github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 10:09:10 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ptrace: add ptracer_access_allowed()

Browse Source 
Add a helper that encapsulates all of the logic for checking ptrace
access and remove open-coded versions in follow-up patches.

Reviewed-by: Jann Horn <jannh@google.com>
Reviewed-by: David Hildenbrand (arm) <david@kernel.org>
Link: https://patch.msgid.link/20260520-work-task_exec_state-v3-3-69f895bc1385@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Christian Brauner (Amutable) 2026-05-20 23:48:54 +02:00 committed by Christian Brauner
parent b092062cb6
commit 92f829f6b2
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
2 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/ptrace.h
View File

@ -17,6 +17,7 @@ struct syscall_info {
struct seccomp_data data;
};
bool ptracer_access_allowed(struct task_struct *tsk);
extern int ptrace_access_vm(struct task_struct *tsk, unsigned long addr,
void *buf, int len, unsigned int gup_flags);

25
kernel/ptrace.c
View File

@ -13,6 +13,7 @@
#include <linux/sched.h>
#include <linux/sched/mm.h>
#include <linux/sched/coredump.h>
#include <linux/sched/exec_state.h>
#include <linux/sched/task.h>
#include <linux/errno.h>
#include <linux/mm.h>
@ -36,6 +37,30 @@
#include <asm/syscall.h> /* for syscall_get_* */
/**
* ptracer_access_allowed - may current peek/poke @tsk's address space?
* @tsk: tracee
*
* Per-access check used by ptrace_access_vm() and architecture-specific
* tag/register accessors. Returns true iff current is the registered
* ptracer of @tsk and either @tsk is owner-dumpable or current holds
* CAP_SYS_PTRACE in @tsk's exec namespace. Lighter than
* __ptrace_may_access(): it re-validates only dumpability and
* capability on every access, without re-running LSM hooks or
* cred_cap_issubset() checks performed at attach time.
*/
bool ptracer_access_allowed(struct task_struct *tsk)
{
const struct task_exec_state *es;
guard(rcu)();
if (ptrace_parent(tsk) != current)
return false;
es = task_exec_state_rcu(tsk);
return READ_ONCE(es->dumpable) == TASK_DUMPABLE_OWNER ||
ptracer_capable(tsk, es->user_ns);
}
/*
* Access another process' address space via ptrace.
* Source/target buffer must be kernel space,