Commit 71ef2a46 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of...

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
  security: Fix setting of PF_SUPERPRIV by __capable()
parents d121db94 5cd9c58f
...@@ -503,8 +503,19 @@ extern const kernel_cap_t __cap_init_eff_set; ...@@ -503,8 +503,19 @@ extern const kernel_cap_t __cap_init_eff_set;
kernel_cap_t cap_set_effective(const kernel_cap_t pE_new); kernel_cap_t cap_set_effective(const kernel_cap_t pE_new);
int capable(int cap); /**
int __capable(struct task_struct *t, int cap); * has_capability - Determine if a task has a superior capability available
* @t: The task in question
* @cap: The capability to be tested for
*
* Return true if the specified task has the given superior capability
* currently in effect, false if not.
*
* Note that this does not set PF_SUPERPRIV on the task.
*/
#define has_capability(t, cap) (security_capable((t), (cap)) == 0)
extern int capable(int cap);
#endif /* __KERNEL__ */ #endif /* __KERNEL__ */
......
...@@ -46,8 +46,8 @@ struct audit_krule; ...@@ -46,8 +46,8 @@ struct audit_krule;
*/ */
extern int cap_capable(struct task_struct *tsk, int cap); extern int cap_capable(struct task_struct *tsk, int cap);
extern int cap_settime(struct timespec *ts, struct timezone *tz); extern int cap_settime(struct timespec *ts, struct timezone *tz);
extern int cap_ptrace(struct task_struct *parent, struct task_struct *child, extern int cap_ptrace_may_access(struct task_struct *child, unsigned int mode);
unsigned int mode); extern int cap_ptrace_traceme(struct task_struct *parent);
extern int cap_capget(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted); extern int cap_capget(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
extern int cap_capset_check(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted); extern int cap_capset_check(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
extern void cap_capset_set(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted); extern void cap_capset_set(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
...@@ -1157,17 +1157,24 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) ...@@ -1157,17 +1157,24 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
* @alter contains the flag indicating whether changes are to be made. * @alter contains the flag indicating whether changes are to be made.
* Return 0 if permission is granted. * Return 0 if permission is granted.
* *
* @ptrace: * @ptrace_may_access:
* Check permission before allowing the @parent process to trace the * Check permission before allowing the current process to trace the
* @child process. * @child process.
* Security modules may also want to perform a process tracing check * Security modules may also want to perform a process tracing check
* during an execve in the set_security or apply_creds hooks of * during an execve in the set_security or apply_creds hooks of
* binprm_security_ops if the process is being traced and its security * binprm_security_ops if the process is being traced and its security
* attributes would be changed by the execve. * attributes would be changed by the execve.
* @parent contains the task_struct structure for parent process. * @child contains the task_struct structure for the target process.
* @child contains the task_struct structure for child process.
* @mode contains the PTRACE_MODE flags indicating the form of access. * @mode contains the PTRACE_MODE flags indicating the form of access.
* Return 0 if permission is granted. * Return 0 if permission is granted.
* @ptrace_traceme:
* Check that the @parent process has sufficient permission to trace the
* current process before allowing the current process to present itself
* to the @parent process for tracing.
* The parent process will still have to undergo the ptrace_may_access
* checks before it is allowed to trace this one.
* @parent contains the task_struct structure for debugger process.
* Return 0 if permission is granted.
* @capget: * @capget:
* Get the @effective, @inheritable, and @permitted capability sets for * Get the @effective, @inheritable, and @permitted capability sets for
* the @target process. The hook may also perform permission checking to * the @target process. The hook may also perform permission checking to
...@@ -1287,8 +1294,8 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) ...@@ -1287,8 +1294,8 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
struct security_operations { struct security_operations {
char name[SECURITY_NAME_MAX + 1]; char name[SECURITY_NAME_MAX + 1];
int (*ptrace) (struct task_struct *parent, struct task_struct *child, int (*ptrace_may_access) (struct task_struct *child, unsigned int mode);
unsigned int mode); int (*ptrace_traceme) (struct task_struct *parent);
int (*capget) (struct task_struct *target, int (*capget) (struct task_struct *target,
kernel_cap_t *effective, kernel_cap_t *effective,
kernel_cap_t *inheritable, kernel_cap_t *permitted); kernel_cap_t *inheritable, kernel_cap_t *permitted);
...@@ -1560,8 +1567,8 @@ extern struct dentry *securityfs_create_dir(const char *name, struct dentry *par ...@@ -1560,8 +1567,8 @@ extern struct dentry *securityfs_create_dir(const char *name, struct dentry *par
extern void securityfs_remove(struct dentry *dentry); extern void securityfs_remove(struct dentry *dentry);
/* Security operations */ /* Security operations */
int security_ptrace(struct task_struct *parent, struct task_struct *child, int security_ptrace_may_access(struct task_struct *child, unsigned int mode);
unsigned int mode); int security_ptrace_traceme(struct task_struct *parent);
int security_capget(struct task_struct *target, int security_capget(struct task_struct *target,
kernel_cap_t *effective, kernel_cap_t *effective,
kernel_cap_t *inheritable, kernel_cap_t *inheritable,
...@@ -1742,11 +1749,15 @@ static inline int security_init(void) ...@@ -1742,11 +1749,15 @@ static inline int security_init(void)
return 0; return 0;
} }
static inline int security_ptrace(struct task_struct *parent, static inline int security_ptrace_may_access(struct task_struct *child,
struct task_struct *child, unsigned int mode)
unsigned int mode) {
return cap_ptrace_may_access(child, mode);
}
static inline int security_ptrace_traceme(struct task_struct *child)
{ {
return cap_ptrace(parent, child, mode); return cap_ptrace_traceme(parent);
} }
static inline int security_capget(struct task_struct *target, static inline int security_capget(struct task_struct *target,
......
...@@ -486,17 +486,22 @@ asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data) ...@@ -486,17 +486,22 @@ asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
return ret; return ret;
} }
int __capable(struct task_struct *t, int cap) /**
* capable - Determine if the current task has a superior capability in effect
* @cap: The capability to be tested for
*
* Return true if the current task has the given superior capability currently
* available for use, false if not.
*
* This sets PF_SUPERPRIV on the task if the capability is available on the
* assumption that it's about to be used.
*/
int capable(int cap)
{ {
if (security_capable(t, cap) == 0) { if (has_capability(current, cap)) {
t->flags |= PF_SUPERPRIV; current->flags |= PF_SUPERPRIV;
return 1; return 1;
} }
return 0; return 0;
} }
int capable(int cap)
{
return __capable(current, cap);
}
EXPORT_SYMBOL(capable); EXPORT_SYMBOL(capable);
...@@ -140,7 +140,7 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode) ...@@ -140,7 +140,7 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
if (!dumpable && !capable(CAP_SYS_PTRACE)) if (!dumpable && !capable(CAP_SYS_PTRACE))
return -EPERM; return -EPERM;
return security_ptrace(current, task, mode); return security_ptrace_may_access(task, mode);
} }
bool ptrace_may_access(struct task_struct *task, unsigned int mode) bool ptrace_may_access(struct task_struct *task, unsigned int mode)
...@@ -499,8 +499,7 @@ int ptrace_traceme(void) ...@@ -499,8 +499,7 @@ int ptrace_traceme(void)
goto repeat; goto repeat;
} }
ret = security_ptrace(current->parent, current, ret = security_ptrace_traceme(current->parent);
PTRACE_MODE_ATTACH);
/* /*
* Set the ptrace bit in the process ptrace flags. * Set the ptrace bit in the process ptrace flags.
......
...@@ -26,6 +26,7 @@ ...@@ -26,6 +26,7 @@
#include <linux/module.h> #include <linux/module.h>
#include <linux/notifier.h> #include <linux/notifier.h>
#include <linux/memcontrol.h> #include <linux/memcontrol.h>
#include <linux/security.h>
int sysctl_panic_on_oom; int sysctl_panic_on_oom;
int sysctl_oom_kill_allocating_task; int sysctl_oom_kill_allocating_task;
...@@ -128,7 +129,8 @@ unsigned long badness(struct task_struct *p, unsigned long uptime) ...@@ -128,7 +129,8 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
* Superuser processes are usually more important, so we make it * Superuser processes are usually more important, so we make it
* less likely that we kill those. * less likely that we kill those.
*/ */
if (__capable(p, CAP_SYS_ADMIN) || __capable(p, CAP_SYS_RESOURCE)) if (has_capability(p, CAP_SYS_ADMIN) ||
has_capability(p, CAP_SYS_RESOURCE))
points /= 4; points /= 4;
/* /*
...@@ -137,7 +139,7 @@ unsigned long badness(struct task_struct *p, unsigned long uptime) ...@@ -137,7 +139,7 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
* tend to only have this flag set on applications they think * tend to only have this flag set on applications they think
* of as important. * of as important.
*/ */
if (__capable(p, CAP_SYS_RAWIO)) if (has_capability(p, CAP_SYS_RAWIO))
points /= 4; points /= 4;
/* /*
......
...@@ -811,7 +811,8 @@ struct security_operations default_security_ops = { ...@@ -811,7 +811,8 @@ struct security_operations default_security_ops = {
void security_fixup_ops(struct security_operations *ops) void security_fixup_ops(struct security_operations *ops)
{ {
set_to_cap_if_null(ops, ptrace); set_to_cap_if_null(ops, ptrace_may_access);
set_to_cap_if_null(ops, ptrace_traceme);
set_to_cap_if_null(ops, capget); set_to_cap_if_null(ops, capget);
set_to_cap_if_null(ops, capset_check); set_to_cap_if_null(ops, capset_check);
set_to_cap_if_null(ops, capset_set); set_to_cap_if_null(ops, capset_set);
......
...@@ -63,14 +63,24 @@ int cap_settime(struct timespec *ts, struct timezone *tz) ...@@ -63,14 +63,24 @@ int cap_settime(struct timespec *ts, struct timezone *tz)
return 0; return 0;
} }
int cap_ptrace (struct task_struct *parent, struct task_struct *child, int cap_ptrace_may_access(struct task_struct *child, unsigned int mode)
unsigned int mode)
{ {
/* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */ /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
if (!cap_issubset(child->cap_permitted, parent->cap_permitted) && if (cap_issubset(child->cap_permitted, current->cap_permitted))
!__capable(parent, CAP_SYS_PTRACE)) return 0;
return -EPERM; if (capable(CAP_SYS_PTRACE))
return 0; return 0;
return -EPERM;
}
int cap_ptrace_traceme(struct task_struct *parent)
{
/* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
if (cap_issubset(current->cap_permitted, parent->cap_permitted))
return 0;
if (has_capability(parent, CAP_SYS_PTRACE))
return 0;
return -EPERM;
} }
int cap_capget (struct task_struct *target, kernel_cap_t *effective, int cap_capget (struct task_struct *target, kernel_cap_t *effective,
...@@ -534,7 +544,7 @@ int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid, ...@@ -534,7 +544,7 @@ int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid,
static inline int cap_safe_nice(struct task_struct *p) static inline int cap_safe_nice(struct task_struct *p)
{ {
if (!cap_issubset(p->cap_permitted, current->cap_permitted) && if (!cap_issubset(p->cap_permitted, current->cap_permitted) &&
!__capable(current, CAP_SYS_NICE)) !capable(CAP_SYS_NICE))
return -EPERM; return -EPERM;
return 0; return 0;
} }
......
...@@ -72,7 +72,8 @@ static int rootplug_bprm_check_security (struct linux_binprm *bprm) ...@@ -72,7 +72,8 @@ static int rootplug_bprm_check_security (struct linux_binprm *bprm)
static struct security_operations rootplug_security_ops = { static struct security_operations rootplug_security_ops = {
/* Use the capability functions for some of the hooks */ /* Use the capability functions for some of the hooks */
.ptrace = cap_ptrace, .ptrace_may_access = cap_ptrace_may_access,
.ptrace_traceme = cap_ptrace_traceme,
.capget = cap_capget, .capget = cap_capget,
.capset_check = cap_capset_check, .capset_check = cap_capset_check,
.capset_set = cap_capset_set, .capset_set = cap_capset_set,
......
...@@ -127,10 +127,14 @@ int register_security(struct security_operations *ops) ...@@ -127,10 +127,14 @@ int register_security(struct security_operations *ops)
/* Security operations */ /* Security operations */
int security_ptrace(struct task_struct *parent, struct task_struct *child, int security_ptrace_may_access(struct task_struct *child, unsigned int mode)
unsigned int mode)
{ {
return security_ops->ptrace(parent, child, mode); return security_ops->ptrace_may_access(child, mode);
}
int security_ptrace_traceme(struct task_struct *parent)
{
return security_ops->ptrace_traceme(parent);
} }
int security_capget(struct task_struct *target, int security_capget(struct task_struct *target,
......
...@@ -1738,24 +1738,34 @@ static inline u32 file_to_av(struct file *file) ...@@ -1738,24 +1738,34 @@ static inline u32 file_to_av(struct file *file)
/* Hook functions begin here. */ /* Hook functions begin here. */
static int selinux_ptrace(struct task_struct *parent, static int selinux_ptrace_may_access(struct task_struct *child,
struct task_struct *child, unsigned int mode)
unsigned int mode)
{ {
int rc; int rc;
rc = secondary_ops->ptrace(parent, child, mode); rc = secondary_ops->ptrace_may_access(child, mode);
if (rc) if (rc)
return rc; return rc;
if (mode == PTRACE_MODE_READ) { if (mode == PTRACE_MODE_READ) {
struct task_security_struct *tsec = parent->security; struct task_security_struct *tsec = current->security;
struct task_security_struct *csec = child->security; struct task_security_struct *csec = child->security;
return avc_has_perm(tsec->sid, csec->sid, return avc_has_perm(tsec->sid, csec->sid,
SECCLASS_FILE, FILE__READ, NULL); SECCLASS_FILE, FILE__READ, NULL);
} }
return task_has_perm(parent, child, PROCESS__PTRACE); return task_has_perm(current, child, PROCESS__PTRACE);
}
static int selinux_ptrace_traceme(struct task_struct *parent)
{
int rc;
rc = secondary_ops->ptrace_traceme(parent);
if (rc)
return rc;
return task_has_perm(parent, current, PROCESS__PTRACE);
} }
static int selinux_capget(struct task_struct *target, kernel_cap_t *effective, static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
...@@ -5346,7 +5356,8 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer) ...@@ -5346,7 +5356,8 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
static struct security_operations selinux_ops = { static struct security_operations selinux_ops = {
.name = "selinux", .name = "selinux",
.ptrace = selinux_ptrace, .ptrace_may_access = selinux_ptrace_may_access,
.ptrace_traceme = selinux_ptrace_traceme,
.capget = selinux_capget, .capget = selinux_capget,
.capset_check = selinux_capset_check, .capset_check = selinux_capset_check,
.capset_set = selinux_capset_set, .capset_set = selinux_capset_set,
......
...@@ -87,27 +87,46 @@ struct inode_smack *new_inode_smack(char *smack) ...@@ -87,27 +87,46 @@ struct inode_smack *new_inode_smack(char *smack)
*/ */
/** /**
* smack_ptrace - Smack approval on ptrace * smack_ptrace_may_access - Smack approval on PTRACE_ATTACH
* @ptp: parent task pointer
* @ctp: child task pointer * @ctp: child task pointer
* *
* Returns 0 if access is OK, an error code otherwise * Returns 0 if access is OK, an error code otherwise
* *
* Do the capability checks, and require read and write. * Do the capability checks, and require read and write.
*/ */
static int smack_ptrace(struct task_struct *ptp, struct task_struct *ctp, static int smack_ptrace_may_access(struct task_struct *ctp, unsigned int mode)
unsigned int mode)
{ {
int rc; int rc;
rc = cap_ptrace(ptp, ctp, mode); rc = cap_ptrace_may_access(ctp, mode);
if (rc != 0) if (rc != 0)
return rc; return rc;
rc = smk_access(ptp->security, ctp->security, MAY_READWRITE); rc = smk_access(current->security, ctp->security, MAY_READWRITE);
if (rc != 0 && __capable(ptp, CAP_MAC_OVERRIDE)) if (rc != 0 && capable(CAP_MAC_OVERRIDE))
return 0; return 0;
return rc;
}
/**
* smack_ptrace_traceme - Smack approval on PTRACE_TRACEME
* @ptp: parent task pointer
*
* Returns 0 if access is OK, an error code otherwise
*
* Do the capability checks, and require read and write.
*/
static int smack_ptrace_traceme(struct task_struct *ptp)
{
int rc;
rc = cap_ptrace_traceme(ptp);
if (rc != 0)
return rc;
rc = smk_access(ptp->security, current->security, MAY_READWRITE);
if (rc != 0 && has_capability(ptp, CAP_MAC_OVERRIDE))
return 0;
return rc; return rc;
} }
...@@ -923,7 +942,7 @@ static int smack_file_send_sigiotask(struct task_struct *tsk, ...@@ -923,7 +942,7 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
*/ */
file = container_of(fown, struct file, f_owner); file = container_of(fown, struct file, f_owner);
rc = smk_access(file->f_security, tsk->security, MAY_WRITE); rc = smk_access(file->f_security, tsk->security, MAY_WRITE);
if (rc != 0 && __capable(tsk, CAP_MAC_OVERRIDE)) if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
return 0; return 0;
return rc; return rc;
} }
...@@ -1164,12 +1183,12 @@ static int smack_task_wait(struct task_struct *p) ...@@ -1164,12 +1183,12 @@ static int smack_task_wait(struct task_struct *p)
* account for the smack labels having gotten to * account for the smack labels having gotten to
* be different in the first place. * be different in the first place.
* *
* This breaks the strict subjet/object access * This breaks the strict subject/object access
* control ideal, taking the object's privilege * control ideal, taking the object's privilege
* state into account in the decision as well as * state into account in the decision as well as
* the smack value. * the smack value.
*/ */
if (capable(CAP_MAC_OVERRIDE) || __capable(p, CAP_MAC_OVERRIDE)) if (capable(CAP_MAC_OVERRIDE) || has_capability(p, CAP_MAC_OVERRIDE))
return 0; return 0;
return rc; return rc;
...@@ -2016,9 +2035,6 @@ static int smack_setprocattr(struct task_struct *p, char *name, ...@@ -2016,9 +2035,6 @@ static int smack_setprocattr(struct task_struct *p, char *name,
{ {
char *newsmack; char *newsmack;
if (!__capable(p, CAP_MAC_ADMIN))
return -EPERM;
/* /*
* Changing another process' Smack value is too dangerous * Changing another process' Smack value is too dangerous
* and supports no sane use case. * and supports no sane use case.
...@@ -2026,6 +2042,9 @@ static int smack_setprocattr(struct task_struct *p, char *name, ...@@ -2026,6 +2042,9 @@ static int smack_setprocattr(struct task_struct *p, char *name,
if (p != current) if (p != current)
return -EPERM; return -EPERM;
if (!capable(CAP_MAC_ADMIN))
return -EPERM;
if (value == NULL || size == 0 || size >= SMK_LABELLEN) if (value == NULL || size == 0 || size >= SMK_LABELLEN)
return -EINVAL; return -EINVAL;
...@@ -2552,7 +2571,8 @@ static void smack_release_secctx(char *secdata, u32 seclen) ...@@ -2552,7 +2571,8 @@ static void smack_release_secctx(char *secdata, u32 seclen)
struct security_operations smack_ops = { struct security_operations smack_ops = {
.name = "smack", .name = "smack",
.ptrace = smack_ptrace, .ptrace_may_access = smack_ptrace_may_access,
.ptrace_traceme = smack_ptrace_traceme,
.capget = cap_capget, .capget = cap_capget,
.capset_check = cap_capset_check, .capset_check = cap_capset_check,
.capset_set = cap_capset_set, .capset_set = cap_capset_set,
...@@ -2729,4 +2749,3 @@ static __init int smack_init(void) ...@@ -2729,4 +2749,3 @@ static __init int smack_init(void)
* all processes and objects when they are created. * all processes and objects when they are created.
*/ */
security_initcall(smack_init); security_initcall(smack_init);
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment