)]}'
{
  "commit": "6210ced85099de2a94dafcf9f6bc0b2fcdcbbfdc",
  "tree": "3e1c172b8f88bf24a71f3553f9c65998cb994e1d",
  "parents": [
    "da358e264cbed0240debe37fa6867c81f0748bf8"
  ],
  "author": {
    "name": "Jann Horn",
    "email": "jannh@google.com",
    "time": "Sat Mar 19 02:08:37 2022 +0100"
  },
  "committer": {
    "name": "Lee Jones",
    "email": "lee.jones@linaro.org",
    "time": "Wed Jun 29 15:04:37 2022 +0100"
  },
  "message": "BACKPORT: ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE\n\ncommit ee1fee900537b5d9560e9f937402de5ddc8412f3 upstream.\n\nSetting PTRACE_O_SUSPEND_SECCOMP is supposed to be a highly privileged\noperation because it allows the tracee to completely bypass all seccomp\nfilters on kernels with CONFIG_CHECKPOINT_RESTORE\u003dy. It is only supposed to\nbe settable by a process with global CAP_SYS_ADMIN, and only if that\nprocess is not subject to any seccomp filters at all.\n\nHowever, while these permission checks were done on the PTRACE_SETOPTIONS\npath, they were missing on the PTRACE_SEIZE path, which also sets\nuser-specified ptrace flags.\n\nMove the permissions checks out into a helper function and let both\nptrace_attach() and ptrace_setoptions() call it.\n\nBug: 233438137\nCc: stable@kernel.org\nFixes: 13c4a90119d2 (\"seccomp: add ptrace options for suspend/resume\")\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nLink: https://lkml.kernel.org/r/20220319010838.1386861-1-jannh@google.com\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Lee Jones \u003clee.jones@linaro.org\u003e\nChange-Id: Ic2f98b220f24ff2f27b1d4aadd5c6d6dca2678ed\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "eb4d04cb3aaf55914befc3a346ef7411b452ee4a",
      "old_mode": 33188,
      "old_path": "kernel/ptrace.c",
      "new_id": "d99f73f83bf5fbcaf80c2832fc9bdb10dc9b77b9",
      "new_mode": 33188,
      "new_path": "kernel/ptrace.c"
    }
  ]
}