summaryrefslogtreecommitdiff
path: root/security/yama/yama_lsm.c
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2012-09-15 08:24:42 +0200
committerTakashi Iwai <tiwai@suse.de>2012-09-15 08:24:42 +0200
commit5d037f9064a8f3b9abbe383cdfb35e159d813711 (patch)
tree2a2445271ee818c360c42408a324d2945a6dd9f7 /security/yama/yama_lsm.c
parent64f1e00d8edb54f5d25fb0114a46050fb8340df4 (diff)
parent985b11fa8064d55d0d5a84e68667434598911bb2 (diff)
Merge tag 'asoc-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linussound-3.6
ASoC: Updates for 3.6 A bigger set of updates than I'm entirely comfortable with - things backed up a bit due to travel. As ever the majority of these are small, focused updates for specific drivers though there are a couple of core changes. There's been good exposure in -next. The AT91 patch fixes a build break.
Diffstat (limited to 'security/yama/yama_lsm.c')
-rw-r--r--security/yama/yama_lsm.c41
1 files changed, 41 insertions, 0 deletions
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index 83554ee8a587..d51b7c76c37d 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -290,10 +290,51 @@ static int yama_ptrace_access_check(struct task_struct *child,
return rc;
}
+/**
+ * yama_ptrace_traceme - validate PTRACE_TRACEME calls
+ * @parent: task that will become the ptracer of the current task
+ *
+ * Returns 0 if following the ptrace is allowed, -ve on error.
+ */
+static int yama_ptrace_traceme(struct task_struct *parent)
+{
+ int rc;
+
+ /* If standard caps disallows it, so does Yama. We should
+ * only tighten restrictions further.
+ */
+ rc = cap_ptrace_traceme(parent);
+ if (rc)
+ return rc;
+
+ /* Only disallow PTRACE_TRACEME on more aggressive settings. */
+ switch (ptrace_scope) {
+ case YAMA_SCOPE_CAPABILITY:
+ if (!ns_capable(task_user_ns(parent), CAP_SYS_PTRACE))
+ rc = -EPERM;
+ break;
+ case YAMA_SCOPE_NO_ATTACH:
+ rc = -EPERM;
+ break;
+ }
+
+ if (rc) {
+ char name[sizeof(current->comm)];
+ printk_ratelimited(KERN_NOTICE
+ "ptraceme of pid %d was attempted by: %s (pid %d)\n",
+ current->pid,
+ get_task_comm(name, parent),
+ parent->pid);
+ }
+
+ return rc;
+}
+
static struct security_operations yama_ops = {
.name = "yama",
.ptrace_access_check = yama_ptrace_access_check,
+ .ptrace_traceme = yama_ptrace_traceme,
.task_prctl = yama_task_prctl,
.task_free = yama_task_free,
};