Re: [PATCH v4 3/3] prctl: Allow ptrace capable processes to change /proc/self/exe

2020-07-07 Thread Cyrill Gorcunov
On Tue, Jul 07, 2020 at 05:45:04PM +0200, Christian Brauner wrote: ... > > Ok, so the original patch proposal was presented in [4] in 2014. The > final version of that patch added the PR_SET_MM_MAP we know today. The > initial version presented in [4] did not require _any_ privilege. > True. I s

Re: [PATCH v4 3/3] prctl: Allow ptrace capable processes to change /proc/self/exe

2020-07-07 Thread Christian Brauner
On Mon, Jul 06, 2020 at 07:44:38PM +0200, Christian Brauner wrote: > On Mon, Jul 06, 2020 at 05:13:35PM +, Nicolas Viennot wrote: > > > > This is scary. But I believe it is safe. > > > > > > > > Reviewed-by: Serge Hallyn > > > > > > > > I am a bit curious about the implications of the selinux

Re: [PATCH v4 3/3] prctl: Allow ptrace capable processes to change /proc/self/exe

2020-07-06 Thread Christian Brauner
On Mon, Jul 06, 2020 at 05:13:35PM +, Nicolas Viennot wrote: > > > This is scary. But I believe it is safe. > > > > > > Reviewed-by: Serge Hallyn > > > > > > I am a bit curious about the implications of the selinux patch. > > > IIUC you are using the permission of the tracing process to execu

RE: [PATCH v4 3/3] prctl: Allow ptrace capable processes to change /proc/self/exe

2020-07-06 Thread Nicolas Viennot
> > This is scary. But I believe it is safe. > > > > Reviewed-by: Serge Hallyn > > > > I am a bit curious about the implications of the selinux patch. > > IIUC you are using the permission of the tracing process to execute > > the file without transition, so this is a way to work around the > > p

Re: [PATCH v4 3/3] prctl: Allow ptrace capable processes to change /proc/self/exe

2020-07-02 Thread Paul Moore
On Thu, Jul 2, 2020 at 5:16 PM Serge E. Hallyn wrote: > On Wed, Jul 01, 2020 at 08:49:06AM +0200, Adrian Reber wrote: > > From: Nicolas Viennot > > > > Previously, the current process could only change the /proc/self/exe > > link with local CAP_SYS_ADMIN. > > This commit relaxes this restriction

Re: [PATCH v4 3/3] prctl: Allow ptrace capable processes to change /proc/self/exe

2020-07-02 Thread Serge E. Hallyn
On Wed, Jul 01, 2020 at 10:55:37AM +0200, Christian Brauner wrote: > On Wed, Jul 01, 2020 at 08:49:06AM +0200, Adrian Reber wrote: > > From: Nicolas Viennot > > > > Previously, the current process could only change the /proc/self/exe > > link with local CAP_SYS_ADMIN. > > This commit relaxes this

Re: [PATCH v4 3/3] prctl: Allow ptrace capable processes to change /proc/self/exe

2020-07-02 Thread Serge E. Hallyn
On Wed, Jul 01, 2020 at 08:49:06AM +0200, Adrian Reber wrote: > From: Nicolas Viennot > > Previously, the current process could only change the /proc/self/exe > link with local CAP_SYS_ADMIN. > This commit relaxes this restriction by permitting such change with > CAP_CHECKPOINT_RESTORE, and the a

Re: [PATCH v4 3/3] prctl: Allow ptrace capable processes to change /proc/self/exe

2020-07-01 Thread Christian Brauner
On Wed, Jul 01, 2020 at 08:49:06AM +0200, Adrian Reber wrote: > From: Nicolas Viennot > > Previously, the current process could only change the /proc/self/exe > link with local CAP_SYS_ADMIN. > This commit relaxes this restriction by permitting such change with > CAP_CHECKPOINT_RESTORE, and the a

[PATCH v4 3/3] prctl: Allow ptrace capable processes to change /proc/self/exe

2020-06-30 Thread Adrian Reber
From: Nicolas Viennot Previously, the current process could only change the /proc/self/exe link with local CAP_SYS_ADMIN. This commit relaxes this restriction by permitting such change with CAP_CHECKPOINT_RESTORE, and the ability to use ptrace. With access to ptrace facilities, a process can do