task_dump_owner() has the following code: mm = task->mm; if (mm) { if (get_dumpable(mm) != SUID_DUMP_USER) { uid = ... } } Check for ->mm is buggy -- kernel thread might be borrowing mm and inode will go to some random uid:gid pair.
Unified · Split
| @@ -1693,6 +1693,12 @@ void task_dump_owner(struct task_struct *task, umode_t mode, · 1692 unmodified lines | |||
| 1693 | kuid_t uid; | 1693 | kuid_t uid; |
| 1694 | kgid_t gid; | 1694 | kgid_t gid; |
| 1695 | 1695 | ||
| 1696 | if (unlikely(task->flags & PF_KTHREAD)) { | ||
| 1697 | *ruid = GLOBAL_ROOT_UID; | ||
| 1698 | *rgid = GLOBAL_ROOT_GID; | ||
| 1699 | return; | ||
| 1700 | } | ||
| 1701 | |||
| 1696 | /* Default to the tasks effective ownership */ | 1702 | /* Default to the tasks effective ownership */ |
| 1697 | rcu_read_lock(); | 1703 | rcu_read_lock(); |
| 1698 | cred = __task_cred(task); | 1704 | cred = __task_cred(task); |