Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Stephen Smalley 006ebb40d3 Security: split proc ptrace checking into read vs. attach ... Enable security modules to distinguish reading of process state via proc from full ptrace access by renaming ptrace_may_attach to ptrace_may_access and adding a mode argument indicating whether only read access or full attach access is requested. This allows security modules to permit access to reading process state without granting full ptrace access. The base DAC/capability checking remains unchanged. Read access to /proc/pid/mem continues to apply a full ptrace attach check since check_mem_permission() already requires the current task to already be ptracing the target. The other ptrace checks within proc for elements like environ, maps, and fds are changed to pass the read mode instead of attach. In the SELinux case, we model such reading of process state as a reading of a proc file labeled with the target process' label. This enables SELinux policy to permit such reading of process state without permitting control or manipulation of the target process, as there are a number of cases where programs probe for such information via proc but do not need to be able to control the target (e.g. procps, lsof, PolicyKit, ConsoleKit). At present we have to choose between allowing full ptrace in policy (more permissive than required/desired) or breaking functionality (or in some cases just silencing the denials via dontaudit rules but this can hide genuine attacks). This version of the patch incorporates comments from Casey Schaufler (change/replace existing ptrace_may_attach interface, pass access mode), and Chris Wright (provide greater consistency in the checking). Note that like their predecessors __ptrace_may_attach and ptrace_may_attach, the __ptrace_may_access and ptrace_may_access interfaces use different return value conventions from each other (0 or -errno vs. 1 or 0). I retained this difference to avoid any changes to the caller logic but made the difference clearer by changing the latter interface to return a bool rather than an int and by adding a comment about it to ptrace.h for any future callers. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: James Morris <jmorris@namei.org>		2008-07-14 15:01:47 +10:00
..
irq	genirq: reenable a nobody cared disabled irq when a new driver arrives	2008-05-02 13:40:34 +02:00
power	Merge branches 'release', 'acpica', 'bugzilla-10224', 'bugzilla-9772', 'bugzilla-9916', 'ec', 'eeepc', 'idle', 'misc', 'pm-legacy', 'sysfs-links-2.6.26', 'thermal', 'thinkpad' and 'video' into release	2008-04-30 13:58:00 -04:00
time	clocksource: allow read access to available/current_clocksource	2008-05-03 18:11:48 +02:00
.gitignore	Update kernel/.gitignore with new auto-generated files	2008-02-09 23:27:01 -08:00
acct.c	bsd_acct: using task_struct->tgid is not right in pid-namespaces	2008-03-24 19:22:20 -07:00
audit.c	[PATCH] remove useless argument type in audit_filter_user()	2008-06-24 23:36:35 -04:00
audit.h	[PATCH 1/2] audit: move extern declarations to audit.h	2008-04-28 06:28:04 -04:00
audit_tree.c	[PATCH] list_for_each_rcu must die: audit	2008-05-17 03:30:23 -04:00
auditfilter.c	[PATCH] remove useless argument type in audit_filter_user()	2008-06-24 23:36:35 -04:00
auditsc.c	[PATCH] new predicate - AUDIT_FILETYPE	2008-04-28 06:28:37 -04:00
backtracetest.c
bounds.c	Add kbuild.h that contains common definitions for kbuild users	2008-04-29 08:06:29 -07:00
capability.c	security: filesystem capabilities: fix fragile setuid fixup code	2008-07-04 10:40:08 -07:00
cgroup.c	cgroups: remove node_ prefix_from ns subsystem	2008-05-24 09:56:14 -07:00
cgroup_debug.c	CGroup API files: move "releasable" to cgroup_debug subsystem	2008-04-29 08:06:09 -07:00
compat.c	ntp: support for TAI	2008-05-01 08:03:59 -07:00
configs.c	kernel: use non-racy method for proc entries creation	2008-04-29 08:06:22 -07:00
cpu.c	kernel: replace remaining __FUNCTION__ occurrences	2008-04-30 08:29:54 -07:00
cpuset.c	cpusets, hotplug, scheduler: fix scheduler domain breakage	2008-07-13 11:37:02 +02:00
delayacct.c
dma.c	kernel: use non-racy method for proc entries creation	2008-04-29 08:06:22 -07:00
exec_domain.c
exit.c	signals: fix sigqueue_free() vs __exit_signal() race	2008-05-24 09:56:10 -07:00
extable.c
fork.c	[PATCH] dup_fd() fixes, part 1	2008-05-16 17:22:26 -04:00
futex.c	futexes: fix fault handling in futex_lock_pi	2008-06-23 13:31:15 +02:00
futex_compat.c	futex_compat __user annotation	2008-03-30 14:18:41 -07:00
hrtimer.c	hrtimer: prevent migration for raising softirq	2008-07-03 11:36:48 -07:00
itimer.c
kallsyms.c	kernel: use non-racy method for proc entries creation	2008-04-29 08:06:22 -07:00
Kconfig.hz
Kconfig.preempt	rcu: move PREEMPT_RCU config option back under PREEMPT	2008-03-10 18:01:20 -07:00
kexec.c	kexec: make extended crashkernel= syntax less confusing	2008-05-01 08:04:00 -07:00
kfifo.c
kgdb.c	kgdb: sparse fix	2008-06-24 10:52:55 -05:00
kmod.c	[PATCH] split linux/file.h	2008-05-01 13:08:16 -04:00
kprobes.c	kernel/kprobes.c: Made kprobe_blacklist static.	2008-07-10 10:13:51 -07:00
ksysfs.c
kthread.c	Deprecate find_task_by_pid()	2008-04-30 08:29:48 -07:00
latencytop.c	kernel: use non-racy method for proc entries creation	2008-04-29 08:06:22 -07:00
lockdep.c	Subject: lockdep: include all lock classes in all_lock_classes	2008-02-25 23:03:02 +01:00
lockdep_internals.h
lockdep_proc.c	kernel: use non-racy method for proc entries creation	2008-04-29 08:06:22 -07:00
Makefile	sched: add optional support for CONFIG_HAVE_UNSTABLE_SCHED_CLOCK	2008-05-05 23:56:18 +02:00
marker.c	make marker_debug static	2008-04-30 08:29:49 -07:00
module.c	modules: proper cleanup of kobject without CONFIG_SYSFS	2008-05-23 13:09:33 +10:00
mutex-debug.c
mutex-debug.h
mutex.c
mutex.h
notifier.c	ipc: re-enable msgmni automatic recomputing msgmni if set to negative	2008-04-29 08:06:13 -07:00
ns_cgroup.c	cgroups: kernel/ns_cgroup.c should #include <linux/nsproxy.h>	2008-04-29 08:06:07 -07:00
nsproxy.c	ipc: sysvsem: refuse clone(CLONE_SYSVSEM|CLONE_NEWIPC)	2008-04-29 08:06:14 -07:00
panic.c	Taint kernel after WARN_ON(condition)	2008-04-29 08:05:59 -07:00
params.c	Add new string functions strict_strto* and convert kernel params to use them	2008-02-08 09:22:41 -08:00
pid.c	pids: introduce change_pid() helper	2008-04-30 08:29:48 -07:00
pid_namespace.c	pidns: make pid->level and pid_ns->level unsigned	2008-04-30 08:29:49 -07:00
pm_qos_params.c
posix-cpu-timers.c	remove div_long_long_rem	2008-05-01 08:03:58 -07:00
posix-timers.c	signals: join send_sigqueue() with send_group_sigqueue()	2008-04-30 08:29:36 -07:00
printk.c	kernel/printk.c: Made printk_recursion_bug_msg static.	2008-07-08 18:10:34 -07:00
profile.c	kernel: use non-racy method for proc entries creation	2008-04-29 08:06:22 -07:00
ptrace.c	Security: split proc ptrace checking into read vs. attach	2008-07-14 15:01:47 +10:00
rcuclassic.c	rcu: fix hotplug vs rcu race	2008-07-01 09:27:17 +02:00
rcupdate.c	rcupdate: fix comment	2008-02-13 16:21:18 -08:00
rcupreempt.c	Fix PREEMPT_RCU without HOTPLUG_CPU	2008-07-10 11:13:44 -07:00
rcupreempt_trace.c
rcutorture.c	kernel: explicitly include required header files under kernel/	2008-04-29 08:06:04 -07:00
relay.c	splice: fix sendfile() issue with relay	2008-05-28 14:49:27 +02:00
res_counter.c	memcgroup: add the max_usage member on the res_counter	2008-04-29 08:06:10 -07:00
resource.c	kernel: use non-racy method for proc entries creation	2008-04-29 08:06:22 -07:00
rtmutex-debug.c	Don't operate with pid_t in rtmutex tester	2008-02-08 09:22:41 -08:00
rtmutex-debug.h
rtmutex-tester.c
rtmutex.c	hrtimer: more hrtimer_init_sleeper() fallout.	2008-02-13 15:45:36 +01:00
rtmutex.h
rtmutex_common.h	Don't operate with pid_t in rtmutex tester	2008-02-08 09:22:41 -08:00
rwsem.c
sched.c	sched: fix cpu hotplug, cleanup	2008-07-10 20:39:58 +02:00
sched_clock.c	sched: fix sched_clock_cpu()	2008-05-29 11:29:19 +02:00
sched_debug.c	revert ("sched: fair-group: SMP-nice for group scheduling")	2008-05-29 11:28:57 +02:00
sched_fair.c	sched: stop wake_affine from causing serious imbalance	2008-05-29 11:29:20 +02:00
sched_features.h	sched: /debug/sched_features	2008-04-19 19:45:00 +02:00
sched_idletask.c	sched: make rt_sched_class, idle_sched_class static	2008-05-05 23:56:17 +02:00
sched_rt.c	sched: rt: dont stop the period timer when there are tasks wanting to run	2008-06-20 11:00:19 +02:00
sched_stats.h	sched, delay accounting: fix incorrect delay time when constantly waiting on runqueue	2008-06-19 14:15:28 +02:00
seccomp.c
semaphore.c	Revert "semaphore: fix"	2008-05-10 20:43:22 -07:00
signal.c	posix timers: discard SI_TIMER signals on exec	2008-05-26 10:37:07 -07:00
softirq.c	Fix cpu hotplug problem in softirq code	2008-05-01 08:03:58 -07:00
softlockup.c	softlockup: print a module list on being stuck	2008-07-05 08:51:24 +02:00
spinlock.c
srcu.c
stacktrace.c
stop_machine.c	stop_machine: make stop_machine_run more virtualization friendly	2008-05-23 13:09:34 +10:00
sys.c	sys_prctl(): fix return of uninitialized value	2008-05-24 09:56:13 -07:00
sys_ni.c
sysctl.c	[PATCH] avoid multiplication overflows and signedness issues for max_fds	2008-05-16 17:22:52 -04:00
sysctl_check.c
taskstats.c	Use find_task_by_vpid in taskstats	2008-04-30 08:29:48 -07:00
test_kprobes.c
time.c	Make constants in kernel/timeconst.h fixed 64 bits	2008-05-02 16:18:42 -07:00
timeconst.pl	Make constants in kernel/timeconst.h fixed 64 bits	2008-05-02 16:18:42 -07:00
timer.c	debugobjects: add timer specific object debugging code	2008-04-30 08:29:53 -07:00
tsacct.c
uid16.c	asmlinkage_protect replaces prevent_tail_call	2008-04-10 17:28:26 -07:00
user.c	alloc_uid: cleanup	2008-04-30 08:29:53 -07:00
user_namespace.c	eCryptfs: make key module subsystem respect namespaces	2008-04-29 08:06:07 -07:00
utsname.c	kernel: explicitly include required header files under kernel/	2008-04-29 08:06:04 -07:00
utsname_sysctl.c
wait.c
workqueue.c	Christoph has moved	2008-07-04 10:40:04 -07:00