1

I want to change the pagemap file permission to 755 or 744 using sudo chmod. But the command is throwing error saying operation not permitted. The motivation is to allow a user read the pagemap file (of its own) without giving sudo access.

When the user have sudo access it is working, he allowed to read pagemap file. But I want to prevent the user to have sudo access, but should allow him to read this pagemap file alone.

2

The Linux kernel requires sudo for /proc/<pid>/pagemap since 4.0

This is documented at: https://github.com/torvalds/linux/blob/v4.9/Documentation/vm/pagemap.txt

   Since Linux 4.0 only users with the CAP_SYS_ADMIN capability can get PFNs.
   In 4.0 and 4.1 opens by unprivileged fail with -EPERM.  Starting from
   4.2 the PFN field is zeroed if the user does not have CAP_SYS_ADMIN.
   Reason: information about PFNs helps in exploiting Rowhammer vulnerability.

Where CAP_SYS_ADMIN basically means "run as sudo", or alternatively:

sudo setcap cap_sys_admin+ep program_that_uses_pagemap
./program_that_uses_pagemap

Keep in mind that /proc is a virtual filesystem, and so the Linux kernel can choose to enforce additional permissions or even alter results arbitrarily for non root as it does here for security reasons by setting PFNs to zero.

  • I think you should change that to "requires CAP_SYS_ADMIN" or "requires root-like privileges". Nothing requires "sudo", ever. – mosvy Jun 14 at 16:51
  • @mosvy thanks for suggestion, isn't basically that "basically means "run as sudo"" means? Doesn't sudo "give root for a command"? I'm not an expert, so maybe there is some further ambiguity I don't see, but this felt like a reasonable analogy for newbies, and CAP_SYS_ADMIN is already mentioned too :-) – Ciro Santilli 新疆改造中心996ICU六四事件 Jun 14 at 17:13
  • Newbies shouldn't even know that a thing called "sudo" ever existed. But don't take this too hard, I don't really care one way or another. – mosvy Jun 14 at 17:25
0

you can try changing the permissions in the /etc/init/mounted-proc.conf file:

script
    chmod 0444 "${MOUNTPOINT}"/self/pagemap
end script

proc is a virtual filesystem generated by the kernel. If you can not change the permission it is not allowed by your kernel and you can only solve it by changing kernel.

  • This is absurd. /proc/self refers to the current process; your proposed script attempts to change the permission of the pagemap file in the chmod process just before that process exits. Even if it was possible, which it isn't, this wouldn't accomplish anything. – Gilles Feb 18 '17 at 23:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.