• Josh Stone's avatar
    Yama: allow access for the current ptrace parent · 50523a29
    Josh Stone authored
    Under ptrace_scope=1, it's possible to have a tracee that is already
    ptrace-attached, but is no longer a direct descendant.  For instance, a
    forking daemon will be re-parented to init, losing its ancestry to the
    tracer that launched it.
    
    The tracer can continue using ptrace in that state, but it will be
    denied other accesses that check PTRACE_MODE_ATTACH, like process_vm_rw
    and various procfs files.  There's no reason to prevent such access for
    a tracer that already has ptrace control anyway.
    
    This patch adds a case to ptracer_exception_found to allow access for
    any task in the same thread group as the current ptrace parent.
    Signed-off-by: default avatarJosh Stone <jistone@redhat.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: James Morris <james.l.morris@oracle.com>
    Cc: "Serge E. Hallyn" <serge@hallyn.com>
    Cc: linux-security-module@vger.kernel.org
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
    50523a29
yama_lsm.c 12.1 KB