Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
OpenXiangShan
riscv-linux
提交
290f458a
R
riscv-linux
项目概览
OpenXiangShan
/
riscv-linux
12 个月 前同步成功
通知
6
Star
2
Fork
2
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
DevOps
流水线
流水线任务
计划
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
R
riscv-linux
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
DevOps
DevOps
流水线
流水线任务
计划
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
流水线任务
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
290f458a
编写于
6月 09, 2017
作者:
J
John Johansen
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
apparmor: allow ptrace checks to be finer grained than just capability
Signed-off-by:
N
John Johansen
<
john.johansen@canonical.com
>
上级
b2d09ae4
变更
3
隐藏空白更改
内联
并排
Showing
3 changed file
with
68 addition
and
0 deletion
+68
-0
security/apparmor/apparmorfs.c
security/apparmor/apparmorfs.c
+6
-0
security/apparmor/include/ipc.h
security/apparmor/include/ipc.h
+6
-0
security/apparmor/ipc.c
security/apparmor/ipc.c
+56
-0
未找到文件。
security/apparmor/apparmorfs.c
浏览文件 @
290f458a
...
...
@@ -2086,6 +2086,11 @@ static struct aa_sfs_entry aa_sfs_entry_file[] = {
{
}
};
static
struct
aa_sfs_entry
aa_sfs_entry_ptrace
[]
=
{
AA_SFS_FILE_STRING
(
"mask"
,
"read trace"
),
{
}
};
static
struct
aa_sfs_entry
aa_sfs_entry_domain
[]
=
{
AA_SFS_FILE_BOOLEAN
(
"change_hat"
,
1
),
AA_SFS_FILE_BOOLEAN
(
"change_hatv"
,
1
),
...
...
@@ -2125,6 +2130,7 @@ static struct aa_sfs_entry aa_sfs_entry_features[] = {
AA_SFS_FILE_U64
(
"capability"
,
VFS_CAP_FLAGS_MASK
),
AA_SFS_DIR
(
"rlimit"
,
aa_sfs_entry_rlimit
),
AA_SFS_DIR
(
"caps"
,
aa_sfs_entry_caps
),
AA_SFS_DIR
(
"ptrace"
,
aa_sfs_entry_ptrace
),
AA_SFS_DIR
(
"query"
,
aa_sfs_entry_query
),
{
}
};
...
...
security/apparmor/include/ipc.h
浏览文件 @
290f458a
...
...
@@ -21,6 +21,12 @@ struct aa_profile;
#define AA_PTRACE_TRACE MAY_WRITE
#define AA_PTRACE_READ MAY_READ
#define AA_MAY_BE_TRACED AA_MAY_APPEND
#define AA_MAY_BE_READ AA_MAY_CREATE
#define PTRACE_PERM_SHIFT 2
#define AA_PTRACE_PERM_MASK (AA_PTRACE_READ | AA_PTRACE_TRACE | \
AA_MAY_BE_READ | AA_MAY_BE_TRACED)
int
aa_may_ptrace
(
struct
aa_label
*
tracer
,
struct
aa_label
*
tracee
,
u32
request
);
...
...
security/apparmor/ipc.c
浏览文件 @
290f458a
...
...
@@ -21,20 +21,76 @@
#include "include/policy.h"
#include "include/ipc.h"
/**
* audit_ptrace_mask - convert mask to permission string
* @buffer: buffer to write string to (NOT NULL)
* @mask: permission mask to convert
*/
static
void
audit_ptrace_mask
(
struct
audit_buffer
*
ab
,
u32
mask
)
{
switch
(
mask
)
{
case
MAY_READ
:
audit_log_string
(
ab
,
"read"
);
break
;
case
MAY_WRITE
:
audit_log_string
(
ab
,
"trace"
);
break
;
case
AA_MAY_BE_READ
:
audit_log_string
(
ab
,
"readby"
);
break
;
case
AA_MAY_BE_TRACED
:
audit_log_string
(
ab
,
"tracedby"
);
break
;
}
}
/* call back to audit ptrace fields */
static
void
audit_ptrace_cb
(
struct
audit_buffer
*
ab
,
void
*
va
)
{
struct
common_audit_data
*
sa
=
va
;
if
(
aad
(
sa
)
->
request
&
AA_PTRACE_PERM_MASK
)
{
audit_log_format
(
ab
,
" requested_mask="
);
audit_ptrace_mask
(
ab
,
aad
(
sa
)
->
request
);
if
(
aad
(
sa
)
->
denied
&
AA_PTRACE_PERM_MASK
)
{
audit_log_format
(
ab
,
" denied_mask="
);
audit_ptrace_mask
(
ab
,
aad
(
sa
)
->
denied
);
}
}
audit_log_format
(
ab
,
" peer="
);
aa_label_xaudit
(
ab
,
labels_ns
(
aad
(
sa
)
->
label
),
aad
(
sa
)
->
peer
,
FLAGS_NONE
,
GFP_ATOMIC
);
}
/* TODO: conditionals */
static
int
profile_ptrace_perm
(
struct
aa_profile
*
profile
,
struct
aa_profile
*
peer
,
u32
request
,
struct
common_audit_data
*
sa
)
{
struct
aa_perms
perms
=
{
};
/* need because of peer in cross check */
if
(
profile_unconfined
(
profile
)
||
!
PROFILE_MEDIATES
(
profile
,
AA_CLASS_PTRACE
))
return
0
;
aad
(
sa
)
->
peer
=
&
peer
->
label
;
aa_profile_match_label
(
profile
,
&
peer
->
label
,
AA_CLASS_PTRACE
,
request
,
&
perms
);
aa_apply_modes_to_perms
(
profile
,
&
perms
);
return
aa_check_perms
(
profile
,
&
perms
,
request
,
sa
,
audit_ptrace_cb
);
}
static
int
cross_ptrace_perm
(
struct
aa_profile
*
tracer
,
struct
aa_profile
*
tracee
,
u32
request
,
struct
common_audit_data
*
sa
)
{
if
(
PROFILE_MEDIATES
(
tracer
,
AA_CLASS_PTRACE
))
return
xcheck
(
profile_ptrace_perm
(
tracer
,
tracee
,
request
,
sa
),
profile_ptrace_perm
(
tracee
,
tracer
,
request
<<
PTRACE_PERM_SHIFT
,
sa
));
/* policy uses the old style capability check for ptrace */
if
(
profile_unconfined
(
tracer
)
||
tracer
==
tracee
)
return
0
;
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录