From: "B. D. Elliott" <bde@nwlink.com>
To: linux-kernel@vger.kernel.org
Subject: A Mess in 2.5/2.6- proc-pid Permissions
Date: Sun, 10 Aug 2003 01:04:20 -0700 [thread overview]
Message-ID: <20030810074057.840CA6A8DD@smtp4.pacifier.net> (raw)
Whenever I log in to a late 2.5 or 2.6-pre, I see the following:
laptop login: bde
Password:
Last login: Tue Aug 5 02:54:35 on tty3
bash: /dev/fd/62: Permission denied
test: : integer expression expected
laptop:/home/bde:
This occurs through getty, telnetd, and sshd.
The problem is that my .bash_profile contains the following line, as a
part of setting up a possible "chroot-" prefix on my prompt:
read -a CHR__ < <(ls -id /)
This, in turn, uses the "/dev/fd" capability for the command redirection.
Looking at /proc/$$ shows the immediate problem:
laptop:/home/bde: ls -lR /proc/$$
/proc/1395:
total 0
-r--r--r-- 1 bde users 0 Aug 10 00:24 cmdline
lrwxrwxrwx 1 bde users 0 Aug 10 00:24 cwd -> /home/bde/
-r-------- 1 bde users 0 Aug 10 00:24 environ
lrwxrwxrwx 1 bde users 0 Aug 10 00:24 exe -> /bin/bash*
dr-x------ 2 root root 0 Aug 10 00:22 fd/
-r--r--r-- 1 bde users 0 Aug 10 00:24 maps
-rw------- 1 bde users 0 Aug 10 00:24 mem
-r--r--r-- 1 bde users 0 Aug 10 00:24 mounts
lrwxrwxrwx 1 bde users 0 Aug 10 00:24 root -> //
-r--r--r-- 1 bde users 0 Aug 10 00:24 stat
-r--r--r-- 1 bde users 0 Aug 10 00:24 statm
-r--r--r-- 1 bde users 0 Aug 10 00:24 status
-r--r--r-- 1 bde users 0 Aug 10 00:24 wchan
ls: /proc/1395/fd: Permission denied
laptop:/home/bde:
To see how this comes about, try the following:
1. Log in as somebody.
2. Do su - to become root; then do "ls -lR /proc/$$". This will look like:
laptop:/home/bde: su -
Password:
laptop:/root# ls -lR /proc/$$
/proc/1405:
total 0
-r--r--r-- 1 root root 0 Aug 10 00:27 cmdline
lrwxrwxrwx 1 root root 0 Aug 10 00:27 cwd -> /root/
-r-------- 1 root root 0 Aug 10 00:27 environ
lrwxrwxrwx 1 root root 0 Aug 10 00:27 exe -> /bin/bash*
dr-x------ 2 root root 0 Aug 10 00:27 fd/
-r--r--r-- 1 root root 0 Aug 10 00:27 maps
-rw------- 1 root root 0 Aug 10 00:27 mem
-r--r--r-- 1 root root 0 Aug 10 00:27 mounts
lrwxrwxrwx 1 root root 0 Aug 10 00:27 root -> //
-r--r--r-- 1 root root 0 Aug 10 00:27 stat
-r--r--r-- 1 root root 0 Aug 10 00:27 statm
-r--r--r-- 1 root root 0 Aug 10 00:27 status
-r--r--r-- 1 root root 0 Aug 10 00:27 wchan
/proc/1405/fd:
total 0
lrwx------ 1 root root 64 Aug 10 00:27 0 -> /dev/pts/1
lrwx------ 1 root root 64 Aug 10 00:27 1 -> /dev/pts/1
lrwx------ 1 root root 64 Aug 10 00:27 2 -> /dev/pts/1
lrwx------ 1 root root 64 Aug 10 00:27 255 -> /dev/pts/1
laptop:/root#
3. Now do "exec su - some-user"; then repeat "ls -lR /proc/$$".
laptop:/root# exec su - bde
bash: /dev/fd/62: Permission denied
test: : integer expression expected
laptop:/home/bde: ls -lR /proc/$$
ls: /proc/1405/cwd: Permission denied
ls: /proc/1405/root: Permission denied
ls: /proc/1405/exe: Permission denied
/proc/1405:
total 0
-r--r--r-- 1 root root 0 Aug 10 00:27 cmdline
lrwxrwxrwx 1 root root 0 Aug 10 00:27 cwd
-r-------- 1 root root 0 Aug 10 00:27 environ
lrwxrwxrwx 1 root root 0 Aug 10 00:27 exe
dr-x------ 2 root root 0 Aug 10 00:27 fd/
-r--r--r-- 1 root root 0 Aug 10 00:27 maps
-rw------- 1 root root 0 Aug 10 00:27 mem
-r--r--r-- 1 root root 0 Aug 10 00:27 mounts
lrwxrwxrwx 1 root root 0 Aug 10 00:27 root
-r--r--r-- 1 root root 0 Aug 10 00:27 stat
-r--r--r-- 1 root root 0 Aug 10 00:27 statm
-r--r--r-- 1 root root 0 Aug 10 00:27 status
-r--r--r-- 1 root root 0 Aug 10 00:27 wchan
ls: /proc/1405/fd: Permission denied
laptop:/home/bde:
4. Now exit from the current shell (the one invoked from the login shell).
5. Repeat the above sequence __without__ the "ls -lR /proc/$$" as root.
laptop:/home/bde: su -
Password:
laptop:/root# exec su - bde
laptop:/home/bde: ls -lR /proc/$$
/proc/1417:
total 0
-r--r--r-- 1 bde users 0 Aug 10 00:32 cmdline
lrwxrwxrwx 1 bde users 0 Aug 10 00:32 cwd -> /home/bde/
-r-------- 1 bde users 0 Aug 10 00:32 environ
lrwxrwxrwx 1 bde users 0 Aug 10 00:32 exe -> /bin/bash*
dr-x------ 2 bde users 0 Aug 10 00:32 fd/
-r--r--r-- 1 bde users 0 Aug 10 00:32 maps
-rw------- 1 bde users 0 Aug 10 00:32 mem
-r--r--r-- 1 bde users 0 Aug 10 00:32 mounts
lrwxrwxrwx 1 bde users 0 Aug 10 00:32 root -> //
-r--r--r-- 1 bde users 0 Aug 10 00:32 stat
-r--r--r-- 1 bde users 0 Aug 10 00:32 statm
-r--r--r-- 1 bde users 0 Aug 10 00:32 status
-r--r--r-- 1 bde users 0 Aug 10 00:32 wchan
/proc/1417/fd:
total 0
lrwx------ 1 bde users 64 Aug 10 00:32 0 -> /dev/pts/1
lrwx------ 1 bde users 64 Aug 10 00:32 1 -> /dev/pts/1
lrwx------ 1 bde users 64 Aug 10 00:32 2 -> /dev/pts/1
lrwx------ 1 bde users 64 Aug 10 00:32 255 -> /dev/pts/1
laptop:/home/bde:
The real problem here is that the inode ownership for the proc-pid files
is set on the first access (when the inode is created). If the uid
changes, which it does during login, the old one remains, preventing any
legitimate access.
The following "sort-of" patch appears to fix this for me. I don't know
whether some locking rules might be violated, however. The patch resets
the inode uid/gid to the present euid/egid at each "revalidate" call.
========================================================================
--- ./fs/proc/base.c.orig 2003-08-08 21:38:05.000000000 -0700
+++ ./fs/proc/base.c 2003-08-09 01:50:03.000000000 -0700
@@ -867,8 +867,13 @@
*/
static int pid_revalidate(struct dentry * dentry, struct nameidata *nd)
{
- if (pid_alive(proc_task(dentry->d_inode)))
+ if (pid_alive(proc_task(dentry->d_inode))) {
+ struct task_struct *task = proc_task(dentry->d_inode);
+
+ dentry->d_inode->i_uid = task->euid;
+ dentry->d_inode->i_gid = task->egid;
return 1;
+ }
d_drop(dentry);
return 0;
}
@@ -889,6 +894,8 @@
if (fcheck_files(files, fd)) {
spin_unlock(&files->file_lock);
put_files_struct(files);
+ dentry->d_inode->i_uid = task->euid;
+ dentry->d_inode->i_gid = task->egid;
return 1;
}
spin_unlock(&files->file_lock);
========================================================================
--
B. D. Elliott bde@nwlink.com
reply other threads:[~2003-08-10 8:04 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030810074057.840CA6A8DD@smtp4.pacifier.net \
--to=bde@nwlink.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®