[kernel/f17] SELinux apply a different permission to ptrace a child vs non-child
Josh Boyer
jwboyer at fedoraproject.org
Wed Apr 11 12:22:17 UTC 2012
commit c6f2d01d81f0391079ea3c9c075e9463cce2b803
Author: Josh Boyer <jwboyer at redhat.com>
Date: Wed Apr 11 08:21:36 2012 -0400
SELinux apply a different permission to ptrace a child vs non-child
(rhbz 802072)
kernel.spec | 12 ++-
...pply-different-permission-to-ptrace-child.patch | 162 ++++++++++++++++++++
2 files changed, 173 insertions(+), 1 deletions(-)
---
diff --git a/kernel.spec b/kernel.spec
index e6b3215..cf92941 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -54,7 +54,7 @@ Summary: The Linux kernel
# For non-released -rc kernels, this will be appended after the rcX and
# gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
#
-%global baserelease 5
+%global baserelease 6
%global fedora_build %{baserelease}
# base_sublevel is the kernel version we're starting with and patching
@@ -797,6 +797,9 @@ Patch21520: KVM-Ensure-all-vcpus-are-consistent-with-in-kernel-i.patch
Patch22000: weird-root-dentry-name-debug.patch
+#selinux ptrace child permissions
+Patch22001: selinux-apply-different-permission-to-ptrace-child.patch
+
%endif
BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1542,6 +1545,9 @@ ApplyPatch libata-disable-runtime-pm-for-hotpluggable-port.patch
ApplyPatch x86-Use-correct-byte-sized-register-constraint-in-__xchg_op.patch
ApplyPatch x86-Use-correct-byte-sized-register-constraint-in-__add.patch
+#selinux ptrace child permissions
+ApplyPatch selinux-apply-different-permission-to-ptrace-child.patch
+
# END OF PATCH APPLICATIONS
%endif
@@ -2381,6 +2387,10 @@ fi
# '-' | |
# '-'
%changelog
+* Wed Apr 11 2012 Josh Boyer <jwboyer at redhat.com>
+- SELinux apply a different permission to ptrace a child vs non-child
+ (rhbz 802072)
+
* Tue Apr 10 2012 Mauro Carvalho Chehab <mchehab at redhat.com> 3.3.1-5
- Backport dvb-core and a few driver fixes from media tree (rhbz808871)
diff --git a/selinux-apply-different-permission-to-ptrace-child.patch b/selinux-apply-different-permission-to-ptrace-child.patch
new file mode 100644
index 0000000..90baad8
--- /dev/null
+++ b/selinux-apply-different-permission-to-ptrace-child.patch
@@ -0,0 +1,162 @@
+Some applications, like gdb, are able to ptrace both children or other
+completely unrelated tasks. We would like to be able to discern these two
+things and to be able to allow gdb to ptrace it's children, but not to be
+able to ptrace unrelated tasks for security reasons.
+
+Upstream is a bit weary of this patch as it may be incomplete. They are
+not fundamentally opposed to the patch, I was just ask to see if I could
+flush out any needed refinement in Fedora where we already had the
+problem. We may find that we need to emulate the YAMA non-child
+registration module in order to completely deal with 'normal' ptrace on
+a system. At the moment however, this patch will at least let us get
+gdb working for many users in Fedora (See fedora-devel-list for a
+discussion of the current issues people are complaining about in F17
+without this)
+
+---
+
+ security/selinux/hooks.c | 38 +++++++++++++++++++++++++++++++++++
+ security/selinux/include/classmap.h | 2 +-
+ security/selinux/include/security.h | 2 ++
+ security/selinux/selinuxfs.c | 3 ++-
+ security/selinux/ss/services.c | 3 +++
+ 5 files changed, 46 insertions(+), 2 deletions(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 1a4acf4..b226f26 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1805,6 +1805,39 @@ static inline u32 open_file_to_av(struct file *file)
+
+ /* Hook functions begin here. */
+
++/**
++ * task_is_descendant - walk up a process family tree looking for a match
++ * @parent: the process to compare against while walking up from child
++ * @child: the process to start from while looking upwards for parent
++ *
++ * Returns 1 if child is a descendant of parent, 0 if not.
++ */
++static int task_is_descendant(struct task_struct *parent,
++ struct task_struct *child)
++{
++ int rc = 0;
++ struct task_struct *walker = child;
++
++ if (!parent || !child)
++ return 0;
++
++ rcu_read_lock();
++ if (!thread_group_leader(parent))
++ parent = rcu_dereference(parent->group_leader);
++ while (walker->pid > 0) {
++ if (!thread_group_leader(walker))
++ walker = rcu_dereference(walker->group_leader);
++ if (walker == parent) {
++ rc = 1;
++ break;
++ }
++ walker = rcu_dereference(walker->real_parent);
++ }
++ rcu_read_unlock();
++
++ return rc;
++}
++
+ static int selinux_ptrace_access_check(struct task_struct *child,
+ unsigned int mode)
+ {
+@@ -1820,6 +1853,9 @@ static int selinux_ptrace_access_check(struct task_struct *child,
+ return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
+ }
+
++
++ if (selinux_policycap_ptrace_child && task_is_descendant(current, child))
++ return current_has_perm(child, PROCESS__PTRACE_CHILD);
+ return current_has_perm(child, PROCESS__PTRACE);
+ }
+
+@@ -1831,6 +1867,8 @@ static int selinux_ptrace_traceme(struct task_struct *parent)
+ if (rc)
+ return rc;
+
++ if (selinux_policycap_ptrace_child && task_is_descendant(parent, current))
++ return task_has_perm(parent, current, PROCESS__PTRACE_CHILD);
+ return task_has_perm(parent, current, PROCESS__PTRACE);
+ }
+
+diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
+index 39e678c..72c08b9 100644
+--- a/security/selinux/include/classmap.h
++++ b/security/selinux/include/classmap.h
+@@ -29,7 +29,7 @@ struct security_class_mapping secclass_map[] = {
+ "getattr", "setexec", "setfscreate", "noatsecure", "siginh",
+ "setrlimit", "rlimitinh", "dyntransition", "setcurrent",
+ "execmem", "execstack", "execheap", "setkeycreate",
+- "setsockcreate", NULL } },
++ "setsockcreate", "ptrace_child", NULL } },
+ { "system",
+ { "ipc_info", "syslog_read", "syslog_mod",
+ "syslog_console", "module_request", NULL } },
+diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
+index dde2005..ac14b0a 100644
+--- a/security/selinux/include/security.h
++++ b/security/selinux/include/security.h
+@@ -68,12 +68,14 @@ extern int selinux_enabled;
+ enum {
+ POLICYDB_CAPABILITY_NETPEER,
+ POLICYDB_CAPABILITY_OPENPERM,
++ POLICYDB_CAPABILITY_PTRACE_CHILD,
+ __POLICYDB_CAPABILITY_MAX
+ };
+ #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
+
+ extern int selinux_policycap_netpeer;
+ extern int selinux_policycap_openperm;
++extern int selinux_policycap_ptrace_child;
+
+ /*
+ * type_datum properties
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 4e93f9e..3379765 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -44,7 +44,8 @@
+ /* Policy capability filenames */
+ static char *policycap_names[] = {
+ "network_peer_controls",
+- "open_perms"
++ "open_perms",
++ "ptrace_child",
+ };
+
+ unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
+diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
+index 9b7e7ed..4d12a6e 100644
+--- a/security/selinux/ss/services.c
++++ b/security/selinux/ss/services.c
+@@ -72,6 +72,7 @@
+
+ int selinux_policycap_netpeer;
+ int selinux_policycap_openperm;
++int selinux_policycap_ptrace_child;
+
+ static DEFINE_RWLOCK(policy_rwlock);
+
+@@ -1812,6 +1813,8 @@ static void security_load_policycaps(void)
+ POLICYDB_CAPABILITY_NETPEER);
+ selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps,
+ POLICYDB_CAPABILITY_OPENPERM);
++ selinux_policycap_ptrace_child = ebitmap_get_bit(&policydb.policycaps,
++ POLICYDB_CAPABILITY_PTRACE_CHILD);
+ }
+
+ static int security_preserve_bools(struct policydb *p);
+
+
+
+
+_______________________________________________
+kernel mailing list
+kernel at lists.fedoraproject.org
+https://admin.fedoraproject.org/mailman/listinfo/kernel
More information about the scm-commits
mailing list