2 * Yama Linux Security Module
4 * Author: Kees Cook <keescook@chromium.org>
6 * Copyright (C) 2010 Canonical, Ltd.
7 * Copyright (C) 2011 The Chromium OS Authors.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2, as
11 * published by the Free Software Foundation.
15 #include <linux/security.h>
16 #include <linux/sysctl.h>
17 #include <linux/ptrace.h>
18 #include <linux/prctl.h>
19 #include <linux/ratelimit.h>
21 #define YAMA_SCOPE_DISABLED 0
22 #define YAMA_SCOPE_RELATIONAL 1
23 #define YAMA_SCOPE_CAPABILITY 2
24 #define YAMA_SCOPE_NO_ATTACH 3
26 static int ptrace_scope = YAMA_SCOPE_RELATIONAL;
28 /* describe a ptrace relationship for potential exception */
29 struct ptrace_relation {
30 struct task_struct *tracer;
31 struct task_struct *tracee;
32 struct list_head node;
36 static LIST_HEAD(ptracer_relations);
37 static DEFINE_SPINLOCK(ptracer_relations_lock);
40 * yama_ptracer_add - add/replace an exception for this tracer/tracee pair
41 * @tracer: the task_struct of the process doing the ptrace
42 * @tracee: the task_struct of the process to be ptraced
44 * Each tracee can have, at most, one tracer registered. Each time this
45 * is called, the prior registered tracer will be replaced for the tracee.
47 * Returns 0 if relationship was added, -ve on error.
49 static int yama_ptracer_add(struct task_struct *tracer,
50 struct task_struct *tracee)
52 struct ptrace_relation *relation, *added;
54 added = kmalloc(sizeof(*added), GFP_KERNEL);
58 added->tracee = tracee;
59 added->tracer = tracer;
61 spin_lock_bh(&ptracer_relations_lock);
63 list_for_each_entry_rcu(relation, &ptracer_relations, node) {
64 if (relation->tracee == tracee) {
65 list_replace_rcu(&relation->node, &added->node);
66 kfree_rcu(relation, rcu);
71 list_add_rcu(&added->node, &ptracer_relations);
75 spin_unlock_bh(&ptracer_relations_lock);
80 * yama_ptracer_del - remove exceptions related to the given tasks
81 * @tracer: remove any relation where tracer task matches
82 * @tracee: remove any relation where tracee task matches
84 static void yama_ptracer_del(struct task_struct *tracer,
85 struct task_struct *tracee)
87 struct ptrace_relation *relation;
89 spin_lock_bh(&ptracer_relations_lock);
91 list_for_each_entry_rcu(relation, &ptracer_relations, node) {
92 if (relation->tracee == tracee ||
93 (tracer && relation->tracer == tracer)) {
94 list_del_rcu(&relation->node);
95 kfree_rcu(relation, rcu);
99 spin_unlock_bh(&ptracer_relations_lock);
103 * yama_task_free - check for task_pid to remove from exception list
104 * @task: task being removed
106 void yama_task_free(struct task_struct *task)
108 yama_ptracer_del(task, task);
112 * yama_task_prctl - check for Yama-specific prctl operations
119 * Return 0 on success, -ve on error. -ENOSYS is returned when Yama
120 * does not handle the given option.
122 int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,
123 unsigned long arg4, unsigned long arg5)
126 struct task_struct *myself = current;
128 rc = cap_task_prctl(option, arg2, arg3, arg4, arg5);
134 /* Since a thread can call prctl(), find the group leader
135 * before calling _add() or _del() on it, since we want
136 * process-level granularity of control. The tracer group
137 * leader checking is handled later when walking the ancestry
138 * at the time of PTRACE_ATTACH check.
141 if (!thread_group_leader(myself))
142 myself = rcu_dereference(myself->group_leader);
143 get_task_struct(myself);
147 yama_ptracer_del(NULL, myself);
149 } else if (arg2 == PR_SET_PTRACER_ANY || (int)arg2 == -1) {
150 rc = yama_ptracer_add(NULL, myself);
152 struct task_struct *tracer;
155 tracer = find_task_by_vpid(arg2);
157 get_task_struct(tracer);
163 rc = yama_ptracer_add(tracer, myself);
164 put_task_struct(tracer);
168 put_task_struct(myself);
176 * task_is_descendant - walk up a process family tree looking for a match
177 * @parent: the process to compare against while walking up from child
178 * @child: the process to start from while looking upwards for parent
180 * Returns 1 if child is a descendant of parent, 0 if not.
182 static int task_is_descendant(struct task_struct *parent,
183 struct task_struct *child)
186 struct task_struct *walker = child;
188 if (!parent || !child)
192 if (!thread_group_leader(parent))
193 parent = rcu_dereference(parent->group_leader);
194 while (walker->pid > 0) {
195 if (!thread_group_leader(walker))
196 walker = rcu_dereference(walker->group_leader);
197 if (walker == parent) {
201 walker = rcu_dereference(walker->real_parent);
209 * ptracer_exception_found - tracer registered as exception for this tracee
210 * @tracer: the task_struct of the process attempting ptrace
211 * @tracee: the task_struct of the process to be ptraced
213 * Returns 1 if tracer has is ptracer exception ancestor for tracee.
215 static int ptracer_exception_found(struct task_struct *tracer,
216 struct task_struct *tracee)
219 struct ptrace_relation *relation;
220 struct task_struct *parent = NULL;
224 if (!thread_group_leader(tracee))
225 tracee = rcu_dereference(tracee->group_leader);
226 list_for_each_entry_rcu(relation, &ptracer_relations, node)
227 if (relation->tracee == tracee) {
228 parent = relation->tracer;
233 if (found && (parent == NULL || task_is_descendant(parent, tracer)))
241 * yama_ptrace_access_check - validate PTRACE_ATTACH calls
242 * @child: task that current task is attempting to ptrace
243 * @mode: ptrace attach mode
245 * Returns 0 if following the ptrace is allowed, -ve on error.
247 int yama_ptrace_access_check(struct task_struct *child,
252 /* If standard caps disallows it, so does Yama. We should
253 * only tighten restrictions further.
255 rc = cap_ptrace_access_check(child, mode);
259 /* require ptrace target be a child of ptracer on attach */
260 if (mode == PTRACE_MODE_ATTACH) {
261 switch (ptrace_scope) {
262 case YAMA_SCOPE_DISABLED:
263 /* No additional restrictions. */
265 case YAMA_SCOPE_RELATIONAL:
266 if (!task_is_descendant(current, child) &&
267 !ptracer_exception_found(current, child) &&
268 !ns_capable(task_user_ns(child), CAP_SYS_PTRACE))
271 case YAMA_SCOPE_CAPABILITY:
272 if (!ns_capable(task_user_ns(child), CAP_SYS_PTRACE))
275 case YAMA_SCOPE_NO_ATTACH:
283 printk_ratelimited(KERN_NOTICE
284 "ptrace of pid %d was attempted by: %s (pid %d)\n",
285 child->pid, current->comm, current->pid);
292 * yama_ptrace_traceme - validate PTRACE_TRACEME calls
293 * @parent: task that will become the ptracer of the current task
295 * Returns 0 if following the ptrace is allowed, -ve on error.
297 int yama_ptrace_traceme(struct task_struct *parent)
301 /* If standard caps disallows it, so does Yama. We should
302 * only tighten restrictions further.
304 rc = cap_ptrace_traceme(parent);
308 /* Only disallow PTRACE_TRACEME on more aggressive settings. */
309 switch (ptrace_scope) {
310 case YAMA_SCOPE_CAPABILITY:
311 if (!ns_capable(task_user_ns(parent), CAP_SYS_PTRACE))
314 case YAMA_SCOPE_NO_ATTACH:
320 printk_ratelimited(KERN_NOTICE
321 "ptraceme of pid %d was attempted by: %s (pid %d)\n",
322 current->pid, parent->comm, parent->pid);
328 #ifndef CONFIG_SECURITY_YAMA_STACKED
329 static struct security_operations yama_ops = {
332 .ptrace_access_check = yama_ptrace_access_check,
333 .ptrace_traceme = yama_ptrace_traceme,
334 .task_prctl = yama_task_prctl,
335 .task_free = yama_task_free,
340 static int yama_dointvec_minmax(struct ctl_table *table, int write,
341 void __user *buffer, size_t *lenp, loff_t *ppos)
345 if (write && !capable(CAP_SYS_PTRACE))
348 rc = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
352 /* Lock the max value if it ever gets set. */
353 if (write && *(int *)table->data == *(int *)table->extra2)
354 table->extra1 = table->extra2;
360 static int max_scope = YAMA_SCOPE_NO_ATTACH;
362 struct ctl_path yama_sysctl_path[] = {
363 { .procname = "kernel", },
364 { .procname = "yama", },
368 static struct ctl_table yama_sysctl_table[] = {
370 .procname = "ptrace_scope",
371 .data = &ptrace_scope,
372 .maxlen = sizeof(int),
374 .proc_handler = yama_dointvec_minmax,
376 .extra2 = &max_scope,
380 #endif /* CONFIG_SYSCTL */
382 static __init int yama_init(void)
384 #ifndef CONFIG_SECURITY_YAMA_STACKED
385 if (!security_module_enable(&yama_ops))
389 printk(KERN_INFO "Yama: becoming mindful.\n");
391 #ifndef CONFIG_SECURITY_YAMA_STACKED
392 if (register_security(&yama_ops))
393 panic("Yama: kernel registration failed.\n");
397 if (!register_sysctl_paths(yama_sysctl_path, yama_sysctl_table))
398 panic("Yama: sysctl registration failed.\n");
404 security_initcall(yama_init);