diff options
| author | Jann Horn <jannh@google.com> | 2026-09-07 23:00:18 +0200 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-09-10 09:48:17 +0200 |
| commit | 5dac8c291d9b7cdcd433cfcd8300ebf79e4a9177 (patch) | |
| tree | 5301e571b05acb50893fd0302a6225b7540b0114 /tools/lib/python | |
| parent | 9f90f96af73d5fd2dee0a0459a89ac467f3ecf5e (diff) | |
| download | linux-next-5dac8c291d9b7cdcd433cfcd8300ebf79e4a9177.tar.gz linux-next-5dac8c291d9b7cdcd433cfcd8300ebf79e4a9177.zip | |
selinux: require PROCESS__PTRACE for FOLL_FORCE introspection
On systems configured with PROC_MEM_FORCE_ALWAYS, ensure that a process can
only create anonymous executable memory via /proc/self/mem if it has
PROCESS__PTRACE (like when using /proc/$pid/mem of another process).
This closes a hole in code integrity enforcement that Project Zero has used
in a remote Android exploit chain:
It was possible to use a memory corruption bug in a service without
EXECMEM/EXECMOD/PTRACE permission to overwrite executable code via
/proc/self/mem, which made it possible to load and run shellcode containing
a kernel exploit.
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Jann Horn <jannh@google.com>
Link: https://patch.msgid.link/20260907-selinux-pokemem-v3-3-0bafbaeafe50@google.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions