proc: Track /proc/$pid/attr/ opener mm_struct
Commit bfb819ea ("proc: Check /proc/$pid/attr/ writes against file opener") tried to make sure that there could not be a confusion between the opener of a /proc/$pid/attr/ file and the writer. It used struct cred to make sure the privileges didn't change. However, there were existing cases where a more privileged thread was passing the opened fd to a differently privileged thread (during container setup). Instead, use mm_struct to track whether the opener and writer are still the same process. (This is what several other proc files already do, though for different reasons.) Reported-by: Christian Brauner <christian.brauner@ubuntu.com> Reported-by: Andrea Righi <andrea.righi@canonical.com> Tested-by: Andrea Righi <andrea.righi@canonical.com> Fixes: bfb819ea ("proc: Check /proc/$pid/attr/ writes against file opener") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
parent
4c8684fe
-
mentioned in commit 7e6d9c49
-
mentioned in commit 1f41b8f9
-
mentioned in commit c4eec37d
-
mentioned in commit bd354c01
-
mentioned in commit 2bc534ca
-
mentioned in commit 63ac7652
-
mentioned in commit 0646b0f9
-
mentioned in commit b08854de
-
mentioned in commit ef9a0d22
-
mentioned in commit c9002013
-
mentioned in commit 9be4a3eb
-
mentioned in commit 0f883707
Please register or sign in to comment