LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH] Fix prlimit64 for suid/sgid processes
@ 2011-01-27 13:47 Kacper Kornet
2011-01-27 22:59 ` Linus Torvalds
0 siblings, 1 reply; 6+ messages in thread
From: Kacper Kornet @ 2011-01-27 13:47 UTC (permalink / raw)
To: linux-kernel; +Cc: Jiri Slaby, Linus Torvalds
Since check_prlimit_permission always fails in the case of SUID/GUID
processes, such processes are not able to read or set their own limits.
This commit changes this by assuming that process can always read/change
its own limits.
Signed-off-by: Kacper Kornet <kornet@camk.edu.pl>
---
kernel/sys.c | 10 ++++++----
1 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/kernel/sys.c b/kernel/sys.c
index e9ad444..0aaafde 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1409,10 +1409,12 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, unsigned int, resource,
rcu_read_unlock();
return -ESRCH;
}
- ret = check_prlimit_permission(tsk);
- if (ret) {
- rcu_read_unlock();
- return ret;
+ if (tsk != current) {
+ ret = check_prlimit_permission(tsk);
+ if (ret) {
+ rcu_read_unlock();
+ return ret;
+ }
}
get_task_struct(tsk);
rcu_read_unlock();
--
Kacper Kornet
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Fix prlimit64 for suid/sgid processes
2011-01-27 13:47 [PATCH] Fix prlimit64 for suid/sgid processes Kacper Kornet
@ 2011-01-27 22:59 ` Linus Torvalds
2011-01-28 23:21 ` [PATCH v2] " Kacper Kornet
0 siblings, 1 reply; 6+ messages in thread
From: Linus Torvalds @ 2011-01-27 22:59 UTC (permalink / raw)
To: Kacper Kornet; +Cc: linux-kernel, Jiri Slaby
On 1/27/11, Kacper Kornet <kornet@camk.edu.pl> wrote:
> Since check_prlimit_permission always fails in the case of SUID/GUID
> processes, such processes are not able to read or set their own limits.
> This commit changes this by assuming that process can always read/change
> its own limits.
Shouldn't this be fixed in check_prlimit_permissions() instead of in the caller?
Linus
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] Fix prlimit64 for suid/sgid processes
2011-01-27 22:59 ` Linus Torvalds
@ 2011-01-28 23:21 ` Kacper Kornet
2011-01-28 23:28 ` Jiri Slaby
2011-01-31 9:40 ` [for .36,.37 stable] " Jiri Slaby
0 siblings, 2 replies; 6+ messages in thread
From: Kacper Kornet @ 2011-01-28 23:21 UTC (permalink / raw)
To: Linus Torvalds; +Cc: linux-kernel, Jiri Slaby
Since check_prlimit_permission always fails in the case of SUID/GUID
processes, such processes are not able to read or set their own limits.
This commit changes this by assuming that process can always read/change
its own limits.
Signed-off-by: Kacper Kornet <kornet@camk.edu.pl>
---
kernel/sys.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/kernel/sys.c b/kernel/sys.c
index e9ad444..03bead7 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1375,7 +1375,8 @@ static int check_prlimit_permission(struct task_struct *task)
const struct cred *cred = current_cred(), *tcred;
tcred = __task_cred(task);
- if ((cred->uid != tcred->euid ||
+ if (current != task &&
+ (cred->uid != tcred->euid ||
cred->uid != tcred->suid ||
cred->uid != tcred->uid ||
cred->gid != tcred->egid ||
--
1.7.3.5
--
Kacper
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] Fix prlimit64 for suid/sgid processes
2011-01-28 23:21 ` [PATCH v2] " Kacper Kornet
@ 2011-01-28 23:28 ` Jiri Slaby
2011-01-31 9:40 ` [for .36,.37 stable] " Jiri Slaby
1 sibling, 0 replies; 6+ messages in thread
From: Jiri Slaby @ 2011-01-28 23:28 UTC (permalink / raw)
To: Kacper Kornet; +Cc: Linus Torvalds, linux-kernel
On 01/29/2011 12:21 AM, Kacper Kornet wrote:
> Since check_prlimit_permission always fails in the case of SUID/GUID
> processes, such processes are not able to read or set their own limits.
> This commit changes this by assuming that process can always read/change
> its own limits.
>
> Signed-off-by: Kacper Kornet <kornet@camk.edu.pl>
ACK. The check comes from the ptrace code. I forgot to copy this test.
> ---
> kernel/sys.c | 3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/kernel/sys.c b/kernel/sys.c
> index e9ad444..03bead7 100644
> --- a/kernel/sys.c
> +++ b/kernel/sys.c
> @@ -1375,7 +1375,8 @@ static int check_prlimit_permission(struct task_struct *task)
> const struct cred *cred = current_cred(), *tcred;
>
> tcred = __task_cred(task);
> - if ((cred->uid != tcred->euid ||
> + if (current != task &&
> + (cred->uid != tcred->euid ||
> cred->uid != tcred->suid ||
> cred->uid != tcred->uid ||
> cred->gid != tcred->egid ||
thanks,
--
js
suse labs
^ permalink raw reply [flat|nested] 6+ messages in thread
* [for .36,.37 stable] Re: [PATCH v2] Fix prlimit64 for suid/sgid processes
2011-01-28 23:21 ` [PATCH v2] " Kacper Kornet
2011-01-28 23:28 ` Jiri Slaby
@ 2011-01-31 9:40 ` Jiri Slaby
2011-02-15 14:28 ` [stable] [for .36, .37 " Greg KH
1 sibling, 1 reply; 6+ messages in thread
From: Jiri Slaby @ 2011-01-31 9:40 UTC (permalink / raw)
To: Kacper Kornet; +Cc: Linus Torvalds, linux-kernel, stable
Ccing stable.
Merged as aa5bd67dcfdf9 and should go into:
->.36-stable (if maintained still)
->.37-stable
On 01/29/2011 12:21 AM, Kacper Kornet wrote:
> Since check_prlimit_permission always fails in the case of SUID/GUID
> processes, such processes are not able to read or set their own limits.
> This commit changes this by assuming that process can always read/change
> its own limits.
>
> Signed-off-by: Kacper Kornet <kornet@camk.edu.pl>
> ---
> kernel/sys.c | 3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/kernel/sys.c b/kernel/sys.c
> index e9ad444..03bead7 100644
> --- a/kernel/sys.c
> +++ b/kernel/sys.c
> @@ -1375,7 +1375,8 @@ static int check_prlimit_permission(struct task_struct *task)
> const struct cred *cred = current_cred(), *tcred;
>
> tcred = __task_cred(task);
> - if ((cred->uid != tcred->euid ||
> + if (current != task &&
> + (cred->uid != tcred->euid ||
> cred->uid != tcred->suid ||
> cred->uid != tcred->uid ||
> cred->gid != tcred->egid ||
thanks,
--
js
suse labs
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [stable] [for .36, .37 stable] Re: [PATCH v2] Fix prlimit64 for suid/sgid processes
2011-01-31 9:40 ` [for .36,.37 stable] " Jiri Slaby
@ 2011-02-15 14:28 ` Greg KH
0 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2011-02-15 14:28 UTC (permalink / raw)
To: Jiri Slaby; +Cc: Kacper Kornet, Linus Torvalds, linux-kernel, stable
On Mon, Jan 31, 2011 at 10:40:57AM +0100, Jiri Slaby wrote:
> Ccing stable.
>
> Merged as aa5bd67dcfdf9 and should go into:
> ->.36-stable (if maintained still)
> ->.37-stable
Thanks, now queued up.
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-02-15 16:00 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-01-27 13:47 [PATCH] Fix prlimit64 for suid/sgid processes Kacper Kornet
2011-01-27 22:59 ` Linus Torvalds
2011-01-28 23:21 ` [PATCH v2] " Kacper Kornet
2011-01-28 23:28 ` Jiri Slaby
2011-01-31 9:40 ` [for .36,.37 stable] " Jiri Slaby
2011-02-15 14:28 ` [stable] [for .36, .37 " Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).