Yama PR_SET_PTRACER_ANY fails on 32-bit user with 64-bit kernel

[Kees Cook]

This is an old bug that looks like the fix missed Precise since Yama was backported there. Yama was introduced in 3.4, but Precise is 3.2 with Yama backported. The upstream fix for this bug is missing, which can cause problems when a Yama-aware program is running in 32-bit userspace (e.g. chroot) on a 64-bit kernel.

Fixed upstream by 2e4930eb7c8fb20a39dfb5f8a8f80402710dcea8

SRU Justification:
- impact: Yama programs running in 32-bit chroots will fail to work correctly
- test case: prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY, ...) shouldn't return EINVAL on 32-bit userspace
- regression potential: nearly zero. this restores a missing function, and the patch is trivial and upstream for years.

[Kees Cook (kees)]

Test-case:

sudo apt-get install gcc-multilib
gcc -Wall yama-test.c -m32 -o yama-test
./yama-test

This should return 0 and report "ok", but on precise, it fails.

[Kees Cook (kees)]

Patch sent to kernel-team list:
https://lists.ubuntu.com/archives/kernel-team/2014-July/045729.html

[Brad Figg (brad-figg)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-precise' to 'verification-done-precise'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Kees Cook (kees)]

Works for me, thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-68.102

---------------
linux (3.2.0-68.102) precise; urgency=low

  [ Joseph Salisbury ]

  * Release Tracking Bug
    - LP: #1355387

  [ Joseph Salisbury ]

  * [Config] updateconfigs after Linux 3.2.62 update

  [ Upstream Kernel Changes ]

  * Revert "net: ipv4: ip_forward: fix inverted local_df test"
    - LP: #1337281
  * Revert "net: ip, ipv6: handle gso skbs in forwarding path"
    - LP: #1337281
  * Yama: handle 32-bit userspace prctl
    - LP: #1338883
  * mm: highmem: don't treat PKMAP_ADDR(LAST_PKMAP) as a highmem address
    - LP: #1348572
  * bluetooth: hci_ldisc: fix deadlock condition
    - LP: #1348572
  * genirq: Sanitize spurious interrupt detection of threaded irqs
    - LP: #1348572
  * UBIFS: fix an mmap and fsync race condition
    - LP: #1348572
  * Input: synaptics - add min/max quirk for the ThinkPad W540
    - LP: #1348572
  * ACPI: Fix conflict between customized DSDT and DSDT local copy
    - LP: #1348572
  * HID: core: fix validation of report id 0
    - LP: #1348572
  * IB/srp: Fix a sporadic crash triggered by cable pulling
    - LP: #1348572
  * reiserfs: drop vmtruncate
    - LP: #1348572
  * reiserfs: call truncate_setsize under tailpack mutex
    - LP: #1348572
  * ARM: imx: fix error handling in ipu device registration
    - LP: #1348572
  * matroxfb: perform a dummy read of M_STATUS
    - LP: #1348572
  * USB: Avoid runtime suspend loops for HCDs that can't handle
    suspend/resume
    - LP: #1348572
  * ARM: 8051/1: put_user: fix possible data corruption in put_user
    - LP: #1348572
  * Input: synaptics - T540p - unify with other LEN0034 models
    - LP: #1348572
  * mac80211: fix IBSS join by initializing last_scan_completed
    - LP: #1348572
  * drm/i915: s/DRM_ERROR/DRM_DEBUG in i915_gem_execbuffer.c
    - LP: #1348572
  * drm/i915: Only copy back the modified fields to userspace from
    execbuffer
    - LP: #1348572
  * ahci: add PCI ID for Marvell 88SE91A0 SATA Controller
    - LP: #1348572
  * ext4: fix zeroing of page during writeback
    - LP: #1348572
  * ext4: fix wrong assert in ext4_mb_normalize_request()
    - LP: #1348572
  * IB/qib: Fix port in pkey change event
    - LP: #1348572
  * IB/ipath: Translate legacy diagpkt into newer extended diagpkt
    - LP: #1348572
  * USB: sierra: fix AA deadlock in open error path
    - LP: #1348572
  * USB: sierra: fix urb and memory leak in resume error path
    - LP: #1348572
  * USB: sierra: fix urb and memory leak on disconnect
    - LP: #1348572
  * USB: sierra: fix remote wakeup
    - LP: #1348572
  * USB: option: fix runtime PM handling
    - LP: #1348572
  * USB: usb_wwan: fix urb leak in write error path
    - LP: #1348572
  * USB: usb_wwan: fix race between write and resume
    - LP: #1348572
  * USB: usb_wwan: fix write and suspend race
    - LP: #1348572
  * USB: usb_wwan: fix urb leak at shutdown
    - LP: #1348572
  * USB: usb_wwan: fix potential blocked I/O after resume
    - LP: #1348572
  * USB: cdc-acm: fix write and suspend race
    - LP: #1348572
  * USB: cdc-acm: fix write and resume race
    - LP: #1348572
  * USB: cdc-acm: fix broken runtime suspend
    - LP: #1348572
  * USB: ...