Erm... Firstly:
int ptrace_attach(struct task_struct *task)
{
...
if (capable(CAP_SYS_PTRACE))
task->ptrace |= PT_PTRACE_CAP;
...
}
Then:
static int unsafe_exec(struct task_struct *p)
{
int unsafe = 0;
if (p->ptrace & PT_PTRACED) {
if (p->ptrace & PT_PTRACE_CAP)
unsafe |= LSM_UNSAFE_PTRACE_CAP;
else
unsafe |= LSM_UNSAFE_PTRACE;
}
if (atomic_read(&p->fs->count) > 1 ||
atomic_read(&p->files->count) > 1 ||
atomic_read(&p->sighand->count) > 1)
unsafe |= LSM_UNSAFE_SHARE;
return unsafe;
}
So LSM_UNSAFE_PTRACE_CAP will only be set if the tracer _does_ have
CAP_SYS_PTRACE. That will be irrelevant, however, if any of fs, files or
sighand are shared.
And finally:
void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
{
...
if (bprm->e_uid != current->uid ||
bprm->e_gid != current->gid ||
!cap_issubset (new_permitted, current->cap_permitted)) {
...
if (unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
if (!capable(CAP_SETUID)) {
bprm->e_uid = current->uid;
bprm->e_gid = current->gid;
}
if (!capable (CAP_SETPCAP)) {
new_permitted = cap_intersect(
new_permitted,
current->cap_permitted);
}
}
...
}
So if it's a 'set-privilege' binary, then if the tracer _doesn't_ have
CAP_SYS_PTRACE, we look at downgrading the privileges of the process.
Without Andrew's patch, we only downgrade the capabilities if we don't have
CAP_SETPCAP (and aren't sharing inheritables).
With Andrew's patch, capabilities are downgraded regardless of whether we have
CAP_SETPCAP or not. I guess that means that if you're tracing a binary whose
filecaps say that it wants CAP_SETPCAP, then it retains CAP_SETPCAP.
I wonder if the tracing task should be examined here, and any capability the
tracer isn't permitted should be denied the process doing the exec.
Anyway, in my commoncap.c prettification patch, I've dressed the limiter
function up as ...
