redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

Yama: consolidate error reporting 

Use a common error reporting function for Yama violation reports, and give
more detail into the process command lines.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.l.morris@oracle.com>
hifive-unleashed-5.1
Kees Cook 2016-04-20 15:46:26 -07:00 committed by James Morris
parent 21985319ad
commit 8a56038c2a
1 changed files with 21 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
security/yama/yama_lsm.c
View File

@ -18,6 +18,7 @@
#include <linux/prctl.h>
#include <linux/ratelimit.h>
#include <linux/workqueue.h>
#include <linux/string_helpers.h>
#define YAMA_SCOPE_DISABLED 0
#define YAMA_SCOPE_RELATIONAL 1
@ -41,6 +42,22 @@ static DEFINE_SPINLOCK(ptracer_relations_lock);
static void yama_relation_cleanup(struct work_struct *work);
static DECLARE_WORK(yama_relation_work, yama_relation_cleanup);
static void report_access(const char *access, struct task_struct *target,
struct task_struct *agent)
{
char *target_cmd, *agent_cmd;
target_cmd = kstrdup_quotable_cmdline(target, GFP_KERNEL);
agent_cmd = kstrdup_quotable_cmdline(agent, GFP_KERNEL);
pr_notice_ratelimited(
"ptrace %s of \"%s\"[%d] was attempted by \"%s\"[%d]\n",
access, target_cmd, target->pid, agent_cmd, agent->pid);
kfree(agent_cmd);
kfree(target_cmd);
}
/**
* yama_relation_cleanup - remove invalid entries from the relation list
*
@ -307,11 +324,8 @@ static int yama_ptrace_access_check(struct task_struct *child,
}
}
if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0) {
printk_ratelimited(KERN_NOTICE
"ptrace of pid %d was attempted by: %s (pid %d)\n",
child->pid, current->comm, current->pid);
}
if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0)
report_access("attach", child, current);
return rc;
}
@ -337,11 +351,8 @@ int yama_ptrace_traceme(struct task_struct *parent)
break;
}
if (rc) {
printk_ratelimited(KERN_NOTICE
"ptraceme of pid %d was attempted by: %s (pid %d)\n",
current->pid, parent->comm, parent->pid);
}
if (rc)
report_access("traceme", current, parent);
return rc;
}