)]}'
{
  "commit": "18245f66be8e793f5794e822ebaca4406d1a101b",
  "tree": "45fa99d2264b57252a9446b6c3d9bf8b55bf453e",
  "parents": [
    "574f840e6ccdee675fe222e22457dfef742d870d"
  ],
  "author": {
    "name": "Jann Horn",
    "email": "jannh@google.com",
    "time": "Sat Mar 19 02:08:37 2022 +0100"
  },
  "committer": {
    "name": "Michael Kochera",
    "email": "kochera@google.com",
    "time": "Wed Jun 01 05:39:04 2022 +0000"
  },
  "message": "ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE\n\ncommit ee1fee900537b5d9560e9f937402de5ddc8412f3 upstream.\n\nSetting PTRACE_O_SUSPEND_SECCOMP is supposed to be a highly privileged\noperation because it allows the tracee to completely bypass all seccomp\nfilters on kernels with CONFIG_CHECKPOINT_RESTORE\u003dy. It is only supposed to\nbe settable by a process with global CAP_SYS_ADMIN, and only if that\nprocess is not subject to any seccomp filters at all.\n\nHowever, while these permission checks were done on the PTRACE_SETOPTIONS\npath, they were missing on the PTRACE_SEIZE path, which also sets\nuser-specified ptrace flags.\n\nMove the permissions checks out into a helper function and let both\nptrace_attach() and ptrace_setoptions() call it.\n\nBUG\u003db/233870285\nTEST\u003dhttp://sponge2/db194c9d-10fa-4607-ba16-463f1323fe66\nRELEASE_NOTE\u003dFixed CVE-2022-30594 in Linux Kernel\nSOURCE\u003dUPSTREAM(ee1fee900537b5d9560e9f937402de5ddc8412f3)\n\ncos-patch: security-moderate\nCc: stable@kernel.org\nFixes: 13c4a90119d2 (\"seccomp: add ptrace options for suspend/resume\")\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nLink: https://lkml.kernel.org/r/20220319010838.1386861-1-jannh@google.com\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nChange-Id: Ifadfb7aa605e33f783ff99c29d2e374d8f38f45e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/33306\nReviewed-by: Vaibhav Rustagi \u003cvaibhavrustagi@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "eb4d04cb3aaf55914befc3a346ef7411b452ee4a",
      "old_mode": 33188,
      "old_path": "kernel/ptrace.c",
      "new_id": "d99f73f83bf5fbcaf80c2832fc9bdb10dc9b77b9",
      "new_mode": 33188,
      "new_path": "kernel/ptrace.c"
    }
  ]
}