From: Nicolas Bouchinet <nicolas.bouchinet@xxxxxxxxxxx>
The hidepid mount option documentation defines the following modes:
- "noaccess": user may not access any `/proc/<pid>/ directories but
their own.
- "invisible": all `/proc/<pid>/` will be fully invisible to other users.
- "ptraceable": means that procfs should only contain `/proc/<pid>/`
directories that the caller can ptrace.
We thus expect that with "noaccess" and "invisible" users would be able to
see their own processes in `/proc/<pid>/`.
The implementation of hidepid however control accesses using the
`ptrace_may_access()` function in any cases. Thus, if a process set
itself as non-dumpable using the `prctl(PR_SET_DUMPABLE,
SUID_DUMP_DISABLE)` it becomes invisible to the user.
This patch fixes the `has_pid_permissions()` function in order to make
its behavior to match the documentation.
Note that since `ptrace_may_access()` is not called anymore with
"noaccess" and "invisible", the `security_ptrace_access_check()` will no
longer be called either.
Signed-off-by: Nicolas Bouchinet <nicolas.bouchinet@xxxxxxxxxxx>
---
fs/proc/base.c | 27 ++++++++++++++++++++++++---
1 file changed, 24 insertions(+), 3 deletions(-)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index c667702dc69b8ca2531e88e12ed7a18533f294dd..fb128cb5f95fe65016fce96c75aee18c762a30f2 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -746,9 +746,12 @@ static bool has_pid_permissions(struct proc_fs_info *fs_info,
struct task_struct *task,
enum proc_hidepid hide_pid_min)
{
+ const struct cred *cred = current_cred(), *tcred;
+ kuid_t caller_uid;
+ kgid_t caller_gid;
/*
- * If 'hidpid' mount option is set force a ptrace check,
- * we indicate that we are using a filesystem syscall
+ * If 'hidepid=ptraceable' mount option is set, force a ptrace check.
+ * We indicate that we are using a filesystem syscall
* by passing PTRACE_MODE_READ_FSCREDS
*/
if (fs_info->hide_pid == HIDEPID_NOT_PTRACEABLE)
@@ -758,7 +761,25 @@ static bool has_pid_permissions(struct proc_fs_info *fs_info,
return true;
if (in_group_p(fs_info->pid_gid))
return true;
- return ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
+
+ task_lock(task);
+ rcu_read_lock();
+ caller_uid = cred->fsuid;
+ caller_gid = cred->fsgid;
+ tcred = __task_cred(task);
+ if (uid_eq(caller_uid, tcred->euid) &&
+ uid_eq(caller_uid, tcred->suid) &&
+ uid_eq(caller_uid, tcred->uid) &&
+ gid_eq(caller_gid, tcred->egid) &&
+ gid_eq(caller_gid, tcred->sgid) &&
+ gid_eq(caller_gid, tcred->gid)) {
+ rcu_read_unlock();
+ task_unlock(task);
+ return true;
+ }
+ rcu_read_unlock();
+ task_unlock(task);
+ return false;
}
---
base-commit: 884a80cc9208ce75831b2376f2b0464018d7f2c4
change-id: 20250718-hidepid_fix-d0743d0540e7
Best regards,
--
Nicolas Bouchinet <nicolas.bouchinet@xxxxxxxxxxx>
