diff options
| author | Kees Cook <keescook@chromium.org> | 2012-08-09 19:01:26 -0700 |
|---|---|---|
| committer | James Morris <james.l.morris@oracle.com> | 2012-08-10 19:58:07 +1000 |
| commit | 9d8dad742ad1c74d7e7210ee05d0b44961d5ea16 (patch) | |
| tree | b1e738bf17987552cdace2695d8b77328dc29bcf /include | |
| parent | f4ba394c1b02e7fc2179fda8d3941a5b3b65efb6 (diff) | |
Yama: higher restrictions should block PTRACE_TRACEME
The higher ptrace restriction levels should be blocking even
PTRACE_TRACEME requests. The comments in the LSM documentation are
misleading about when the checks happen (the parent does not go through
security_ptrace_access_check() on a PTRACE_TRACEME call).
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org # 3.5.x and later
Signed-off-by: James Morris <james.l.morris@oracle.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/security.h | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/include/linux/security.h b/include/linux/security.h index 4e5a73cdbbe..3dea6a9d568 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1242,8 +1242,6 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) * Check that the @parent process has sufficient permission to trace the * current process before allowing the current process to present itself * to the @parent process for tracing. - * The parent process will still have to undergo the ptrace_access_check - * checks before it is allowed to trace this one. * @parent contains the task_struct structure for debugger process. * Return 0 if permission is granted. * @capget: |