[PATCH v4 2/5] pid: Add PIDFD_IOCTL_GETFD to fetch file descriptors from processes
Andy Lutomirski
luto at kernel.org
Fri Dec 20 01:43:17 UTC 2019
On Wed, Dec 18, 2019 at 3:55 PM Sargun Dhillon <sargun at sargun.me> wrote:
>
> +
> + if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) {
> + file = ERR_PTR(-EPERM);
> + goto out;
> + }
I don't think this is MODE_READ. By copying an fd from the task, you
can easily change its state.
IMO it would be really nice if pidfd could act more like a capability
here and carry a ptrace mode, for example. But I guess it doesn't
right now.
--Andy
More information about the Containers
mailing list