Skip to content

proc: checks system security policy before trying to get personalities #637

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

proc: checks system security policy before trying to get personalities #637

wants to merge 1 commit into from

Conversation

HorlogeSkynet
Copy link
Contributor

See #636.

@mihalicyn
Copy link
Member

Dear @HorlogeSkynet,

please add Signed-off-by tag to your commit message.

mihalicyn
mihalicyn reviewed Apr 30, 2024
View reviewed changes
Copy link
Member

@mihalicyn mihalicyn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, except a few small nits. Thanks!

@HorlogeSkynet
Copy link
Contributor Author

LGTM, except a few small nits. Thanks!

Thanks for your quick review @mihalicyn. 'just pushed :

  • replaced ENOTSUP by EACCES
  • added missing \n in (new) error messages
  • added an error log in case of read_nointr failure
  • changed buf size count
  • renamed Yama ptrace scope constants according to Yama internals
  • signed-off commit

Bye 👋

stgraber
stgraber reviewed May 1, 2024
View reviewed changes
@HorlogeSkynet
proc: checks system security policy before trying to get personalities
5815e82 
096972f and fc8f593 introduces task personalities retrieval to fix
incorrect /proc files info in some cases.
Linux governs access to personalities based on system ptrace policy,
which may be restricted by an LSM (e.g. Yama).

This patch implements a simple check for "Yama ptrace scope" kernel
value to make sure ptrace usage is allowed, and prevent access from
containers to proc files with "Permission denied" error if not.

> closes #636 (follow-up to #553 and #609).

Signed-off-by: Samuel FORESTIER <[email protected]>
@HorlogeSkynet HorlogeSkynet mentioned this pull request May 1, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mihalicyn mihalicyn mihalicyn left review comments

@stgraber stgraber stgraber left review comments

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@HorlogeSkynet @mihalicyn @stgraber