proc: remove kernel.maps_protect

After commit 831830b5a2b5d413407adf380ef62fe17d6fcbf2 aka
"restrict reading from /proc/<pid>/maps to those who share ->mm or can ptrace"
sysctl stopped being relevant because commit moved security checks from ->show
time to ->start time (mm_for_maps()).

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Acked-by: Kees Cook <kees.cook@canonical.com>

diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index f566ad9bcb7b6a4a58deab30f085d85f0e39746e..63ed861d5ca17d90165e9e48c42ace3c81943bdd 100644 (file)
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -1332,13 +1332,6 @@ determine whether or not they are still functioning properly.
 Because the NMI watchdog shares registers with oprofile, by disabling the NMI
 watchdog, oprofile may have more registers to utilize.
 
 Because the NMI watchdog shares registers with oprofile, by disabling the NMI
 watchdog, oprofile may have more registers to utilize.
 

-maps_protect
-------------
-
-Enables/Disables the protection of the per-process proc entries "maps" and
-"smaps".  When enabled, the contents of these files are visible only to
-readers that are allowed to ptrace() the given process.
-

 msgmni
 ------
 
 msgmni
 ------
 

diff --git a/fs/proc/base.c b/fs/proc/base.c
index c1332dd2575d16c33d5bd3b7075cef755e9cb976..b5918ae8ca79a7823bd6a4d3eb0ecfc0b08d30f6 100644 (file)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -148,9 +148,6 @@ static unsigned int pid_entry_count_dirs(const struct pid_entry *entries,
        return count;
 }
 
        return count;
 }
 

-int maps_protect;
-EXPORT_SYMBOL(maps_protect);
-

 static struct fs_struct *get_fs_struct(struct task_struct *task)
 {
        struct fs_struct *fs;
 static struct fs_struct *get_fs_struct(struct task_struct *task)
 {
        struct fs_struct *fs;

diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 442202314d5322292f87328b3e62b5427b3fa77a..3bfb7b8747b3f027657a217a18ff0a7bc37b6f5d 100644 (file)
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -45,8 +45,6 @@ do {                                          \
 extern int nommu_vma_show(struct seq_file *, struct vm_area_struct *);
 #endif
 
 extern int nommu_vma_show(struct seq_file *, struct vm_area_struct *);
 #endif
 

-extern int maps_protect;
-

 extern int proc_tid_stat(struct seq_file *m, struct pid_namespace *ns,
                                struct pid *pid, struct task_struct *task);
 extern int proc_tgid_stat(struct seq_file *m, struct pid_namespace *ns,
 extern int proc_tid_stat(struct seq_file *m, struct pid_namespace *ns,
                                struct pid *pid, struct task_struct *task);
 extern int proc_tgid_stat(struct seq_file *m, struct pid_namespace *ns,

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 73d1891ee6259e41f5be2f1d8d2a16948887097d..4806830ea2a1b0515c2faf00f52a6134f0f418c1 100644 (file)
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -210,9 +210,6 @@ static int show_map(struct seq_file *m, void *v)
        dev_t dev = 0;
        int len;
 
        dev_t dev = 0;
        int len;
 

-       if (maps_protect && !ptrace_may_access(task, PTRACE_MODE_READ))
-               return -EACCES;
-

        if (file) {
                struct inode *inode = vma->vm_file->f_path.dentry->d_inode;
                dev = inode->i_sb->s_dev;
        if (file) {
                struct inode *inode = vma->vm_file->f_path.dentry->d_inode;
                dev = inode->i_sb->s_dev;


@@ -742,22 +739,11 @@ const struct file_operations proc_pagemap_operations = {
 #ifdef CONFIG_NUMA
 extern int show_numa_map(struct seq_file *m, void *v);
 
 #ifdef CONFIG_NUMA
 extern int show_numa_map(struct seq_file *m, void *v);
 

-static int show_numa_map_checked(struct seq_file *m, void *v)
-{
-       struct proc_maps_private *priv = m->private;
-       struct task_struct *task = priv->task;
-
-       if (maps_protect && !ptrace_may_access(task, PTRACE_MODE_READ))
-               return -EACCES;
-
-       return show_numa_map(m, v);
-}
-

 static const struct seq_operations proc_pid_numa_maps_op = {
         .start  = m_start,
         .next   = m_next,
         .stop   = m_stop,
 static const struct seq_operations proc_pid_numa_maps_op = {
         .start  = m_start,
         .next   = m_next,
         .stop   = m_stop,

-        .show   = show_numa_map_checked
+        .show   = show_numa_map,

 };
 
 static int numa_maps_open(struct inode *inode, struct file *file)
 };
 
 static int numa_maps_open(struct inode *inode, struct file *file)

diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index 5d84e7121df819cd0d9eb8b9bd54973edf5b77ed..219bd79ea894f656d57f29c9b4527c41363ab3d1 100644 (file)
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -110,11 +110,6 @@ int task_statm(struct mm_struct *mm, int *shared, int *text,
 static int show_map(struct seq_file *m, void *_vml)
 {
        struct vm_list_struct *vml = _vml;
 static int show_map(struct seq_file *m, void *_vml)
 {
        struct vm_list_struct *vml = _vml;

-       struct proc_maps_private *priv = m->private;
-       struct task_struct *task = priv->task;
-
-       if (maps_protect && !ptrace_may_access(task, PTRACE_MODE_READ))
-               return -EACCES;

 
        return nommu_vma_show(m, vml->vma);
 }
 
        return nommu_vma_show(m, vml->vma);
 }

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 50ec0886fa3d355d696e9992a9057ce11a721525..cc3e0d7a5acf97c5854f01b0fc166ea245795517 100644 (file)
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -80,7 +80,6 @@ extern int pid_max_min, pid_max_max;
 extern int sysctl_drop_caches;
 extern int percpu_pagelist_fraction;
 extern int compat_log;
 extern int sysctl_drop_caches;
 extern int percpu_pagelist_fraction;
 extern int compat_log;

-extern int maps_protect;

 extern int latencytop_enabled;
 extern int sysctl_nr_open_min, sysctl_nr_open_max;
 #ifdef CONFIG_RCU_TORTURE_TEST
 extern int latencytop_enabled;
 extern int sysctl_nr_open_min, sysctl_nr_open_max;
 #ifdef CONFIG_RCU_TORTURE_TEST


@@ -809,16 +808,6 @@ static struct ctl_table kern_table[] = {
                .mode           = 0644,
                .proc_handler   = &proc_dointvec,
        },
                .mode           = 0644,
                .proc_handler   = &proc_dointvec,
        },

-#endif
-#ifdef CONFIG_PROC_FS
-       {
-               .ctl_name       = CTL_UNNUMBERED,
-               .procname       = "maps_protect",
-               .data           = &maps_protect,
-               .maxlen         = sizeof(int),
-               .mode           = 0644,
-               .proc_handler   = &proc_dointvec,
-       },

 #endif
        {
                .ctl_name       = CTL_UNNUMBERED,
 #endif
        {
                .ctl_name       = CTL_UNNUMBERED,