These changes are the raw update to linux-4.4.6-rt14. Kernel sources

[kvmfornfv.git] / kernel / security / yama / yama_lsm.c

diff --git a/kernel/security/yama/yama_lsm.c b/kernel/security/yama/yama_lsm.c
index 24aae2a..cb6ed10 100644 (file)
--- a/kernel/security/yama/yama_lsm.c
+++ b/kernel/security/yama/yama_lsm.c
@@ -12,7 +12,7 @@
  *
  */
 
-#include <linux/security.h>
+#include <linux/lsm_hooks.h>
 #include <linux/sysctl.h>
 #include <linux/ptrace.h>
 #include <linux/prctl.h>
@@ -154,13 +154,9 @@ void yama_task_free(struct task_struct *task)
 int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                           unsigned long arg4, unsigned long arg5)
 {
-       int rc;
+       int rc = -ENOSYS;
        struct task_struct *myself = current;
 
-       rc = cap_task_prctl(option, arg2, arg3, arg4, arg5);
-       if (rc != -ENOSYS)
-               return rc;
-
        switch (option) {
        case PR_SET_PTRACER:
                /* Since a thread can call prctl(), find the group leader
@@ -279,20 +275,13 @@ static int ptracer_exception_found(struct task_struct *tracer,
  *
  * Returns 0 if following the ptrace is allowed, -ve on error.
  */
-int yama_ptrace_access_check(struct task_struct *child,
+static int yama_ptrace_access_check(struct task_struct *child,
                                    unsigned int mode)
 {
-       int rc;
-
-       /* If standard caps disallows it, so does Yama.  We should
-        * only tighten restrictions further.
-        */
-       rc = cap_ptrace_access_check(child, mode);
-       if (rc)
-               return rc;
+       int rc = 0;
 
        /* require ptrace target be a child of ptracer on attach */
-       if (mode == PTRACE_MODE_ATTACH) {
+       if (mode & PTRACE_MODE_ATTACH) {
                switch (ptrace_scope) {
                case YAMA_SCOPE_DISABLED:
                        /* No additional restrictions. */
@@ -318,7 +307,7 @@ int yama_ptrace_access_check(struct task_struct *child,
                }
        }
 
-       if (rc) {
+       if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0) {
                printk_ratelimited(KERN_NOTICE
                        "ptrace of pid %d was attempted by: %s (pid %d)\n",
                        child->pid, current->comm, current->pid);
@@ -335,14 +324,7 @@ int yama_ptrace_access_check(struct task_struct *child,
  */
 int yama_ptrace_traceme(struct task_struct *parent)
 {
-       int rc;
-
-       /* If standard caps disallows it, so does Yama.  We should
-        * only tighten restrictions further.
-        */
-       rc = cap_ptrace_traceme(parent);
-       if (rc)
-               return rc;
+       int rc = 0;
 
        /* Only disallow PTRACE_TRACEME on more aggressive settings. */
        switch (ptrace_scope) {
@@ -364,16 +346,12 @@ int yama_ptrace_traceme(struct task_struct *parent)
        return rc;
 }
 
-#ifndef CONFIG_SECURITY_YAMA_STACKED
-static struct security_operations yama_ops = {
-       .name =                 "yama",
-
-       .ptrace_access_check =  yama_ptrace_access_check,
-       .ptrace_traceme =       yama_ptrace_traceme,
-       .task_prctl =           yama_task_prctl,
-       .task_free =            yama_task_free,
+static struct security_hook_list yama_hooks[] = {
+       LSM_HOOK_INIT(ptrace_access_check, yama_ptrace_access_check),
+       LSM_HOOK_INIT(ptrace_traceme, yama_ptrace_traceme),
+       LSM_HOOK_INIT(task_prctl, yama_task_prctl),
+       LSM_HOOK_INIT(task_free, yama_task_free),
 };
-#endif
 
 #ifdef CONFIG_SYSCTL
 static int yama_dointvec_minmax(struct ctl_table *table, int write,
@@ -413,28 +391,18 @@ static struct ctl_table yama_sysctl_table[] = {
        },
        { }
 };
-#endif /* CONFIG_SYSCTL */
-
-static __init int yama_init(void)
+static void __init yama_init_sysctl(void)
 {
-#ifndef CONFIG_SECURITY_YAMA_STACKED
-       if (!security_module_enable(&yama_ops))
-               return 0;
-#endif
-
-       printk(KERN_INFO "Yama: becoming mindful.\n");
-
-#ifndef CONFIG_SECURITY_YAMA_STACKED
-       if (register_security(&yama_ops))
-               panic("Yama: kernel registration failed.\n");
-#endif
-
-#ifdef CONFIG_SYSCTL
        if (!register_sysctl_paths(yama_sysctl_path, yama_sysctl_table))
                panic("Yama: sysctl registration failed.\n");
-#endif
-
-       return 0;
 }
+#else
+static inline void yama_init_sysctl(void) { }
+#endif /* CONFIG_SYSCTL */
 
-security_initcall(yama_init);
+void __init yama_add_hooks(void)
+{
+       pr_info("Yama: becoming mindful.\n");
+       security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks));
+       yama_init_sysctl();
+}