[PATCH] proc: Track /proc/$pid/attr/ opener mm_struct

Kees Cook keescook at chromium.org
Mon Jun 14 22:50:50 UTC 2021

On Tue, Jun 15, 2021 at 02:46:19AM +0800, youling 257 wrote:
> I test this patch cause "init: cannot setexeccon(u:r:ueventd:s0)
> operation not permitted.
> init ctrl_write_limited.

Thanks for testing!

This appears to come from here:

In setexeccon(), I see (pid=0, attr="exec"):

        fd = openattr(pid, attr, O_RDWR | O_CLOEXEC);
                        ret = write(fd, context2, strlen(context2) + 1);

and openattr() is doing:
                rc = asprintf(&path, "/proc/thread-self/attr/%s", attr);
                if (rc < 0)
                        return -1;
                fd = open(path, flags | O_CLOEXEC);

I'm not sure how the above could fail. (mm_access() always allows

The only way I can understand the check failing is if a process did:

open, exec, write

But setexeccon() is not doing anything between the open and the write...

I will keep looking...


Kees Cook

More information about the Linux-security-module-archive mailing list