Merge branch 'fixes-v5.1-a' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris...
[muen/linux.git] / security / yama / yama_lsm.c
1 /*
2  * Yama Linux Security Module
3  *
4  * Author: Kees Cook <keescook@chromium.org>
5  *
6  * Copyright (C) 2010 Canonical, Ltd.
7  * Copyright (C) 2011 The Chromium OS Authors.
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License version 2, as
11  * published by the Free Software Foundation.
12  *
13  */
14
15 #include <linux/lsm_hooks.h>
16 #include <linux/sysctl.h>
17 #include <linux/ptrace.h>
18 #include <linux/prctl.h>
19 #include <linux/ratelimit.h>
20 #include <linux/workqueue.h>
21 #include <linux/string_helpers.h>
22 #include <linux/task_work.h>
23 #include <linux/sched.h>
24 #include <linux/spinlock.h>
25
26 #define YAMA_SCOPE_DISABLED     0
27 #define YAMA_SCOPE_RELATIONAL   1
28 #define YAMA_SCOPE_CAPABILITY   2
29 #define YAMA_SCOPE_NO_ATTACH    3
30
31 static int ptrace_scope = YAMA_SCOPE_RELATIONAL;
32
33 /* describe a ptrace relationship for potential exception */
34 struct ptrace_relation {
35         struct task_struct *tracer;
36         struct task_struct *tracee;
37         bool invalid;
38         struct list_head node;
39         struct rcu_head rcu;
40 };
41
42 static LIST_HEAD(ptracer_relations);
43 static DEFINE_SPINLOCK(ptracer_relations_lock);
44
45 static void yama_relation_cleanup(struct work_struct *work);
46 static DECLARE_WORK(yama_relation_work, yama_relation_cleanup);
47
48 struct access_report_info {
49         struct callback_head work;
50         const char *access;
51         struct task_struct *target;
52         struct task_struct *agent;
53 };
54
55 static void __report_access(struct callback_head *work)
56 {
57         struct access_report_info *info =
58                 container_of(work, struct access_report_info, work);
59         char *target_cmd, *agent_cmd;
60
61         target_cmd = kstrdup_quotable_cmdline(info->target, GFP_KERNEL);
62         agent_cmd = kstrdup_quotable_cmdline(info->agent, GFP_KERNEL);
63
64         pr_notice_ratelimited(
65                 "ptrace %s of \"%s\"[%d] was attempted by \"%s\"[%d]\n",
66                 info->access, target_cmd, info->target->pid, agent_cmd,
67                 info->agent->pid);
68
69         kfree(agent_cmd);
70         kfree(target_cmd);
71
72         put_task_struct(info->agent);
73         put_task_struct(info->target);
74         kfree(info);
75 }
76
77 /* defers execution because cmdline access can sleep */
78 static void report_access(const char *access, struct task_struct *target,
79                                 struct task_struct *agent)
80 {
81         struct access_report_info *info;
82         char agent_comm[sizeof(agent->comm)];
83
84         assert_spin_locked(&target->alloc_lock); /* for target->comm */
85
86         if (current->flags & PF_KTHREAD) {
87                 /* I don't think kthreads call task_work_run() before exiting.
88                  * Imagine angry ranting about procfs here.
89                  */
90                 pr_notice_ratelimited(
91                     "ptrace %s of \"%s\"[%d] was attempted by \"%s\"[%d]\n",
92                     access, target->comm, target->pid,
93                     get_task_comm(agent_comm, agent), agent->pid);
94                 return;
95         }
96
97         info = kmalloc(sizeof(*info), GFP_ATOMIC);
98         if (!info)
99                 return;
100         init_task_work(&info->work, __report_access);
101         get_task_struct(target);
102         get_task_struct(agent);
103         info->access = access;
104         info->target = target;
105         info->agent = agent;
106         if (task_work_add(current, &info->work, true) == 0)
107                 return; /* success */
108
109         WARN(1, "report_access called from exiting task");
110         put_task_struct(target);
111         put_task_struct(agent);
112         kfree(info);
113 }
114
115 /**
116  * yama_relation_cleanup - remove invalid entries from the relation list
117  *
118  */
119 static void yama_relation_cleanup(struct work_struct *work)
120 {
121         struct ptrace_relation *relation;
122
123         spin_lock(&ptracer_relations_lock);
124         rcu_read_lock();
125         list_for_each_entry_rcu(relation, &ptracer_relations, node) {
126                 if (relation->invalid) {
127                         list_del_rcu(&relation->node);
128                         kfree_rcu(relation, rcu);
129                 }
130         }
131         rcu_read_unlock();
132         spin_unlock(&ptracer_relations_lock);
133 }
134
135 /**
136  * yama_ptracer_add - add/replace an exception for this tracer/tracee pair
137  * @tracer: the task_struct of the process doing the ptrace
138  * @tracee: the task_struct of the process to be ptraced
139  *
140  * Each tracee can have, at most, one tracer registered. Each time this
141  * is called, the prior registered tracer will be replaced for the tracee.
142  *
143  * Returns 0 if relationship was added, -ve on error.
144  */
145 static int yama_ptracer_add(struct task_struct *tracer,
146                             struct task_struct *tracee)
147 {
148         struct ptrace_relation *relation, *added;
149
150         added = kmalloc(sizeof(*added), GFP_KERNEL);
151         if (!added)
152                 return -ENOMEM;
153
154         added->tracee = tracee;
155         added->tracer = tracer;
156         added->invalid = false;
157
158         spin_lock(&ptracer_relations_lock);
159         rcu_read_lock();
160         list_for_each_entry_rcu(relation, &ptracer_relations, node) {
161                 if (relation->invalid)
162                         continue;
163                 if (relation->tracee == tracee) {
164                         list_replace_rcu(&relation->node, &added->node);
165                         kfree_rcu(relation, rcu);
166                         goto out;
167                 }
168         }
169
170         list_add_rcu(&added->node, &ptracer_relations);
171
172 out:
173         rcu_read_unlock();
174         spin_unlock(&ptracer_relations_lock);
175         return 0;
176 }
177
178 /**
179  * yama_ptracer_del - remove exceptions related to the given tasks
180  * @tracer: remove any relation where tracer task matches
181  * @tracee: remove any relation where tracee task matches
182  */
183 static void yama_ptracer_del(struct task_struct *tracer,
184                              struct task_struct *tracee)
185 {
186         struct ptrace_relation *relation;
187         bool marked = false;
188
189         rcu_read_lock();
190         list_for_each_entry_rcu(relation, &ptracer_relations, node) {
191                 if (relation->invalid)
192                         continue;
193                 if (relation->tracee == tracee ||
194                     (tracer && relation->tracer == tracer)) {
195                         relation->invalid = true;
196                         marked = true;
197                 }
198         }
199         rcu_read_unlock();
200
201         if (marked)
202                 schedule_work(&yama_relation_work);
203 }
204
205 /**
206  * yama_task_free - check for task_pid to remove from exception list
207  * @task: task being removed
208  */
209 static void yama_task_free(struct task_struct *task)
210 {
211         yama_ptracer_del(task, task);
212 }
213
214 /**
215  * yama_task_prctl - check for Yama-specific prctl operations
216  * @option: operation
217  * @arg2: argument
218  * @arg3: argument
219  * @arg4: argument
220  * @arg5: argument
221  *
222  * Return 0 on success, -ve on error.  -ENOSYS is returned when Yama
223  * does not handle the given option.
224  */
225 static int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,
226                            unsigned long arg4, unsigned long arg5)
227 {
228         int rc = -ENOSYS;
229         struct task_struct *myself = current;
230
231         switch (option) {
232         case PR_SET_PTRACER:
233                 /* Since a thread can call prctl(), find the group leader
234                  * before calling _add() or _del() on it, since we want
235                  * process-level granularity of control. The tracer group
236                  * leader checking is handled later when walking the ancestry
237                  * at the time of PTRACE_ATTACH check.
238                  */
239                 rcu_read_lock();
240                 if (!thread_group_leader(myself))
241                         myself = rcu_dereference(myself->group_leader);
242                 get_task_struct(myself);
243                 rcu_read_unlock();
244
245                 if (arg2 == 0) {
246                         yama_ptracer_del(NULL, myself);
247                         rc = 0;
248                 } else if (arg2 == PR_SET_PTRACER_ANY || (int)arg2 == -1) {
249                         rc = yama_ptracer_add(NULL, myself);
250                 } else {
251                         struct task_struct *tracer;
252
253                         tracer = find_get_task_by_vpid(arg2);
254                         if (!tracer) {
255                                 rc = -EINVAL;
256                         } else {
257                                 rc = yama_ptracer_add(tracer, myself);
258                                 put_task_struct(tracer);
259                         }
260                 }
261
262                 put_task_struct(myself);
263                 break;
264         }
265
266         return rc;
267 }
268
269 /**
270  * task_is_descendant - walk up a process family tree looking for a match
271  * @parent: the process to compare against while walking up from child
272  * @child: the process to start from while looking upwards for parent
273  *
274  * Returns 1 if child is a descendant of parent, 0 if not.
275  */
276 static int task_is_descendant(struct task_struct *parent,
277                               struct task_struct *child)
278 {
279         int rc = 0;
280         struct task_struct *walker = child;
281
282         if (!parent || !child)
283                 return 0;
284
285         rcu_read_lock();
286         if (!thread_group_leader(parent))
287                 parent = rcu_dereference(parent->group_leader);
288         while (walker->pid > 0) {
289                 if (!thread_group_leader(walker))
290                         walker = rcu_dereference(walker->group_leader);
291                 if (walker == parent) {
292                         rc = 1;
293                         break;
294                 }
295                 walker = rcu_dereference(walker->real_parent);
296         }
297         rcu_read_unlock();
298
299         return rc;
300 }
301
302 /**
303  * ptracer_exception_found - tracer registered as exception for this tracee
304  * @tracer: the task_struct of the process attempting ptrace
305  * @tracee: the task_struct of the process to be ptraced
306  *
307  * Returns 1 if tracer has a ptracer exception ancestor for tracee.
308  */
309 static int ptracer_exception_found(struct task_struct *tracer,
310                                    struct task_struct *tracee)
311 {
312         int rc = 0;
313         struct ptrace_relation *relation;
314         struct task_struct *parent = NULL;
315         bool found = false;
316
317         rcu_read_lock();
318
319         /*
320          * If there's already an active tracing relationship, then make an
321          * exception for the sake of other accesses, like process_vm_rw().
322          */
323         parent = ptrace_parent(tracee);
324         if (parent != NULL && same_thread_group(parent, tracer)) {
325                 rc = 1;
326                 goto unlock;
327         }
328
329         /* Look for a PR_SET_PTRACER relationship. */
330         if (!thread_group_leader(tracee))
331                 tracee = rcu_dereference(tracee->group_leader);
332         list_for_each_entry_rcu(relation, &ptracer_relations, node) {
333                 if (relation->invalid)
334                         continue;
335                 if (relation->tracee == tracee) {
336                         parent = relation->tracer;
337                         found = true;
338                         break;
339                 }
340         }
341
342         if (found && (parent == NULL || task_is_descendant(parent, tracer)))
343                 rc = 1;
344
345 unlock:
346         rcu_read_unlock();
347
348         return rc;
349 }
350
351 /**
352  * yama_ptrace_access_check - validate PTRACE_ATTACH calls
353  * @child: task that current task is attempting to ptrace
354  * @mode: ptrace attach mode
355  *
356  * Returns 0 if following the ptrace is allowed, -ve on error.
357  */
358 static int yama_ptrace_access_check(struct task_struct *child,
359                                     unsigned int mode)
360 {
361         int rc = 0;
362
363         /* require ptrace target be a child of ptracer on attach */
364         if (mode & PTRACE_MODE_ATTACH) {
365                 switch (ptrace_scope) {
366                 case YAMA_SCOPE_DISABLED:
367                         /* No additional restrictions. */
368                         break;
369                 case YAMA_SCOPE_RELATIONAL:
370                         rcu_read_lock();
371                         if (!pid_alive(child))
372                                 rc = -EPERM;
373                         if (!rc && !task_is_descendant(current, child) &&
374                             !ptracer_exception_found(current, child) &&
375                             !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))
376                                 rc = -EPERM;
377                         rcu_read_unlock();
378                         break;
379                 case YAMA_SCOPE_CAPABILITY:
380                         rcu_read_lock();
381                         if (!ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))
382                                 rc = -EPERM;
383                         rcu_read_unlock();
384                         break;
385                 case YAMA_SCOPE_NO_ATTACH:
386                 default:
387                         rc = -EPERM;
388                         break;
389                 }
390         }
391
392         if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0)
393                 report_access("attach", child, current);
394
395         return rc;
396 }
397
398 /**
399  * yama_ptrace_traceme - validate PTRACE_TRACEME calls
400  * @parent: task that will become the ptracer of the current task
401  *
402  * Returns 0 if following the ptrace is allowed, -ve on error.
403  */
404 static int yama_ptrace_traceme(struct task_struct *parent)
405 {
406         int rc = 0;
407
408         /* Only disallow PTRACE_TRACEME on more aggressive settings. */
409         switch (ptrace_scope) {
410         case YAMA_SCOPE_CAPABILITY:
411                 if (!has_ns_capability(parent, current_user_ns(), CAP_SYS_PTRACE))
412                         rc = -EPERM;
413                 break;
414         case YAMA_SCOPE_NO_ATTACH:
415                 rc = -EPERM;
416                 break;
417         }
418
419         if (rc) {
420                 task_lock(current);
421                 report_access("traceme", current, parent);
422                 task_unlock(current);
423         }
424
425         return rc;
426 }
427
428 static struct security_hook_list yama_hooks[] __lsm_ro_after_init = {
429         LSM_HOOK_INIT(ptrace_access_check, yama_ptrace_access_check),
430         LSM_HOOK_INIT(ptrace_traceme, yama_ptrace_traceme),
431         LSM_HOOK_INIT(task_prctl, yama_task_prctl),
432         LSM_HOOK_INIT(task_free, yama_task_free),
433 };
434
435 #ifdef CONFIG_SYSCTL
436 static int yama_dointvec_minmax(struct ctl_table *table, int write,
437                                 void __user *buffer, size_t *lenp, loff_t *ppos)
438 {
439         struct ctl_table table_copy;
440
441         if (write && !capable(CAP_SYS_PTRACE))
442                 return -EPERM;
443
444         /* Lock the max value if it ever gets set. */
445         table_copy = *table;
446         if (*(int *)table_copy.data == *(int *)table_copy.extra2)
447                 table_copy.extra1 = table_copy.extra2;
448
449         return proc_dointvec_minmax(&table_copy, write, buffer, lenp, ppos);
450 }
451
452 static int zero;
453 static int max_scope = YAMA_SCOPE_NO_ATTACH;
454
455 static struct ctl_path yama_sysctl_path[] = {
456         { .procname = "kernel", },
457         { .procname = "yama", },
458         { }
459 };
460
461 static struct ctl_table yama_sysctl_table[] = {
462         {
463                 .procname       = "ptrace_scope",
464                 .data           = &ptrace_scope,
465                 .maxlen         = sizeof(int),
466                 .mode           = 0644,
467                 .proc_handler   = yama_dointvec_minmax,
468                 .extra1         = &zero,
469                 .extra2         = &max_scope,
470         },
471         { }
472 };
473 static void __init yama_init_sysctl(void)
474 {
475         if (!register_sysctl_paths(yama_sysctl_path, yama_sysctl_table))
476                 panic("Yama: sysctl registration failed.\n");
477 }
478 #else
479 static inline void yama_init_sysctl(void) { }
480 #endif /* CONFIG_SYSCTL */
481
482 static int __init yama_init(void)
483 {
484         pr_info("Yama: becoming mindful.\n");
485         security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks), "yama");
486         yama_init_sysctl();
487         return 0;
488 }
489
490 DEFINE_LSM(yama) = {
491         .name = "yama",
492         .init = yama_init,
493 };