proc_rwmem check PRIV_PROC_MEM_WRITE when writing

[sjg]

Summary

This will fail when mac_veriexec is enforced.

Move the check from procfs_doprocmem to proc_rwmem to ensure all
cases are covered.

Sponsored by: Juniper Networks, Inc.

[olce]

proc_rwmem() is also called by ptrace() and cuse(4). I can imagine you also want to prevent process tampering via ptrace(), but what about cuse(4), and more generally other potential uses where data transfers are performed by proc_rwmem()?

If this is a concern, an alternative would be to add a check of PRIV_PROC_MEM_WRITE directly in kern_ptrace().

sys/sys/priv.h

518

[markj]

In D47484#1082949, @olce wrote:

proc_rwmem() is also called by ptrace() and cuse(4). I can imagine you also want to prevent process tampering via ptrace(), but what about cuse(4), and more generally other potential uses where data transfers are performed by proc_rwmem()?

If this is a concern, an alternative would be to add a check of PRIV_PROC_MEM_WRITE directly in kern_ptrace().

The point is to disallow arbitrary modifications of process memory. kern_ptrace() is not the only interface which permits this, proc_rwmem() can be reached via dtrace as well. veriexec has ways to exempt executables from this restriction, e.g., so that one can use gdb. I think executables which operate a cuse server would require similar handling, and that's probably acceptable.

[olce]

In D47484#1082989, @markj wrote:

The point is to disallow arbitrary modifications of process memory. kern_ptrace() is not the only interface which permits this, proc_rwmem() can be reached via dtrace as well. veriexec has ways to exempt executables from this restriction, e.g., so that one can use gdb.

Yes, I agree (and am already aware).

I think executables which operate a cuse server would require similar handling, and that's probably acceptable.

That I wasn't sure of, by lack of cuse knowledge, thanks for sharing this info. It seems to me that if proc_rwmem() is used to send data to another process that explicitly requested it and if cuse enforces that the data can only be sent to the requested addresses (out of the control of the sending server process), then that send should be accepted regardless of PRIV_PROC_MEM_WRITE. But I don't know if it's the case, and even if it is I agree it doesn't matter at first order.