring no_new_privs to be set would > break your usecase? Would nginx need to still be able to execute setuid > binaries? I think adding the NNP check would be OK for my use. I'll add this to the next iteration! > Aside from this, and the comments Kees already made, this looks good > to me. Thanks for the review, L.