procfs: make /proc/*/pagemap 0400
The /proc/*/pagemap contain sensitive information and currently its mode is 0444. Change this to 0400, so the VFS will prevent unprivileged processes from getting file descriptors on arbitrary privileged /proc/*/pagemap files. This reduces the scope of address space leaking and bypasses by protecting already running processes. Signed-off-by: Djalal Harouni <tixxdz@opendz.org> Acked-by: Kees Cook <keescook@chromium.org> Acked-by: Andy Lutomirski <luto@amacapital.net> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Ingo Molnar <mingo@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
35a35046e4
commit
32ed74a4b9
|
@ -2617,7 +2617,7 @@ static const struct pid_entry tgid_base_stuff[] = {
|
||||||
#ifdef CONFIG_PROC_PAGE_MONITOR
|
#ifdef CONFIG_PROC_PAGE_MONITOR
|
||||||
REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
|
REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
|
||||||
REG("smaps", S_IRUGO, proc_pid_smaps_operations),
|
REG("smaps", S_IRUGO, proc_pid_smaps_operations),
|
||||||
REG("pagemap", S_IRUGO, proc_pagemap_operations),
|
REG("pagemap", S_IRUSR, proc_pagemap_operations),
|
||||||
#endif
|
#endif
|
||||||
#ifdef CONFIG_SECURITY
|
#ifdef CONFIG_SECURITY
|
||||||
DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
|
DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
|
||||||
|
@ -2955,7 +2955,7 @@ static const struct pid_entry tid_base_stuff[] = {
|
||||||
#ifdef CONFIG_PROC_PAGE_MONITOR
|
#ifdef CONFIG_PROC_PAGE_MONITOR
|
||||||
REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
|
REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
|
||||||
REG("smaps", S_IRUGO, proc_tid_smaps_operations),
|
REG("smaps", S_IRUGO, proc_tid_smaps_operations),
|
||||||
REG("pagemap", S_IRUGO, proc_pagemap_operations),
|
REG("pagemap", S_IRUSR, proc_pagemap_operations),
|
||||||
#endif
|
#endif
|
||||||
#ifdef CONFIG_SECURITY
|
#ifdef CONFIG_SECURITY
|
||||||
DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
|
DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
|
||||||
|
|
Loading…
Reference in a new issue