• S
    Security: split proc ptrace checking into read vs. attach · 006ebb40
    Stephen Smalley 提交于
    Enable security modules to distinguish reading of process state via
    proc from full ptrace access by renaming ptrace_may_attach to
    ptrace_may_access and adding a mode argument indicating whether only
    read access or full attach access is requested.  This allows security
    modules to permit access to reading process state without granting
    full ptrace access.  The base DAC/capability checking remains unchanged.
    
    Read access to /proc/pid/mem continues to apply a full ptrace attach
    check since check_mem_permission() already requires the current task
    to already be ptracing the target.  The other ptrace checks within
    proc for elements like environ, maps, and fds are changed to pass the
    read mode instead of attach.
    
    In the SELinux case, we model such reading of process state as a
    reading of a proc file labeled with the target process' label.  This
    enables SELinux policy to permit such reading of process state without
    permitting control or manipulation of the target process, as there are
    a number of cases where programs probe for such information via proc
    but do not need to be able to control the target (e.g. procps,
    lsof, PolicyKit, ConsoleKit).  At present we have to choose between
    allowing full ptrace in policy (more permissive than required/desired)
    or breaking functionality (or in some cases just silencing the denials
    via dontaudit rules but this can hide genuine attacks).
    
    This version of the patch incorporates comments from Casey Schaufler
    (change/replace existing ptrace_may_attach interface, pass access
    mode), and Chris Wright (provide greater consistency in the checking).
    
    Note that like their predecessors __ptrace_may_attach and
    ptrace_may_attach, the __ptrace_may_access and ptrace_may_access
    interfaces use different return value conventions from each other (0
    or -errno vs. 1 or 0).  I retained this difference to avoid any
    changes to the caller logic but made the difference clearer by
    changing the latter interface to return a bool rather than an int and
    by adding a comment about it to ptrace.h for any future callers.
    Signed-off-by: NStephen Smalley <sds@tycho.nsa.gov>
    Acked-by: NChris Wright <chrisw@sous-sol.org>
    Signed-off-by: NJames Morris <jmorris@namei.org>
    006ebb40
task_nommu.c 4.5 KB