1 /* 2 * Yama Linux Security Module 3 * 4 * Author: Kees Cook <keescook@chromium.org> 5 * 6 * Copyright (C) 2010 Canonical, Ltd. 7 * Copyright (C) 2011 The Chromium OS Authors. 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License version 2, as 11 * published by the Free Software Foundation. 12 * 13 */ 14 15 #include <linux/lsm_hooks.h> 16 #include <linux/sysctl.h> 17 #include <linux/ptrace.h> 18 #include <linux/prctl.h> 19 #include <linux/ratelimit.h> 20 #include <linux/workqueue.h> 21 22 #define YAMA_SCOPE_DISABLED 0 23 #define YAMA_SCOPE_RELATIONAL 1 24 #define YAMA_SCOPE_CAPABILITY 2 25 #define YAMA_SCOPE_NO_ATTACH 3 26 27 static int ptrace_scope = YAMA_SCOPE_RELATIONAL; 28 29 /* describe a ptrace relationship for potential exception */ 30 struct ptrace_relation { 31 struct task_struct *tracer; 32 struct task_struct *tracee; 33 bool invalid; 34 struct list_head node; 35 struct rcu_head rcu; 36 }; 37 38 static LIST_HEAD(ptracer_relations); 39 static DEFINE_SPINLOCK(ptracer_relations_lock); 40 41 static void yama_relation_cleanup(struct work_struct *work); 42 static DECLARE_WORK(yama_relation_work, yama_relation_cleanup); 43 44 /** 45 * yama_relation_cleanup - remove invalid entries from the relation list 46 * 47 */ 48 static void yama_relation_cleanup(struct work_struct *work) 49 { 50 struct ptrace_relation *relation; 51 52 spin_lock(&ptracer_relations_lock); 53 rcu_read_lock(); 54 list_for_each_entry_rcu(relation, &ptracer_relations, node) { 55 if (relation->invalid) { 56 list_del_rcu(&relation->node); 57 kfree_rcu(relation, rcu); 58 } 59 } 60 rcu_read_unlock(); 61 spin_unlock(&ptracer_relations_lock); 62 } 63 64 /** 65 * yama_ptracer_add - add/replace an exception for this tracer/tracee pair 66 * @tracer: the task_struct of the process doing the ptrace 67 * @tracee: the task_struct of the process to be ptraced 68 * 69 * Each tracee can have, at most, one tracer registered. Each time this 70 * is called, the prior registered tracer will be replaced for the tracee. 71 * 72 * Returns 0 if relationship was added, -ve on error. 73 */ 74 static int yama_ptracer_add(struct task_struct *tracer, 75 struct task_struct *tracee) 76 { 77 struct ptrace_relation *relation, *added; 78 79 added = kmalloc(sizeof(*added), GFP_KERNEL); 80 if (!added) 81 return -ENOMEM; 82 83 added->tracee = tracee; 84 added->tracer = tracer; 85 added->invalid = false; 86 87 spin_lock(&ptracer_relations_lock); 88 rcu_read_lock(); 89 list_for_each_entry_rcu(relation, &ptracer_relations, node) { 90 if (relation->invalid) 91 continue; 92 if (relation->tracee == tracee) { 93 list_replace_rcu(&relation->node, &added->node); 94 kfree_rcu(relation, rcu); 95 goto out; 96 } 97 } 98 99 list_add_rcu(&added->node, &ptracer_relations); 100 101 out: 102 rcu_read_unlock(); 103 spin_unlock(&ptracer_relations_lock); 104 return 0; 105 } 106 107 /** 108 * yama_ptracer_del - remove exceptions related to the given tasks 109 * @tracer: remove any relation where tracer task matches 110 * @tracee: remove any relation where tracee task matches 111 */ 112 static void yama_ptracer_del(struct task_struct *tracer, 113 struct task_struct *tracee) 114 { 115 struct ptrace_relation *relation; 116 bool marked = false; 117 118 rcu_read_lock(); 119 list_for_each_entry_rcu(relation, &ptracer_relations, node) { 120 if (relation->invalid) 121 continue; 122 if (relation->tracee == tracee || 123 (tracer && relation->tracer == tracer)) { 124 relation->invalid = true; 125 marked = true; 126 } 127 } 128 rcu_read_unlock(); 129 130 if (marked) 131 schedule_work(&yama_relation_work); 132 } 133 134 /** 135 * yama_task_free - check for task_pid to remove from exception list 136 * @task: task being removed 137 */ 138 void yama_task_free(struct task_struct *task) 139 { 140 yama_ptracer_del(task, task); 141 } 142 143 /** 144 * yama_task_prctl - check for Yama-specific prctl operations 145 * @option: operation 146 * @arg2: argument 147 * @arg3: argument 148 * @arg4: argument 149 * @arg5: argument 150 * 151 * Return 0 on success, -ve on error. -ENOSYS is returned when Yama 152 * does not handle the given option. 153 */ 154 int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3, 155 unsigned long arg4, unsigned long arg5) 156 { 157 int rc = -ENOSYS; 158 struct task_struct *myself = current; 159 160 switch (option) { 161 case PR_SET_PTRACER: 162 /* Since a thread can call prctl(), find the group leader 163 * before calling _add() or _del() on it, since we want 164 * process-level granularity of control. The tracer group 165 * leader checking is handled later when walking the ancestry 166 * at the time of PTRACE_ATTACH check. 167 */ 168 rcu_read_lock(); 169 if (!thread_group_leader(myself)) 170 myself = rcu_dereference(myself->group_leader); 171 get_task_struct(myself); 172 rcu_read_unlock(); 173 174 if (arg2 == 0) { 175 yama_ptracer_del(NULL, myself); 176 rc = 0; 177 } else if (arg2 == PR_SET_PTRACER_ANY || (int)arg2 == -1) { 178 rc = yama_ptracer_add(NULL, myself); 179 } else { 180 struct task_struct *tracer; 181 182 rcu_read_lock(); 183 tracer = find_task_by_vpid(arg2); 184 if (tracer) 185 get_task_struct(tracer); 186 else 187 rc = -EINVAL; 188 rcu_read_unlock(); 189 190 if (tracer) { 191 rc = yama_ptracer_add(tracer, myself); 192 put_task_struct(tracer); 193 } 194 } 195 196 put_task_struct(myself); 197 break; 198 } 199 200 return rc; 201 } 202 203 /** 204 * task_is_descendant - walk up a process family tree looking for a match 205 * @parent: the process to compare against while walking up from child 206 * @child: the process to start from while looking upwards for parent 207 * 208 * Returns 1 if child is a descendant of parent, 0 if not. 209 */ 210 static int task_is_descendant(struct task_struct *parent, 211 struct task_struct *child) 212 { 213 int rc = 0; 214 struct task_struct *walker = child; 215 216 if (!parent || !child) 217 return 0; 218 219 rcu_read_lock(); 220 if (!thread_group_leader(parent)) 221 parent = rcu_dereference(parent->group_leader); 222 while (walker->pid > 0) { 223 if (!thread_group_leader(walker)) 224 walker = rcu_dereference(walker->group_leader); 225 if (walker == parent) { 226 rc = 1; 227 break; 228 } 229 walker = rcu_dereference(walker->real_parent); 230 } 231 rcu_read_unlock(); 232 233 return rc; 234 } 235 236 /** 237 * ptracer_exception_found - tracer registered as exception for this tracee 238 * @tracer: the task_struct of the process attempting ptrace 239 * @tracee: the task_struct of the process to be ptraced 240 * 241 * Returns 1 if tracer has is ptracer exception ancestor for tracee. 242 */ 243 static int ptracer_exception_found(struct task_struct *tracer, 244 struct task_struct *tracee) 245 { 246 int rc = 0; 247 struct ptrace_relation *relation; 248 struct task_struct *parent = NULL; 249 bool found = false; 250 251 rcu_read_lock(); 252 if (!thread_group_leader(tracee)) 253 tracee = rcu_dereference(tracee->group_leader); 254 list_for_each_entry_rcu(relation, &ptracer_relations, node) { 255 if (relation->invalid) 256 continue; 257 if (relation->tracee == tracee) { 258 parent = relation->tracer; 259 found = true; 260 break; 261 } 262 } 263 264 if (found && (parent == NULL || task_is_descendant(parent, tracer))) 265 rc = 1; 266 rcu_read_unlock(); 267 268 return rc; 269 } 270 271 /** 272 * yama_ptrace_access_check - validate PTRACE_ATTACH calls 273 * @child: task that current task is attempting to ptrace 274 * @mode: ptrace attach mode 275 * 276 * Returns 0 if following the ptrace is allowed, -ve on error. 277 */ 278 static int yama_ptrace_access_check(struct task_struct *child, 279 unsigned int mode) 280 { 281 int rc = 0; 282 283 /* require ptrace target be a child of ptracer on attach */ 284 if (mode == PTRACE_MODE_ATTACH) { 285 switch (ptrace_scope) { 286 case YAMA_SCOPE_DISABLED: 287 /* No additional restrictions. */ 288 break; 289 case YAMA_SCOPE_RELATIONAL: 290 rcu_read_lock(); 291 if (!task_is_descendant(current, child) && 292 !ptracer_exception_found(current, child) && 293 !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE)) 294 rc = -EPERM; 295 rcu_read_unlock(); 296 break; 297 case YAMA_SCOPE_CAPABILITY: 298 rcu_read_lock(); 299 if (!ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE)) 300 rc = -EPERM; 301 rcu_read_unlock(); 302 break; 303 case YAMA_SCOPE_NO_ATTACH: 304 default: 305 rc = -EPERM; 306 break; 307 } 308 } 309 310 if (rc) { 311 printk_ratelimited(KERN_NOTICE 312 "ptrace of pid %d was attempted by: %s (pid %d)\n", 313 child->pid, current->comm, current->pid); 314 } 315 316 return rc; 317 } 318 319 /** 320 * yama_ptrace_traceme - validate PTRACE_TRACEME calls 321 * @parent: task that will become the ptracer of the current task 322 * 323 * Returns 0 if following the ptrace is allowed, -ve on error. 324 */ 325 int yama_ptrace_traceme(struct task_struct *parent) 326 { 327 int rc = 0; 328 329 /* Only disallow PTRACE_TRACEME on more aggressive settings. */ 330 switch (ptrace_scope) { 331 case YAMA_SCOPE_CAPABILITY: 332 if (!has_ns_capability(parent, current_user_ns(), CAP_SYS_PTRACE)) 333 rc = -EPERM; 334 break; 335 case YAMA_SCOPE_NO_ATTACH: 336 rc = -EPERM; 337 break; 338 } 339 340 if (rc) { 341 printk_ratelimited(KERN_NOTICE 342 "ptraceme of pid %d was attempted by: %s (pid %d)\n", 343 current->pid, parent->comm, parent->pid); 344 } 345 346 return rc; 347 } 348 349 static struct security_hook_list yama_hooks[] = { 350 LSM_HOOK_INIT(ptrace_access_check, yama_ptrace_access_check), 351 LSM_HOOK_INIT(ptrace_traceme, yama_ptrace_traceme), 352 LSM_HOOK_INIT(task_prctl, yama_task_prctl), 353 LSM_HOOK_INIT(task_free, yama_task_free), 354 }; 355 356 void __init yama_add_hooks(void) 357 { 358 security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks)); 359 } 360 361 #ifdef CONFIG_SYSCTL 362 static int yama_dointvec_minmax(struct ctl_table *table, int write, 363 void __user *buffer, size_t *lenp, loff_t *ppos) 364 { 365 struct ctl_table table_copy; 366 367 if (write && !capable(CAP_SYS_PTRACE)) 368 return -EPERM; 369 370 /* Lock the max value if it ever gets set. */ 371 table_copy = *table; 372 if (*(int *)table_copy.data == *(int *)table_copy.extra2) 373 table_copy.extra1 = table_copy.extra2; 374 375 return proc_dointvec_minmax(&table_copy, write, buffer, lenp, ppos); 376 } 377 378 static int zero; 379 static int max_scope = YAMA_SCOPE_NO_ATTACH; 380 381 struct ctl_path yama_sysctl_path[] = { 382 { .procname = "kernel", }, 383 { .procname = "yama", }, 384 { } 385 }; 386 387 static struct ctl_table yama_sysctl_table[] = { 388 { 389 .procname = "ptrace_scope", 390 .data = &ptrace_scope, 391 .maxlen = sizeof(int), 392 .mode = 0644, 393 .proc_handler = yama_dointvec_minmax, 394 .extra1 = &zero, 395 .extra2 = &max_scope, 396 }, 397 { } 398 }; 399 #endif /* CONFIG_SYSCTL */ 400 401 static __init int yama_init(void) 402 { 403 #ifndef CONFIG_SECURITY_YAMA_STACKED 404 /* 405 * If yama is being stacked this is already taken care of. 406 */ 407 if (!security_module_enable("yama")) 408 return 0; 409 yama_add_hooks(); 410 #endif 411 pr_info("Yama: becoming mindful.\n"); 412 413 #ifdef CONFIG_SYSCTL 414 if (!register_sysctl_paths(yama_sysctl_path, yama_sysctl_table)) 415 panic("Yama: sysctl registration failed.\n"); 416 #endif 417 418 return 0; 419 } 420 421 security_initcall(yama_init); 422