Eric W. Biederman bfedb58925 mm: Add a user_ns owner to mm_struct and fix ptrace permission checks ... During exec dumpable is cleared if the file that is being executed is not readable by the user executing the file. A bug in ptrace_may_access allows reading the file if the executable happens to enter into a subordinate user namespace (aka clone(CLONE_NEWUSER), unshare(CLONE_NEWUSER), or setns(fd, CLONE_NEWUSER). This problem is fixed with only necessary userspace breakage by adding a user namespace owner to mm_struct, captured at the time of exec, so it is clear in which user namespace CAP_SYS_PTRACE must be present in to be able to safely give read permission to the executable. The function ptrace_may_access is modified to verify that the ptracer has CAP_SYS_ADMIN in task->mm->user_ns instead of task->cred->user_ns. This ensures that if the task changes it's cred into a subordinate user namespace it does not become ptraceable. The function ptrace_attach is modified to only set PT_PTRACE_CAP when CAP_SYS_PTRACE is held over task->mm->user_ns. The intent of PT_PTRACE_CAP is to be a flag to note that whatever permission changes the task might go through the tracer has sufficient permissions for it not to be an issue. task->cred->user_ns is always the same as or descendent of mm->user_ns. Which guarantees that having CAP_SYS_PTRACE over mm->user_ns is the worst case for the tasks credentials. To prevent regressions mm->dumpable and mm->user_ns are not considered when a task has no mm. As simply failing ptrace_may_attach causes regressions in privileged applications attempting to read things such as /proc/<pid>/stat Cc: stable@vger.kernel.org Acked-by: Kees Cook <keescook@chromium.org> Tested-by: Cyrill Gorcunov <gorcunov@openvz.org> Fixes: 8409cca705 ("userns: allow ptrace from non-init user namespaces") Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>		2016-11-22 11:49:48 -06:00
..
bpf	bpf: fix map not being uncharged during map creation failure	2016-11-07 13:22:26 -05:00
configs	config: android: enable CONFIG_SECCOMP	2016-10-11 15:06:32 -07:00
debug
events	Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-10-28 16:27:16 -07:00
gcov	gcov: add support for gcc version >= 6	2016-07-15 14:54:27 +09:00
irq	genirq: Use irq type from irqdata instead of irqdesc	2016-11-08 15:15:19 +01:00
livepatch	livepatch/module: make TAINT_LIVEPATCH module-specific	2016-08-26 14:42:08 +02:00
locking	locking/lglock: Remove lglock implementation	2016-09-22 15:25:56 +02:00
power	PM / sleep: fix device reference leak in test_suspend	2016-11-02 05:10:04 +01:00
printk	Revert "printk: make reading the kernel log flush pending lines"	2016-11-14 09:31:52 -08:00
rcu	This adds a new gcc plugin named "latent_entropy". It is designed to	2016-10-15 10:03:15 -07:00
sched	sched/core: Remove pointless printout in sched_show_task()	2016-11-03 07:31:34 +01:00
time	timers: Prevent base clock corruption when forwarding	2016-10-25 16:32:50 +02:00
trace	ftrace: Add more checks for FTRACE_FL_DISABLED in processing ip records	2016-11-14 16:31:49 -05:00
.gitignore
acct.c
async.c
audit_fsnotify.c
audit_tree.c	audit: cleanup prune_tree_thread	2016-04-04 09:46:47 -04:00
audit_watch.c	Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit	2016-09-01 15:55:56 -07:00
audit.c	Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/audit	2016-10-04 14:21:41 -07:00
audit.h	Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit	2016-07-29 17:54:17 -07:00
auditfilter.c	audit: add fields to exclude filter by reusing user filter	2016-06-27 11:01:00 -04:00
auditsc.c	Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/audit	2016-10-04 14:21:41 -07:00
backtracetest.c
bounds.c
capability.c	kernel: Add noaudit variant of ns_capable()	2016-06-06 20:16:18 +10:00
cgroup_freezer.c
cgroup_pids.c	cgroup: Use lld instead of ld when printing pids controller events_limit	2016-06-21 15:03:36 -04:00
cgroup.c	Merge branch 'for-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2016-10-14 12:18:50 -07:00
compat.c
configs.c
context_tracking.c
cpu_pm.c
cpu.c	cpu/hotplug: Use distinct name for cpu_hotplug.dep_map	2016-10-16 11:09:32 +02:00
cpuset.c	Merge branch 'for-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2016-10-14 12:18:50 -07:00
crash_dump.c
cred.c	cred: Reject inodes with invalid ids in set_create_file_as()	2016-06-30 18:05:09 -05:00
delayacct.c
dma.c
elfcore.c
exec_domain.c
exit.c	mm, oom: enforce exit_oom_victim on current task	2016-10-07 18:46:28 -07:00
extable.c
fork.c	mm: Add a user_ns owner to mm_struct and fix ptrace permission checks	2016-11-22 11:49:48 -06:00
freezer.c	freezer, oom: check TIF_MEMDIE on the correct task	2016-07-28 16:07:41 -07:00
futex_compat.c
futex.c	futex: Add some more function commentry	2016-09-05 17:20:18 +02:00
groups.c	cred: simpler, 1D supplementary groups	2016-10-07 18:46:30 -07:00
hung_task.c	hung_task: allow hung_task_panic when hung_task_warnings is 0	2016-10-11 15:06:33 -07:00
irq_work.c
jump_label.c	powerpc updates for 4.8 #2	2016-08-05 09:00:54 -04:00
kallsyms.c
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c	kcov: properly check if we are in an interrupt	2016-10-27 18:43:42 -07:00
kexec_core.c	kexec: add restriction on kexec_load() segment sizes	2016-08-02 19:35:31 -04:00
kexec_file.c	kexec: fix double-free when failing to relocate the purgatory	2016-09-01 17:52:01 -07:00
kexec_internal.h
kexec.c	kexec: allow architectures to override boot mapping	2016-08-02 19:35:27 -04:00
kmod.c
kprobes.c	kprobes: include <asm/sections.h> instead of <asm-generic/sections.h>	2016-10-11 15:06:31 -07:00
ksysfs.c	kexec: add a kexec_crash_loaded() function	2016-08-02 19:35:30 -04:00
kthread.c	kthread: better support freezable kthread workers	2016-10-11 15:06:33 -07:00
latencytop.c
Makefile	userns: Add per user namespace sysctls.	2016-08-08 13:18:58 -05:00
membarrier.c
memremap.c	mm: fix cache mode of dax pmd mappings	2016-09-09 17:34:46 -07:00
module_signing.c	KEYS: Move the point of trust determination to __key_link()	2016-04-11 22:43:43 +01:00
module-internal.h
module.c	livepatch/module: make TAINT_LIVEPATCH module-specific	2016-08-26 14:42:08 +02:00
notifier.c
nsproxy.c
padata.c	padata: Convert to hotplug state machine	2016-09-19 21:44:30 +02:00
panic.c	x86/panic: replace smp_send_stop() with kdump friendly version in panic path	2016-10-11 15:06:32 -07:00
params.c
pid_namespace.c	Merge branch 'nsfs-ioctls' into HEAD	2016-09-22 20:00:36 -05:00
pid.c	remove lots of IS_ERR_VALUE abuses	2016-05-27 15:26:11 -07:00
profile.c	profile: Convert to hotplug state machine	2016-07-15 10:41:42 +02:00
ptrace.c	mm: Add a user_ns owner to mm_struct and fix ptrace permission checks	2016-11-22 11:49:48 -06:00
range.c
reboot.c
relay.c	relay: Use irq_work instead of plain timer for deferred wakeup	2016-10-11 15:06:32 -07:00
resource.c	/proc/iomem: only expose physical resource addresses to privileged users	2016-04-14 12:56:09 -07:00
seccomp.c	seccomp: Fix tracer exit notifications during fatal signals	2016-08-30 16:12:46 -07:00
signal.c	x86/signal: Add SA_{X32,IA32}_ABI sa_flags	2016-09-14 21:28:11 +02:00
smp.c	smp: Allocate smp_call_on_cpu() workqueue on stack too	2016-09-22 14:49:10 +02:00
smpboot.c	kthread/smpboot: do not park in kthread_create_on_cpu()	2016-10-11 15:06:33 -07:00
smpboot.h
softirq.c	softirq: Display IRQ_POLL for irq-poll statistics	2016-10-21 15:45:47 -06:00
stacktrace.c
stop_machine.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-10-03 13:39:00 -07:00
sys_ni.c	x86/pkeys: Fix pkeys build breakage for some non-x86 arches	2016-09-13 14:41:36 +02:00
sys.c	prctl: make PR_SET_THP_DISABLE wait for mmap_sem killable	2016-05-23 17:04:14 -07:00
sysctl_binary.c	kernel/sysctl_binary.c: use generic UUID library	2016-05-20 17:58:30 -07:00
sysctl.c	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-10-10 13:04:49 -07:00
task_work.c	task_work: use READ_ONCE/lockless_dereference, avoid pi_lock if !task_works	2016-08-02 19:35:02 -04:00
taskstats.c	taskstats: fix the length of cgroupstats_cmd_get_policy	2016-11-03 16:55:58 -04:00
test_kprobes.c
torture.c	torture: Convert torture_shutdown() to hrtimer	2016-08-22 10:01:49 -07:00
tracepoint.c	kernel/...: convert pr_warning to pr_warn	2016-03-22 15:36:02 -07:00
tsacct.c
ucount.c	mntns: Add a limit on the number of mount namespaces.	2016-08-31 07:28:35 -05:00
uid16.c	cred: simpler, 1D supplementary groups	2016-10-07 18:46:30 -07:00
up.c	smp: Add function to execute a function synchronously on a CPU	2016-09-05 13:52:39 +02:00
user_namespace.c	Merge branch 'nsfs-ioctls' into HEAD	2016-09-22 20:00:36 -05:00
user-return-notifier.c
user.c
utsname_sysctl.c
utsname.c	Merge branch 'nsfs-ioctls' into HEAD	2016-09-22 20:00:36 -05:00
watchdog.c	Revert "perf/x86/intel, watchdog: Switch NMI watchdog to ref cycles on x86"	2016-07-10 20:58:36 +02:00
workqueue_internal.h
workqueue.c	kthread: rename probe_kthread_data() to kthread_probe_data()	2016-10-11 15:06:33 -07:00