Re: [PATCH] ptrace: allow restriction of ptrace scope

[Roland McGrath <roland@redhat.com>]

> Though, honestly, just trying to get rid of PTRACE seems like the better
> place to spend time.

Crushing irony of telling *me* this duly noted.  ;-)
I am not really sure what deeply different set of security constraints
you envision on any other kind of new debugger interface that would be
any different for the concerns you've expressed, though.

> > I don't think "task->pid > 0" is a sort of check that is used elsewhere in
> > the kernel for this.  Perhaps "task == &init_task" would be better.
> 
> Is this correct for pid_ns?  I thought pid 1 (regardless of NS) would have
> a NULL parent?

Don't ask me.  I just mentioned pid_ns to get those who really know about
it to feel obliged to review your code.

> > I suspect you really want to test same_thread_group(walker, current).
> > You don't actually mean to rule out a debugger that forks children with
> > one thread and calls ptrace with another, do you?
> 
> Won't they ultimately have the same parent, though?

Sure, those debugger threads will have the same parent, such as the shell
that spawned the debugger.  But your "security" check is that the caller of
ptrace is a direct ancestor of the tracee.  The ancestry of that ptrace
caller is immaterial.


Thanks,
Roland