From: David Rientjes <rientjes@google.com>
To: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
Vlastimil Babka <vbabka@suse.cz>,
Liam Howlett <liam.howlett@oracle.com>,
Shakeel Butt <shakeelb@google.com>,
Suren Baghdasaryan <surenb@google.com>
Subject: Re: [PATCH] mm/madvise: process_madvise() drop capability check if same mm
Date: Sun, 15 Sep 2024 00:50:10 -0700 (PDT) [thread overview]
Message-ID: <5db5f367-9efd-7a9b-07dc-efb06669b260@google.com> (raw)
In-Reply-To: <20240913140628.77047-1-lorenzo.stoakes@oracle.com>
On Fri, 13 Sep 2024, Lorenzo Stoakes wrote:
> In commit 96cfe2c0fd23 ("mm/madvise: replace ptrace attach requirement for
> process_madvise") process_madvise() was updated to require the caller to
> possess the CAP_SYS_NICE capability to perform the operation, in addition
> to a check against PTRACE_MODE_READ performed by mm_access().
>
> The mm_access() function explicitly checks to see if the address space of
> the process being referenced is the current one, in which case no check is
> performed.
>
> We, however, do not do this when checking the CAP_SYS_NICE capability. This
> means that we insist on the caller possessing this capability in order to
> perform madvise() operations on its own address space, which seems
> nonsensical.
>
> Simply add a check to allow for an invocation of this function with pidfd
> set to the current process without elevation.
>
> Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Acked-by: David Rientjes <rientjes@google.com>
prev parent reply other threads:[~2024-09-15 7:50 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-13 14:06 Lorenzo Stoakes
2024-09-13 14:31 ` Liam R. Howlett
2024-09-13 14:35 ` Liam R. Howlett
2024-09-13 14:51 ` Vlastimil Babka
2024-09-13 15:56 ` Shakeel Butt
2024-09-15 7:50 ` David Rientjes [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5db5f367-9efd-7a9b-07dc-efb06669b260@google.com \
--to=rientjes@google.com \
--cc=akpm@linux-foundation.org \
--cc=liam.howlett@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=lorenzo.stoakes@oracle.com \
--cc=shakeelb@google.com \
--cc=surenb@google.com \
--cc=vbabka@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox