Re: procfs: boot- and runtime configurable access mode for /proc/<pid>dirs

[Daniel Reichelt]

> More to the point, permissions in /proc/<pid>/* don't do us much good.
> As the matter of fact, we ought to make them all flat - i.e. same for
> user/group/other, since we have to recheck access rights on every damn
> IO operations.  Checks done at open() are useless here - have the
> task exec suid-root binary and they are obsolete.

Well, my patch is about modes of the pid-dirs themselves, not their
contents. And it changes procfs' behaviour about modes both on initial
creation and during revalidation on access. However flattening all the
piddir's entries DOES pose a security risk. Have a look at the
"traditional behaviour": piddir world-readable, however e.g.
<pid>/environ isn't. Often it's a workaround for broken software to
specify a password within an environment variable instead of by cmdline.
Since up until now all processes including their full cmdlines are
visible to everyone, environ must be considered more sensitive than a
cmdline.

The security implications are taken care of by my patch. The more
restrictive the modes for the piddir, the less access to its contents.
So from a security point of view, my patch takes care of that and IMHO
there's no need to put hands on the procfs' management of modes for
piddir-contents.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/