)]}' { "commit": "5cd9c58fbe9ec92b45b27e131719af4f2bd9eb40", "tree": "8573db001b4dc3c2ad97102dda42b841c40b5f6c", "parents": [ "8d0968abd03ec6b407df117adc773562386702fa" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Aug 14 11:37:28 2008 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Thu Aug 14 22:59:43 2008 +1000" }, "message": "security: Fix setting of PF_SUPERPRIV by __capable()\n\nFix the setting of PF_SUPERPRIV by __capable() as it could corrupt the flags\nthe target process if that is not the current process and it is trying to\nchange its own flags in a different way at the same time.\n\n__capable() is using neither atomic ops nor locking to protect t-\u003eflags. This\npatch removes __capable() and introduces has_capability() that doesn\u0027t set\nPF_SUPERPRIV on the process being queried.\n\nThis patch further splits security_ptrace() in two:\n\n (1) security_ptrace_may_access(). This passes judgement on whether one\n process may access another only (PTRACE_MODE_ATTACH for ptrace() and\n PTRACE_MODE_READ for /proc), and takes a pointer to the child process.\n current is the parent.\n\n (2) security_ptrace_traceme(). This passes judgement on PTRACE_TRACEME only,\n and takes only a pointer to the parent process. current is the child.\n\n In Smack and commoncap, this uses has_capability() to determine whether\n the parent will be permitted to use PTRACE_ATTACH if normal checks fail.\n This does not set PF_SUPERPRIV.\n\nTwo of the instances of __capable() actually only act on current, and so have\nbeen changed to calls to capable().\n\nOf the places that were using __capable():\n\n (1) The OOM killer calls __capable() thrice when weighing the killability of a\n process. All of these now use has_capability().\n\n (2) cap_ptrace() and smack_ptrace() were using __capable() to check to see\n whether the parent was allowed to trace any process. As mentioned above,\n these have been split. For PTRACE_ATTACH and /proc, capable() is now\n used, and for PTRACE_TRACEME, has_capability() is used.\n\n (3) cap_safe_nice() only ever saw current, so now uses capable().\n\n (4) smack_setprocattr() rejected accesses to tasks other than current just\n after calling __capable(), so the order of these two tests have been\n switched and capable() is used instead.\n\n (5) In smack_file_send_sigiotask(), we need to allow privileged processes to\n receive SIGIO on files they\u0027re manipulating.\n\n (6) In smack_task_wait(), we let a process wait for a privileged process,\n whether or not the process doing the waiting is privileged.\n\nI\u0027ve tested this with the LTP SELinux and syscalls testscripts.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nAcked-by: Andrew G. Morgan \u003cmorgan@kernel.org\u003e\nAcked-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "02673846d20539b25949c3e10356ae09e9be762b", "old_mode": 33188, "old_path": "include/linux/capability.h", "new_id": "9d1fe30b6f6c1226b7fe6e6d37937c2d50be70ac", "new_mode": 33188, "new_path": "include/linux/capability.h" }, { "type": "modify", "old_id": "fd96e7f8a6f9c9ecad138a0eaae84c5f6c82dc64", "old_mode": 33188, "old_path": "include/linux/security.h", "new_id": "2ee5ecfb23938e6f894b185909e9e89499a26d6d", "new_mode": 33188, "new_path": "include/linux/security.h" }, { "type": "modify", "old_id": "0101e847603e675d46cbfd53154455e3ba8943de", "old_mode": 33188, "old_path": "kernel/capability.c", "new_id": "33e51e78c2d8672559fa4aa6d5dcc4d38d113627", "new_mode": 33188, "new_path": "kernel/capability.c" }, { "type": "modify", "old_id": "082b3fcb32a09e2110c97b6c7527d5f3eca137b7", "old_mode": 33188, "old_path": "kernel/ptrace.c", "new_id": "356699a96d565faa2e034253f9178c7d0aa2829d", "new_mode": 33188, "new_path": "kernel/ptrace.c" }, { "type": "modify", "old_id": "8a5467ee6265deb11a48fe9861348dd182dc9f7f", "old_mode": 33188, "old_path": "mm/oom_kill.c", "new_id": "64e5b4bcd964cd912b5a5f6b22dc392621269d84", "new_mode": 33188, "new_path": "mm/oom_kill.c" }, { "type": "modify", "old_id": "63d10da515a5b01e9cf36a2f7b2a49e82b10d199", "old_mode": 33188, "old_path": "security/capability.c", "new_id": "2458748190361328b3862092c82563fbb587bcf1", "new_mode": 33188, "new_path": "security/capability.c" }, { "type": "modify", "old_id": "4afbece37a086af337be9f3b8566a11843092ee3", "old_mode": 33188, "old_path": "security/commoncap.c", "new_id": "e4c4b3fc0c04e49e553610a8bd4d433e55e9212a", "new_mode": 33188, "new_path": "security/commoncap.c" }, { "type": "modify", "old_id": "be0ebec2580b14165f24f9cbc9fac3778b73b15b", "old_mode": 33188, "old_path": "security/root_plug.c", "new_id": "c3f68b5b372d31c74e7f3bbb8e5fbfc737b25cab", "new_mode": 33188, "new_path": "security/root_plug.c" }, { "type": "modify", "old_id": "ff7068727757639149501937043766d2199a8228", "old_mode": 33188, "old_path": "security/security.c", "new_id": "3a4b4f55b33f373d5a85145d61e6de95cce4bf3c", "new_mode": 33188, "new_path": "security/security.c" }, { "type": "modify", "old_id": "3ae9bec5a5088ba62eab619cae7e7664151a522b", "old_mode": 33188, "old_path": "security/selinux/hooks.c", "new_id": "03fc6a81ae32bd783ddd96eca85f118a2ba79bd8", "new_mode": 33188, "new_path": "security/selinux/hooks.c" }, { "type": "modify", "old_id": "1b40e558f98329a718a76c7a4b4458380a63057e", "old_mode": 33188, "old_path": "security/smack/smack_lsm.c", "new_id": "87d75417ea937e7756678fd381c3cb96c9d1c7a5", "new_mode": 33188, "new_path": "security/smack/smack_lsm.c" } ] }