From 6f0aa00c6be763a5e0d95fb8e55a19a080101cbd Mon Sep 17 00:00:00 2001
From: Augustin Cavalier <waddlesplash@gmail.com>
Date: Thu, 4 Jul 2019 16:50:17 -0400
Subject: [PATCH] kernel/user_debugger: Add missing permissions checks.

Part of #14961.
---
 src/system/kernel/debug/user_debugger.cpp | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/system/kernel/debug/user_debugger.cpp b/src/system/kernel/debug/user_debugger.cpp
index f541adb04b..d20b2102cc 100644
--- a/src/system/kernel/debug/user_debugger.cpp
+++ b/src/system/kernel/debug/user_debugger.cpp
@@ -2834,6 +2834,10 @@ _user_disable_debugger(int state)
 status_t
 _user_install_default_debugger(port_id debuggerPort)
 {
+	// Do not allow non-root processes to install a default debugger.
+	if (geteuid() != 0)
+		return B_PERMISSION_DENIED;
+
 	// if supplied, check whether the port is a valid port
 	if (debuggerPort >= 0) {
 		port_info portInfo;
@@ -2855,6 +2859,14 @@ _user_install_default_debugger(port_id debuggerPort)
 port_id
 _user_install_team_debugger(team_id teamID, port_id debuggerPort)
 {
+	if (geteuid() != 0) {
+		Team* team = team_get_team_struct(teamID);
+		if (team == NULL)
+			return B_BAD_VALUE;
+		if (team->effective_uid != geteuid())
+			return B_PERMISSION_DENIED;
+	}
+
 	return install_team_debugger(teamID, debuggerPort, -1, false, false);
 }