4

As a non-root user I am running a process. The process binary has been given a cap_sys_resource capability. Even though the process is owned by the same user, that user cannot read its /proc//fd directory. The permissions in /proc/pid look like this:

dr-xr-xr-x.   9 ec2-user ec2-user 0 May 12 01:03 .
dr-xr-xr-x. 249 root     root     0 Apr  3 13:34 ..
dr-xr-xr-x.   2 ec2-user ec2-user 0 May 12 01:03 attr
-rw-r--r--.   1 root     root     0 May 12 01:04 autogroup
-r--------.   1 root     root     0 May 12 01:03 auxv
-r--r--r--.   1 root     root     0 May 12 01:04 cgroup
--w-------.   1 root     root     0 May 12 01:04 clear_refs
-r--r--r--.   1 root     root     0 May 12 01:03 cmdline
-rw-r--r--.   1 root     root     0 May 12 01:04 comm
-rw-r--r--.   1 root     root     0 May 12 01:04 coredump_filter
-r--r--r--.   1 root     root     0 May 12 01:04 cpuset
lrwxrwxrwx.   1 root     root     0 May 12 01:04 cwd
-r--------.   1 root     root     0 May 12 01:04 environ
lrwxrwxrwx.   1 root     root     0 May 12 01:04 exe
dr-x------.   2 root     root     0 May 12 01:03 fd
dr-x------.   2 root     root     0 May 12 01:04 fdinfo
-rw-r--r--.   1 root     root     0 May 12 01:04 gid_map
-r--------.   1 root     root     0 May 12 01:04 io
-r--r--r--.   1 root     root     0 May 12 01:04 limits
-rw-r--r--.   1 root     root     0 May 12 01:04 loginuid
dr-x------.   2 root     root     0 May 12 01:04 map_files
-r--r--r--.   1 root     root     0 May 12 01:04 maps
-rw-------.   1 root     root     0 May 12 01:04 mem
-r--r--r--.   1 root     root     0 May 12 01:04 mountinfo
-r--r--r--.   1 root     root     0 May 12 01:04 mounts
-r--------.   1 root     root     0 May 12 01:04 mountstats
dr-xr-xr-x.   5 ec2-user ec2-user 0 May 12 01:04 net
dr-x--x--x.   2 root     root     0 May 12 01:03 ns
-r--r--r--.   1 root     root     0 May 12 01:04 numa_maps
-rw-r--r--.   1 root     root     0 May 12 01:04 oom_adj
-r--r--r--.   1 root     root     0 May 12 01:04 oom_score
-rw-r--r--.   1 root     root     0 May 12 01:04 oom_score_adj
-r--r--r--.   1 root     root     0 May 12 01:04 pagemap
-r--r--r--.   1 root     root     0 May 12 01:04 personality
-rw-r--r--.   1 root     root     0 May 12 01:04 projid_map
lrwxrwxrwx.   1 root     root     0 May 12 01:04 root
-rw-r--r--.   1 root     root     0 May 12 01:04 sched
-r--r--r--.   1 root     root     0 May 12 01:04 schedstat
-r--r--r--.   1 root     root     0 May 12 01:04 sessionid
-rw-r--r--.   1 root     root     0 May 12 01:04 setgroups
-r--r--r--.   1 root     root     0 May 12 01:04 smaps
-r--r--r--.   1 root     root     0 May 12 01:04 stack
-r--r--r--.   1 root     root     0 May 12 01:03 stat
-r--r--r--.   1 root     root     0 May 12 01:03 statm
-r--r--r--.   1 root     root     0 May 12 01:03 status
-r--r--r--.   1 root     root     0 May 12 01:04 syscall
dr-xr-xr-x.   3 ec2-user ec2-user 0 May 12 01:03 task
-r--r--r--.   1 root     root     0 May 12 01:04 timers
-rw-r--r--.   1 root     root     0 May 12 01:04 uid_map
-r--r--r--.   1 root     root     0 May 12 01:04 wchan

Is there a way to read the /proc//fd directory without using the root user?

  • I see this in 3.10.0-514.10.2.el7.x86_64 kernel. My actual use case is in a docker container. However I can see the same behavior in a host OS with the same kernel too. – Hakan Baba May 12 '17 at 5:18
  • In addition to cap_sys_resource I can see the same behavior if the process has cap_net_bind_service capability. – Hakan Baba May 12 '17 at 5:24
  • If both capabilities are removed from the process, all files in /proc/<pid> are owned by the ec2-user and the fd directory can be read. – Hakan Baba May 12 '17 at 5:25
3

Real root should be able to do it. I think you need to be more specific about who is trying to read /proc/pid/fd/ if you want us to suggest a more specific solution!

Note that in the contained case, root might be missing some of it's usual capabilities, which allow it to bypass permissions checks.

http://man7.org/linux/man-pages/man5/proc.5.html

Permission to dereference or read (readlink(2)) the symbolic links in this directory is governed by a ptrace access mode PTRACE_MODE_READ_FSCREDS check; see ptrace(2).

http://man7.org/linux/man-pages/man2/ptrace.2.html

Deny access if the target process "dumpable" attribute has a value other than 1 (SUID_DUMP_USER; see the discussion of PR_SET_DUMPABLE in prctl(2)), and the caller does not have the CAP_SYS_PTRACE capability in the user namespace of the target process.

http://man7.org/linux/man-pages/man2/prctl.2.html

PR_SET_DUMPABLE (since Linux 2.3.20) Set the state of the "dumpable" flag, which determines whether core dumps are produced for the calling process upon delivery of a signal whose default behavior is to produce a core dump. In kernels up to and including 2.6.12, arg2 must be either 0 (SUID_DUMP_DISABLE, process is not dumpable) or 1 (SUID_DUMP_USER, process is dumpable). Between kernels 2.6.13 and 2.6.17, the value 2 was also permitted, which caused any binary which normally would not be dumped to be dumped readable by root only; for security reasons, this feature has been removed. (See also the description of /proc/sys/fs/ suid_dumpable in proc(5).) Normally, this flag is set to 1. However, it is reset to the current value contained in the file /proc/sys/fs/suid_dumpable (which by default has the value 0), in the following circumstances:

  • The process's effective user or group ID is changed.

  • The process's filesystem user or group ID is changed (see credentials(7)).

  • The process executes (execve(2)) a set-user-ID or set- group-ID program, resulting in a change of either the effective user ID or the effective group ID.

  • The process executes (execve(2)) a program that has file capabilities (see capabilities(7)), but only if the permitted capabilities gained exceed those already permitted for the process.

  • Let me update the question. Same user is trying to read the /proc/pid/fd. Not root. – Hakan Baba May 12 '17 at 16:46
  • @HakanBaba sorry, I wasn't clear. The permission check is simply not going to pass unless you have some elevated privilege (capability). If your question is to solve this without granting all privileges... I don't have a strong grasp of capabilities, so I guess I mean it would be easier to find a working solution if e.g. I could see some specific code to reshape. More than that, if it showed why the code wanted this specific access, it might help show the best way to achieve the ultimate goal, which is currently mysterious. (Short version: "why can't you use root?") – sourcejedi May 12 '17 at 17:59
  • @HakanBaba or more rudely: if you look at the documentation I quoted, it gives very specific conditions. root is not essential. Which part of the docs do you find unclear? – sourcejedi May 12 '17 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.