diff options
author | Olof Johansson <olof@lixom.net> | 2012-09-05 15:35:48 -0700 |
---|---|---|
committer | Olof Johansson <olof@lixom.net> | 2012-09-05 15:35:48 -0700 |
commit | 1875962377574b4edb7b164001e3e341c25290d5 (patch) | |
tree | 374a5299403ec21e2d9a66a6548ce876a388b589 /security/yama/yama_lsm.c | |
parent | 5cbee140a28c2746449ae31e85738043ae4da927 (diff) | |
parent | c88a79a7789b2909ad1cf69ea2c9142030bbd6f4 (diff) | |
download | op-kernel-dev-1875962377574b4edb7b164001e3e341c25290d5.zip op-kernel-dev-1875962377574b4edb7b164001e3e341c25290d5.tar.gz |
Merge branch 'soc-core' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/dt
* 'soc-core' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
ARM: mach-shmobile: Add compilation support for dtbs using 'make dtbs'
+ sync to 3.6-rc3
Diffstat (limited to 'security/yama/yama_lsm.c')
-rw-r--r-- | security/yama/yama_lsm.c | 43 |
1 files changed, 39 insertions, 4 deletions
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c index 83554ee..0cc99a3 100644 --- a/security/yama/yama_lsm.c +++ b/security/yama/yama_lsm.c @@ -279,12 +279,46 @@ static int yama_ptrace_access_check(struct task_struct *child, } if (rc) { - char name[sizeof(current->comm)]; printk_ratelimited(KERN_NOTICE "ptrace of pid %d was attempted by: %s (pid %d)\n", - child->pid, - get_task_comm(name, current), - current->pid); + child->pid, current->comm, current->pid); + } + + return rc; +} + +/** + * yama_ptrace_traceme - validate PTRACE_TRACEME calls + * @parent: task that will become the ptracer of the current task + * + * Returns 0 if following the ptrace is allowed, -ve on error. + */ +static int yama_ptrace_traceme(struct task_struct *parent) +{ + int rc; + + /* If standard caps disallows it, so does Yama. We should + * only tighten restrictions further. + */ + rc = cap_ptrace_traceme(parent); + if (rc) + return rc; + + /* Only disallow PTRACE_TRACEME on more aggressive settings. */ + switch (ptrace_scope) { + case YAMA_SCOPE_CAPABILITY: + if (!ns_capable(task_user_ns(parent), CAP_SYS_PTRACE)) + rc = -EPERM; + break; + case YAMA_SCOPE_NO_ATTACH: + rc = -EPERM; + break; + } + + if (rc) { + printk_ratelimited(KERN_NOTICE + "ptraceme of pid %d was attempted by: %s (pid %d)\n", + current->pid, parent->comm, parent->pid); } return rc; @@ -294,6 +328,7 @@ static struct security_operations yama_ops = { .name = "yama", .ptrace_access_check = yama_ptrace_access_check, + .ptrace_traceme = yama_ptrace_traceme, .task_prctl = yama_task_prctl, .task_free = yama_task_free, }; |