Received: by 2002:a25:1506:0:0:0:0:0 with SMTP id 6csp3902222ybv; Mon, 10 Feb 2020 08:30:02 -0800 (PST) X-Google-Smtp-Source: APXvYqxV198XnEbIj4ACJzkS1HGsKP57liB/NDaWMvuhwXse8vSzljZ0xMb8s9LQt0V9Vi4kNZQm X-Received: by 2002:aca:c415:: with SMTP id u21mr1330211oif.49.1581352202769; Mon, 10 Feb 2020 08:30:02 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1581352202; cv=none; d=google.com; s=arc-20160816; b=La1Lhwqq6dT4RTBmcCPaly/iQBCY9JMhD5NEmc3vqGQ0Zz+vGaglG6/Q/coNt6EQ4U PCTw0qj8LUqu+Nt7zk8AjbFKa4iJhCaydBaiO++TX82/h5LZqo/q+QKsKFTnZOqTWpoJ EYraudeqki8a4RYeW2Zvq9MeI+UI5G9mGz5C7YZTMSjObzBwdNv4q8Iogb+AQywhoo3n oNAgQ96uPV/4hRTrDvR6rSijjQEmYBZ970Tvj8ihtIfZUaLCBXVQcm4TiWOMso8dYXvK J3IIt9PzviBP2pDsxfV9FBIkYbncc65lnDY2EWP8OQxjltMeueOWIVZWl1BSCtPWuac9 XTkw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :feedback-id:references:in-reply-to:message-id:subject:reply-to:cc :from:to:dkim-signature:date; bh=HaQYFeP243+jZHqXubIy8pMTeQYphN87kh+Q8EfSCug=; b=uS3pfHSRfPAiVOQ3HlDDviVbQTxtGMvHSYMVZklOCPk9sKSGz1Lxf0vhbiLJ3GmjhK htlDlgnbQYaqiHMKQlwoL7Md6VgD/LFQPq59OUsNKvCKmKfZIvl3CRnBb9u0Dg4ZdpGU juNB9E1Am1a0pq1mq7rYZsSsRUAAP64aOm/J+ApEU79MwBkg++xFw7UDnQ3RnbSdBpmG UTlf0l6ErHu467ADZE8MfqVSiQOvag6QDti+fuH+NtL8P0LS/3drut8qJo2clWImOW0L bEe3kwqcthEsuCsaHfbMZCe+SuDq2O86gqj5d8ihCr2EZTg1A+LmWzaF08ihC5fVHbAh 1IJw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@protonmail.ch header.s=default header.b=aETHlAln; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.ch Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id n9si381819ota.103.2020.02.10.08.29.51; Mon, 10 Feb 2020 08:30:02 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@protonmail.ch header.s=default header.b=aETHlAln; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.ch Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727924AbgBJQ3m (ORCPT + 99 others); Mon, 10 Feb 2020 11:29:42 -0500 Received: from mail-40135.protonmail.ch ([185.70.40.135]:25629 "EHLO mail-40135.protonmail.ch" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727686AbgBJQ3m (ORCPT ); Mon, 10 Feb 2020 11:29:42 -0500 Date: Mon, 10 Feb 2020 16:29:31 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.ch; s=default; t=1581352179; bh=HaQYFeP243+jZHqXubIy8pMTeQYphN87kh+Q8EfSCug=; h=Date:To:From:Cc:Reply-To:Subject:In-Reply-To:References: Feedback-ID:From; b=aETHlAlnvTvQPVmDanVXZ67C1YxDKkAcP3yUkwrXqtxF3lYAh74Px0kK8+8KcnPps M3875IFSBl/WF0/86G8k8Daw98k9L2ScMN+dO1yVlSOIXSPB+Ip+88T5TTPgApmJMp vBN+/dE0B1lhH/ssW8qk1W0TBhTeOSX5VJqbtuLc= To: Alexey Gladkov From: Jordan Glover Cc: LKML , Kernel Hardening , Linux API , Linux FS Devel , Linux Security Module , Akinobu Mita , Alexander Viro , Alexey Dobriyan , Andrew Morton , Andy Lutomirski , Daniel Micay , Djalal Harouni , "Dmitry V . Levin" , "Eric W . Biederman" , Greg Kroah-Hartman , Ingo Molnar , "J . Bruce Fields" , Jeff Layton , Jonathan Corbet , Kees Cook , Linus Torvalds , Oleg Nesterov , Solar Designer Reply-To: Jordan Glover Subject: Re: [PATCH v8 08/11] proc: instantiate only pids that we can ptrace on 'hidepid=4' mount option Message-ID: In-Reply-To: <20200210150519.538333-9-gladkov.alexey@gmail.com> References: <20200210150519.538333-1-gladkov.alexey@gmail.com> <20200210150519.538333-9-gladkov.alexey@gmail.com> Feedback-ID: QEdvdaLhFJaqnofhWA-dldGwsuoeDdDw7vz0UPs8r8sanA3bIt8zJdf4aDqYKSy4gJuZ0WvFYJtvq21y6ge_uQ==:Ext:ProtonMail MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Spam-Status: No, score=0.3 required=7.0 tests=ALL_TRUSTED,BAYES_50, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,FREEMAIL_REPLYTO, FREEMAIL_REPLYTO_END_DIGIT shortcircuit=no autolearn=no autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mail.protonmail.ch Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Monday, February 10, 2020 3:05 PM, Alexey Gladkov wrote: > If "hidepid=3D4" mount option is set then do not instantiate pids that > we can not ptrace. "hidepid=3D4" means that procfs should only contain > pids that the caller can ptrace. > > Cc: Kees Cook keescook@chromium.org > Cc: Andy Lutomirski luto@kernel.org > Signed-off-by: Djalal Harouni tixxdz@gmail.com > Signed-off-by: Alexey Gladkov gladkov.alexey@gmail.com > > fs/proc/base.c | 15 +++++++++++++++ > fs/proc/root.c | 14 +++++++++++--- > include/linux/proc_fs.h | 1 + > 3 files changed, 27 insertions(+), 3 deletions(-) > > diff --git a/fs/proc/base.c b/fs/proc/base.c > index 24b7c620ded3..49937d54e745 100644 > --- a/fs/proc/base.c > +++ b/fs/proc/base.c > @@ -699,6 +699,14 @@ static bool has_pid_permissions(struct proc_fs_info = *fs_info, > struct task_struct *task, > int hide_pid_min) > { > > - /* > - - If 'hidpid' mount option is set force a ptrace check, > - - we indicate that we are using a filesystem syscall > - - by passing PTRACE_MODE_READ_FSCREDS > - */ > - if (proc_fs_hide_pid(fs_info) =3D=3D HIDEPID_NOT_PTRACABLE) > - return ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS); > > > - if (proc_fs_hide_pid(fs_info) < hide_pid_min) > return true; > if (in_group_p(proc_fs_pid_gid(fs_info))) > @@ -3271,7 +3279,14 @@ struct dentry *proc_pid_lookup(struct dentry *= dentry, unsigned int flags) > if (!task) > goto out; > > - /* Limit procfs to only ptracable tasks */ > - if (proc_fs_hide_pid(fs_info) =3D=3D HIDEPID_NOT_PTRACABLE) { > - if (!has_pid_permissions(fs_info, task, HIDEPID_NO_ACCESS)) > > > - =09goto out_put_task; > > > - } > - result =3D proc_pid_instantiate(dentry, task, NULL); > +out_put_task: > put_task_struct(task); > out: > return result; > diff --git a/fs/proc/root.c b/fs/proc/root.c > index e2bb015da1a8..5e27bb31f125 100644 > --- a/fs/proc/root.c > +++ b/fs/proc/root.c > @@ -52,6 +52,15 @@ static const struct fs_parameter_description proc_= fs_parameters =3D { > .specs =3D proc_param_specs, > }; > > +static inline int > +valid_hidepid(unsigned int value) > +{ > > - return (value =3D=3D HIDEPID_OFF || > - value =3D=3D HIDEPID_NO_ACCESS || > > > - value =3D=3D HIDEPID_INVISIBLE || > > > - value =3D=3D HIDEPID_NOT_PTRACABLE); > > > > +} > + > static int proc_parse_param(struct fs_context *fc, struct fs_parameter *p= aram) > { > struct proc_fs_context *ctx =3D fc->fs_private; > @@ -68,10 +77,9 @@ static int proc_parse_param(struct fs_context *fc, str= uct fs_parameter *param) > break; > > case Opt_hidepid: > > - if (!valid_hidepid(result.uint_32)) > > > - =09return invalf(fc, "proc: unknown value of hidepid.\\n"); > ctx->hidepid =3D result.uint_32; > > > > - if (ctx->hidepid < HIDEPID_OFF || > > > - ctx->hidepid > HIDEPID_INVISIBLE) > > > - =09return invalf(fc, "proc: hidepid value must be between 0 and= 2.\\n"); > break; > > > > default: > diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h > index f307940f8311..6822548405a7 100644 > --- a/include/linux/proc_fs.h > +++ b/include/linux/proc_fs.h > @@ -17,6 +17,7 @@ enum { > HIDEPID_OFF =3D 0, > HIDEPID_NO_ACCESS =3D 1, > HIDEPID_INVISIBLE =3D 2, > > - HIDEPID_NOT_PTRACABLE =3D 4, /* Limit pids to only ptracable pids */ Is there a reason new option is "4" instead of "3"? The order 1..2..4 may b= e confusing for people. Jordan