[PATCH RFC v3 59/90] ptrace: refuse PTRACE_TRACEME across cells

[Josef Bacik]

The parent of a task that was spawned into a cell is the spawner, which is
outside of the cell. PTRACE_TRACEME would turn the spawner into a tracer
without its consent.

A traced task is not reaped automatically. It would remain a zombie, and
zap_pid_ns_processes() would wait for it. A hostile cell could use that to
prevent itself from ever being reported dead.

Refuse PTRACE_TRACEME if the parent is not in the same cell.

Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
---
 kernel/ptrace.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index c30e15d39c41..c6115922ea2e 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -508,8 +508,20 @@ static int ptrace_attach(struct task_struct *task, long request,
 static int ptrace_traceme(void)
 {
 	int ret = -EPERM;
+	bool same;
 
 	write_lock_irq(&tasklist_lock);
+	/*
+	 * The parent of a task that was spawned into a cell is outside of it,
+	 * never asked to be a tracer and will not behave like one.
+	 */
+	rcu_read_lock();
+	same = cell_same(current_cred(), __task_cred(current->real_parent));
+	rcu_read_unlock();
+	if (!same) {
+		write_unlock_irq(&tasklist_lock);
+		return -EPERM;
+	}
 	/* Are we already being traced? */
 	if (!current->ptrace) {
 		ret = security_ptrace_traceme(current->parent);

-- 
2.55.0