diff options
| author |   Alexey Gladkov <gladkov.alexey@gmail.com> | 2020-04-19 16:10:53 +0200 |
|---|---|---|
| committer |   Eric W. Biederman <ebiederm@xmission.com> | 2020-04-22 10:51:21 -0500 |
| commit | 24a71ce5c47f6b1b3cdacf544cb24220f5c3b7ef (patch) | |
| tree | da93b7bfc767c3fad21663b6c1aab72e2e9ffec8 /fs/proc/root.c | |
| parent | proc: allow to mount many instances of proc in one pid namespace (diff) | |
| download | linux-dev-24a71ce5c47f6b1b3cdacf544cb24220f5c3b7ef.tar.xz linux-dev-24a71ce5c47f6b1b3cdacf544cb24220f5c3b7ef.zip | |
proc: instantiate only pids that we can ptrace on 'hidepid=4' mount option
If "hidepid=4" mount option is set then do not instantiate pids that
we can not ptrace. "hidepid=4" means that procfs should only contain
pids that the caller can ptrace.
Signed-off-by: Djalal Harouni <tixxdz@gmail.com>
Signed-off-by: Alexey Gladkov <gladkov.alexey@gmail.com>
Reviewed-by: Alexey Dobriyan <adobriyan@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Diffstat (limited to '')
| -rw-r--r-- | fs/proc/root.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/fs/proc/root.c b/fs/proc/root.c index 208989274923..8f23b951d685 100644 --- a/fs/proc/root.c +++ b/fs/proc/root.c @@ -47,6 +47,14 @@ static const struct fs_parameter_spec proc_fs_parameters[] = { {} }; +static inline int valid_hidepid(unsigned int value) +{ + return (value == HIDEPID_OFF || + value == HIDEPID_NO_ACCESS || + value == HIDEPID_INVISIBLE || + value == HIDEPID_NOT_PTRACEABLE); +} + static int proc_parse_param(struct fs_context *fc, struct fs_parameter *param) { struct proc_fs_context *ctx = fc->fs_private; @@ -63,10 +71,9 @@ static int proc_parse_param(struct fs_context *fc, struct fs_parameter *param) break; case Opt_hidepid: + if (!valid_hidepid(result.uint_32)) + return invalf(fc, "proc: unknown value of hidepid.\n"); ctx->hidepid = result.uint_32; - if (ctx->hidepid < HIDEPID_OFF || - ctx->hidepid > HIDEPID_INVISIBLE) - return invalfc(fc, "hidepid value must be between 0 and 2.\n"); break; default: |