| Message ID | 20140708054959.GU5412@outflux.net |
|---|---|
| State | New |
| Headers | show |
On Mon, Jul 07, 2014 at 10:49:59PM -0700, Kees Cook wrote: > BugLink: http://bugs.launchpad.net/bugs/1338883 > > commit 2e4930eb7c8fb20a39dfb5f8a8f80402710dcea8 upstream. > > When running a 64-bit kernel and receiving prctls from a 32-bit > userspace, the "-1" used as an unsigned long will end up being > misdetected. The kernel is looking for 0xffffffffffffffff instead of > 0xffffffff. Since prctl lacks a distinct compat interface, Yama needs > to handle this translation itself. As such, support either value as > meaning PR_SET_PTRACER_ANY, to avoid breaking the ABI for 64-bit. > > Signed-off-by: Kees Cook <keescook@chromium.org> > Acked-by: John Johansen <john.johansen@canonical.com> > Cc: stable@vger.kernel.org > Signed-off-by: James Morris <james.l.morris@oracle.com> > > [adjusted for Precise's Yama backport format/whitespace changes] > Signed-off-by: Kees Cook <kees@ubuntu.com> > --- > security/yama/yama_lsm.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c > index 30361cb..84bd07b 100644 > --- a/security/yama/yama_lsm.c > +++ b/security/yama/yama_lsm.c > @@ -140,8 +140,7 @@ int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3, > if (arg2 == 0) { > yama_ptracer_del(NULL, myself); > rc = 0; > - } > - else if (arg2 == PR_SET_PTRACER_ANY) { > + } else if (arg2 == PR_SET_PTRACER_ANY || (int)arg2 == -1) { > rc = yama_ptracer_add(NULL, myself); > } else { > struct task_struct *tracer; Seems to match upstream commit. Looks to do what is claimed. Acked-by: Andy Whitcroft <apw@canonical.com> -apw
On 07/07/2014 10:49 PM, Kees Cook wrote: > BugLink: http://bugs.launchpad.net/bugs/1338883 > > commit 2e4930eb7c8fb20a39dfb5f8a8f80402710dcea8 upstream. > > When running a 64-bit kernel and receiving prctls from a 32-bit > userspace, the "-1" used as an unsigned long will end up being > misdetected. The kernel is looking for 0xffffffffffffffff instead of > 0xffffffff. Since prctl lacks a distinct compat interface, Yama needs > to handle this translation itself. As such, support either value as > meaning PR_SET_PTRACER_ANY, to avoid breaking the ABI for 64-bit. > > Signed-off-by: Kees Cook <keescook@chromium.org> > Acked-by: John Johansen <john.johansen@canonical.com> > Cc: stable@vger.kernel.org > Signed-off-by: James Morris <james.l.morris@oracle.com> > > [adjusted for Precise's Yama backport format/whitespace changes] > Signed-off-by: Kees Cook <kees@ubuntu.com> > --- > security/yama/yama_lsm.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c > index 30361cb..84bd07b 100644 > --- a/security/yama/yama_lsm.c > +++ b/security/yama/yama_lsm.c > @@ -140,8 +140,7 @@ int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3, > if (arg2 == 0) { > yama_ptracer_del(NULL, myself); > rc = 0; > - } > - else if (arg2 == PR_SET_PTRACER_ANY) { > + } else if (arg2 == PR_SET_PTRACER_ANY || (int)arg2 == -1) { > rc = yama_ptracer_add(NULL, myself); > } else { > struct task_struct *tracer; >
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c index 30361cb..84bd07b 100644 --- a/security/yama/yama_lsm.c +++ b/security/yama/yama_lsm.c @@ -140,8 +140,7 @@ int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3, if (arg2 == 0) { yama_ptracer_del(NULL, myself); rc = 0; - } - else if (arg2 == PR_SET_PTRACER_ANY) { + } else if (arg2 == PR_SET_PTRACER_ANY || (int)arg2 == -1) { rc = yama_ptracer_add(NULL, myself); } else { struct task_struct *tracer;