Home
Reading
Searching
Subscribe
Sponsors
Statistics
Posting
Contact
Spam
Lists
Links
About
Hosting
Filtering
Features Download
Marketing
Archives
FAQ
Blog
 
Gmane
From: Stephen Wilson <wilsons <at> start.ca>
Subject: [PATCH v2 0/12] enable writing to /proc/pid/mem
Newsgroups: gmane.linux.kernel
Date: Sunday 13th March 2011 19:49:12 UTC (over 5 years ago)
For a long time /proc/pid/mem has provided a read-only interface, at least
since 2.4.0.  However, a write capability has existed "forever" in tree via
the
function mem_write(), disabled with an #ifdef along with the comment "this
is a
security hazard".  Currently, the main problem with mem_write() is that
between
the time permissions are checked and the actual write the target task could
exec a setuid-root binary.

This patch series enables safe writes to /proc/pid/mem.  Such functionality
is
useful as it gives debuggers a simple and efficient mechanism to manipulate
a
process' address space.  Memory can be read and written using single calls
to
pread(2) and pwrite(2) instead of iteratively calling into ptrace(2).  In
addition, /proc/pid/mem has always had write permissions enabled, so
clearly it
*wants* to be written to. 


The first version of these patches was split into two series.  Here they
are
combined together for easier reference and review.


Patches 1-5 make is_gate_vma() and in_gate_vma() functions of mm_struct,
not
task_struct.  These patches are of particular interest to the x86
architecture
maintainers and were originally distributed as a stand alone series[1]. 
From a
conceptual point of view, the question of whether an address lies in a gate
vma
should be asked with respect to a particular mm, not a particular task. 
From a
practical point of view, this change will help simplify current and future
operations on mm's.  In particular, it allows some code paths to avoid the
need
to hold task_lock.  The principle change there is to mirror TIF_IA32 via a
new
flag in mm_context_t. 


Patches 6-12 build on the new flexibility to enable secure writes to
/proc/pid/mem.  These patches impact the memory and procfs subsystems and
were
originally distributed as a stand alone series[2].   The principle strategy
is
to get a reference to the target task's mm before the permission check, and
to
hold that reference until after the write completes.

This patch set is based on v2.6.38-rc8.
 
The general approach used was suggested to me by Alexander Viro, but any
mistakes present in these patches are entirely my own.

--
steve


[1] lkml.org/lkml/2011/3/8/409
[2] lkml.org/lkml/2011/3/8/418


Changes since v1:

  - Rename mm_context_t.compat to ia32_compat as suggested by Michel
    Lespinasse.

  - Rework check_mem_permission() to return ERR_PTR and hold
cred_guard_mutex
    as suggested by Alexander Viro.

  - Collapse patches into a single series.

Stephen Wilson (12):
      x86: add context tag to mark mm when running a task in 32-bit
compatibility mode
      x86: mark associated mm when running a task in 32 bit compatibility
mode
      mm: arch: make get_gate_vma take an mm_struct instead of a
task_struct
      mm: arch: make in_gate_area take an mm_struct instead of a
task_struct
      mm: arch: rename in_gate_area_no_task to in_gate_area_no_mm
      mm: use mm_struct to resolve gate vma's in __get_user_pages
      mm: factor out main logic of access_process_vm
      mm: implement access_remote_vm
      proc: disable mem_write after exec
      proc: hold cred_guard_mutex in check_mem_permission()
      proc: make check_mem_permission() return an mm_struct on success
      proc: enable writing to /proc/pid/mem


 arch/powerpc/kernel/vdso.c         |    6 +-
 arch/s390/kernel/vdso.c            |    6 +-
 arch/sh/kernel/vsyscall/vsyscall.c |    6 +-
 arch/x86/ia32/ia32_aout.c          |    1 +
 arch/x86/include/asm/mmu.h         |    6 +++
 arch/x86/kernel/process_64.c       |    8 ++++
 arch/x86/mm/init_64.c              |   16 ++++----
 arch/x86/vdso/vdso32-setup.c       |   15 ++++---
 fs/binfmt_elf.c                    |    2 +-
 fs/proc/base.c                     |   79
++++++++++++++++++++++++------------
 fs/proc/task_mmu.c                 |    8 ++-
 include/linux/mm.h                 |   12 +++--
 kernel/kallsyms.c                  |    4 +-
 mm/memory.c                        |   73
++++++++++++++++++++++++---------
 mm/mlock.c                         |    4 +-
 mm/nommu.c                         |    2 +-
 16 files changed, 165 insertions(+), 83 deletions(-)



--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to [email protected]  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email:  email@kvack.org 
 
CD: 3ms