Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux...
[linux/fpc-iii.git] / security / yama / yama_lsm.c
blobcb6ed10816d49ac963a65816a92ca738a7fb42d0
1 /*
2 * Yama Linux Security Module
4 * Author: Kees Cook <keescook@chromium.org>
6 * Copyright (C) 2010 Canonical, Ltd.
7 * Copyright (C) 2011 The Chromium OS Authors.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2, as
11 * published by the Free Software Foundation.
15 #include <linux/lsm_hooks.h>
16 #include <linux/sysctl.h>
17 #include <linux/ptrace.h>
18 #include <linux/prctl.h>
19 #include <linux/ratelimit.h>
20 #include <linux/workqueue.h>
22 #define YAMA_SCOPE_DISABLED 0
23 #define YAMA_SCOPE_RELATIONAL 1
24 #define YAMA_SCOPE_CAPABILITY 2
25 #define YAMA_SCOPE_NO_ATTACH 3
27 static int ptrace_scope = YAMA_SCOPE_RELATIONAL;
29 /* describe a ptrace relationship for potential exception */
30 struct ptrace_relation {
31 struct task_struct *tracer;
32 struct task_struct *tracee;
33 bool invalid;
34 struct list_head node;
35 struct rcu_head rcu;
38 static LIST_HEAD(ptracer_relations);
39 static DEFINE_SPINLOCK(ptracer_relations_lock);
41 static void yama_relation_cleanup(struct work_struct *work);
42 static DECLARE_WORK(yama_relation_work, yama_relation_cleanup);
44 /**
45 * yama_relation_cleanup - remove invalid entries from the relation list
48 static void yama_relation_cleanup(struct work_struct *work)
50 struct ptrace_relation *relation;
52 spin_lock(&ptracer_relations_lock);
53 rcu_read_lock();
54 list_for_each_entry_rcu(relation, &ptracer_relations, node) {
55 if (relation->invalid) {
56 list_del_rcu(&relation->node);
57 kfree_rcu(relation, rcu);
60 rcu_read_unlock();
61 spin_unlock(&ptracer_relations_lock);
64 /**
65 * yama_ptracer_add - add/replace an exception for this tracer/tracee pair
66 * @tracer: the task_struct of the process doing the ptrace
67 * @tracee: the task_struct of the process to be ptraced
69 * Each tracee can have, at most, one tracer registered. Each time this
70 * is called, the prior registered tracer will be replaced for the tracee.
72 * Returns 0 if relationship was added, -ve on error.
74 static int yama_ptracer_add(struct task_struct *tracer,
75 struct task_struct *tracee)
77 struct ptrace_relation *relation, *added;
79 added = kmalloc(sizeof(*added), GFP_KERNEL);
80 if (!added)
81 return -ENOMEM;
83 added->tracee = tracee;
84 added->tracer = tracer;
85 added->invalid = false;
87 spin_lock(&ptracer_relations_lock);
88 rcu_read_lock();
89 list_for_each_entry_rcu(relation, &ptracer_relations, node) {
90 if (relation->invalid)
91 continue;
92 if (relation->tracee == tracee) {
93 list_replace_rcu(&relation->node, &added->node);
94 kfree_rcu(relation, rcu);
95 goto out;
99 list_add_rcu(&added->node, &ptracer_relations);
101 out:
102 rcu_read_unlock();
103 spin_unlock(&ptracer_relations_lock);
104 return 0;
108 * yama_ptracer_del - remove exceptions related to the given tasks
109 * @tracer: remove any relation where tracer task matches
110 * @tracee: remove any relation where tracee task matches
112 static void yama_ptracer_del(struct task_struct *tracer,
113 struct task_struct *tracee)
115 struct ptrace_relation *relation;
116 bool marked = false;
118 rcu_read_lock();
119 list_for_each_entry_rcu(relation, &ptracer_relations, node) {
120 if (relation->invalid)
121 continue;
122 if (relation->tracee == tracee ||
123 (tracer && relation->tracer == tracer)) {
124 relation->invalid = true;
125 marked = true;
128 rcu_read_unlock();
130 if (marked)
131 schedule_work(&yama_relation_work);
135 * yama_task_free - check for task_pid to remove from exception list
136 * @task: task being removed
138 void yama_task_free(struct task_struct *task)
140 yama_ptracer_del(task, task);
144 * yama_task_prctl - check for Yama-specific prctl operations
145 * @option: operation
146 * @arg2: argument
147 * @arg3: argument
148 * @arg4: argument
149 * @arg5: argument
151 * Return 0 on success, -ve on error. -ENOSYS is returned when Yama
152 * does not handle the given option.
154 int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,
155 unsigned long arg4, unsigned long arg5)
157 int rc = -ENOSYS;
158 struct task_struct *myself = current;
160 switch (option) {
161 case PR_SET_PTRACER:
162 /* Since a thread can call prctl(), find the group leader
163 * before calling _add() or _del() on it, since we want
164 * process-level granularity of control. The tracer group
165 * leader checking is handled later when walking the ancestry
166 * at the time of PTRACE_ATTACH check.
168 rcu_read_lock();
169 if (!thread_group_leader(myself))
170 myself = rcu_dereference(myself->group_leader);
171 get_task_struct(myself);
172 rcu_read_unlock();
174 if (arg2 == 0) {
175 yama_ptracer_del(NULL, myself);
176 rc = 0;
177 } else if (arg2 == PR_SET_PTRACER_ANY || (int)arg2 == -1) {
178 rc = yama_ptracer_add(NULL, myself);
179 } else {
180 struct task_struct *tracer;
182 rcu_read_lock();
183 tracer = find_task_by_vpid(arg2);
184 if (tracer)
185 get_task_struct(tracer);
186 else
187 rc = -EINVAL;
188 rcu_read_unlock();
190 if (tracer) {
191 rc = yama_ptracer_add(tracer, myself);
192 put_task_struct(tracer);
196 put_task_struct(myself);
197 break;
200 return rc;
204 * task_is_descendant - walk up a process family tree looking for a match
205 * @parent: the process to compare against while walking up from child
206 * @child: the process to start from while looking upwards for parent
208 * Returns 1 if child is a descendant of parent, 0 if not.
210 static int task_is_descendant(struct task_struct *parent,
211 struct task_struct *child)
213 int rc = 0;
214 struct task_struct *walker = child;
216 if (!parent || !child)
217 return 0;
219 rcu_read_lock();
220 if (!thread_group_leader(parent))
221 parent = rcu_dereference(parent->group_leader);
222 while (walker->pid > 0) {
223 if (!thread_group_leader(walker))
224 walker = rcu_dereference(walker->group_leader);
225 if (walker == parent) {
226 rc = 1;
227 break;
229 walker = rcu_dereference(walker->real_parent);
231 rcu_read_unlock();
233 return rc;
237 * ptracer_exception_found - tracer registered as exception for this tracee
238 * @tracer: the task_struct of the process attempting ptrace
239 * @tracee: the task_struct of the process to be ptraced
241 * Returns 1 if tracer has is ptracer exception ancestor for tracee.
243 static int ptracer_exception_found(struct task_struct *tracer,
244 struct task_struct *tracee)
246 int rc = 0;
247 struct ptrace_relation *relation;
248 struct task_struct *parent = NULL;
249 bool found = false;
251 rcu_read_lock();
252 if (!thread_group_leader(tracee))
253 tracee = rcu_dereference(tracee->group_leader);
254 list_for_each_entry_rcu(relation, &ptracer_relations, node) {
255 if (relation->invalid)
256 continue;
257 if (relation->tracee == tracee) {
258 parent = relation->tracer;
259 found = true;
260 break;
264 if (found && (parent == NULL || task_is_descendant(parent, tracer)))
265 rc = 1;
266 rcu_read_unlock();
268 return rc;
272 * yama_ptrace_access_check - validate PTRACE_ATTACH calls
273 * @child: task that current task is attempting to ptrace
274 * @mode: ptrace attach mode
276 * Returns 0 if following the ptrace is allowed, -ve on error.
278 static int yama_ptrace_access_check(struct task_struct *child,
279 unsigned int mode)
281 int rc = 0;
283 /* require ptrace target be a child of ptracer on attach */
284 if (mode & PTRACE_MODE_ATTACH) {
285 switch (ptrace_scope) {
286 case YAMA_SCOPE_DISABLED:
287 /* No additional restrictions. */
288 break;
289 case YAMA_SCOPE_RELATIONAL:
290 rcu_read_lock();
291 if (!task_is_descendant(current, child) &&
292 !ptracer_exception_found(current, child) &&
293 !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))
294 rc = -EPERM;
295 rcu_read_unlock();
296 break;
297 case YAMA_SCOPE_CAPABILITY:
298 rcu_read_lock();
299 if (!ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))
300 rc = -EPERM;
301 rcu_read_unlock();
302 break;
303 case YAMA_SCOPE_NO_ATTACH:
304 default:
305 rc = -EPERM;
306 break;
310 if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0) {
311 printk_ratelimited(KERN_NOTICE
312 "ptrace of pid %d was attempted by: %s (pid %d)\n",
313 child->pid, current->comm, current->pid);
316 return rc;
320 * yama_ptrace_traceme - validate PTRACE_TRACEME calls
321 * @parent: task that will become the ptracer of the current task
323 * Returns 0 if following the ptrace is allowed, -ve on error.
325 int yama_ptrace_traceme(struct task_struct *parent)
327 int rc = 0;
329 /* Only disallow PTRACE_TRACEME on more aggressive settings. */
330 switch (ptrace_scope) {
331 case YAMA_SCOPE_CAPABILITY:
332 if (!has_ns_capability(parent, current_user_ns(), CAP_SYS_PTRACE))
333 rc = -EPERM;
334 break;
335 case YAMA_SCOPE_NO_ATTACH:
336 rc = -EPERM;
337 break;
340 if (rc) {
341 printk_ratelimited(KERN_NOTICE
342 "ptraceme of pid %d was attempted by: %s (pid %d)\n",
343 current->pid, parent->comm, parent->pid);
346 return rc;
349 static struct security_hook_list yama_hooks[] = {
350 LSM_HOOK_INIT(ptrace_access_check, yama_ptrace_access_check),
351 LSM_HOOK_INIT(ptrace_traceme, yama_ptrace_traceme),
352 LSM_HOOK_INIT(task_prctl, yama_task_prctl),
353 LSM_HOOK_INIT(task_free, yama_task_free),
356 #ifdef CONFIG_SYSCTL
357 static int yama_dointvec_minmax(struct ctl_table *table, int write,
358 void __user *buffer, size_t *lenp, loff_t *ppos)
360 struct ctl_table table_copy;
362 if (write && !capable(CAP_SYS_PTRACE))
363 return -EPERM;
365 /* Lock the max value if it ever gets set. */
366 table_copy = *table;
367 if (*(int *)table_copy.data == *(int *)table_copy.extra2)
368 table_copy.extra1 = table_copy.extra2;
370 return proc_dointvec_minmax(&table_copy, write, buffer, lenp, ppos);
373 static int zero;
374 static int max_scope = YAMA_SCOPE_NO_ATTACH;
376 struct ctl_path yama_sysctl_path[] = {
377 { .procname = "kernel", },
378 { .procname = "yama", },
382 static struct ctl_table yama_sysctl_table[] = {
384 .procname = "ptrace_scope",
385 .data = &ptrace_scope,
386 .maxlen = sizeof(int),
387 .mode = 0644,
388 .proc_handler = yama_dointvec_minmax,
389 .extra1 = &zero,
390 .extra2 = &max_scope,
394 static void __init yama_init_sysctl(void)
396 if (!register_sysctl_paths(yama_sysctl_path, yama_sysctl_table))
397 panic("Yama: sysctl registration failed.\n");
399 #else
400 static inline void yama_init_sysctl(void) { }
401 #endif /* CONFIG_SYSCTL */
403 void __init yama_add_hooks(void)
405 pr_info("Yama: becoming mindful.\n");
406 security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks));
407 yama_init_sysctl();