| commit | cdb19fb1cc7c1854d5698e43139f7920bcab274a | |
| author | Al Viro <viro@zeniv.linux.org.uk> | |
| Wed, 23 Mar 2011 19:52:50 +0000 (23 15:52 -0400) | ||
| committer | Greg Kroah-Hartman <gregkh@suse.de> | |
| Mon, 7 Nov 2011 20:32:46 +0000 (7 12:32 -0800) | ||
| tree | dbd9df1968b3b1fbee46d581c44b6f7a4ed421f1 | treesnapshot (tar.gz zip) |
| parent | 6719bac67645ca27b2e74726387705b589a89a24 | commitdiff |
deal with races in /proc/*/{syscall,stack,personality}
commit a9712bc12c40c172e393f85a9b2ba8db4bf59509 upstream.
All of those are rw-r--r-- and all are broken for suid - if you open
a file before the target does suid-root exec, you'll be still able
to access it. For personality it's not a big deal, but for syscall
and stack it's a real problem.
Fix: check that task is tracable for you at the time of read().
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit a9712bc12c40c172e393f85a9b2ba8db4bf59509 upstream.
All of those are rw-r--r-- and all are broken for suid - if you open
a file before the target does suid-root exec, you'll be still able
to access it. For personality it's not a big deal, but for syscall
and stack it's a real problem.
Fix: check that task is tracable for you at the time of read().
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| fs/proc/base.c | diffblobblamehistory |