linux/fs/proc
Vasiliy Kulikov 293eb1e777 proc: fix a race in do_io_accounting()
If an inode's mode permits opening /proc/PID/io and the resulting file
descriptor is kept across execve() of a setuid or similar binary, the
ptrace_may_access() check tries to prevent using this fd against the
task with escalated privileges.

Unfortunately, there is a race in the check against execve().  If
execve() is processed after the ptrace check, but before the actual io
information gathering, io statistics will be gathered from the
privileged process.  At least in theory this might lead to gathering
sensible information (like ssh/ftp password length) that wouldn't be
available otherwise.

Holding task->signal->cred_guard_mutex while gathering the io
information should protect against the race.

The order of locking is similar to the one inside of ptrace_attach():
first goes cred_guard_mutex, then lock_task_sighand().

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-07-26 16:49:43 -07:00
..
array.c ptrace: s/tracehook_tracer_task()/ptrace_parent()/ 2011-06-22 19:26:29 +02:00
base.c proc: fix a race in do_io_accounting() 2011-07-26 16:49:43 -07:00
cmdline.c proc: switch /proc/cmdline to seq_file 2008-10-23 14:29:04 +04:00
consoles.c console: rename acquire/release_console_sem() to console_lock/unlock() 2011-01-26 10:50:06 +10:00
cpuinfo.c proc: move /proc/cpuinfo code to fs/proc/cpuinfo.c 2008-10-23 15:05:11 +04:00
devices.c proc: use seq_puts()/seq_putc() where possible 2011-01-13 08:03:16 -08:00
generic.c airo: correct proc entry creation interfaces 2011-05-16 14:25:28 -04:00
inode.c procfs: return ENOENT on opening a being-removed proc entry 2011-07-26 16:49:43 -07:00
internal.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/linux-2.6-nsfd 2011-05-25 18:10:16 -07:00
interrupts.c proc: move /proc/interrupts boilerplate code to fs/proc/interrupts.c 2008-10-23 15:15:46 +04:00
Kconfig kconfig: rename CONFIG_EMBEDDED to CONFIG_EXPERT 2011-01-20 17:02:05 -08:00
kcore.c /proc/kcore: fix seeking 2011-01-13 08:03:17 -08:00
kmsg.c procfs: Use generic_file_llseek in /proc/kmsg 2010-04-09 16:35:41 +02:00
loadavg.c sched, timers: cleanup avenrun users 2009-05-15 15:32:45 +02:00
Makefile ns: proc files for namespace naming policy. 2011-05-10 14:31:44 -07:00
meminfo.c thp: transparent hugepage vmstat 2011-01-13 17:32:43 -08:00
mmu.c fs/proc/mmu.c: headers butchery 2007-10-17 08:42:48 -07:00
namespaces.c proc: Fix Oops on stat of /proc/<zombie pid>/ns/net 2011-06-15 14:35:29 -07:00
nommu.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
page.c thp: remove PG_buddy 2011-01-13 17:32:43 -08:00
proc_devtree.c of/flattree: Drop an uninteresting message to pr_debug level 2011-03-02 13:45:18 -07:00
proc_net.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
proc_sysctl.c ->permission() sanitizing: don't pass flags to ->permission() 2011-07-20 01:43:24 -04:00
proc_tty.c proc: use seq_puts()/seq_putc() where possible 2011-01-13 08:03:16 -08:00
root.c fix leak in proc_set_super() 2011-06-12 17:45:28 -04:00
softirqs.c proc: use seq_puts()/seq_putc() where possible 2011-01-13 08:03:16 -08:00
stat.c proc/stat: use defined macro KMALLOC_MAX_SIZE 2011-05-26 17:12:37 -07:00
task_mmu.c proc: fix pagemap_read() error case 2011-05-26 17:12:37 -07:00
task_nommu.c report errors in /proc/*/*map* sanely 2011-03-23 16:36:50 -04:00
uptime.c [PATCH] Fix idle time field in /proc/uptime 2009-09-24 10:16:24 +02:00
version.c proc: switch /proc/version to seq_file 2008-10-23 14:19:58 +04:00
vmcore.c fs/proc/vmcore.c: add hook to read_from_oldmem() to check for non-ram pages 2011-05-26 17:12:37 -07:00