RE: [PATCH v4 3/3] prctl: Allow ptrace capable processes to change /proc/self/exe

quoted

This is scary.  But I believe it is safe.

Reviewed-by: Serge Hallyn <serge@hallyn.com>

I am a bit curious about the implications of the selinux patch.
IIUC you are using the permission of the tracing process to execute
the file without transition, so this is a way to work around the
policy which might prevent the tracee from doing so.
Given that SELinux wants to be MAC, I'm not *quite* sure that's
considered kosher.  You also are skipping the PROCESS__PTRACE to
SECCLASS_PROCESS check which selinux_bprm_set_creds does later on.
Again I'm just not quite sure what's considered normal there these
days.

Paul, do you have input there?

I agree, the SELinux hook looks wrong.  Building on what Christian said, this looks more like a ptrace operation than an exec operation.

Serge, Paul, Christian,

I made a PoC to demonstrate the change of /proc/self/exe without CAP_SYS_ADMIN using only ptrace and execve.
You may find it here: https://github.com/nviennot/run_as_exe

What do you recommend to relax the security checks in the kernel when it comes to changing the exe link?

    Nico