Subject: [merged] procfs-make-proc-pagemap-0400.patch removed from -mm tree To: tixxdz@xxxxxxxxxx,ebiederm@xxxxxxxxxxxx,keescook@xxxxxxxxxxxx,luto@xxxxxxxxxxxxxx,mingo@xxxxxxxxxx,oleg@xxxxxxxxxx,viro@xxxxxxxxxxxxxxxxxx,mm-commits@xxxxxxxxxxxxxxx From: akpm@xxxxxxxxxxxxxxxxxxxx Date: Tue, 08 Apr 2014 14:18:29 -0700 The patch titled Subject: procfs: make /proc/*/pagemap 0400 has been removed from the -mm tree. Its filename was procfs-make-proc-pagemap-0400.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Djalal Harouni <tixxdz@xxxxxxxxxx> Subject: procfs: make /proc/*/pagemap 0400 The /proc/*/pagemap contain sensitive information and currently its mode is 0444. Change this to 0400, so the VFS will prevent unprivileged processes from getting file descriptors on arbitrary privileged /proc/*/pagemap files. This reduces the scope of address space leaking and bypasses by protecting already running processes. Signed-off-by: Djalal Harouni <tixxdz@xxxxxxxxxx> Acked-by: Kees Cook <keescook@xxxxxxxxxxxx> Acked-by: Andy Lutomirski <luto@xxxxxxxxxxxxxx> Cc: Eric W. Biederman <ebiederm@xxxxxxxxxxxx> Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: Oleg Nesterov <oleg@xxxxxxxxxx> Cc: Ingo Molnar <mingo@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/proc/base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff -puN fs/proc/base.c~procfs-make-proc-pagemap-0400 fs/proc/base.c --- a/fs/proc/base.c~procfs-make-proc-pagemap-0400 +++ a/fs/proc/base.c @@ -2617,7 +2617,7 @@ static const struct pid_entry tgid_base_ #ifdef CONFIG_PROC_PAGE_MONITOR REG("clear_refs", S_IWUSR, proc_clear_refs_operations), REG("smaps", S_IRUGO, proc_pid_smaps_operations), - REG("pagemap", S_IRUGO, proc_pagemap_operations), + REG("pagemap", S_IRUSR, proc_pagemap_operations), #endif #ifdef CONFIG_SECURITY DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), @@ -2955,7 +2955,7 @@ static const struct pid_entry tid_base_s #ifdef CONFIG_PROC_PAGE_MONITOR REG("clear_refs", S_IWUSR, proc_clear_refs_operations), REG("smaps", S_IRUGO, proc_tid_smaps_operations), - REG("pagemap", S_IRUGO, proc_pagemap_operations), + REG("pagemap", S_IRUSR, proc_pagemap_operations), #endif #ifdef CONFIG_SECURITY DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), _ Patches currently in -mm which might be from tixxdz@xxxxxxxxxx are origin.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html