Re: quotactl hook

offerat_private

* frm gregat_private "09/10/01 19:05:18 -0700" | sed '1,$s/^/* /'
*
* On Mon, Sep 10, 2001 at 05:32:12PM -0700, richard offer wrote:
*> 
*> Greg, obviously you're more up on kernel development than I am, can you
*> give me a hint. Or was it just a general warning "there have been issues
*> with this code in the past, be very careful about changing any logic".
* 
* 2.4 had the same ptrace problems that 2.2 did, but they showed up a bit
* differently.  And it's mostly a general warning, that rmc() call is
* there for a reason, which scares me that we are changing things around
* it.  But that holds true for the lsm patch logic there in general :)
* 
* That is one place that will _really_ need a good look over by people who
* understand all of the race conditions that are possible at that moment
* in time.

How does this work ? It back-tracks from Stephens separation of function
from access control, but it implements an identical code path to pre-LSM.

===== ptrace.c 1.5 vs edited =====

--- 1.5/kernel/ptrace.c Tue Aug  7 15:50:05 2001
+++ edited/ptrace.c     Tue Sep 11 09:24:04 2001
@@ -27,20 +27,22 @@
                goto bad;
        if (!task->mm)
                goto bad;
+       retval = 0;
        if(((current->uid != task->euid) ||
            (current->uid != task->suid) ||
            (current->uid != task->uid) ||
            (current->gid != task->egid) ||
            (current->gid != task->sgid) ||
            (current->gid != task->gid)) && !capable(CAP_SYS_PTRACE))
-               goto bad;
-       rmb();
-       if (!task->mm->dumpable && !capable(CAP_SYS_PTRACE))
-               goto bad;
+               retval = -EPERM;
+       if ( !retval )
+               rmb();
+       if (!retval && !task->mm->dumpable && !capable(CAP_SYS_PTRACE))
+               retval = -EPERM;
        /* the same process cannot be attached many times */
-       if (task->ptrace & PT_PTRACED)
-               goto bad;
-       retval = security_ops->ptrace(current, task);
+       if (!retval && task->ptrace & PT_PTRACED)
+               retval = -EPERM;
+       retval = security_ops->ptrace(current, task, retval);
        if (retval)
                goto bad;
 


* 
* thanks,
* 
* greg k-h
* 

richard.

-----------------------------------------------------------------------
Richard Offer                     Technical Lead, Trust Technology, SGI
"Specialization is for insects"
_______________________________________________________________________


_______________________________________________
linux-security-module mailing list
linux-security-moduleat_private
http://mail.wirex.com/mailman/listinfo/linux-security-module
