Re: [PATCH v2 6/9] procfs: add permission checks on the file's opener of /proc/*/stat

2013-10-02 Thread Djalal Harouni
On Wed, Oct 02, 2013 at 05:46:19PM +0100, Andy Lutomirski wrote: > On Wed, Oct 2, 2013 at 4:14 PM, Djalal Harouni wrote: > > On Tue, Oct 01, 2013 at 06:39:00PM -0700, Andy Lutomirski wrote: > >> On 10/01/2013 01:26 PM, Djalal Harouni wrote: > >> > Some fields of the /proc/*/stat are sensitive

Re: [PATCH v2 6/9] procfs: add permission checks on the file's opener of /proc/*/stat

2013-10-02 Thread Andy Lutomirski
On Wed, Oct 2, 2013 at 4:14 PM, Djalal Harouni wrote: > On Tue, Oct 01, 2013 at 06:39:00PM -0700, Andy Lutomirski wrote: >> On 10/01/2013 01:26 PM, Djalal Harouni wrote: >> > Some fields of the /proc/*/stat are sensitive fields that need >> > appropriate protection. >> > >> > However, /proc file

Re: [PATCH v2 6/9] procfs: add permission checks on the file's opener of /proc/*/stat

2013-10-02 Thread Djalal Harouni
On Tue, Oct 01, 2013 at 06:39:00PM -0700, Andy Lutomirski wrote: > On 10/01/2013 01:26 PM, Djalal Harouni wrote: > > Some fields of the /proc/*/stat are sensitive fields that need > > appropriate protection. > > > > However, /proc file descriptors can be passed to a more privileged > > process

Re: [PATCH v2 6/9] procfs: add permission checks on the file's opener of /proc/*/stat

2013-10-02 Thread Djalal Harouni
On Tue, Oct 01, 2013 at 06:39:00PM -0700, Andy Lutomirski wrote: On 10/01/2013 01:26 PM, Djalal Harouni wrote: Some fields of the /proc/*/stat are sensitive fields that need appropriate protection. However, /proc file descriptors can be passed to a more privileged process (e.g. a

Re: [PATCH v2 6/9] procfs: add permission checks on the file's opener of /proc/*/stat

2013-10-02 Thread Andy Lutomirski
On Wed, Oct 2, 2013 at 4:14 PM, Djalal Harouni tix...@opendz.org wrote: On Tue, Oct 01, 2013 at 06:39:00PM -0700, Andy Lutomirski wrote: On 10/01/2013 01:26 PM, Djalal Harouni wrote: Some fields of the /proc/*/stat are sensitive fields that need appropriate protection. However, /proc

Re: [PATCH v2 6/9] procfs: add permission checks on the file's opener of /proc/*/stat

2013-10-02 Thread Djalal Harouni
On Wed, Oct 02, 2013 at 05:46:19PM +0100, Andy Lutomirski wrote: On Wed, Oct 2, 2013 at 4:14 PM, Djalal Harouni tix...@opendz.org wrote: On Tue, Oct 01, 2013 at 06:39:00PM -0700, Andy Lutomirski wrote: On 10/01/2013 01:26 PM, Djalal Harouni wrote: Some fields of the /proc/*/stat are

Re: [PATCH v2 6/9] procfs: add permission checks on the file's opener of /proc/*/stat

2013-10-01 Thread Andy Lutomirski
On 10/01/2013 01:26 PM, Djalal Harouni wrote: > Some fields of the /proc/*/stat are sensitive fields that need > appropriate protection. > > However, /proc file descriptors can be passed to a more privileged > process (e.g. a suid-exec) which will pass the classic > ptrace_may_access() permission

[PATCH v2 6/9] procfs: add permission checks on the file's opener of /proc/*/stat

2013-10-01 Thread Djalal Harouni
Some fields of the /proc/*/stat are sensitive fields that need appropriate protection. However, /proc file descriptors can be passed to a more privileged process (e.g. a suid-exec) which will pass the classic ptrace_may_access() permission check during read(). To prevent it, use

[PATCH v2 6/9] procfs: add permission checks on the file's opener of /proc/*/stat

2013-10-01 Thread Djalal Harouni
Some fields of the /proc/*/stat are sensitive fields that need appropriate protection. However, /proc file descriptors can be passed to a more privileged process (e.g. a suid-exec) which will pass the classic ptrace_may_access() permission check during read(). To prevent it, use

Re: [PATCH v2 6/9] procfs: add permission checks on the file's opener of /proc/*/stat

2013-10-01 Thread Andy Lutomirski
On 10/01/2013 01:26 PM, Djalal Harouni wrote: Some fields of the /proc/*/stat are sensitive fields that need appropriate protection. However, /proc file descriptors can be passed to a more privileged process (e.g. a suid-exec) which will pass the classic ptrace_may_access() permission check