Commit 35a35046 authored by Djalal Harouni's avatar Djalal Harouni Committed by Linus Torvalds
Browse files

procfs: make /proc/*/{stack,syscall,personality} 0400 



These procfs files contain sensitive information and currently their
mode is 0444.  Change this to 0400, so the VFS will be able to block
unprivileged processes from getting file descriptors on arbitrary
privileged /proc/*/{stack,syscall,personality} files.

This reduces the scope of ASLR leaking and bypasses by protecting already
running processes.

Signed-off-by: default avatarDjalal Harouni <tixxdz@opendz.org>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarAndy Lutomirski <luto@amacapital.net>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 1c44dbc8

fs/proc/base.c

+6 −6
Original line number Diff line number Diff line
@@ -2588,7 +2588,7 @@ static const struct pid_entry tgid_base_stuff[] = { 
	REG("environ",    S_IRUSR, proc_environ_operations),

	INF("auxv",       S_IRUSR, proc_pid_auxv),

	ONE("status",     S_IRUGO, proc_pid_status),

	ONE("personality", S_IRUGO, proc_pid_personality),

	ONE("personality", S_IRUSR, proc_pid_personality),

	INF("limits",	  S_IRUGO, proc_pid_limits),

#ifdef CONFIG_SCHED_DEBUG

	REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
@@ -2598,7 +2598,7 @@ static const struct pid_entry tgid_base_stuff[] = { 
#endif

	REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),

#ifdef CONFIG_HAVE_ARCH_TRACEHOOK

	INF("syscall",    S_IRUGO, proc_pid_syscall),

	INF("syscall",    S_IRUSR, proc_pid_syscall),

#endif

	INF("cmdline",    S_IRUGO, proc_pid_cmdline),

	ONE("stat",       S_IRUGO, proc_tgid_stat),
@@ -2626,7 +2626,7 @@ static const struct pid_entry tgid_base_stuff[] = { 
	INF("wchan",      S_IRUGO, proc_pid_wchan),

#endif

#ifdef CONFIG_STACKTRACE

	ONE("stack",      S_IRUGO, proc_pid_stack),

	ONE("stack",      S_IRUSR, proc_pid_stack),

#endif

#ifdef CONFIG_SCHEDSTATS

	INF("schedstat",  S_IRUGO, proc_pid_schedstat),
@@ -2927,14 +2927,14 @@ static const struct pid_entry tid_base_stuff[] = { 
	REG("environ",   S_IRUSR, proc_environ_operations),

	INF("auxv",      S_IRUSR, proc_pid_auxv),

	ONE("status",    S_IRUGO, proc_pid_status),

	ONE("personality", S_IRUGO, proc_pid_personality),

	ONE("personality", S_IRUSR, proc_pid_personality),

	INF("limits",	 S_IRUGO, proc_pid_limits),

#ifdef CONFIG_SCHED_DEBUG

	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),

#endif

	REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),

#ifdef CONFIG_HAVE_ARCH_TRACEHOOK

	INF("syscall",   S_IRUGO, proc_pid_syscall),

	INF("syscall",   S_IRUSR, proc_pid_syscall),

#endif

	INF("cmdline",   S_IRUGO, proc_pid_cmdline),

	ONE("stat",      S_IRUGO, proc_tid_stat),
@@ -2964,7 +2964,7 @@ static const struct pid_entry tid_base_stuff[] = { 
	INF("wchan",     S_IRUGO, proc_pid_wchan),

#endif

#ifdef CONFIG_STACKTRACE

	ONE("stack",      S_IRUGO, proc_pid_stack),

	ONE("stack",      S_IRUSR, proc_pid_stack),

#endif

#ifdef CONFIG_SCHEDSTATS

	INF("schedstat", S_IRUGO, proc_pid_schedstat),

CRA Git | Maintained and supported by SUSTech CRA and CCSE