__ptrace_may_access() picks the filesystem or the real uid and gid of the caller by its mode and wants them to be all three of the uids and gids of the target. Say which ids it is and use the library. No functional change. Signed-off-by: Josef Bacik --- kernel/ptrace.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/kernel/ptrace.c b/kernel/ptrace.c index 3f2fe68ccb14..8024d80f82e3 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -305,8 +305,7 @@ static bool task_still_dumpable(struct task_struct *task, unsigned int mode) static int __ptrace_may_access(struct task_struct *task, unsigned int mode) { const struct cred *cred = current_cred(), *tcred; - kuid_t caller_uid; - kgid_t caller_gid; + enum cred_ids caller_ids; if (!(mode & PTRACE_MODE_FSCREDS) == !(mode & PTRACE_MODE_REALCREDS)) { WARN(1, "denying ptrace access check without PTRACE_MODE_*CREDS\n"); @@ -327,8 +326,7 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) return 0; rcu_read_lock(); if (mode & PTRACE_MODE_FSCREDS) { - caller_uid = cred->fsuid; - caller_gid = cred->fsgid; + caller_ids = CRED_IDS_FS; } else { /* * Using the euid would make more sense here, but something @@ -338,16 +336,10 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) * used a syscall that requests access to another process * (and not a filesystem syscall to procfs). */ - caller_uid = cred->uid; - caller_gid = cred->gid; + caller_ids = CRED_IDS_REAL; } tcred = __task_cred(task); - if (uid_eq(caller_uid, tcred->euid) && - uid_eq(caller_uid, tcred->suid) && - uid_eq(caller_uid, tcred->uid) && - gid_eq(caller_gid, tcred->egid) && - gid_eq(caller_gid, tcred->sgid) && - gid_eq(caller_gid, tcred->gid)) + if (cred_ids_allow_control(cred, caller_ids, tcred)) goto ok; if (ptrace_has_cap(tcred->user_ns, mode)) goto ok; -- 2.55.0