ACK: [SRU][Bionic][PATCH 0/1] Fix ptrace read check (LP: 1890848)

[Tim Gardner]

Acked-by: Tim Gardner <tim.gardner at canonical.com>

On 7/16/21 10:14 AM, Georgia Garcia wrote:
> BugLink: https://bugs.launchpad.net/bugs/1890848
> 
> SRU Justification:
> 
> [Impact]
> Permission 'ptrace trace' is required to readlink() /proc/*/ns/*, when
> only 'ptrace read' should be required according to 'man namespaces':
> 
> "Permission to dereference or read (readlink(2)) these symbolic links
> is governed by a ptrace access mode PTRACE_MODE_READ_FSCREDS check; see
> ptrace(2)."
> 
> [Fix]
> 
> Upstream commit 338d0be437ef10e247a35aed83dbab182cf406a2 fixes ptrace
> read check.
> 
> [Test Plan]
> 
> BugLink contains the source of a binary that reproduces the issue. In
> summary, it executes readlink() on /proc/*/ns/*. There's also a policy
> that has only 'ptrace read' permission. When the bug is fixed,
> execution is allowed.
> 
> [Where problems could occur]
> 
> The regression can be considered as low, since it's lowering the number
> of permissions required. Existing policies that already contain the
> permission 'ptrace trace' and 'ptrace read' will have a broader policy
> than required.
> 
> John Johansen (1):
>    apparmor: fix ptrace read check
> 
>   security/apparmor/lsm.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 

-- 
-----------
Tim Gardner
Canonical, Inc