On Mon, Dec 07, 2015 at 12:32:06PM -0800, Kees Cook wrote:
> On Sat, Dec 5, 2015 at 6:04 PM, Jann Horn <jann@xxxxxxxxx> wrote:
[...]
> > - if (ptrace_may_access(task, PTRACE_MODE_READ)) {
> > + if (ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_FSCREDS)) {
>
> This should maybe use the PTRACE_MODE_READ_FSCREDS macro?
Oh, yes. I don't know how I missed that. :/
> > error = ns_get_path(&ns_path, task, ns_ops);
> > if (!error)
> > nd_jump_link(&ns_path);
> > @@ -63,7 +63,7 @@ static int proc_ns_readlink(struct dentry *dentry, char __user *buffer, int bufl
> > if (!task)
> > return res;
> >
> > - if (ptrace_may_access(task, PTRACE_MODE_READ)) {
> > + if (ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_FSCREDS)) {
>
> same here?
Yes.Attachment:
signature.asc
Description: Digital signature