forked from torvalds/linux
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'proc-linus' of git://git.kernel.org/pub/scm/linux/kerne…
…l/git/ebiederm/user-namespace Pull proc updates from Eric Biederman: "This has four sets of changes: - modernize proc to support multiple private instances - ensure we see the exit of each process tid exactly - remove has_group_leader_pid - use pids not tasks in posix-cpu-timers lookup Alexey updated proc so each mount of proc uses a new superblock. This allows people to actually use mount options with proc with no fear of messing up another mount of proc. Given the kernel's internal mounts of proc for things like uml this was a real problem, and resulted in Android's hidepid mount options being ignored and introducing security issues. The rest of the changes are small cleanups and fixes that came out of my work to allow this change to proc. In essence it is swapping the pids in de_thread during exec which removes a special case the code had to handle. Then updating the code to stop handling that special case" * 'proc-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: proc: proc_pid_ns takes super_block as an argument remove the no longer needed pid_alive() check in __task_pid_nr_ns() posix-cpu-timers: Replace __get_task_for_clock with pid_for_clock posix-cpu-timers: Replace cpu_timer_pid_type with clock_pid_type posix-cpu-timers: Extend rcu_read_lock removing task_struct references signal: Remove has_group_leader_pid exec: Remove BUG_ON(has_group_leader_pid) posix-cpu-timer: Unify the now redundant code in lookup_task posix-cpu-timer: Tidy up group_leader logic in lookup_task proc: Ensure we see the exit of each process tid exactly once rculist: Add hlists_swap_heads_rcu proc: Use PIDTYPE_TGID in next_tgid Use proc_pid_ns() to get pid_namespace from the proc superblock proc: use named enums for better readability proc: use human-readable values for hidepid docs: proc: add documentation for "hidepid=4" and "subset=pid" options and new mount behavior proc: add option to mount only a pids subset proc: instantiate only pids that we can ptrace on 'hidepid=4' mount option proc: allow to mount many instances of proc in one pid namespace proc: rename struct proc_fs_info to proc_fs_opts
- Loading branch information
Showing
25 changed files
with
492 additions
and
206 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -51,6 +51,8 @@ fixes/update part 1.1 Stefani Seibold <[email protected]> June 9 2009 | |
| 4 Configuring procfs | ||
| 4.1 Mount options | ||
| 5 Filesystem behavior | ||
| Preface | ||
| ======= | ||
|
|
||
|
|
@@ -2143,28 +2145,80 @@ The following mount options are supported: | |
| ========= ======================================================== | ||
| hidepid= Set /proc/<pid>/ access mode. | ||
| gid= Set the group authorized to learn processes information. | ||
| subset= Show only the specified subset of procfs. | ||
| ========= ======================================================== | ||
|
|
||
| hidepid=0 means classic mode - everybody may access all /proc/<pid>/ directories | ||
| (default). | ||
|
|
||
| hidepid=1 means users may not access any /proc/<pid>/ directories but their | ||
| own. Sensitive files like cmdline, sched*, status are now protected against | ||
| other users. This makes it impossible to learn whether any user runs | ||
| specific program (given the program doesn't reveal itself by its behaviour). | ||
| As an additional bonus, as /proc/<pid>/cmdline is unaccessible for other users, | ||
| poorly written programs passing sensitive information via program arguments are | ||
| now protected against local eavesdroppers. | ||
|
|
||
| hidepid=2 means hidepid=1 plus all /proc/<pid>/ will be fully invisible to other | ||
| users. It doesn't mean that it hides a fact whether a process with a specific | ||
| pid value exists (it can be learned by other means, e.g. by "kill -0 $PID"), | ||
| but it hides process' uid and gid, which may be learned by stat()'ing | ||
| /proc/<pid>/ otherwise. It greatly complicates an intruder's task of gathering | ||
| information about running processes, whether some daemon runs with elevated | ||
| privileges, whether other user runs some sensitive program, whether other users | ||
| run any program at all, etc. | ||
| hidepid=off or hidepid=0 means classic mode - everybody may access all | ||
| /proc/<pid>/ directories (default). | ||
|
|
||
| hidepid=noaccess or hidepid=1 means users may not access any /proc/<pid>/ | ||
| directories but their own. Sensitive files like cmdline, sched*, status are now | ||
| protected against other users. This makes it impossible to learn whether any | ||
| user runs specific program (given the program doesn't reveal itself by its | ||
| behaviour). As an additional bonus, as /proc/<pid>/cmdline is unaccessible for | ||
| other users, poorly written programs passing sensitive information via program | ||
| arguments are now protected against local eavesdroppers. | ||
|
|
||
| hidepid=invisible or hidepid=2 means hidepid=1 plus all /proc/<pid>/ will be | ||
| fully invisible to other users. It doesn't mean that it hides a fact whether a | ||
| process with a specific pid value exists (it can be learned by other means, e.g. | ||
| by "kill -0 $PID"), but it hides process' uid and gid, which may be learned by | ||
| stat()'ing /proc/<pid>/ otherwise. It greatly complicates an intruder's task of | ||
| gathering information about running processes, whether some daemon runs with | ||
| elevated privileges, whether other user runs some sensitive program, whether | ||
| other users run any program at all, etc. | ||
|
|
||
| hidepid=ptraceable or hidepid=4 means that procfs should only contain | ||
| /proc/<pid>/ directories that the caller can ptrace. | ||
|
|
||
| gid= defines a group authorized to learn processes information otherwise | ||
| prohibited by hidepid=. If you use some daemon like identd which needs to learn | ||
| information about processes information, just add identd to this group. | ||
|
|
||
| subset=pid hides all top level files and directories in the procfs that | ||
| are not related to tasks. | ||
|
|
||
| 5 Filesystem behavior | ||
| ---------------------------- | ||
|
|
||
| Originally, before the advent of pid namepsace, procfs was a global file | ||
| system. It means that there was only one procfs instance in the system. | ||
|
|
||
| When pid namespace was added, a separate procfs instance was mounted in | ||
| each pid namespace. So, procfs mount options are global among all | ||
| mountpoints within the same namespace. | ||
|
|
||
| :: | ||
|
|
||
| # grep ^proc /proc/mounts | ||
| proc /proc proc rw,relatime,hidepid=2 0 0 | ||
|
|
||
| # strace -e mount mount -o hidepid=1 -t proc proc /tmp/proc | ||
| mount("proc", "/tmp/proc", "proc", 0, "hidepid=1") = 0 | ||
| +++ exited with 0 +++ | ||
|
|
||
| # grep ^proc /proc/mounts | ||
| proc /proc proc rw,relatime,hidepid=2 0 0 | ||
| proc /tmp/proc proc rw,relatime,hidepid=2 0 0 | ||
|
|
||
| and only after remounting procfs mount options will change at all | ||
| mountpoints. | ||
|
|
||
| # mount -o remount,hidepid=1 -t proc proc /tmp/proc | ||
|
|
||
| # grep ^proc /proc/mounts | ||
| proc /proc proc rw,relatime,hidepid=1 0 0 | ||
| proc /tmp/proc proc rw,relatime,hidepid=1 0 0 | ||
|
|
||
| This behavior is different from the behavior of other filesystems. | ||
|
|
||
| The new procfs behavior is more like other filesystems. Each procfs mount | ||
| creates a new procfs instance. Mount options affect own procfs instance. | ||
| It means that it became possible to have several procfs instances | ||
| displaying tasks with different filtering options in one pid namespace. | ||
|
|
||
| # mount -o hidepid=invisible -t proc proc /proc | ||
| # mount -o hidepid=noaccess -t proc proc /tmp/proc | ||
| # grep ^proc /proc/mounts | ||
| proc /proc proc rw,relatime,hidepid=invisible 0 0 | ||
| proc /tmp/proc proc rw,relatime,hidepid=noaccess 0 0 | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.