mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-04 16:25:34 +00:00
afe81f7541
Using ptrace(2) and related debug features on a target process can lead to a privilege escalation. Indeed, ptrace(2) can be used by an attacker to impersonate another task and to remain undetected while performing malicious activities. Thanks to ptrace_may_access(), various part of the kernel can check if a tracer is more privileged than a tracee. A landlocked process has fewer privileges than a non-landlocked process and must then be subject to additional restrictions when manipulating processes. To be allowed to use ptrace(2) and related syscalls on a target process, a landlocked process must have a subset of the target process's rules (i.e. the tracee must be in a sub-domain of the tracer). Cc: James Morris <jmorris@namei.org> Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com> Reviewed-by: Jann Horn <jannh@google.com> Acked-by: Serge Hallyn <serge@hallyn.com> Reviewed-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210422154123.13086-5-mic@digikod.net Signed-off-by: James Morris <jamorris@linux.microsoft.com>
33 lines
698 B
C
33 lines
698 B
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Landlock LSM - Security framework setup
|
|
*
|
|
* Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net>
|
|
* Copyright © 2018-2020 ANSSI
|
|
*/
|
|
|
|
#include <linux/init.h>
|
|
#include <linux/lsm_hooks.h>
|
|
|
|
#include "common.h"
|
|
#include "cred.h"
|
|
#include "ptrace.h"
|
|
#include "setup.h"
|
|
|
|
struct lsm_blob_sizes landlock_blob_sizes __lsm_ro_after_init = {
|
|
.lbs_cred = sizeof(struct landlock_cred_security),
|
|
};
|
|
|
|
static int __init landlock_init(void)
|
|
{
|
|
landlock_add_cred_hooks();
|
|
landlock_add_ptrace_hooks();
|
|
pr_info("Up and running.\n");
|
|
return 0;
|
|
}
|
|
|
|
DEFINE_LSM(LANDLOCK_NAME) = {
|
|
.name = LANDLOCK_NAME,
|
|
.init = landlock_init,
|
|
.blobs = &landlock_blob_sizes,
|
|
};
|