ptrace: use fsuid, fsgid, effective creds for fs access checks

By checking the effective credentials instead of the real UID / permitted
capabilities, ensure that the calling process actually intended to use its
credentials.

To ensure that all ptrace checks use the correct caller credentials (e.g.
in case out-of-tree code or newly added code omits the PTRACE_MODE_*CREDS
flag), use two new flags and require one of them to be set.

The problem was that when a privileged task had temporarily dropped its
privileges, e.g.  by calling setreuid(0, user_uid), with the intent to
perform following syscalls with the credentials of a user, it still passed
ptrace access checks that the user would not be able to pass.

While an attacker should not be able to convince the privileged task to
perform a ptrace() syscall, this is a problem because the ptrace access
check is reused for things in procfs.

In particular, the following somewhat interesting procfs entries only rely
on ptrace access checks:

 /proc/$pid/stat - uses the check for determining whether pointers
     should be visible, useful for bypassing ASLR
 /proc/$pid/maps - also useful for bypassing ASLR
 /proc/$pid/cwd - useful for gaining access to restricted
     directories that contain files with lax permissions, e.g. in
     this scenario:
     lrwxrwxrwx root root /proc/13020/cwd -> /root/foobar
     drwx------ root root /root
     drwxr-xr-x root root /root/foobar
     -rw-r--r-- root root /root/foobar/secret

Therefore, on a system where a root-owned mode 6755 binary changes its
effective credentials as described and then dumps a user-specified file,
this could be used by an attacker to reveal the memory layout of root's
processes or reveal the contents of files he is not allowed to access
(through /proc/$pid/cwd).

[akpm@linux-foundation.org: fix warning]
Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Morris <james.l.morris@oracle.com>
Cc: "Serge E. Hallyn" <serge.hallyn@ubuntu.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

3 files changed, 14 insertions, 13 deletions

diff --git a/fs/proc/array.c b/fs/proc/array.c
index d73291f5f0fc..b6c00ce0e29e 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -395,7 +395,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
 
         state = *get_task_state(task);
         vsize = eip = esp = 0;
-        permitted = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT);
+        permitted = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS | PTRACE_MODE_NOAUDIT);
         mm = get_task_mm(task);
         if (mm) {
                 vsize = task_vsize(mm);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 2cf5d7e37375..e665097c1da5 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -403,7 +403,7 @@ static const struct file_operations proc_pid_cmdline_ops = {
 static int proc_pid_auxv(struct seq_file *m, struct pid_namespace *ns,
                          struct pid *pid, struct task_struct *task)
 {
-        struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ);
+        struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
         if (mm && !IS_ERR(mm)) {
                 unsigned int nwords = 0;
                 do {
@@ -430,7 +430,8 @@ static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns,
 
         wchan = get_wchan(task);
 
-        if (wchan && ptrace_may_access(task, PTRACE_MODE_READ) && !lookup_symbol_name(wchan, symname))
+        if (wchan && ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)
+                        && !lookup_symbol_name(wchan, symname))
                 seq_printf(m, "%s", symname);
         else
                 seq_putc(m, '0');
@@ -444,7 +445,7 @@ static int lock_trace(struct task_struct *task)
         int err = mutex_lock_killable(&task->signal->cred_guard_mutex);
         if (err)
                 return err;
-        if (!ptrace_may_access(task, PTRACE_MODE_ATTACH)) {
+        if (!ptrace_may_access(task, PTRACE_MODE_ATTACH_FSCREDS)) {
                 mutex_unlock(&task->signal->cred_guard_mutex);
                 return -EPERM;
         }
@@ -697,7 +698,7 @@ static int proc_fd_access_allowed(struct inode *inode)
          */
         task = get_proc_task(inode);
         if (task) {
-                allowed = ptrace_may_access(task, PTRACE_MODE_READ);
+                allowed = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
                 put_task_struct(task);
         }
         return allowed;
@@ -732,7 +733,7 @@ static bool has_pid_permissions(struct pid_namespace *pid,
                 return true;
         if (in_group_p(pid->pid_gid))
                 return true;
-        return ptrace_may_access(task, PTRACE_MODE_READ);
+        return ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
 }
 
 
@@ -809,7 +810,7 @@ struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode)
         struct mm_struct *mm = ERR_PTR(-ESRCH);
 
         if (task) {
-                mm = mm_access(task, mode);
+                mm = mm_access(task, mode | PTRACE_MODE_FSCREDS);
                 put_task_struct(task);
 
                 if (!IS_ERR_OR_NULL(mm)) {
@@ -1860,7 +1861,7 @@ static int map_files_d_revalidate(struct dentry *dentry, unsigned int flags)
         if (!task)
                 goto out_notask;
 
-        mm = mm_access(task, PTRACE_MODE_READ);
+        mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
         if (IS_ERR_OR_NULL(mm))
                 goto out;
 
@@ -2013,7 +2014,7 @@ static struct dentry *proc_map_files_lookup(struct inode *dir,
                 goto out;
 
         result = -EACCES;
-        if (!ptrace_may_access(task, PTRACE_MODE_READ))
+        if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
                 goto out_put_task;
 
         result = -ENOENT;
@@ -2066,7 +2067,7 @@ proc_map_files_readdir(struct file *file, struct dir_context *ctx)
                 goto out;
 
         ret = -EACCES;
-        if (!ptrace_may_access(task, PTRACE_MODE_READ))
+        if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
                 goto out_put_task;
 
         ret = 0;
@@ -2533,7 +2534,7 @@ static int do_io_accounting(struct task_struct *task, struct seq_file *m, int wh
         if (result)
                 return result;
 
-        if (!ptrace_may_access(task, PTRACE_MODE_READ)) {
+        if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) {
                 result = -EACCES;
                 goto out_unlock;
         }
diff --git a/fs/proc/namespaces.c b/fs/proc/namespaces.c
index 1dece8781f91..276f12431dbf 100644
--- a/fs/proc/namespaces.c
+++ b/fs/proc/namespaces.c
@@ -46,7 +46,7 @@ static const char *proc_ns_get_link(struct dentry *dentry,
         if (!task)
                 return error;
 
-        if (ptrace_may_access(task, PTRACE_MODE_READ)) {
+        if (ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) {
                 error = ns_get_path(&ns_path, task, ns_ops);
                 if (!error)
                         nd_jump_link(&ns_path);
@@ -67,7 +67,7 @@ static int proc_ns_readlink(struct dentry *dentry, char __user *buffer, int bufl
         if (!task)
                 return res;
 
-        if (ptrace_may_access(task, PTRACE_MODE_READ)) {
+        if (ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) {
                 res = ns_get_name(name, sizeof(name), task, ns_ops);
                 if (res >= 0)
                         res = readlink_copy(buffer, buflen, name);