2 * Yama Linux Security Module
4 * Author: Kees Cook <keescook@chromium.org>
6 * Copyright (C) 2010 Canonical, Ltd.
7 * Copyright (C) 2011 The Chromium OS Authors.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2, as
11 * published by the Free Software Foundation.
15 #include <linux/security.h>
16 #include <linux/sysctl.h>
17 #include <linux/ptrace.h>
18 #include <linux/prctl.h>
19 #include <linux/ratelimit.h>
21 static int ptrace_scope = 1;
23 /* describe a ptrace relationship for potential exception */
24 struct ptrace_relation {
25 struct task_struct *tracer;
26 struct task_struct *tracee;
27 struct list_head node;
30 static LIST_HEAD(ptracer_relations);
31 static DEFINE_SPINLOCK(ptracer_relations_lock);
34 * yama_ptracer_add - add/replace an exception for this tracer/tracee pair
35 * @tracer: the task_struct of the process doing the ptrace
36 * @tracee: the task_struct of the process to be ptraced
38 * Each tracee can have, at most, one tracer registered. Each time this
39 * is called, the prior registered tracer will be replaced for the tracee.
41 * Returns 0 if relationship was added, -ve on error.
43 static int yama_ptracer_add(struct task_struct *tracer,
44 struct task_struct *tracee)
47 struct ptrace_relation *added;
48 struct ptrace_relation *entry, *relation = NULL;
50 added = kmalloc(sizeof(*added), GFP_KERNEL);
54 spin_lock_bh(&ptracer_relations_lock);
55 list_for_each_entry(entry, &ptracer_relations, node)
56 if (entry->tracee == tracee) {
62 relation->tracee = tracee;
63 list_add(&relation->node, &ptracer_relations);
65 relation->tracer = tracer;
67 spin_unlock_bh(&ptracer_relations_lock);
68 if (added != relation)
75 * yama_ptracer_del - remove exceptions related to the given tasks
76 * @tracer: remove any relation where tracer task matches
77 * @tracee: remove any relation where tracee task matches
79 static void yama_ptracer_del(struct task_struct *tracer,
80 struct task_struct *tracee)
82 struct ptrace_relation *relation, *safe;
84 spin_lock_bh(&ptracer_relations_lock);
85 list_for_each_entry_safe(relation, safe, &ptracer_relations, node)
86 if (relation->tracee == tracee ||
87 (tracer && relation->tracer == tracer)) {
88 list_del(&relation->node);
91 spin_unlock_bh(&ptracer_relations_lock);
95 * yama_task_free - check for task_pid to remove from exception list
96 * @task: task being removed
98 static void yama_task_free(struct task_struct *task)
100 yama_ptracer_del(task, task);
104 * yama_task_prctl - check for Yama-specific prctl operations
111 * Return 0 on success, -ve on error. -ENOSYS is returned when Yama
112 * does not handle the given option.
114 static int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,
115 unsigned long arg4, unsigned long arg5)
118 struct task_struct *myself = current;
120 rc = cap_task_prctl(option, arg2, arg3, arg4, arg5);
126 /* Since a thread can call prctl(), find the group leader
127 * before calling _add() or _del() on it, since we want
128 * process-level granularity of control. The tracer group
129 * leader checking is handled later when walking the ancestry
130 * at the time of PTRACE_ATTACH check.
133 if (!thread_group_leader(myself))
134 myself = rcu_dereference(myself->group_leader);
135 get_task_struct(myself);
139 yama_ptracer_del(NULL, myself);
141 } else if (arg2 == PR_SET_PTRACER_ANY) {
142 rc = yama_ptracer_add(NULL, myself);
144 struct task_struct *tracer;
147 tracer = find_task_by_vpid(arg2);
149 get_task_struct(tracer);
155 rc = yama_ptracer_add(tracer, myself);
156 put_task_struct(tracer);
160 put_task_struct(myself);
168 * task_is_descendant - walk up a process family tree looking for a match
169 * @parent: the process to compare against while walking up from child
170 * @child: the process to start from while looking upwards for parent
172 * Returns 1 if child is a descendant of parent, 0 if not.
174 static int task_is_descendant(struct task_struct *parent,
175 struct task_struct *child)
178 struct task_struct *walker = child;
180 if (!parent || !child)
184 if (!thread_group_leader(parent))
185 parent = rcu_dereference(parent->group_leader);
186 while (walker->pid > 0) {
187 if (!thread_group_leader(walker))
188 walker = rcu_dereference(walker->group_leader);
189 if (walker == parent) {
193 walker = rcu_dereference(walker->real_parent);
201 * ptracer_exception_found - tracer registered as exception for this tracee
202 * @tracer: the task_struct of the process attempting ptrace
203 * @tracee: the task_struct of the process to be ptraced
205 * Returns 1 if tracer has is ptracer exception ancestor for tracee.
207 static int ptracer_exception_found(struct task_struct *tracer,
208 struct task_struct *tracee)
211 struct ptrace_relation *relation;
212 struct task_struct *parent = NULL;
215 spin_lock_bh(&ptracer_relations_lock);
217 if (!thread_group_leader(tracee))
218 tracee = rcu_dereference(tracee->group_leader);
219 list_for_each_entry(relation, &ptracer_relations, node)
220 if (relation->tracee == tracee) {
221 parent = relation->tracer;
226 if (found && (parent == NULL || task_is_descendant(parent, tracer)))
229 spin_unlock_bh(&ptracer_relations_lock);
235 * yama_ptrace_access_check - validate PTRACE_ATTACH calls
236 * @child: task that current task is attempting to ptrace
237 * @mode: ptrace attach mode
239 * Returns 0 if following the ptrace is allowed, -ve on error.
241 static int yama_ptrace_access_check(struct task_struct *child,
246 /* If standard caps disallows it, so does Yama. We should
247 * only tighten restrictions further.
249 rc = cap_ptrace_access_check(child, mode);
253 /* require ptrace target be a child of ptracer on attach */
254 if (mode == PTRACE_MODE_ATTACH &&
256 !task_is_descendant(current, child) &&
257 !ptracer_exception_found(current, child) &&
258 !capable(CAP_SYS_PTRACE))
262 char name[sizeof(current->comm)];
263 printk_ratelimited(KERN_NOTICE "ptrace of non-child"
264 " pid %d was attempted by: %s (pid %d)\n",
266 get_task_comm(name, current),
273 static struct security_operations yama_ops = {
276 .ptrace_access_check = yama_ptrace_access_check,
277 .task_prctl = yama_task_prctl,
278 .task_free = yama_task_free,
285 struct ctl_path yama_sysctl_path[] = {
286 { .procname = "kernel", },
287 { .procname = "yama", },
291 static struct ctl_table yama_sysctl_table[] = {
293 .procname = "ptrace_scope",
294 .data = &ptrace_scope,
295 .maxlen = sizeof(int),
297 .proc_handler = proc_dointvec_minmax,
303 #endif /* CONFIG_SYSCTL */
305 static __init int yama_init(void)
307 if (!security_module_enable(&yama_ops))
310 printk(KERN_INFO "Yama: becoming mindful.\n");
312 if (register_security(&yama_ops))
313 panic("Yama: kernel registration failed.\n");
316 if (!register_sysctl_paths(yama_sysctl_path, yama_sysctl_table))
317 panic("Yama: sysctl registration failed.\n");
323 security_initcall(yama_init);