From 0dc155fc76700115521a73033de7a22bf6f10388 Mon Sep 17 00:00:00 2001 From: Juan RP Date: Thu, 25 May 2017 09:38:57 +0200 Subject: [PATCH] linux4.11: patch from suse for issue 726016. From: "Eric W. Biederman" Date: Mon, 22 May 2017 16:04:48 -0500 Subject: [PATCH] ptrace: Properly initialize ptracer_cred on fork Message-ID: <877f18txfz.fsf_-_@xmission.com> Patch-mainline: Submitted, LKML References: bsc#1040041 --- .../patches/opensuse-bug-726016.patch | 113 ++++++++++++++++++ srcpkgs/linux4.11/template | 2 +- 2 files changed, 114 insertions(+), 1 deletion(-) create mode 100644 srcpkgs/linux4.11/patches/opensuse-bug-726016.patch diff --git a/srcpkgs/linux4.11/patches/opensuse-bug-726016.patch b/srcpkgs/linux4.11/patches/opensuse-bug-726016.patch new file mode 100644 index 00000000000..7d9995ffefa --- /dev/null +++ b/srcpkgs/linux4.11/patches/opensuse-bug-726016.patch @@ -0,0 +1,113 @@ +From: "Eric W. Biederman" +Date: Mon, 22 May 2017 16:04:48 -0500 +Subject: [PATCH] ptrace: Properly initialize ptracer_cred on fork +Message-ID: <877f18txfz.fsf_-_@xmission.com> +Patch-mainline: Submitted, LKML +References: bsc#1040041 + +When I introduced ptracer_cred I failed to consider the weirdness of +fork where the task_struct copies the old value by default. This +winds up leaving ptracer_cred set even when a process forks and +the child process does not wind up being ptraced. + +Because ptracer_cred is not set on non-ptraced processes whose +parents were ptraced this has broken the ability of the enlightenment +window manager to start setuid children. + +Fix this by properly initializing ptracer_cred in ptrace_init_task + +This must be done with a little bit of care to preserve the current value +of ptracer_cred when ptrace carries through fork. Re-reading the +ptracer_cred from the ptracing process at this point is inconsistent +with how PT_PTRACE_CAP has been maintained all of these years. + +Fixes: 64b875f7ac8a ("ptrace: Capture the ptracer's creds not PT_PTRACE_CAP") +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Takashi Iwai + +--- + include/linux/ptrace.h | 7 +++++-- + kernel/ptrace.c | 20 +++++++++++++------- + 2 files changed, 18 insertions(+), 9 deletions(-) + +--- a/include/linux/ptrace.h ++++ b/include/linux/ptrace.h +@@ -54,7 +54,8 @@ extern int ptrace_request(struct task_st + unsigned long addr, unsigned long data); + extern void ptrace_notify(int exit_code); + extern void __ptrace_link(struct task_struct *child, +- struct task_struct *new_parent); ++ struct task_struct *new_parent, ++ const struct cred *ptracer_cred); + extern void __ptrace_unlink(struct task_struct *child); + extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead); + #define PTRACE_MODE_READ 0x01 +@@ -206,7 +207,7 @@ static inline void ptrace_init_task(stru + + if (unlikely(ptrace) && current->ptrace) { + child->ptrace = current->ptrace; +- __ptrace_link(child, current->parent); ++ __ptrace_link(child, current->parent, current->ptracer_cred); + + if (child->ptrace & PT_SEIZED) + task_set_jobctl_pending(child, JOBCTL_TRAP_STOP); +@@ -215,6 +216,8 @@ static inline void ptrace_init_task(stru + + set_tsk_thread_flag(child, TIF_SIGPENDING); + } ++ else ++ child->ptracer_cred = NULL; + } + + /** +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -60,19 +60,25 @@ int ptrace_access_vm(struct task_struct + } + + ++void __ptrace_link(struct task_struct *child, struct task_struct *new_parent, ++ const struct cred *ptracer_cred) ++{ ++ BUG_ON(!list_empty(&child->ptrace_entry)); ++ list_add(&child->ptrace_entry, &new_parent->ptraced); ++ child->parent = new_parent; ++ child->ptracer_cred = get_cred(ptracer_cred); ++} ++ + /* + * ptrace a task: make the debugger its new parent and + * move it to the ptrace list. + * + * Must be called with the tasklist lock write-held. + */ +-void __ptrace_link(struct task_struct *child, struct task_struct *new_parent) ++static void ptrace_link(struct task_struct *child, struct task_struct *new_parent) + { +- BUG_ON(!list_empty(&child->ptrace_entry)); +- list_add(&child->ptrace_entry, &new_parent->ptraced); +- child->parent = new_parent; + rcu_read_lock(); +- child->ptracer_cred = get_cred(__task_cred(new_parent)); ++ __ptrace_link(child, new_parent, __task_cred(new_parent)); + rcu_read_unlock(); + } + +@@ -386,7 +392,7 @@ static int ptrace_attach(struct task_str + flags |= PT_SEIZED; + task->ptrace = flags; + +- __ptrace_link(task, current); ++ ptrace_link(task, current); + + /* SEIZE doesn't trap tracee on attach */ + if (!seize) +@@ -459,7 +465,7 @@ static int ptrace_traceme(void) + */ + if (!ret && !(current->real_parent->flags & PF_EXITING)) { + current->ptrace = PT_PTRACED; +- __ptrace_link(current, current->real_parent); ++ ptrace_link(current, current->real_parent); + } + } + write_unlock_irq(&tasklist_lock); diff --git a/srcpkgs/linux4.11/template b/srcpkgs/linux4.11/template index 1972d60b3bb..36c2624947c 100644 --- a/srcpkgs/linux4.11/template +++ b/srcpkgs/linux4.11/template @@ -1,7 +1,7 @@ # Template file for 'linux4.11' pkgname=linux4.11 version=4.11.2 -revision=1 +revision=2 patch_args="-Np1" wrksrc="linux-${version}" maintainer="Juan RP "