lkml.org 
[lkml]   [2016]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 14/16] security: let security modules use PTRACE_MODE_* with bitmasks
    Date
    From: Jann Horn <jann@thejh.net>

    commit 3dfb7d8cdbc7ea0c2970450e60818bb3eefbad69 upstream.

    It looks like smack and yama weren't aware that the ptrace mode
    can have flags ORed into it - PTRACE_MODE_NOAUDIT until now, but
    only for /proc/$pid/stat, and with the PTRACE_MODE_*CREDS patch,
    all modes have flags ORed into them.

    Signed-off-by: Jann Horn <jann@thejh.net>
    Acked-by: Kees Cook <keescook@chromium.org>
    Acked-by: Casey Schaufler <casey@schaufler-ca.com>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: James Morris <james.l.morris@oracle.com>
    Cc: "Serge E. Hallyn" <serge.hallyn@ubuntu.com>
    Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: "Eric W. Biederman" <ebiederm@xmission.com>
    Cc: Willy Tarreau <w@1wt.eu>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [wt: no smk_ptrace_mode() in 3.10]
    Signed-off-by: Willy Tarreau <w@1wt.eu>
    ---
    security/yama/yama_lsm.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
    index 13c88fbc..0038834 100644
    --- a/security/yama/yama_lsm.c
    +++ b/security/yama/yama_lsm.c
    @@ -292,7 +292,7 @@ int yama_ptrace_access_check(struct task_struct *child,
    return rc;

    /* require ptrace target be a child of ptracer on attach */
    - if (mode == PTRACE_MODE_ATTACH) {
    + if (mode & PTRACE_MODE_ATTACH) {
    switch (ptrace_scope) {
    case YAMA_SCOPE_DISABLED:
    /* No additional restrictions. */
    @@ -318,7 +318,7 @@ int yama_ptrace_access_check(struct task_struct *child,
    }
    }

    - if (rc) {
    + if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0) {
    printk_ratelimited(KERN_NOTICE
    "ptrace of pid %d was attempted by: %s (pid %d)\n",
    child->pid, current->comm, current->pid);
    --
    2.8.0.rc2.1.gbe9624a
    \
     
     \ /
      Last update: 2016-10-20 00:52    [W:0.028 / U:7.500 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site