6 files changed, 30 insertions, 7 deletions

diff --git a/fs/exec.c b/fs/exec.c
index 4e497b9ee71e..3cf2cfced97a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1406,7 +1406,7 @@ static void check_unsafe_exec(struct linux_binprm *bprm)
         unsigned n_fs;
 
         if (p->ptrace) {
-                if (p->ptrace & PT_PTRACE_CAP)
+                if (ptracer_capable(p, current_user_ns()))
                         bprm->unsafe |= LSM_UNSAFE_PTRACE_CAP;
                 else
                         bprm->unsafe |= LSM_UNSAFE_PTRACE;
diff --git a/include/linux/capability.h b/include/linux/capability.h
index dbc21c719ce6..d6088e2a7668 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -242,6 +242,7 @@ static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap)
 #endif /* CONFIG_MULTIUSER */
 extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
 extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
+extern bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns);
 
 /* audit system wants to get cap info from files as well */
 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index 504c98a278d4..e13bfdf7f314 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -19,7 +19,6 @@
 #define PT_SEIZED       0x00010000      /* SEIZE used, enable new behavior */
 #define PT_PTRACED      0x00000001
 #define PT_DTRACE       0x00000002      /* delayed trace (used on m68k, i386) */
-#define PT_PTRACE_CAP   0x00000004      /* ptracer can follow suid-exec */
 
 #define PT_OPT_FLAG_SHIFT       3
 /* PT_TRACE_* event enable flags */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 348f51b0ec92..e9f693598e15 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1656,6 +1656,7 @@ struct task_struct {
         struct list_head cpu_timers[3];
 
 /* process credentials */
+        const struct cred __rcu *ptracer_cred; /* Tracer's credentials at attach */
         const struct cred __rcu *real_cred; /* objective and real subjective task
                                          * credentials (COW) */
         const struct cred __rcu *cred;  /* effective (overridable) subjective task
diff --git a/kernel/capability.c b/kernel/capability.c
index 00411c82dac5..dfa0e4528b0b 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -473,3 +473,23 @@ bool capable_wrt_inode_uidgid(const struct inode *inode, int cap)
                 kgid_has_mapping(ns, inode->i_gid);
 }
 EXPORT_SYMBOL(capable_wrt_inode_uidgid);
+
+/**
+ * ptracer_capable - Determine if the ptracer holds CAP_SYS_PTRACE in the namespace
+ * @tsk: The task that may be ptraced
+ * @ns: The user namespace to search for CAP_SYS_PTRACE in
+ *
+ * Return true if the task that is ptracing the current task had CAP_SYS_PTRACE
+ * in the specified user namespace.
+ */
+bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns)
+{
+        int ret = 0;  /* An absent tracer adds no restrictions */
+        const struct cred *cred;
+        rcu_read_lock();
+        cred = rcu_dereference(tsk->ptracer_cred);
+        if (cred)
+                ret = security_capable_noaudit(cred, ns, CAP_SYS_PTRACE);
+        rcu_read_unlock();
+        return (ret == 0);
+}
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 282821557183..e82c15cadd6d 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -39,6 +39,9 @@ void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)
         BUG_ON(!list_empty(&child->ptrace_entry));
         list_add(&child->ptrace_entry, &new_parent->ptraced);
         child->parent = new_parent;
+        rcu_read_lock();
+        child->ptracer_cred = get_cred(__task_cred(new_parent));
+        rcu_read_unlock();
 }
 
 /**
@@ -71,12 +74,16 @@ void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)
  */
 void __ptrace_unlink(struct task_struct *child)
 {
+        const struct cred *old_cred;
         BUG_ON(!child->ptrace);
 
         clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
 
         child->parent = child->real_parent;
         list_del_init(&child->ptrace_entry);
+        old_cred = child->ptracer_cred;
+        child->ptracer_cred = NULL;
+        put_cred(old_cred);
 
         spin_lock(&child->sighand->siglock);
         child->ptrace = 0;
@@ -326,11 +333,6 @@ static int ptrace_attach(struct task_struct *task, long request,
 
         task_lock(task);
         retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH_REALCREDS);
-        if (!retval) {
-                struct mm_struct *mm = task->mm;
-                if (mm && ns_capable(mm->user_ns, CAP_SYS_PTRACE))
-                        flags |= PT_PTRACE_CAP;
-        }
         task_unlock(task);
         if (retval)
                 goto unlock_creds;