proc: revalidate kernel thread inodes to root:root

task_dump_owner() has the following code: mm = task->mm; if (mm) { if (get_dumpable(mm) != SUID_DUMP_USER) { uid = ... } } Check for ->mm is buggy -- kernel thread might be borrowing mm and inode will go to some random uid:gid pair.

Alexey Dobriyan committed 8 years ago

Commit 2e0ad551 parent 1e630661 file · +6 −0Browse files

Unified · Split

fs/proc/base.c+6−0

@@ -1693,6 +1693,12 @@ void task_dump_owner(struct task_struct *task, umode_t mode, · 1692 unmodified lines
1693	1693	kuid_t uid;
1694	1694	kgid_t gid;
1695	1695
	1696	+ if (unlikely(task->flags & PF_KTHREAD)) {
	1697	+ *ruid = GLOBAL_ROOT_UID;
	1698	+ *rgid = GLOBAL_ROOT_GID;
	1699	+ return;
	1700	+ }
	1701	+
1696	1702	/* Default to the tasks effective ownership */
1697	1703	rcu_read_lock();
1698	1704	cred = __task_cred(task);