From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=91.218.175.108 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793365484; b=umQfNtcDFhGoIKkV4kTVIPd5kwC/AJRtMYq+1FNaJXtmobmLfGGlvCXcKLxuaYh4jBEV TNMkD9ojhs4FSvXC+K0umeHcpmP9ZjECIbFnJfguYnSmtNBiJiDBpVfQNz0MrpS0OD+yq TEaXORR3o7yQa6Sd/xSjudM2mAwGyXuYjfhKZ0PPVRPjJ0/BM425EDKcjV606UpTMc1KN vJ+ewhjXUguGfQSC/qFjHpPY+T05R2Ss0KJERpjqTuyUa7s4WlI9oYPyzCA5//Rzc+DQs WO6FNA5G2vf/EBPejWJaaGST8stvRpl60I6KX0JpHijTt7bKbOh11QDqXQONJs5yaGQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793365484; h=DMARC-Filter:X-Envelope-To:DKIM-Signature:X-Envelope-To:Received: X-Mizu-Trace-ID:X-Migadu-Flow:From:To:Cc:Subject:Date:Message-ID: X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=0IWmS4WC95xy01as/JCFcIPD2W8HOZ24Kv38L9m1u+w=; b=mXMbxpkilKaphaj5rO7cd20fGV3+98aGM/PPoosbey4f3rjByiH/D07oQm2vwh5ha5ZP md+8Pd1gGhLllX6oMokHGfOWSVCFEfPWK2TdP969hPfusYzKtlHPEUUJ3CMtvb+6Kz4vP ck3sJKfNyNH8q5DTwtzlAvbo7rZINFfhRfaSyPIGjM59ZMNRFqsDs9rVHlG2FCQSByjpN cnZrbPZ6hupWC53o6EoqHb8/U2ofn1vHgwxCR0ONAoHlwtnJuSwO76340RZnqf1BdUZbf XL4h+p5U5nBbLUzfNNnlDPDWH6sGa9pMZop8QYtdHsSpU+YDhv+7SIERcmPZapbpT+g== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=lMNv5oNm; arc=none smtp.remote-ip=91.218.175.108 Received: from mta0.migadu.com (out-108.mta0.migadu.com [91.218.175.108]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B589606A321 for ; Fri, 30 Oct 2026 13:04:42 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 3B589606A321 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=lMNv5oNm X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=F6CW+GlYFn9RDkv4iwwAtyN5SQkQZyzRTuwmWu/xWfE=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1793365481; v=1; x=1793970281; b=lMNv5oNmjeSnPYhNV8khi6kkZpNj64DyBAOa2NEBopgvnRA3wpxpDddT9FGyBlmCGYox7uVc EouGIxXyEVsDlE8S8g4zLrPKd3r7aGNSMbrcFHYEmDQkJWzf8xPKNTpQVfeeRwBHwvkvXa9aZdQ 4eFn/Zx5+i2oEts4UTQAVvlU= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 1c8fc233732a9821; Fri, 30 Oct 2026 13:04:41 +0000 X-Mizu-Trace-ID: 1c8fc233732a9821 X-Migadu-Flow: FLOW_OUT From: Tao Cui To: Christian Brauner Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Tycho Andersen , Alexander Mikhalitsyn , Andrei Vagin , cui.tao@linux.dev, Tao Cui Subject: [PATCH 1/2] nsfs: require ptrace read access for pid translation ioctls Date: Fri, 30 Oct 2026 21:04:21 +0800 Message-ID: <20261030130422.738277-2-cui.tao@linux.dev> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261030130422.738277-1-cui.tao@linux.dev> References: <20261030130422.738277-1-cui.tao@linux.dev> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Tao Cui The four NS_GET_{PID,TGID}_{FROM,IN}_PIDNS ioctls translate a pid between the caller's pid namespace and the namespace referred to by the open nsfs file without checking that the caller may ptrace the task being looked up. Nsfs fds travel freely over SCM_RIGHTS, so once such an fd reaches a process on a hidepid=2 host it can enumerate and resolve the pids of tasks hidepid means to hide. Mirror the ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS) check the PIDFD_GET_*_NAMESPACE ioctls have had since commit 5b08bd408534 ("pidfs: allow retrieval of namespace file descriptors"): perform the check inside the existing RCU read-side critical section and return -EACCES when the caller lacks ptrace access. Legitimate holders such as LXCFS are unaffected. Fixes: ca567df74a28 ("nsfs: add pid translation ioctls") Signed-off-by: Tao Cui --- fs/nsfs.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/fs/nsfs.c b/fs/nsfs.c index 8179d69da038..9ff30bd876cf 100644 --- a/fs/nsfs.c +++ b/fs/nsfs.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -268,6 +269,19 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl, if (!tsk) return ret; + /* + * The returned ids reveal whether @tsk is alive and which + * pid it has in @pid_ns, so require the same read access + * to @tsk that ptrace-gated /proc/ files need. @tsk is + * only pinned by RCU, but calling ptrace_may_access() + * here is safe by the same pattern as validate_nsset() + * (kernel/nsproxy.c); ptrace_may_access() runs under + * the target's task_lock. The PIDFD_GET_*_NAMESPACE ioctls + * in fs/pidfs.c carry the same check. + */ + if (!ptrace_may_access(tsk, PTRACE_MODE_READ_FSCREDS)) + return -EACCES; + switch (ioctl) { case NS_GET_PID_FROM_PIDNS: ret = task_pid_vnr(tsk); -- 2.43.0