[PATCH][RFC] Let even non-dumpable tasks access /proc/self/fd

[PATCH][RFC] Let even non-dumpable tasks access /proc/self/fd

[Petr Baudis]

All tasks calling setuid() from root to non-root during their lifetime
will not be able to access their /proc/self/fd.  This is troublesome
because the fstatat() and other *at() routines are emulated by accessing
/proc/self/fd/*/path and that will break with setuid()ing programs,
leading to various weird consequences (e.g. with the latest glibc,
nftw() does not work with setuid()ing programs on ppc and furthermore
causes the LSB testsuite to fail because of this).

This kernel patch fixes the problem by letting the process access its
own /proc/self/fd - as far as I can see, this should be reasonably safe
since for the process, this does not reveal "anything new". Feel free to
comment on this.

Signed-off-by: Petr Baudis <pasky@suse.cz>

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 6cc77dc..ea36a25 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1368,7 +1368,9 @@ static struct inode *proc_pid_make_inode
 	ei->type = ino;
 	inode->i_uid = 0;
 	inode->i_gid = 0;
-	if (ino == PROC_TGID_INO || ino == PROC_TID_INO || task_dumpable(task)) {
+	if (ino == PROC_TGID_INO || ino == PROC_TID_INO ||
+	    ((ino == PROC_TGID_FD || ino == PROC_TID_FD || ino >= PROC_TID_FD_DIR) && task == current) ||
+	    task_dumpable(task)) {
 		inode->i_uid = task->euid;
 		inode->i_gid = task->egid;
 	}
@@ -1398,7 +1400,9 @@ static int pid_revalidate(struct dentry 
 	struct inode *inode = dentry->d_inode;
 	struct task_struct *task = proc_task(inode);
 	if (pid_alive(task)) {
-		if (proc_type(inode) == PROC_TGID_INO || proc_type(inode) == PROC_TID_INO || task_dumpable(task)) {
+		if (proc_type(inode) == PROC_TGID_INO || proc_type(inode) == PROC_TID_INO ||
+		    ((proc_type(inode) == PROC_TGID_FD || proc_type(inode) == PROC_TID_FD) && task == current) ||
+		     task_dumpable(task)) {
 			inode->i_uid = task->euid;
 			inode->i_gid = task->egid;
 		} else {
@@ -1425,7 +1429,7 @@ static int tid_fd_revalidate(struct dent
 		if (fcheck_files(files, fd)) {
 			rcu_read_unlock();
 			put_files_struct(files);
-			if (task_dumpable(task)) {
+			if (task_dumpable(task) || task == current) {
 				inode->i_uid = task->euid;
 				inode->i_gid = task->egid;
 			} else {


-- 
				Petr "Pasky" Baudis
Stuff: http://pasky.or.cz/
Right now I am having amnesia and deja-vu at the same time.  I think
I have forgotten this before.

Re: [PATCH][RFC] Let even non-dumpable tasks access /proc/self/fd

[Serge E. Hallyn]

Quoting Petr Baudis (pasky@suse.cz):
> This kernel patch fixes the problem by letting the process access its
> own /proc/self/fd - as far as I can see, this should be reasonably safe
> since for the process, this does not reveal "anything new". Feel free to
> comment on this.

Given that

	fd=open("/etc/shadow", "r");
	setuid(1000);
	read(fd, buf, 100);

is possible before this patch, I agree - nothing new is revealed with
this patch  :)

(I've been waiting to respond because it does make me nervous, but
it seems clear that is unwarranted)

thanks,
-serge