diff options
| author | Kees Cook <keescook@chromium.org> | 2016-04-20 15:46:26 -0700 |
|---|---|---|
| committer | James Morris <james.l.morris@oracle.com> | 2016-04-21 10:47:26 +1000 |
| commit | 8a56038c2aef97a9d4b9dd608b912b9d9a4a2d68 (patch) | |
| tree | c0b51f6b4c1634e2fb2c85601e59827662ec198d /security/yama/yama_lsm.c | |
| parent | 21985319add60b55fc27230d9421a3e5af7e998a (diff) | |
| download | op-kernel-dev-8a56038c2aef97a9d4b9dd608b912b9d9a4a2d68.zip op-kernel-dev-8a56038c2aef97a9d4b9dd608b912b9d9a4a2d68.tar.gz | |
Yama: consolidate error reporting
Use a common error reporting function for Yama violation reports, and give
more detail into the process command lines.
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Diffstat (limited to 'security/yama/yama_lsm.c')
| -rw-r--r-- | security/yama/yama_lsm.c | 31 |
1 files changed, 21 insertions, 10 deletions
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c index cb6ed10..c19f6e5 100644 --- a/security/yama/yama_lsm.c +++ b/security/yama/yama_lsm.c @@ -18,6 +18,7 @@ #include <linux/prctl.h> #include <linux/ratelimit.h> #include <linux/workqueue.h> +#include <linux/string_helpers.h> #define YAMA_SCOPE_DISABLED 0 #define YAMA_SCOPE_RELATIONAL 1 @@ -41,6 +42,22 @@ static DEFINE_SPINLOCK(ptracer_relations_lock); static void yama_relation_cleanup(struct work_struct *work); static DECLARE_WORK(yama_relation_work, yama_relation_cleanup); +static void report_access(const char *access, struct task_struct *target, + struct task_struct *agent) +{ + char *target_cmd, *agent_cmd; + + target_cmd = kstrdup_quotable_cmdline(target, GFP_KERNEL); + agent_cmd = kstrdup_quotable_cmdline(agent, GFP_KERNEL); + + pr_notice_ratelimited( + "ptrace %s of \"%s\"[%d] was attempted by \"%s\"[%d]\n", + access, target_cmd, target->pid, agent_cmd, agent->pid); + + kfree(agent_cmd); + kfree(target_cmd); +} + /** * yama_relation_cleanup - remove invalid entries from the relation list * @@ -307,11 +324,8 @@ static int yama_ptrace_access_check(struct task_struct *child, } } - if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0) { - printk_ratelimited(KERN_NOTICE - "ptrace of pid %d was attempted by: %s (pid %d)\n", - child->pid, current->comm, current->pid); - } + if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0) + report_access("attach", child, current); return rc; } @@ -337,11 +351,8 @@ int yama_ptrace_traceme(struct task_struct *parent) break; } - if (rc) { - printk_ratelimited(KERN_NOTICE - "ptraceme of pid %d was attempted by: %s (pid %d)\n", - current->pid, parent->comm, parent->pid); - } + if (rc) + report_access("traceme", current, parent); return rc; } |
