Hi David, On Mon, Aug 02, 2010 at 02:34:21PM -0400, David P. Quigley wrote: > On Mon, 2010-08-02 at 09:59 -0700, Kees Cook wrote: > [...snip] > > > > I've seen two so far. Both are addressed with a one line fix. And I would > > stress that no other existing subsystem in the kernel can provide the same > > level of control that my ptrace exception logic provides. SELinux cannot do > > this. > > > > Would you mind explaining to me what you believe this patch can do that > SELinux can't? Based on what I read in the kconfig entry for the feature > and the subsequent exception patch I'm not seeing anything here that > SELinux can't do. If there is something we are missing I'd like to > understand it so we can make the decision on whether or not our ptrace > access control checks need to be modified. Sure thing. When looking at how PTRACE is used, it seemed clear that there were exactly 2 use-cases: - tracking children (either for monitoring or debugging) - in-memory crash handlers Allowing child-tracing was easy: this is discoverable through process ancestry. Doing the crash handlers is different, since the handler can come from anywhere. One thing that seemed common was that the crashing program would know which pid was going to attach to it, so if those programs declared to the kernel which pid is allowed to attach, then it could make an exception for it. I did not find a heuristic approach that the kernel could use to figure this out for itself (maybe I missed something). It seems to me that SELinux (and AppArmor and maybe others?) can declare general relationships of who can PTRACE who, etc, but nothing that specifically says "only _this_ instance". Instead of "the crash handler binary running as $identity can attach to program foo running as $identity", it is "the crash handler process specified by program foo at the time of the crash, can attach to foo", which is much more specific. If there's a way to do this already, I am genuinely interested to learn more about it. Perhaps I've grossly misunderstood something. -Kees -- Kees Cook Ubuntu Security Team -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
