From cagney@tpgi.com.au  Tue Sep  8 00:05:56 1998
Received: from andrew1.lnk.telstra.net (andrew1.lnk.telstra.net [139.130.51.121])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id AAA12817
          for <FreeBSD-gnats-submit@freebsd.org>; Tue, 8 Sep 1998 00:05:53 -0700 (PDT)
          (envelope-from cagney@tpgi.com.au)
Received: (from cagney@localhost) by andrew1.lnk.telstra.net (8.8.8/8.7.3) id RAA10643; Tue, 8 Sep 1998 17:05:47 +1000 (EST)
Message-Id: <199809080705.RAA10643@andrew1.lnk.telstra.net>
Date: Tue, 8 Sep 1998 17:05:47 +1000 (EST)
From: Andrew Cagney <cagney@tpgi.com.au>
Reply-To: cagney@tpgi.com.au
To: FreeBSD-gnats-submit@freebsd.org, cagney@andrew1.lnk.telstra.net
Subject: GDB (ptrace?) can touch almost any executable
X-Send-Pr-Version: 3.2

>Number:         7858
>Category:       kern
>Synopsis:       GDB (ptrace?) can touch almost any executable
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Sep  8 00:10:00 PDT 1998
>Closed-Date:    Mon Sep 21 18:34:07 PDT 1998
>Last-Modified:  Mon Sep 21 18:35:02 PDT 1998
>Originator:     Andrew Cagney
>Release:        FreeBSD 2.2.7-RELEASE i386
>Organization:
Un-organized
>Environment:

FreeBSD b1.cygnus.com 2.2.7-RELEASE FreeBSD 2.2.7-RELEASE #0: Fri Sep  4 16:47:02 EST 1998     cagney@b1.cygnus.com:/usr/src/sys/compile/B2  i386
Kernel is almost vanila (but that is probably what they all say :-).	

>Description:

	GDB can be used to change the modify/creation dates of files
	the user doesn't own.

	Suspect PTRACE security hole.

>How-To-Repeat:

Exibit 1:

	cagney@b1.cygnus.com$ cat ../devo/gdb/testsuite/gdb.base/reread2.c 

	#include <stdio.h>

	int x;

	void foo()
	{
	  x++;
	  printf("This is foo\n");
	}

	int main()
	{
	#ifdef usestubs
	  set_debug_traps ();
	  breakpoint ();
	#endif
	  foo();
	  return 0;
	}

Compile exibit 1 with:

	cagney@b1.cygnus.com$ sudo gcc -g -o reread ../devo/gdb/testsuite/gdb.base/reread2.c 
	Password:
	cagney@b1.cygnus.com$ ls -ldg reread
	-rwxr-xr-x  1 root  wheel  11710 Sep  8 16:46 reread
	cagney@b1.cygnus.com$ whoami
	cagney
	cagney@b1.cygnus.com$ groups
	wheel network people
	cagney@b1.cygnus.com$ 


Check the files date:

	cagney@b1.cygnus.com$ date ; /bin/ls -lT reread
	Tue Sep  8 16:54:03 EST 1998
	-rwxr-xr-x  1 root  wheel  11710 Sep  8 16:52:57 1998 reread


Run GDB vis:

	cagney@b1.cygnus.com$ /usr/bin/gdb ./reread 
	...
	GDB 4.16 (i386-unknown-freebsd), 
	Copyright 1996 Free Software Foundation, Inc...
	(gdb) run
	Starting program: /home/scratch/freebsd-gdb/./reread 
	This is foo

	Program exited normally.
	(gdb) 


Check the dates again:

	cagney@b1.cygnus.com$ date ; /bin/ls -lT reread
	Tue Sep  8 16:55:11 EST 1998
	-rwxr-xr-x  1 root  wheel  11710 Sep  8 16:52:57 1998 reread

Until eventually (~30 seconds?).

	cagney@b1.cygnus.com$ date ; /bin/ls -lT reread
	Tue Sep  8 16:55:28 EST 1998
	-rwxr-xr-x  1 root  wheel  11710 Sep  8 16:55:27 1998 reread

shows up....


>Fix:
	
	Good question!

		have fun, Andrew
>Release-Note:
>Audit-Trail:

From: Niall Smart <rotel@indigo.ie>
To: cagney@tpgi.com.au, FreeBSD-gnats-submit@FreeBSD.ORG,
        cagney@andrew1.lnk.telstra.net
Cc:  Subject: Re: kern/7858: GDB (ptrace?) can touch almost any executable
Date: Tue, 15 Sep 1998 22:55:07 +0000

 On Sep 8,  5:05pm, Andrew Cagney wrote:
 } Subject: kern/7858: GDB (ptrace?) can touch almost any executable
 > 
 > 	GDB can be used to change the modify/creation dates of files
 > 	the user doesn't own.
 > 
 > 	Suspect PTRACE security hole.
 
 I wouldn't call this a security hole, in fact it looks very like
 the bug that randomly changes the modification dates of files.
 
 > 
 > Check the files date:
 > 
 > 	cagney@b1.cygnus.com$ date ; /bin/ls -lT reread
 > 	Tue Sep  8 16:54:03 EST 1998
 > 	-rwxr-xr-x  1 root  wheel  11710 Sep  8 16:52:57 1998 reread
 
 
 > Run GDB vis:
 > 
 > 	cagney@b1.cygnus.com$ /usr/bin/gdb ./reread 
 
 
 > 
 > Until eventually (~30 seconds?).
 > 
 > 	cagney@b1.cygnus.com$ date ; /bin/ls -lT reread
 > 	Tue Sep  8 16:55:28 EST 1998
 > 	-rwxr-xr-x  1 root  wheel  11710 Sep  8 16:55:27 1998 reread
 > 
 > shows up....
 
 Ring any bells for anyone?  A solution to this might fix that
 other bug.
 
 Niall
 
 -- 
 Niall Smart, rotel@indigo.ie.
 Amaze your friends and annoy your enemies:
 echo '#define if(x) if (!(x))' >> /usr/include/stdio.h
State-Changed-From-To: open->closed 
State-Changed-By: jdp 
State-Changed-When: Mon Sep 21 18:34:07 PDT 1998 
State-Changed-Why:  
Fixed in 2.2-stable by revision 1.20.2.2 of procfs_mem.c and related   
changes to several other files. 
Note, this is the same as PR kern/3475, which I have also closed. 
>Unformatted:
