Re: [PATCH] Security: Implement prctl(PR_SET_NETWORK, PR_NETWORK_OFF) semantics.
From: Eric W. Biederman <hidden>
Date: 2009-12-17 19:18:43
Also in:
lkml
Michael Stone [off-list ref] writes:
quoted hunk
diff --git a/kernel/ptrace.c b/kernel/ptrace.c index 23bd09c..5b38db0 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c@@ -151,6 +151,8 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode) dumpable = get_dumpable(task->mm); if (!dumpable && !capable(CAP_SYS_PTRACE)) return -EPERM; + if (current->network) + return -EPERM;
The principle should be: you gain no privileges by ptracing. Therefore this check should be: if (current->network && !task->network) return -EPERM; Which keeps the ptrace logic from being a larger hammer than it needs to be. Eric