On Wed, Dec 18, 2019 at 3:55 PM Sargun Dhillon <sargun@xxxxxxxxx> wrote:
>
> +
> + if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) {
> + file = ERR_PTR(-EPERM);
> + goto out;
> + }
I don't think this is MODE_READ. By copying an fd from the task, you
can easily change its state.
IMO it would be really nice if pidfd could act more like a capability
here and carry a ptrace mode, for example. But I guess it doesn't
right now.
--Andy
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers
