On Thu, Jan 28, 2021 at 2:04 PM Suren Baghdasaryan <surenb@xxxxxxxxxx> wrote:
>
> On Thu, Jan 28, 2021 at 10:24 AM Kalesh Singh <kaleshsingh@xxxxxxxxxx> wrote:
> >
> > Since fdinfo doesn't permit reading process memory and manipulating
> > process state, allow accessing fdinfo under PTRACE_MODE_READ_FSCRED.
>
> I would copy some of the reasoning from your cover letter so that this
> patch has more context on its own when merged.
Sounds good. I'll update this description in the next version.
>
> >
> > Suggested-by: Jann Horn <jannh@xxxxxxxxxx>
> > Signed-off-by: Kalesh Singh <kaleshsingh@xxxxxxxxxx>
> > ---
> > fs/proc/base.c | 4 ++--
> > fs/proc/fd.c | 15 ++++++++++++++-
> > 2 files changed, 16 insertions(+), 3 deletions(-)
> >
> > diff --git a/fs/proc/base.c b/fs/proc/base.c
> > index b3422cda2a91..a37f9de7103f 100644
> > --- a/fs/proc/base.c
> > +++ b/fs/proc/base.c
> > @@ -3160,7 +3160,7 @@ static const struct pid_entry tgid_base_stuff[] = {
> > DIR("task", S_IRUGO|S_IXUGO, proc_task_inode_operations, proc_task_operations),
> > DIR("fd", S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
> > DIR("map_files", S_IRUSR|S_IXUSR, proc_map_files_inode_operations, proc_map_files_operations),
> > - DIR("fdinfo", S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fdinfo_operations),
> > + DIR("fdinfo", S_IRUGO|S_IXUGO, proc_fdinfo_inode_operations, proc_fdinfo_operations),
> > DIR("ns", S_IRUSR|S_IXUGO, proc_ns_dir_inode_operations, proc_ns_dir_operations),
> > #ifdef CONFIG_NET
> > DIR("net", S_IRUGO|S_IXUGO, proc_net_inode_operations, proc_net_operations),
> > @@ -3504,7 +3504,7 @@ static const struct inode_operations proc_tid_comm_inode_operations = {
> > */
> > static const struct pid_entry tid_base_stuff[] = {
> > DIR("fd", S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
> > - DIR("fdinfo", S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fdinfo_operations),
> > + DIR("fdinfo", S_IRUGO|S_IXUGO, proc_fdinfo_inode_operations, proc_fdinfo_operations),
> > DIR("ns", S_IRUSR|S_IXUGO, proc_ns_dir_inode_operations, proc_ns_dir_operations),
> > #ifdef CONFIG_NET
> > DIR("net", S_IRUGO|S_IXUGO, proc_net_inode_operations, proc_net_operations),
> > diff --git a/fs/proc/fd.c b/fs/proc/fd.c
> > index cb51763ed554..585e213301f9 100644
> > --- a/fs/proc/fd.c
> > +++ b/fs/proc/fd.c
> > @@ -6,6 +6,7 @@
> > #include <linux/fdtable.h>
> > #include <linux/namei.h>
> > #include <linux/pid.h>
> > +#include <linux/ptrace.h>
> > #include <linux/security.h>
> > #include <linux/file.h>
> > #include <linux/seq_file.h>
> > @@ -72,6 +73,18 @@ static int seq_show(struct seq_file *m, void *v)
> >
> > static int seq_fdinfo_open(struct inode *inode, struct file *file)
> > {
> > + bool allowed = false;
> > + struct task_struct *task = get_proc_task(inode);
> > +
> > + if (!task)
> > + return -ESRCH;
> > +
> > + allowed = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
> > + put_task_struct(task);
> > +
> > + if (!allowed)
> > + return -EACCES;
> > +
> > return single_open(file, seq_show, inode);
> > }
> >
> > @@ -307,7 +320,7 @@ static struct dentry *proc_fdinfo_instantiate(struct dentry *dentry,
> > struct proc_inode *ei;
> > struct inode *inode;
> >
> > - inode = proc_pid_make_inode(dentry->d_sb, task, S_IFREG | S_IRUSR);
> > + inode = proc_pid_make_inode(dentry->d_sb, task, S_IFREG | S_IRUGO);
> > if (!inode)
> > return ERR_PTR(-ENOENT);
> >
> > --
> > 2.30.0.365.g02bc693789-goog
> >
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel
