Stephen Smalley
006ebb40d3
Security: split proc ptrace checking into read vs. attach ...
Enable security modules to distinguish reading of process state via
proc from full ptrace access by renaming ptrace_may_attach to
ptrace_may_access and adding a mode argument indicating whether only
read access or full attach access is requested. This allows security
modules to permit access to reading process state without granting
full ptrace access. The base DAC/capability checking remains unchanged.
Read access to /proc/pid/mem continues to apply a full ptrace attach
check since check_mem_permission() already requires the current task
to already be ptracing the target. The other ptrace checks within
proc for elements like environ, maps, and fds are changed to pass the
read mode instead of attach.
In the SELinux case, we model such reading of process state as a
reading of a proc file labeled with the target process' label. This
enables SELinux policy to permit such reading of process state without
permitting control or manipulation of the target process, as there are
a number of cases where programs probe for such information via proc
but do not need to be able to control the target (e.g. procps,
lsof, PolicyKit, ConsoleKit). At present we have to choose between
allowing full ptrace in policy (more permissive than required/desired)
or breaking functionality (or in some cases just silencing the denials
via dontaudit rules but this can hide genuine attacks).
This version of the patch incorporates comments from Casey Schaufler
(change/replace existing ptrace_may_attach interface, pass access
mode), and Chris Wright (provide greater consistency in the checking).
Note that like their predecessors __ptrace_may_attach and
ptrace_may_attach, the __ptrace_may_access and ptrace_may_access
interfaces use different return value conventions from each other (0
or -errno vs. 1 or 0). I retained this difference to avoid any
changes to the caller logic but made the difference clearer by
changing the latter interface to return a bool rather than an int and
by adding a comment about it to ptrace.h for any future callers.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-07-14 15:01:47 +10:00
genirq: reenable a nobody cared disabled irq when a new driver arrives
2008-05-02 13:40:34 +02:00
Merge branches 'release', 'acpica', 'bugzilla-10224', 'bugzilla-9772', 'bugzilla-9916', 'ec', 'eeepc', 'idle', 'misc', 'pm-legacy', 'sysfs-links-2.6.26', 'thermal', 'thinkpad' and 'video' into release
2008-04-30 13:58:00 -04:00
clocksource: allow read access to available/current_clocksource
2008-05-03 18:11:48 +02:00
Update kernel/.gitignore with new auto-generated files
2008-02-09 23:27:01 -08:00
bsd_acct: using task_struct->tgid is not right in pid-namespaces
2008-03-24 19:22:20 -07:00
[PATCH] remove useless argument type in audit_filter_user()
2008-06-24 23:36:35 -04:00
[PATCH 1/2] audit: move extern declarations to audit.h
2008-04-28 06:28:04 -04:00
[PATCH] list_for_each_rcu must die: audit
2008-05-17 03:30:23 -04:00
[PATCH] remove useless argument type in audit_filter_user()
2008-06-24 23:36:35 -04:00
[PATCH] new predicate - AUDIT_FILETYPE
2008-04-28 06:28:37 -04:00
x86: add a simple backtrace test module
2008-01-30 13:33:08 +01:00
Add kbuild.h that contains common definitions for kbuild users
2008-04-29 08:06:29 -07:00
security: filesystem capabilities: fix fragile setuid fixup code
2008-07-04 10:40:08 -07:00
cgroups: remove node_ prefix_from ns subsystem
2008-05-24 09:56:14 -07:00
CGroup API files: move "releasable" to cgroup_debug subsystem
2008-04-29 08:06:09 -07:00
ntp: support for TAI
2008-05-01 08:03:59 -07:00
kernel: use non-racy method for proc entries creation
2008-04-29 08:06:22 -07:00
kernel: replace remaining __FUNCTION__ occurrences
2008-04-30 08:29:54 -07:00
cpusets, hotplug, scheduler: fix scheduler domain breakage
2008-07-13 11:37:02 +02:00
Add scaled time to taskstats based process accounting
2007-10-18 14:37:28 -07:00
kernel: use non-racy method for proc entries creation
2008-04-29 08:06:22 -07:00
whitespace fixes: execution domains
2007-10-18 14:37:26 -07:00
signals: fix sigqueue_free() vs __exit_signal() race
2008-05-24 09:56:10 -07:00
module: Don't report discarded init pages as kernel text.
2008-01-29 17:13:18 +11:00
[PATCH] dup_fd() fixes, part 1
2008-05-16 17:22:26 -04:00
futexes: fix fault handling in futex_lock_pi
2008-06-23 13:31:15 +02:00
futex_compat __user annotation
2008-03-30 14:18:41 -07:00
hrtimer: prevent migration for raising softirq
2008-07-03 11:36:48 -07:00
ITIMER_REAL: convert to use struct pid
2008-02-08 09:22:29 -08:00
kernel: use non-racy method for proc entries creation
2008-04-29 08:06:22 -07:00
sched: high-res preemption tick
2008-01-25 21:08:29 +01:00
rcu: move PREEMPT_RCU config option back under PREEMPT
2008-03-10 18:01:20 -07:00
kexec: make extended crashkernel= syntax less confusing
2008-05-01 08:04:00 -07:00
is_power_of_2: kernel/kfifo.c
2007-07-16 09:05:50 -07:00
kgdb: sparse fix
2008-06-24 10:52:55 -05:00
[PATCH] split linux/file.h
2008-05-01 13:08:16 -04:00
kernel/kprobes.c: Made kprobe_blacklist static.
2008-07-10 10:13:51 -07:00
Kobject: convert remaining kobject_unregister() to kobject_put()
2008-01-24 20:40:40 -08:00
Deprecate find_task_by_pid()
2008-04-30 08:29:48 -07:00
kernel: use non-racy method for proc entries creation
2008-04-29 08:06:22 -07:00
Subject: lockdep: include all lock classes in all_lock_classes
2008-02-25 23:03:02 +01:00
[PATCH] lockdep: more chains
2006-12-07 08:39:43 -08:00
kernel: use non-racy method for proc entries creation
2008-04-29 08:06:22 -07:00
sched: add optional support for CONFIG_HAVE_UNSTABLE_SCHED_CLOCK
2008-05-05 23:56:18 +02:00
make marker_debug static
2008-04-30 08:29:49 -07:00
modules: proper cleanup of kobject without CONFIG_SYSFS
2008-05-23 13:09:33 +10:00
kernel: remove fastcall in kernel/*
2008-02-08 09:22:31 -08:00
kernel: remove fastcall in kernel/*
2008-02-08 09:22:31 -08:00
ipc: re-enable msgmni automatic recomputing msgmni if set to negative
2008-04-29 08:06:13 -07:00
cgroups: kernel/ns_cgroup.c should #include <linux/nsproxy.h>
2008-04-29 08:06:07 -07:00
ipc: sysvsem: refuse clone(CLONE_SYSVSEM|CLONE_NEWIPC)
2008-04-29 08:06:14 -07:00
Taint kernel after WARN_ON(condition)
2008-04-29 08:05:59 -07:00
Add new string functions strict_strto* and convert kernel params to use them
2008-02-08 09:22:41 -08:00
pids: introduce change_pid() helper
2008-04-30 08:29:48 -07:00
pidns: make pid->level and pid_ns->level unsigned
2008-04-30 08:29:49 -07:00
pm qos infrastructure and interface
2008-02-05 09:44:22 -08:00
remove div_long_long_rem
2008-05-01 08:03:58 -07:00
signals: join send_sigqueue() with send_group_sigqueue()
2008-04-30 08:29:36 -07:00
kernel/printk.c: Made printk_recursion_bug_msg static.
2008-07-08 18:10:34 -07:00
kernel: use non-racy method for proc entries creation
2008-04-29 08:06:22 -07:00
Security: split proc ptrace checking into read vs. attach
2008-07-14 15:01:47 +10:00
rcu: fix hotplug vs rcu race
2008-07-01 09:27:17 +02:00
rcupdate: fix comment
2008-02-13 16:21:18 -08:00
Fix PREEMPT_RCU without HOTPLUG_CPU
2008-07-10 11:13:44 -07:00
Preempt-RCU: implementation
2008-01-25 21:08:24 +01:00
kernel: explicitly include required header files under kernel/
2008-04-29 08:06:04 -07:00
splice: fix sendfile() issue with relay
2008-05-28 14:49:27 +02:00
memcgroup: add the max_usage member on the res_counter
2008-04-29 08:06:10 -07:00
kernel: use non-racy method for proc entries creation
2008-04-29 08:06:22 -07:00
Don't operate with pid_t in rtmutex tester
2008-02-08 09:22:41 -08:00
Driver core: change sysdev classes to use dynamic kobject names
2008-01-24 20:40:40 -08:00
hrtimer: more hrtimer_init_sleeper() fallout.
2008-02-13 15:45:36 +01:00
Don't operate with pid_t in rtmutex tester
2008-02-08 09:22:41 -08:00
sched: mark rwsem functions as __sched for wchan/profiling
2007-12-18 15:21:13 +01:00
sched: fix cpu hotplug, cleanup
2008-07-10 20:39:58 +02:00
sched: fix sched_clock_cpu()
2008-05-29 11:29:19 +02:00
revert ("sched: fair-group: SMP-nice for group scheduling")
2008-05-29 11:28:57 +02:00
sched: stop wake_affine from causing serious imbalance
2008-05-29 11:29:20 +02:00
sched: /debug/sched_features
2008-04-19 19:45:00 +02:00
sched: make rt_sched_class, idle_sched_class static
2008-05-05 23:56:17 +02:00
sched: rt: dont stop the period timer when there are tasks wanting to run
2008-06-20 11:00:19 +02:00
sched, delay accounting: fix incorrect delay time when constantly waiting on runqueue
2008-06-19 14:15:28 +02:00
make seccomp zerocost in schedule
2007-07-16 09:05:50 -07:00
Revert "semaphore: fix"
2008-05-10 20:43:22 -07:00
posix timers: discard SI_TIMER signals on exec
2008-05-26 10:37:07 -07:00
Fix cpu hotplug problem in softirq code
2008-05-01 08:03:58 -07:00
softlockup: print a module list on being stuck
2008-07-05 08:51:24 +02:00
spinlock: lockbreak cleanup
2008-01-30 13:31:20 +01:00
make srcu_readers_active() static
2008-02-06 10:41:02 -08:00
stop_machine: make stop_machine_run more virtualization friendly
2008-05-23 13:09:34 +10:00
sys_prctl(): fix return of uninitialized value
2008-05-24 09:56:13 -07:00
timerfd: new timerfd API
2008-02-05 09:44:07 -08:00
[PATCH] avoid multiplication overflows and signedness issues for max_fds
2008-05-16 17:22:52 -04:00
constify tables in kernel/sysctl_check.c
2008-02-08 09:22:31 -08:00
Use find_task_by_vpid in taskstats
2008-04-30 08:29:48 -07:00
kprobes: kretprobe user entry-handler
2008-02-06 10:41:11 -08:00
Make constants in kernel/timeconst.h fixed 64 bits
2008-05-02 16:18:42 -07:00
Make constants in kernel/timeconst.h fixed 64 bits
2008-05-02 16:18:42 -07:00
debugobjects: add timer specific object debugging code
2008-04-30 08:29:53 -07:00
Add scaled time to taskstats based process accounting
2007-10-18 14:37:28 -07:00
asmlinkage_protect replaces prevent_tail_call
2008-04-10 17:28:26 -07:00
alloc_uid: cleanup
2008-04-30 08:29:53 -07:00
eCryptfs: make key module subsystem respect namespaces
2008-04-29 08:06:07 -07:00
kernel: explicitly include required header files under kernel/
2008-04-29 08:06:04 -07:00
Isolate the UTS namespace's domainname and hostname back
2007-11-29 09:24:53 -08:00
kernel: remove fastcall in kernel/*
2008-02-08 09:22:31 -08:00
Christoph has moved
2008-07-04 10:40:04 -07:00
006ebb40d3