[PATCH v5] proc: add config & param to block forcing mem writes

Anderson Cc: Jeff Xu Cc: Jann Horn Cc: Kees Cook Cc: Ard Biesheuvel Cc: Christian Brauner Suggested-by: Linus Torvalds Signed-off-by: Linus Torvalds Signed-off-by: Adrian Ratiu --- Changes in v5: * Wrapped task fields accesses in READ_ONCE() * Added all values to proc_mem_force_table[] and

Re: [PATCH v4] proc: add config & param to block forcing mem writes

On Wednesday, July 31, 2024 02:08 EEST, Jeff Xu wrote: > On Tue, Jul 30, 2024 at 6:25 AM Adrian Ratiu > wrote: > > > > This adds a Kconfig option and boot param to allow removing > > the FOLL_FORCE flag from /proc/pid/mem write calls because > > it can be a

Re: [PATCH v4] proc: add config & param to block forcing mem writes

On Wednesday, July 31, 2024 02:18 EEST, Linus Torvalds wrote: > On Tue, 30 Jul 2024 at 16:09, Jeff Xu wrote: > > > > > + task = get_proc_task(file_inode(file)); > > > + if (task) { > > > + ptrace_active = task->ptrace && task->mm == mm && > > >

[PATCH v4] proc: add config & param to block forcing mem writes

Anderson Cc: Jeff Xu Cc: Jann Horn Cc: Kees Cook Cc: Ard Biesheuvel Cc: Christian Brauner Suggested-by: Linus Torvalds Signed-off-by: Linus Torvalds Signed-off-by: Adrian Ratiu --- Changes in v4: * Fixed doc punctuation, used passive tense, improved wording consistency, fixed default value

Re: [PATCH v3] proc: add config & param to block forcing mem writes

On Friday, July 26, 2024 13:18 EEST, Ard Biesheuvel wrote: > On Fri, 26 Jul 2024 at 11:11, Adrian Ratiu wrote: > > > > This adds a Kconfig option and boot param to allow removing > > the FOLL_FORCE flag from /proc/pid/mem write calls because > > it can be abused. >

[PATCH v3] proc: add config & param to block forcing mem writes

Anderson Cc: Jeff Xu Cc: Jann Horn Cc: Kees Cook Cc: Christian Brauner Suggested-by: Linus Torvalds Signed-off-by: Linus Torvalds Signed-off-by: Adrian Ratiu --- Changes in v3: * Simplified code to use shorthand ifs and a lookup_constant() table. Changes in v2: * Added bootparam on top of

Re: [PATCH] proc: add config & param to block forcing mem writes

On Tuesday, July 23, 2024 21:30 EEST, Linus Torvalds wrote: > On Tue, 23 Jul 2024 at 10:18, Adrian Ratiu wrote: > > > > This adds a Kconfig option and boot param to allow removing > > the FOLL_FORCE flag from /proc/pid/mem write calls because > > it can be abused

[PATCH] proc: add config & param to block forcing mem writes

Anderson Cc: Jeff Xu Cc: Jann Horn Cc: Kees Cook Cc: Christian Brauner Suggested-by: Linus Torvalds Signed-off-by: Linus Torvalds Signed-off-by: Adrian Ratiu --- .../admin-guide/kernel-parameters.txt | 10 fs/proc/base.c| 58

Re: [PATCH] proc: add config to block FOLL_FORCE in mem writes

On Thursday, July 18, 2024 03:04 EEST, Linus Torvalds wrote: > On Wed, 17 Jul 2024 at 15:24, Kees Cook wrote: > > > > > In particular, this patch would make it easy to make that > > > SECURITY_PROC_MEM_RESTRICT_FOLL_FORCE config option be a "choice" > > > where you pick "never, ptrace, always"

[PATCH] proc: add config to block FOLL_FORCE in mem writes

: Linus Torvalds Signed-off-by: Adrian Ratiu --- fs/proc/base.c | 6 +- security/Kconfig | 14 ++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 72a1acd03675..53ad71d7d785 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -855,7

Re: [PATCH] proc: allow restricting /proc/pid/mem writes

Hello On Monday, February 26, 2024 21:24 EET, Kees Cook wrote: > [sorry for the duplicate, fixing Jann's email address] > > On Mon, Feb 26, 2024 at 09:10:54AM -0800, Doug Anderson wrote: > > Hi, > > > > On Wed, Feb 21, 2024 at 1:06 PM Adrian Ratiu > &g