Eric W. Biederman 694a95fa6d mm: Add a user_ns owner to mm_struct and fix ptrace permission checks ... commit bfedb58925 upstream. During exec dumpable is cleared if the file that is being executed is not readable by the user executing the file. A bug in ptrace_may_access allows reading the file if the executable happens to enter into a subordinate user namespace (aka clone(CLONE_NEWUSER), unshare(CLONE_NEWUSER), or setns(fd, CLONE_NEWUSER). This problem is fixed with only necessary userspace breakage by adding a user namespace owner to mm_struct, captured at the time of exec, so it is clear in which user namespace CAP_SYS_PTRACE must be present in to be able to safely give read permission to the executable. The function ptrace_may_access is modified to verify that the ptracer has CAP_SYS_ADMIN in task->mm->user_ns instead of task->cred->user_ns. This ensures that if the task changes it's cred into a subordinate user namespace it does not become ptraceable. The function ptrace_attach is modified to only set PT_PTRACE_CAP when CAP_SYS_PTRACE is held over task->mm->user_ns. The intent of PT_PTRACE_CAP is to be a flag to note that whatever permission changes the task might go through the tracer has sufficient permissions for it not to be an issue. task->cred->user_ns is always the same as or descendent of mm->user_ns. Which guarantees that having CAP_SYS_PTRACE over mm->user_ns is the worst case for the tasks credentials. To prevent regressions mm->dumpable and mm->user_ns are not considered when a task has no mm. As simply failing ptrace_may_attach causes regressions in privileged applications attempting to read things such as /proc/<pid>/stat Acked-by: Kees Cook <keescook@chromium.org> Tested-by: Cyrill Gorcunov <gorcunov@openvz.org> Fixes: 8409cca705 ("userns: allow ptrace from non-init user namespaces") Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-01-06 10:40:13 +01:00
..
acpi	Merge branches 'acpica-fixes', 'acpi-cppc-fixes' and 'acpi-tools-fixes'	2016-11-18 21:34:42 +01:00
asm-generic	Revert "default exported asm symbols to zero"	2016-12-07 08:39:00 -08:00
clocksource
crypto	crypto: drbg - prevent invalid SG mappings	2016-11-30 19:46:44 +08:00
drm	drm: Don't force all planes to be added to the state due to zpos	2016-10-26 18:48:05 +02:00
dt-bindings	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux	2016-10-12 11:05:23 -07:00
keys
kvm
linux	mm: Add a user_ns owner to mm_struct and fix ptrace permission checks	2017-01-06 10:40:13 +01:00
math-emu
media	Linux 4.8	2016-10-05 16:43:53 -03:00
memory
misc
net	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2016-12-01 11:04:41 -05:00
pcmcia
ras
rdma	Merge of primary rdma-core code for 4.9	2016-10-09 17:04:33 -07:00
rxrpc
scsi
soc	powerpc updates for 4.9 #2	2016-10-14 11:07:42 -07:00
sound	ASoC: Updates for v4.9	2016-09-30 18:40:40 +02:00
target	target: Make EXTENDED_COPY 0xe4 failure return COPY TARGET DEVICE NOT REACHABLE	2016-10-19 21:22:32 -07:00
trace	Merge branch 'for-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2016-10-14 12:18:50 -07:00
uapi	can: raw: raw_setsockopt: limit number of can_filter that can be set	2016-12-07 10:45:57 +01:00
video	fbdev changes for 4.9	2016-10-12 11:01:37 -07:00
xen	xen: features and fixes for 4.9-rc0	2016-10-06 11:19:10 -07:00
Kbuild