linux-kernel - Re: [PATCH 2/2] Yama: add PTRACE exception tracking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201006300109.o5U19s1N043912@www262.sakura.ne.jp>
Date:	Wed, 30 Jun 2010 10:09:54 +0900
From:	Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:	kees.cook@...onical.com
Cc:	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [PATCH 2/2] Yama: add PTRACE exception tracking

Kees Cook wrote:
> +static spinlock_t ptracer_relations_lock;
static DEFINE_SPINLOCK(ptracer_relations_lock);

> +static int yama_ptracer_add(struct task_struct *tracer,
> +			    struct task_struct *tracee)
> +{
> +	struct ptrace_relation *relation;
> +
> +	relation = kzalloc(sizeof(*relation), GFP_KERNEL);
You can use kmalloc() since all fields are initialized within this function.
> +	if (!relation)
> +		return -ENOMEM;
> +	relation->tracer = tracer;
> +	relation->tracee = tracee;
> +	spin_lock(&ptracer_relations_lock);
> +	list_add(&relation->node, &ptracer_relations);
> +	spin_unlock(&ptracer_relations_lock);
> +
> +	return 0;
> +}

> +static int ptracer_exception_found(struct task_struct *tracer,
> +				   struct task_struct *tracee)
> +{
> +	int rc = 0;
> +	struct ptrace_relation *relation;
> +	struct task_struct *parent = NULL;
> +
> +	spin_lock(&ptracer_relations_lock);
> +	list_for_each_entry(relation, &ptracer_relations, node)
> +		if (relation->tracee == tracee) {
> +			parent = relation->tracer;
> +			break;
> +		}
> +	if (task_is_descendant(parent, tracer))
> +		rc = 1;
> +	spin_unlock(&ptracer_relations_lock);

Can't we release ptracer_relations_lock before calling
task_is_descendant() since task_is_descendant() won't
access "struct ptrace_relation" on ptracer_relations list.

> @@ -32,27 +204,20 @@ static int yama_ptrace_access_check(struct task_struct *child,
>  {
>  	int rc;
>  
> +	/* If standard caps disallows it, so does Yama.  We should
> +	 * should only tighten restrictions further.
s/should should/should/
> +	 */

> @@ -221,6 +388,8 @@ static __init int yama_init(void)
>  
>  	printk(KERN_INFO "Yama: becoming mindful.\n");
>  
> +	spin_lock_init(&ptracer_relations_lock);
> +
You can statically initialize by using DEFINE_SPINLOCK().
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/