Similar to being able to examine if a process has been correctly confined
with seccomp, the state of no_new_privs is equally interesting, so this
adds it to /proc/$pid/status.
Signed-off-by: Kees Cook <[email protected]>
---
Documentation/filesystems/proc.txt | 2 ++
fs/proc/array.c | 5 +++--
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index 74329fd0add2..c03f2f91c6ab 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -191,6 +191,7 @@ read the file /proc/PID/status:
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: ffffffffffffffff
+ NoNewPrivs: 0
Seccomp: 0
voluntary_ctxt_switches: 0
nonvoluntary_ctxt_switches: 1
@@ -262,6 +263,7 @@ Table 1-2: Contents of the status files (as of 4.1)
CapPrm bitmap of permitted capabilities
CapEff bitmap of effective capabilities
CapBnd bitmap of capabilities bounding set
+ NoNewPrivs no_new_privs, like prctl(PR_GET_NO_NEW_PRIV, ...)
Seccomp seccomp mode, like prctl(PR_GET_SECCOMP, ...)
Cpus_allowed mask of CPUs on which this process may run
Cpus_allowed_list Same as previous, but in "list format"
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 81818adb8e9e..082676ab4878 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -342,10 +342,11 @@ static inline void task_cap(struct seq_file *m, struct task_struct *p)
static inline void task_seccomp(struct seq_file *m, struct task_struct *p)
{
+ seq_put_decimal_ull(m, "NoNewPrivs:\t", task_no_new_privs(p));
#ifdef CONFIG_SECCOMP
- seq_put_decimal_ull(m, "Seccomp:\t", p->seccomp.mode);
- seq_putc(m, '\n');
+ seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode);
#endif
+ seq_putc(m, '\n');
}
static inline void task_context_switch_counts(struct seq_file *m,
--
2.7.4
--
Kees Cook
Nexus Security
On Thu, Nov 03, 2016 at 02:40:41PM -0700, Kees Cook wrote:
> Similar to being able to examine if a process has been correctly confined
> with seccomp, the state of no_new_privs is equally interesting, so this
> adds it to /proc/$pid/status.
>
> Signed-off-by: Kees Cook <[email protected]>
(Note: The proc.5 manpage also lists all the entries of the "status" file,
so it should also be updated.)
Reviewed-by: Jann Horn <[email protected]>
> ---
> Documentation/filesystems/proc.txt | 2 ++
> fs/proc/array.c | 5 +++--
> 2 files changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
> index 74329fd0add2..c03f2f91c6ab 100644
> --- a/Documentation/filesystems/proc.txt
> +++ b/Documentation/filesystems/proc.txt
> @@ -191,6 +191,7 @@ read the file /proc/PID/status:
> CapPrm: 0000000000000000
> CapEff: 0000000000000000
> CapBnd: ffffffffffffffff
> + NoNewPrivs: 0
> Seccomp: 0
> voluntary_ctxt_switches: 0
> nonvoluntary_ctxt_switches: 1
> @@ -262,6 +263,7 @@ Table 1-2: Contents of the status files (as of 4.1)
> CapPrm bitmap of permitted capabilities
> CapEff bitmap of effective capabilities
> CapBnd bitmap of capabilities bounding set
> + NoNewPrivs no_new_privs, like prctl(PR_GET_NO_NEW_PRIV, ...)
> Seccomp seccomp mode, like prctl(PR_GET_SECCOMP, ...)
> Cpus_allowed mask of CPUs on which this process may run
> Cpus_allowed_list Same as previous, but in "list format"
> diff --git a/fs/proc/array.c b/fs/proc/array.c
> index 81818adb8e9e..082676ab4878 100644
> --- a/fs/proc/array.c
> +++ b/fs/proc/array.c
> @@ -342,10 +342,11 @@ static inline void task_cap(struct seq_file *m, struct task_struct *p)
>
> static inline void task_seccomp(struct seq_file *m, struct task_struct *p)
> {
> + seq_put_decimal_ull(m, "NoNewPrivs:\t", task_no_new_privs(p));
> #ifdef CONFIG_SECCOMP
> - seq_put_decimal_ull(m, "Seccomp:\t", p->seccomp.mode);
> - seq_putc(m, '\n');
> + seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode);
> #endif
> + seq_putc(m, '\n');
> }
>
> static inline void task_context_switch_counts(struct seq_file *m,
> --
> 2.7.4
>
>
> --
> Kees Cook
> Nexus Security