In 1.3.96 fs/proc/mem.c was changed and now enforces (pid == current->pid)
in order to allow a read to /proc/pid/mem. Security is what we all want,
granted. But if we are going to prevent any other process than ourselves
from having a look at our memory space, we should perhaps happily
remove /proc/pid/mem altogether... (*)
Here is a patch. It tries to make reasonable security checks
(actually I take the condition from sys_ptrace.)
--- linux-1.3/fs/proc/mem.c.org Sat May 4 03:08:48 1996
+++ linux-1.3/fs/proc/mem.c Sat May 4 03:20:23 1996
@@ -65,9 +65,19 @@
return -EINVAL;
pid = inode->i_ino;
pid >>= 16;
- if (pid != current->pid)
- return -EACCES;
- tsk = current;
+ tsk = NULL;
+ for (i = 1; i < NR_TASKS; i++) {
+ if (task[i] != NULL && (task[i]->pid == pid))
+ tsk = task[i];
+ }
+
+ if (!tsk ||
+ ((!tsk->dumpable ||
+ (current->uid != tsk->euid) ||
+ (current->uid != tsk->uid) ||
+ (current->gid != tsk->egid) ||
+ (current->gid != tsk->gid)) && !suser()))
+ return -EACCES;
addr = file->f_pos;
count = check_range(tsk, addr, count);
if (count < 0)
@@ -126,9 +136,18 @@
addr = file->f_pos;
pid = inode->i_ino;
pid >>= 16;
- if (pid != current->pid)
- return -EACCES;
- tsk = current;
+ tsk = NULL;
+ for (i = 1; i < NR_TASKS; i++) {
+ if (task[i] != NULL && (task[i]->pid == pid))
+ tsk = task[i];
+ }
+ if (!tsk ||
+ ((!tsk->dumpable ||
+ (current->uid != tsk->euid) ||
+ (current->uid != tsk->uid) ||
+ (current->gid != tsk->egid) ||
+ (current->gid != tsk->gid)) && !suser()))
+ return -EACCES;
tmp = buf;
while (count > 0) {
if (current->signal & ~current->blocked)
(*) this might look ironical. It is. 3 o'clock in the morning is time
for irony when you really need strace...
--
Thomas.Quinot@Cuivre.FdN.FR <URL:http://Web.FdN.FR/~tquinot/>