Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751986AbcDTWsF (ORCPT ); Wed, 20 Apr 2016 18:48:05 -0400 Received: from mail-pf0-f170.google.com ([209.85.192.170]:34099 "EHLO mail-pf0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751229AbcDTWqe (ORCPT ); Wed, 20 Apr 2016 18:46:34 -0400 From: Kees Cook To: James Morris Cc: Kees Cook , Mimi Zohar , Joe Perches , Andy Shevchenko , Andrew Morton , "Serge E. Hallyn" , Jonathan Corbet , Kalle Valo , Mauro Carvalho Chehab , Guenter Roeck , Jiri Slaby , Paul Moore , Stephen Smalley , Casey Schaufler , Andreas Gruenbacher , Rasmus Villemoes , Ulf Hansson , Vitaly Kuznetsov , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org Subject: [PATCH 4/6] Yama: consolidate error reporting Date: Wed, 20 Apr 2016 15:46:26 -0700 Message-Id: <1461192388-13900-5-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.6.3 In-Reply-To: <1461192388-13900-1-git-send-email-keescook@chromium.org> References: <1461192388-13900-1-git-send-email-keescook@chromium.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2119 Lines: 73 Use a common error reporting function for Yama violation reports, and give more detail into the process command lines. Signed-off-by: Kees Cook --- security/yama/yama_lsm.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c index cb6ed10816d4..c19f6e5df9a3 100644 --- a/security/yama/yama_lsm.c +++ b/security/yama/yama_lsm.c @@ -18,6 +18,7 @@ #include #include #include +#include #define YAMA_SCOPE_DISABLED 0 #define YAMA_SCOPE_RELATIONAL 1 @@ -41,6 +42,22 @@ static DEFINE_SPINLOCK(ptracer_relations_lock); static void yama_relation_cleanup(struct work_struct *work); static DECLARE_WORK(yama_relation_work, yama_relation_cleanup); +static void report_access(const char *access, struct task_struct *target, + struct task_struct *agent) +{ + char *target_cmd, *agent_cmd; + + target_cmd = kstrdup_quotable_cmdline(target, GFP_KERNEL); + agent_cmd = kstrdup_quotable_cmdline(agent, GFP_KERNEL); + + pr_notice_ratelimited( + "ptrace %s of \"%s\"[%d] was attempted by \"%s\"[%d]\n", + access, target_cmd, target->pid, agent_cmd, agent->pid); + + kfree(agent_cmd); + kfree(target_cmd); +} + /** * yama_relation_cleanup - remove invalid entries from the relation list * @@ -307,11 +324,8 @@ static int yama_ptrace_access_check(struct task_struct *child, } } - if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0) { - printk_ratelimited(KERN_NOTICE - "ptrace of pid %d was attempted by: %s (pid %d)\n", - child->pid, current->comm, current->pid); - } + if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0) + report_access("attach", child, current); return rc; } @@ -337,11 +351,8 @@ int yama_ptrace_traceme(struct task_struct *parent) break; } - if (rc) { - printk_ratelimited(KERN_NOTICE - "ptraceme of pid %d was attempted by: %s (pid %d)\n", - current->pid, parent->comm, parent->pid); - } + if (rc) + report_access("traceme", current, parent); return rc; } -- 2.6.3