Commit c94bea2e authored by Eric W. Biederman's avatar Eric W. Biederman Committed by Greg Kroah-Hartman

ptrace: Properly initialize ptracer_cred on fork

commit c70d9d80 upstream.

When I introduced ptracer_cred I failed to consider the weirdness of
fork where the task_struct copies the old value by default.  This
winds up leaving ptracer_cred set even when a process forks and
the child process does not wind up being ptraced.

Because ptracer_cred is not set on non-ptraced processes whose
parents were ptraced this has broken the ability of the enlightenment
window manager to start setuid children.

Fix this by properly initializing ptracer_cred in ptrace_init_task

This must be done with a little bit of care to preserve the current value
of ptracer_cred when ptrace carries through fork.  Re-reading the
ptracer_cred from the ptracing process at this point is inconsistent
with how PT_PTRACE_CAP has been maintained all of these years.
Tested-by: default avatarTakashi Iwai <tiwai@suse.de>
Fixes: 64b875f7 ("ptrace: Capture the ptracer's creds not PT_PTRACE_CAP")
Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent dd6a4b53
...@@ -50,7 +50,8 @@ extern int ptrace_request(struct task_struct *child, long request, ...@@ -50,7 +50,8 @@ extern int ptrace_request(struct task_struct *child, long request,
unsigned long addr, unsigned long data); unsigned long addr, unsigned long data);
extern void ptrace_notify(int exit_code); extern void ptrace_notify(int exit_code);
extern void __ptrace_link(struct task_struct *child, extern void __ptrace_link(struct task_struct *child,
struct task_struct *new_parent); struct task_struct *new_parent,
const struct cred *ptracer_cred);
extern void __ptrace_unlink(struct task_struct *child); extern void __ptrace_unlink(struct task_struct *child);
extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead); extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
#define PTRACE_MODE_READ 0x01 #define PTRACE_MODE_READ 0x01
...@@ -202,7 +203,7 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace) ...@@ -202,7 +203,7 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace)
if (unlikely(ptrace) && current->ptrace) { if (unlikely(ptrace) && current->ptrace) {
child->ptrace = current->ptrace; child->ptrace = current->ptrace;
__ptrace_link(child, current->parent); __ptrace_link(child, current->parent, current->ptracer_cred);
if (child->ptrace & PT_SEIZED) if (child->ptrace & PT_SEIZED)
task_set_jobctl_pending(child, JOBCTL_TRAP_STOP); task_set_jobctl_pending(child, JOBCTL_TRAP_STOP);
...@@ -211,6 +212,8 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace) ...@@ -211,6 +212,8 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace)
set_tsk_thread_flag(child, TIF_SIGPENDING); set_tsk_thread_flag(child, TIF_SIGPENDING);
} }
else
child->ptracer_cred = NULL;
} }
/** /**
......
...@@ -28,19 +28,25 @@ ...@@ -28,19 +28,25 @@
#include <linux/compat.h> #include <linux/compat.h>
void __ptrace_link(struct task_struct *child, struct task_struct *new_parent,
const struct cred *ptracer_cred)
{
BUG_ON(!list_empty(&child->ptrace_entry));
list_add(&child->ptrace_entry, &new_parent->ptraced);
child->parent = new_parent;
child->ptracer_cred = get_cred(ptracer_cred);
}
/* /*
* ptrace a task: make the debugger its new parent and * ptrace a task: make the debugger its new parent and
* move it to the ptrace list. * move it to the ptrace list.
* *
* Must be called with the tasklist lock write-held. * Must be called with the tasklist lock write-held.
*/ */
void __ptrace_link(struct task_struct *child, struct task_struct *new_parent) static void ptrace_link(struct task_struct *child, struct task_struct *new_parent)
{ {
BUG_ON(!list_empty(&child->ptrace_entry));
list_add(&child->ptrace_entry, &new_parent->ptraced);
child->parent = new_parent;
rcu_read_lock(); rcu_read_lock();
child->ptracer_cred = get_cred(__task_cred(new_parent)); __ptrace_link(child, new_parent, __task_cred(new_parent));
rcu_read_unlock(); rcu_read_unlock();
} }
...@@ -353,7 +359,7 @@ static int ptrace_attach(struct task_struct *task, long request, ...@@ -353,7 +359,7 @@ static int ptrace_attach(struct task_struct *task, long request,
flags |= PT_SEIZED; flags |= PT_SEIZED;
task->ptrace = flags; task->ptrace = flags;
__ptrace_link(task, current); ptrace_link(task, current);
/* SEIZE doesn't trap tracee on attach */ /* SEIZE doesn't trap tracee on attach */
if (!seize) if (!seize)
...@@ -420,7 +426,7 @@ static int ptrace_traceme(void) ...@@ -420,7 +426,7 @@ static int ptrace_traceme(void)
*/ */
if (!ret && !(current->real_parent->flags & PF_EXITING)) { if (!ret && !(current->real_parent->flags & PF_EXITING)) {
current->ptrace = PT_PTRACED; current->ptrace = PT_PTRACED;
__ptrace_link(current, current->real_parent); ptrace_link(current, current->real_parent);
} }
} }
write_unlock_irq(&tasklist_lock); write_unlock_irq(&tasklist_lock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment