linux.git/kernel/ptrace.c, branch v3.8-rc4

Merge branch 'akpm' (Andrew's patch-bomb)

2012-12-18T04:58:12+00:00

Merge misc patches from Andrew Morton:
 "Incoming:

   - lots of misc stuff

   - backlight tree updates

   - lib/ updates

   - Oleg's percpu-rwsem changes

   - checkpatch

   - rtc

   - aoe

   - more checkpoint/restart support

  I still have a pile of MM stuff pending - Pekka should be merging
  later today after which that is good to go.  A number of other things
  are twiddling thumbs awaiting maintainer merges."

* emailed patches from Andrew Morton : (180 commits)
  scatterlist: don't BUG when we can trivially return a proper error.
  docs: update documentation about /proc//fdinfo/ fanotify output
  fs, fanotify: add @mflags field to fanotify output
  docs: add documentation about /proc//fdinfo/ output
  fs, notify: add procfs fdinfo helper
  fs, exportfs: add exportfs_encode_inode_fh() helper
  fs, exportfs: escape nil dereference if no s_export_op present
  fs, epoll: add procfs fdinfo helper
  fs, eventfd: add procfs fdinfo helper
  procfs: add ability to plug in auxiliary fdinfo providers
  tools/testing/selftests/kcmp/kcmp_test.c: print reason for failure in kcmp_test
  breakpoint selftests: print failure status instead of cause make error
  kcmp selftests: print fail status instead of cause make error
  kcmp selftests: make run_tests fix
  mem-hotplug selftests: print failure status instead of cause make error
  cpu-hotplug selftests: print failure status instead of cause make error
  mqueue selftests: print failure status instead of cause make error
  vm selftests: print failure status instead of cause make error
  ubifs: use prandom_bytes
  mtd: nandsim: use prandom_bytes
  ...

ptrace: introduce PTRACE_O_EXITKILL

2012-12-18T01:15:22+00:00

Ptrace jailers want to be sure that the tracee can never escape
from the control. However if the tracer dies unexpectedly the
tracee continues to run in potentially unsafe mode.

Add the new ptrace option PTRACE_O_EXITKILL. If the tracer exits
it sends SIGKILL to every tracee which has this bit set.

Note that the new option is not equal to the last-option << 1.  Because
currently all options have an event, and the new one starts the eventless
group.  It uses the random 20 bit, so we have the room for 12 more events,
but we can also add the new eventless options below this one.

Suggested by Amnon Shiloh.

Signed-off-by: Oleg Nesterov 
Tested-by: Amnon Shiloh 
Cc: Denys Vlasenko 
Cc: Michael Kerrisk 
Cc: Serge Hallyn 
Cc: Chris Evans 
Cc: David Howells 
Cc: "Eric W. Biederman" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

userns: Kill task_user_ns

2012-11-20T12:17:44+00:00

The task_user_ns function hides the fact that it is getting the user
namespace from struct cred on the task.  struct cred may go away as
soon as the rcu lock is released.  This leads to a race where we
can dereference a stale user namespace pointer.

To make it obvious a struct cred is involved kill task_user_ns.

To kill the race modify the users of task_user_ns to only
reference the user namespace while the rcu lock is held.

Cc: Kees Cook 
Cc: James Morris 
Acked-by: Kees Cook 
Acked-by: Serge Hallyn 
Signed-off-by: "Eric W. Biederman"

ptrace: mark __ptrace_may_access() static

2012-08-03T04:47:17+00:00

__ptrace_may_access() is used within only kernel/ptrace.c.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

userns: Convert ptrace, kill, set_priority permission checks to work with kuids and kgids

2012-05-03T10:28:51+00:00

Update the permission checks to use the new uid_eq and gid_eq helpers
and remove the now unnecessary user_ns equality comparison.

Acked-by: Serge Hallyn 
Signed-off-by: Eric W. Biederman

userns: Use cred->user_ns instead of cred->user->user_ns

2012-04-07T23:55:51+00:00

Optimize performance and prepare for the removal of the user_ns reference
from user_struct.  Remove the slow long walk through cred->user->user_ns and
instead go straight to cred->user_ns.

Acked-by: Serge Hallyn 
Signed-off-by: Eric W. Biederman

ptrace: remove PTRACE_SEIZE_DEVEL bit

2012-03-23T23:58:41+00:00

PTRACE_SEIZE code is tested and ready for production use, remove the
code which requires special bit in data argument to make PTRACE_SEIZE
work.

Strace team prepares for a new release of strace, and we would like to
ship the code which uses PTRACE_SEIZE, preferably after this change goes
into released kernel.

Signed-off-by: Denys Vlasenko 
Acked-by: Tejun Heo 
Acked-by: Oleg Nesterov 
Cc: Pedro Alves 
Cc: Jan Kratochvil 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ptrace: make PTRACE_SEIZE set ptrace options specified in 'data' parameter

2012-03-23T23:58:40+00:00

This can be used to close a few corner cases in strace where we get
unwanted racy behavior after attach, but before we have a chance to set
options (the notorious post-execve SIGTRAP comes to mind), and removes
the need to track "did we set opts for this task" state in strace
internals.

While we are at it:

Make it possible to extend SEIZE in the future with more functionality
by passing non-zero 'addr' parameter.  To that end, error out if 'addr'
is non-zero.  PTRACE_ATTACH did not (and still does not) have such
check, and users (strace) do pass garbage there...  let's avoid
repeating this mistake with SEIZE.

Set all task->ptrace bits in one operation - before this change, we were
adding PT_SEIZED and PT_PTRACE_CAP with task->ptrace |= BIT ops.  This
was probably ok (not a bug), but let's be on a safer side.

Changes since v2: use (unsigned long) casts instead of (long) ones, move
PTRACE_SEIZE_DEVEL-related code to separate lines of code.

Signed-off-by: Denys Vlasenko 
Acked-by: Tejun Heo 
Cc: Pedro Alves 
Reviewed-by: Oleg Nesterov 
Cc: Jan Kratochvil 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ptrace: simplify PTRACE_foo constants and PTRACE_SETOPTIONS code

2012-03-23T23:58:40+00:00

Exchange PT_TRACESYSGOOD and PT_PTRACE_CAP bit positions, which makes
PT_option bits contiguous and therefore makes code in
ptrace_setoptions() much simpler.

Every PTRACE_O_TRACEevent is defined to (1 << PTRACE_EVENT_event)
instead of using explicit numeric constants, to ensure we don't mess up
relationship between bit positions and event ids.

PT_EVENT_FLAG_SHIFT was not particularly useful, PT_OPT_FLAG_SHIFT with
value of PT_EVENT_FLAG_SHIFT-1 is easier to use.

PT_TRACE_MASK constant is nuked, the only its use is replaced by
(PTRACE_O_MASK << PT_OPT_FLAG_SHIFT).

Signed-off-by: Denys Vlasenko 
Acked-by: Tejun Heo 
Reviewed-by: Oleg Nesterov 
Cc: Pedro Alves 
Cc: Jan Kratochvil 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ptrace: don't modify flags on PTRACE_SETOPTIONS failure

2012-03-23T23:58:40+00:00

On ptrace(PTRACE_SETOPTIONS, pid, 0, ), we used to set those
option bits which are known, and then fail with -EINVAL if there are
some unknown bits in .

This is inconsistent with typical error handling, which does not change
any state if input is invalid.

This patch changes PTRACE_SETOPTIONS behavior so that in this case, we
return -EINVAL and don't change any bits in task->ptrace.

It's very unlikely that there is userspace code in the wild which will
be affected by this change: it should have the form

    ptrace(PTRACE_SETOPTIONS, pid, 0, PTRACE_O_BOGUSOPT)

where PTRACE_O_BOGUSOPT is a constant unknown to the kernel.  But kernel
headers, naturally, don't contain any PTRACE_O_BOGUSOPTs, thus the only
way userspace can use one if it defines one itself.  I can't see why
anyone would do such a thing deliberately.

Signed-off-by: Denys Vlasenko 
Acked-by: Tejun Heo 
Reviewed-by: Oleg Nesterov 
Cc: Pedro Alves 
Cc: Jan Kratochvil 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds