Stephen Smalley
006ebb40d3
Security: split proc ptrace checking into read vs. attach ...
Enable security modules to distinguish reading of process state via
proc from full ptrace access by renaming ptrace_may_attach to
ptrace_may_access and adding a mode argument indicating whether only
read access or full attach access is requested. This allows security
modules to permit access to reading process state without granting
full ptrace access. The base DAC/capability checking remains unchanged.
Read access to /proc/pid/mem continues to apply a full ptrace attach
check since check_mem_permission() already requires the current task
to already be ptracing the target. The other ptrace checks within
proc for elements like environ, maps, and fds are changed to pass the
read mode instead of attach.
In the SELinux case, we model such reading of process state as a
reading of a proc file labeled with the target process' label. This
enables SELinux policy to permit such reading of process state without
permitting control or manipulation of the target process, as there are
a number of cases where programs probe for such information via proc
but do not need to be able to control the target (e.g. procps,
lsof, PolicyKit, ConsoleKit). At present we have to choose between
allowing full ptrace in policy (more permissive than required/desired)
or breaking functionality (or in some cases just silencing the denials
via dontaudit rules but this can hide genuine attacks).
This version of the patch incorporates comments from Casey Schaufler
(change/replace existing ptrace_may_attach interface, pass access
mode), and Chris Wright (provide greater consistency in the checking).
Note that like their predecessors __ptrace_may_attach and
ptrace_may_attach, the __ptrace_may_access and ptrace_may_access
interfaces use different return value conventions from each other (0
or -errno vs. 1 or 0). I retained this difference to avoid any
changes to the caller logic but made the difference clearer by
changing the latter interface to return a bool rather than an int and
by adding a comment about it to ptrace.h for any future callers.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-07-14 15:01:47 +10:00
9p: fix O_APPEND in legacy mode
2008-07-03 09:59:03 -05:00
fs: replace remaining __FUNCTION__ occurrences
2008-04-30 08:29:54 -07:00
[PATCH] fix reservation discarding in affs
2008-05-06 13:45:33 -04:00
Fix various old email addresses for dwmw2
2008-06-06 11:29:10 -07:00
autofs: path_{get,put}() cleanups
2008-05-01 08:04:01 -07:00
byteorder: don't directly include linux/byteorder/generic.h
2008-05-16 12:01:45 -07:00
fs: replace remaining __FUNCTION__ occurrences
2008-04-30 08:29:54 -07:00
cifs: fix wksidarr declaration to be big-endian friendly
2008-07-12 14:33:42 -07:00
codafs: fix build warning
2008-04-29 08:06:04 -07:00
fs: replace remaining __FUNCTION__ occurrences
2008-04-30 08:29:54 -07:00
fs: Remove unnecessary inclusions of asm/semaphore.h
2008-04-18 22:16:44 -04:00
DEBUGFS: Correct location of debugfs API documentation.
2008-04-30 16:52:47 -07:00
devpts: factor out PTY index allocation
2008-04-30 08:29:48 -07:00
dlm: fix plock dev_write return value
2008-05-19 15:37:27 -05:00
ecryptfs: remove unnecessary mux from ecryptfs_init_ecryptfs_miscdev()
2008-07-04 10:40:05 -07:00
fs: replace remaining __FUNCTION__ occurrences
2008-04-30 08:29:54 -07:00
ext2: retry block allocation if new blocks are allocated from system zone
2008-04-28 08:58:43 -07:00
ext3: add missing unlock to error path in ext3_quota_write()
2008-07-04 10:40:05 -07:00
ext4: add missing unlock to an error path in ext4_quota_write()
2008-07-04 10:40:05 -07:00
fat: relax the permission check of fat_setattr()
2008-06-12 18:05:39 -07:00
fs/freevxfs/: proper externs
2008-04-29 08:06:00 -07:00
fuse: fix thinko in max I/O size calucation
2008-06-17 18:08:10 -07:00
[GFS2] fix gfs2 block allocation (cleaned up)
2008-06-24 19:02:28 +01:00
hfs: fix warning with 64k PAGE_SIZE
2008-04-30 08:29:52 -07:00
Fix hfsplus oops on image without extents
2008-05-13 08:02:24 -07:00
fix hppfs Makefile breakage
2008-05-21 16:55:58 -07:00
mm: bdi: add separate writeback accounting capability
2008-04-30 08:29:50 -07:00
isofs: fix access to unallocated memory when reading corrupted filesystem
2008-04-30 08:29:33 -07:00
jbd: need to hold j_state_lock to updates to transaction t_state to T_COMMIT
2008-05-14 19:11:14 -07:00
jbd2: Fix barrier fallback code to re-lock the buffer head
2008-06-03 22:31:11 -04:00
Merge git://git.infradead.org/mtd-2.6
2008-05-01 11:15:28 -07:00
proc: remove proc_root_fs
2008-04-29 08:06:18 -07:00
fs: replace remaining __FUNCTION__ occurrences
2008-04-30 08:29:54 -07:00
fs: replace remaining __FUNCTION__ occurrences
2008-04-30 08:29:54 -07:00
ncpfs: use get/put_unaligned_* helpers
2008-04-29 08:06:28 -07:00
NFS: Fix readdir cache invalidation
2008-07-08 15:22:40 -04:00
nfsd: reorder printk in do_probe_callback to avoid use-after-free
2008-05-18 19:13:07 -04:00
ntfs: le*_add_cpu conversion
2008-05-24 09:56:08 -07:00
ocfs2: Fix flags in ocfs2_file_lock
2008-07-10 09:25:39 -07:00
fs: replace remaining __FUNCTION__ occurrences
2008-04-30 08:29:54 -07:00
Security: split proc ptrace checking into read vs. attach
2008-07-14 15:01:47 +10:00
mm: bdi: add separate writeback accounting capability
2008-04-30 08:29:50 -07:00
reiserfs: discard prealloc in reiserfs_delete_inode
2008-07-08 12:39:31 -07:00
fs: replace remaining __FUNCTION__ occurrences
2008-04-30 08:29:54 -07:00
sysfs: remove error messages for -EEXIST case
2008-05-14 22:34:16 -07:00
sysv: [bl]e*_add_cpu conversion
2008-04-30 08:29:52 -07:00
udf: Fix regression in UDF anchor block detection
2008-06-24 11:38:03 +02:00
ufs: remove unneeded ufs_put_inode prototype
2008-05-13 08:02:23 -07:00
fs: replace remaining __FUNCTION__ occurrences
2008-04-30 08:29:54 -07:00
Fix reference counting race on log buffers
2008-07-11 11:37:18 -07:00
uml: activate_mm: remove the dead PF_BORROWED_MM check
2008-06-06 11:36:22 -07:00
[PATCH] sanitize anon_inode_getfd()
2008-05-01 13:08:50 -04:00
fs/binfmt_aout.c: use printk_ratelimit()
2008-04-29 08:06:04 -07:00
Remove last traces of a.out support from ELF loader.
2008-06-16 10:20:57 -07:00
nommu: fix ksize() abuse
2008-06-06 11:29:13 -07:00
binfmt_misc.c: avoid potential kernel stack overflow
2008-04-29 08:06:04 -07:00
nommu: fix ksize() abuse
2008-06-06 11:29:13 -07:00
binfmt_misc.c: avoid potential kernel stack overflow
2008-04-29 08:06:04 -07:00
binfmt_misc.c: avoid potential kernel stack overflow
2008-04-29 08:06:04 -07:00
[PATCH] sanitize handling of shared descriptor tables in failing execve()
2008-04-25 09:23:53 -04:00
docbook: fix bio missing parameter
2008-05-07 18:35:03 +02:00
[PATCH] fix cgroup-inflicted breakage in block_dev.c
2008-06-23 08:30:55 -04:00
Properly notify block layer of sync writes
2008-07-01 09:07:34 +02:00
fs: remove unused fops from struct char_device_struct
2008-04-29 08:06:01 -07:00
[PATCH] get rid of leak in compat_execve()
2008-05-16 17:23:05 -04:00
tty: The big operations rework
2008-04-30 08:29:47 -07:00
[patch 2/3] vfs: dcache cleanups
2008-06-23 13:07:00 -04:00
[PATCH] split linux/file.h
2008-05-01 13:08:16 -04:00
quota: don't call sync_fs() from vfs_quota_off() when there's no quota turn off
2008-05-13 08:02:23 -07:00
vfs: skip inodes without pages to free in drop_pagecache_sb()
2008-04-29 08:06:05 -07:00
[PATCH] sanitize anon_inode_getfd()
2008-05-01 13:08:50 -04:00
[PATCH] sanitize anon_inode_getfd()
2008-05-01 13:08:50 -04:00
exec: fix stack excutability without PT_GNU_STACK
2008-07-10 13:25:43 -07:00
[PATCH] split linux/file.h
2008-05-01 13:08:16 -04:00
[PATCH] avoid multiplication overflows and signedness issues for max_fds
2008-05-16 17:22:52 -04:00
[PATCH] split linux/file.h
2008-05-01 13:08:16 -04:00
fs/fs-writeback.c: make 2 functions static
2008-04-29 08:06:00 -07:00
VFS: fix unused variable warning
2008-05-06 13:13:37 -07:00
Remove duplicated unlikely() in IS_ERR()
2008-04-29 08:06:25 -07:00
[PATCH] move a bunch of declarations to fs/internal.h
2008-04-21 23:11:01 -04:00
make vfs_ioctl() static
2008-04-29 08:06:00 -07:00
ntfs: update help text
2008-07-04 10:40:07 -07:00
frv: don't offer BINFMT_FLAT
2008-06-06 11:29:08 -07:00
add kernel-doc for simple_read_from_buffer and memory_read_from_buffer
2008-07-04 10:40:07 -07:00
[patch 4/4] flock: remove unused fields from file_lock_operations
2008-06-23 11:52:30 -04:00
[patch 3/4] vfs: fix ERR_PTR abuse in generic_readlink
2008-06-23 11:52:30 -04:00
fs: replace remaining __FUNCTION__ occurrences
2008-04-30 08:29:54 -07:00
security: filesystem capabilities: fix fragile setuid fixup code
2008-07-04 10:40:08 -07:00
[patch 1/4] vfs: path_{get,put}() cleanups
2008-06-23 11:52:29 -04:00
[patch 7/7] vfs: mountinfo: show dominating group id
2008-04-23 00:05:09 -04:00
[patch 7/7] vfs: mountinfo: show dominating group id
2008-04-23 00:05:09 -04:00
quota: quota core changes for quotaon on remount
2008-04-28 08:58:33 -07:00
quota: do not allow setting of quota limits to too high values
2008-04-28 08:58:32 -07:00
quota: le*_add_cpu conversion
2008-04-30 08:29:51 -07:00
fs: use loff_t type instead of long long
2008-04-22 15:17:11 -07:00
Fix performance regression on lmbench select benchmark
2008-06-22 12:23:15 -07:00
[patch 2/7] vfs: mountinfo: add seq_file_root()
2008-04-23 00:04:38 -04:00
[PATCH] sanitize anon_inode_getfd()
2008-05-01 13:08:50 -04:00
splice: handle try_to_release_page() failure
2008-05-28 14:49:27 +02:00
make __put_super() static
2008-04-29 08:06:00 -07:00
vfs: fix unconditional write_super() call in file_fsync()
2008-04-29 08:06:06 -07:00
[PATCH] sanitize anon_inode_getfd()
2008-05-01 13:08:50 -04:00
[patch for 2.6.26 4/4] vfs: utimensat(): fix write access check for futimens()
2008-06-23 08:43:52 -04:00
xattr: add missing consts to function arguments
2008-04-29 08:06:06 -07:00
006ebb40d3