From: "Serge E. Hallyn" <serge@hallyn.com>
To: Kees Cook <kees.cook@canonical.com>
Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/2] Yama: add PTRACE exception tracking
Date: Tue, 29 Jun 2010 22:56:09 -0500 [thread overview]
Message-ID: <20100630035609.GA16307@hallyn.com> (raw)
In-Reply-To: <20100630004027.GG4837@outflux.net>
Quoting Kees Cook (kees.cook@canonical.com):
> Some application suites have external crash handlers that depend on
> being able to use PTRACE to generate crash reports (KDE, Chromium, etc).
> Since the inferior process generally knows the PID of the debugger,
> it can use PR_SET_PTRACER to allow a specific PID and its descendants
> to perform the PTRACE instead of only a direct ancestor.
>
> Signed-off-by: Kees Cook <kees.cook@canonical.com>
> ---
Hi Kees - very nice, overall. One little note though:
> @@ -32,27 +204,20 @@ static int yama_ptrace_access_check(struct task_struct *child,
> {
> int rc;
>
> + /* If standard caps disallows it, so does Yama. We should
> + * should only tighten restrictions further.
> + */
> rc = cap_ptrace_access_check(child, mode);
This means that if capable(CAP_SYS_PTRACE) we'll always shortcut
here, so
> - if (rc != 0)
> + if (rc)
> return rc;
>
> /* require ptrace target be a child of ptracer on attach */
> - if (mode == PTRACE_MODE_ATTACH && ptrace_scope &&
> - !capable(CAP_SYS_PTRACE)) {
> - struct task_struct *walker = child;
> -
> - rcu_read_lock();
> - read_lock(&tasklist_lock);
> - while (walker->pid > 0) {
> - if (walker == current)
> - break;
> - walker = walker->real_parent;
> - }
> - if (walker->pid == 0)
> - rc = -EPERM;
> - read_unlock(&tasklist_lock);
> - rcu_read_unlock();
> - }
> + if (mode == PTRACE_MODE_ATTACH &&
> + ptrace_scope &&
> + !capable(CAP_SYS_PTRACE) &&
You don't need the CAP_SYS_PTRACE check here AFAICS.
> + !task_is_descendant(current, child) &&
> + !ptracer_exception_found(current, child))
> + rc = -EPERM;
>
> if (rc) {
> char name[sizeof(current->comm)];
> @@ -170,6 +335,8 @@ static struct security_operations yama_ops = {
> .ptrace_access_check = yama_ptrace_access_check,
> .inode_follow_link = yama_inode_follow_link,
> .path_link = yama_path_link,
> + .task_prctl = yama_task_prctl,
> + .task_free = yama_task_free,
> };
>
> #ifdef CONFIG_SYSCTL
> @@ -221,6 +388,8 @@ static __init int yama_init(void)
>
> printk(KERN_INFO "Yama: becoming mindful.\n");
>
> + spin_lock_init(&ptracer_relations_lock);
> +
> if (register_security(&yama_ops))
> panic("Yama: kernel registration failed.\n");
>
> --
> 1.7.1
>
>
> --
> Kees Cook
> Ubuntu Security Team
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2010-06-30 3:55 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-06-30 0:38 [PATCH 0/2] " Kees Cook
2010-06-30 0:39 ` [PATCH 1/2] security: create task_free security callback Kees Cook
2010-06-30 0:40 ` [PATCH 2/2] Yama: add PTRACE exception tracking Kees Cook
2010-06-30 1:09 ` Tetsuo Handa
2010-06-30 3:51 ` Kees Cook
2010-06-30 3:56 ` Serge E. Hallyn [this message]
2010-06-30 5:27 ` Kees Cook
2010-06-30 12:40 ` Serge E. Hallyn
2010-06-30 15:41 ` Eric Paris
2010-06-30 15:53 ` Kees Cook
2010-06-30 21:39 ` Tetsuo Handa
2010-06-30 7:31 ` [PATCH 0/2] " Christoph Hellwig
2010-06-30 15:45 ` Kees Cook
2010-07-01 1:39 ` James Morris
2010-07-01 4:44 ` Kees Cook
2010-07-01 13:20 ` Serge E. Hallyn
2010-07-01 15:22 ` Stephen Smalley
2010-07-01 17:16 ` Kees Cook
2010-07-01 19:41 ` Serge E. Hallyn
2010-07-01 19:57 ` Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100630035609.GA16307@hallyn.com \
--to=serge@hallyn.com \
--cc=kees.cook@canonical.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome