On Thu, 17 Jan 2019, James Morris wrote: > On Wed, 16 Jan 2019, Kees Cook wrote: > > > It's possible that a pid has died before we take the rcu lock, in which > > case we can't walk the ancestry list as it may be detached. Instead, check > > for death first before doing the walk. > > > > Reported-by: [email protected] > > Fixes: 2d514487faf1 ("security: Yama LSM") > > Cc: [email protected] > > Suggested-by: Oleg Nesterov <[email protected]> > > Signed-off-by: Kees Cook <[email protected]> > > --- > > James, can you please send this to Linus in your -fixes tree? > > Done.
I mean, queued in that tree. > > > --- > > security/yama/yama_lsm.c | 4 +++- > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c > > index ffda91a4a1aa..02514fe558b4 100644 > > --- a/security/yama/yama_lsm.c > > +++ b/security/yama/yama_lsm.c > > @@ -368,7 +368,9 @@ static int yama_ptrace_access_check(struct task_struct > > *child, > > break; > > case YAMA_SCOPE_RELATIONAL: > > rcu_read_lock(); > > - if (!task_is_descendant(current, child) && > > + if (!pid_alive(child)) > > + rc = -EPERM; > > + if (!rc && !task_is_descendant(current, child) && > > !ptracer_exception_found(current, child) && > > !ns_capable(__task_cred(child)->user_ns, > > CAP_SYS_PTRACE)) > > rc = -EPERM; > > > > -- James Morris <[email protected]>
