lkml.org 
[lkml]   [2009]   [Dec]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 1/3] Security: Add disablenetwork interface. (v4)
    Quoting Michael Stone (michael@laptop.org):
    > Daniel Bernstein has observed [1] that security-conscious userland processes
    > may benefit from the ability to irrevocably remove their ability to create,
    > bind, connect to, or send messages except in the case of previously connected
    > sockets or AF_UNIX filesystem sockets.
    >
    > This patch provides
    >
    > * a new configuration option named CONFIG_SECURITY_DISABLENETWORK,
    > * a new prctl option-pair (PR_SET_NETWORK, PR_GET_NETWORK),
    > * a new prctl(PR_SET_NETWORK) flag named PR_NETWORK_OFF, and
    > * a new task_struct flags field named "network"
    >
    > Signed-off-by: Michael Stone <michael@laptop.org>
    > ---
    > include/linux/prctl.h | 7 +++++
    > include/linux/prctl_network.h | 7 +++++
    > include/linux/sched.h | 4 +++
    > kernel/sys.c | 53 +++++++++++++++++++++++++++++++++++++++++
    > security/Kconfig | 11 ++++++++
    > 5 files changed, 82 insertions(+), 0 deletions(-)
    > create mode 100644 include/linux/prctl_network.h
    >
    > diff --git a/include/linux/prctl.h b/include/linux/prctl.h
    > index a3baeb2..4eb4110 100644
    > --- a/include/linux/prctl.h
    > +++ b/include/linux/prctl.h
    > @@ -102,4 +102,11 @@
    >
    > #define PR_MCE_KILL_GET 34
    >
    > +/* Get/set process disable-network flags */
    > +#define PR_SET_NETWORK 35
    > +#define PR_GET_NETWORK 36
    > +# define PR_NETWORK_ON 0
    > +# define PR_NETWORK_OFF 1
    > +# define PR_NETWORK_ALL_FLAGS 1
    > +
    > #endif /* _LINUX_PRCTL_H */
    > diff --git a/include/linux/prctl_network.h b/include/linux/prctl_network.h
    > new file mode 100644
    > index 0000000..d18f8cb
    > --- /dev/null
    > +++ b/include/linux/prctl_network.h
    > @@ -0,0 +1,7 @@
    > +#ifndef _LINUX_PRCTL_NETWORK_H
    > +#define _LINUX_PRCTL_NETWORK_H
    > +
    > +extern long prctl_get_network(unsigned long*);
    > +extern long prctl_set_network(unsigned long*);
    > +
    > +#endif /* _LINUX_PRCTL_NETWORK_H */
    > diff --git a/include/linux/sched.h b/include/linux/sched.h
    > index f2f842d..6fcaef8 100644
    > --- a/include/linux/sched.h
    > +++ b/include/linux/sched.h
    > @@ -1403,6 +1403,10 @@ struct task_struct {
    > #endif
    > seccomp_t seccomp;
    >
    > +#ifdef CONFIG_SECURITY_DISABLENETWORK
    > + unsigned long network;
    > +#endif
    > +
    > /* Thread group tracking */
    > u32 parent_exec_id;
    > u32 self_exec_id;
    > diff --git a/kernel/sys.c b/kernel/sys.c
    > index 26a6b73..b48f021 100644
    > --- a/kernel/sys.c
    > +++ b/kernel/sys.c
    > @@ -35,6 +35,7 @@
    > #include <linux/cpu.h>
    > #include <linux/ptrace.h>
    > #include <linux/fs_struct.h>
    > +#include <linux/prctl_network.h>
    >
    > #include <linux/compat.h>
    > #include <linux/syscalls.h>
    > @@ -1578,6 +1579,12 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
    > else
    > error = PR_MCE_KILL_DEFAULT;
    > break;
    > + case PR_SET_NETWORK:
    > + error = prctl_set_network((unsigned long*)arg2);
    > + break;
    > + case PR_GET_NETWORK:
    > + error = prctl_get_network((unsigned long*)arg2);
    > + break;

    Is there any reason not to handle these in
    disablenetwork_security_prctl()
    ?

    Other than that, this looks quite good to me... (No need to
    initialize ret=0 in your security_* updates, to get pedantic,
    that's all I noticed)

    I'll give it a closer look on monday before I ack.

    thanks,
    -serge


    \
     
     \ /
      Last update: 2009-12-27 04:17    [W:3.211 / U:0.136 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site