Re: question about /proc/<PID>/mem in 2.4

[Alan Cox]

On Wed, Jul 07, 2004 at 02:53:44PM +0100, Tigran Aivazian wrote:
>         if (!MAY_PTRACE(task) || !may_ptrace_attach(task))
>                 return -ESRCH;
> 
> Btw, the second check looks like an obvious race to me. I.e. if this
> condition can change between the check in the beginning of mem_read() and
> return from access_process_vm() then what is to stop it from changing just
> after this second check and return from mem_read()?

The boundary in question is exec(). We don't allow ptrace attach during
an exec in process and that may well make the specific mm untraceable.
So the lifetime is something like

	exec
		no attach
		create mm
		load stuff
		destroy old mm
		if suid
			no ptrace
		can attach (maybe)

So an open by self before an exec always refers to the old dead mm and
the one after always hits the other checks. A user can ptrace their own
app but ptrace itself doesn't set ptraced exec's setuid.



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/