Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b1f438f8 authored by Jann Horn's avatar Jann Horn Committed by Greg Kroah-Hartman
Browse files

ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE 



commit ee1fee900537b5d9560e9f937402de5ddc8412f3 upstream.

Setting PTRACE_O_SUSPEND_SECCOMP is supposed to be a highly privileged
operation because it allows the tracee to completely bypass all seccomp
filters on kernels with CONFIG_CHECKPOINT_RESTORE=y. It is only supposed to
be settable by a process with global CAP_SYS_ADMIN, and only if that
process is not subject to any seccomp filters at all.

However, while these permission checks were done on the PTRACE_SETOPTIONS
path, they were missing on the PTRACE_SEIZE path, which also sets
user-specified ptrace flags.

Move the permissions checks out into a helper function and let both
ptrace_attach() and ptrace_setoptions() call it.

Cc: stable@kernel.org
Fixes: 13c4a901 ("seccomp: add ptrace options for suspend/resume")
Signed-off-by: default avatarJann Horn <jannh@google.com>
Link: https://lkml.kernel.org/r/20220319010838.1386861-1-jannh@google.com


Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4211bc4c

kernel/ptrace.c

+32 −15
Original line number Diff line number Diff line
@@ -364,6 +364,26 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode) 
	return !err;

}



static int check_ptrace_options(unsigned long data)

{

	if (data & ~(unsigned long)PTRACE_O_MASK)

		return -EINVAL;



	if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) {

		if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) ||

		    !IS_ENABLED(CONFIG_SECCOMP))

			return -EINVAL;



		if (!capable(CAP_SYS_ADMIN))

			return -EPERM;



		if (seccomp_mode(&current->seccomp) != SECCOMP_MODE_DISABLED ||

		    current->ptrace & PT_SUSPEND_SECCOMP)

			return -EPERM;

	}

	return 0;

}



static int ptrace_attach(struct task_struct *task, long request,

			 unsigned long addr,

			 unsigned long flags)
@@ -375,8 +395,16 @@ static int ptrace_attach(struct task_struct *task, long request, 
	if (seize) {

		if (addr != 0)

			goto out;

		/*

		 * This duplicates the check in check_ptrace_options() because

		 * ptrace_attach() and ptrace_setoptions() have historically

		 * used different error codes for unknown ptrace options.

		 */

		if (flags & ~(unsigned long)PTRACE_O_MASK)

			goto out;

		retval = check_ptrace_options(flags);

		if (retval)

			return retval;

		flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT);

	} else {

		flags = PT_PTRACED;
@@ -649,22 +677,11 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds 
static int ptrace_setoptions(struct task_struct *child, unsigned long data)

{

	unsigned flags;

	int ret;



	if (data & ~(unsigned long)PTRACE_O_MASK)

		return -EINVAL;



	if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) {

		if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) ||

		    !IS_ENABLED(CONFIG_SECCOMP))

			return -EINVAL;



		if (!capable(CAP_SYS_ADMIN))

			return -EPERM;



		if (seccomp_mode(&current->seccomp) != SECCOMP_MODE_DISABLED ||

		    current->ptrace & PT_SUSPEND_SECCOMP)

			return -EPERM;

	}

	ret = check_ptrace_options(data);

	if (ret)

		return ret;



	/* Avoid intermediate state when all opts are cleared */

	flags = child->ptrace;