1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * Yama Linux Security Module |
4 | * |
5 | * Author: Kees Cook <keescook@chromium.org> |
6 | * |
7 | * Copyright (C) 2010 Canonical, Ltd. |
8 | * Copyright (C) 2011 The Chromium OS Authors. |
9 | */ |
10 | |
11 | #include <linux/lsm_hooks.h> |
12 | #include <linux/sysctl.h> |
13 | #include <linux/ptrace.h> |
14 | #include <linux/prctl.h> |
15 | #include <linux/ratelimit.h> |
16 | #include <linux/workqueue.h> |
17 | #include <linux/string_helpers.h> |
18 | #include <linux/task_work.h> |
19 | #include <linux/sched.h> |
20 | #include <linux/spinlock.h> |
21 | |
22 | #define YAMA_SCOPE_DISABLED 0 |
23 | #define YAMA_SCOPE_RELATIONAL 1 |
24 | #define YAMA_SCOPE_CAPABILITY 2 |
25 | #define YAMA_SCOPE_NO_ATTACH 3 |
26 | |
27 | static int ptrace_scope = YAMA_SCOPE_RELATIONAL; |
28 | |
29 | /* describe a ptrace relationship for potential exception */ |
30 | struct ptrace_relation { |
31 | struct task_struct *tracer; |
32 | struct task_struct *tracee; |
33 | bool invalid; |
34 | struct list_head node; |
35 | struct rcu_head rcu; |
36 | }; |
37 | |
38 | static LIST_HEAD(ptracer_relations); |
39 | static DEFINE_SPINLOCK(ptracer_relations_lock); |
40 | |
41 | static void yama_relation_cleanup(struct work_struct *work); |
42 | static DECLARE_WORK(yama_relation_work, yama_relation_cleanup); |
43 | |
44 | struct access_report_info { |
45 | struct callback_head work; |
46 | const char *access; |
47 | struct task_struct *target; |
48 | struct task_struct *agent; |
49 | }; |
50 | |
51 | static void __report_access(struct callback_head *work) |
52 | { |
53 | struct access_report_info *info = |
54 | container_of(work, struct access_report_info, work); |
55 | char *target_cmd, *agent_cmd; |
56 | |
57 | target_cmd = kstrdup_quotable_cmdline(task: info->target, GFP_KERNEL); |
58 | agent_cmd = kstrdup_quotable_cmdline(task: info->agent, GFP_KERNEL); |
59 | |
60 | pr_notice_ratelimited( |
61 | "ptrace %s of \"%s\"[%d] was attempted by \"%s\"[%d]\n" , |
62 | info->access, target_cmd, info->target->pid, agent_cmd, |
63 | info->agent->pid); |
64 | |
65 | kfree(objp: agent_cmd); |
66 | kfree(objp: target_cmd); |
67 | |
68 | put_task_struct(t: info->agent); |
69 | put_task_struct(t: info->target); |
70 | kfree(objp: info); |
71 | } |
72 | |
73 | /* defers execution because cmdline access can sleep */ |
74 | static void report_access(const char *access, struct task_struct *target, |
75 | struct task_struct *agent) |
76 | { |
77 | struct access_report_info *info; |
78 | char agent_comm[sizeof(agent->comm)]; |
79 | |
80 | assert_spin_locked(&target->alloc_lock); /* for target->comm */ |
81 | |
82 | if (current->flags & PF_KTHREAD) { |
83 | /* I don't think kthreads call task_work_run() before exiting. |
84 | * Imagine angry ranting about procfs here. |
85 | */ |
86 | pr_notice_ratelimited( |
87 | "ptrace %s of \"%s\"[%d] was attempted by \"%s\"[%d]\n" , |
88 | access, target->comm, target->pid, |
89 | get_task_comm(agent_comm, agent), agent->pid); |
90 | return; |
91 | } |
92 | |
93 | info = kmalloc(size: sizeof(*info), GFP_ATOMIC); |
94 | if (!info) |
95 | return; |
96 | init_task_work(twork: &info->work, func: __report_access); |
97 | get_task_struct(t: target); |
98 | get_task_struct(t: agent); |
99 | info->access = access; |
100 | info->target = target; |
101 | info->agent = agent; |
102 | if (task_work_add(current, twork: &info->work, mode: TWA_RESUME) == 0) |
103 | return; /* success */ |
104 | |
105 | WARN(1, "report_access called from exiting task" ); |
106 | put_task_struct(t: target); |
107 | put_task_struct(t: agent); |
108 | kfree(objp: info); |
109 | } |
110 | |
111 | /** |
112 | * yama_relation_cleanup - remove invalid entries from the relation list |
113 | * |
114 | */ |
115 | static void yama_relation_cleanup(struct work_struct *work) |
116 | { |
117 | struct ptrace_relation *relation; |
118 | |
119 | spin_lock(lock: &ptracer_relations_lock); |
120 | rcu_read_lock(); |
121 | list_for_each_entry_rcu(relation, &ptracer_relations, node) { |
122 | if (relation->invalid) { |
123 | list_del_rcu(entry: &relation->node); |
124 | kfree_rcu(relation, rcu); |
125 | } |
126 | } |
127 | rcu_read_unlock(); |
128 | spin_unlock(lock: &ptracer_relations_lock); |
129 | } |
130 | |
131 | /** |
132 | * yama_ptracer_add - add/replace an exception for this tracer/tracee pair |
133 | * @tracer: the task_struct of the process doing the ptrace |
134 | * @tracee: the task_struct of the process to be ptraced |
135 | * |
136 | * Each tracee can have, at most, one tracer registered. Each time this |
137 | * is called, the prior registered tracer will be replaced for the tracee. |
138 | * |
139 | * Returns 0 if relationship was added, -ve on error. |
140 | */ |
141 | static int yama_ptracer_add(struct task_struct *tracer, |
142 | struct task_struct *tracee) |
143 | { |
144 | struct ptrace_relation *relation, *added; |
145 | |
146 | added = kmalloc(size: sizeof(*added), GFP_KERNEL); |
147 | if (!added) |
148 | return -ENOMEM; |
149 | |
150 | added->tracee = tracee; |
151 | added->tracer = tracer; |
152 | added->invalid = false; |
153 | |
154 | spin_lock(lock: &ptracer_relations_lock); |
155 | rcu_read_lock(); |
156 | list_for_each_entry_rcu(relation, &ptracer_relations, node) { |
157 | if (relation->invalid) |
158 | continue; |
159 | if (relation->tracee == tracee) { |
160 | list_replace_rcu(old: &relation->node, new: &added->node); |
161 | kfree_rcu(relation, rcu); |
162 | goto out; |
163 | } |
164 | } |
165 | |
166 | list_add_rcu(new: &added->node, head: &ptracer_relations); |
167 | |
168 | out: |
169 | rcu_read_unlock(); |
170 | spin_unlock(lock: &ptracer_relations_lock); |
171 | return 0; |
172 | } |
173 | |
174 | /** |
175 | * yama_ptracer_del - remove exceptions related to the given tasks |
176 | * @tracer: remove any relation where tracer task matches |
177 | * @tracee: remove any relation where tracee task matches |
178 | */ |
179 | static void yama_ptracer_del(struct task_struct *tracer, |
180 | struct task_struct *tracee) |
181 | { |
182 | struct ptrace_relation *relation; |
183 | bool marked = false; |
184 | |
185 | rcu_read_lock(); |
186 | list_for_each_entry_rcu(relation, &ptracer_relations, node) { |
187 | if (relation->invalid) |
188 | continue; |
189 | if (relation->tracee == tracee || |
190 | (tracer && relation->tracer == tracer)) { |
191 | relation->invalid = true; |
192 | marked = true; |
193 | } |
194 | } |
195 | rcu_read_unlock(); |
196 | |
197 | if (marked) |
198 | schedule_work(work: &yama_relation_work); |
199 | } |
200 | |
201 | /** |
202 | * yama_task_free - check for task_pid to remove from exception list |
203 | * @task: task being removed |
204 | */ |
205 | static void yama_task_free(struct task_struct *task) |
206 | { |
207 | yama_ptracer_del(tracer: task, tracee: task); |
208 | } |
209 | |
210 | /** |
211 | * yama_task_prctl - check for Yama-specific prctl operations |
212 | * @option: operation |
213 | * @arg2: argument |
214 | * @arg3: argument |
215 | * @arg4: argument |
216 | * @arg5: argument |
217 | * |
218 | * Return 0 on success, -ve on error. -ENOSYS is returned when Yama |
219 | * does not handle the given option. |
220 | */ |
221 | static int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3, |
222 | unsigned long arg4, unsigned long arg5) |
223 | { |
224 | int rc = -ENOSYS; |
225 | struct task_struct *myself = current; |
226 | |
227 | switch (option) { |
228 | case PR_SET_PTRACER: |
229 | /* Since a thread can call prctl(), find the group leader |
230 | * before calling _add() or _del() on it, since we want |
231 | * process-level granularity of control. The tracer group |
232 | * leader checking is handled later when walking the ancestry |
233 | * at the time of PTRACE_ATTACH check. |
234 | */ |
235 | rcu_read_lock(); |
236 | if (!thread_group_leader(p: myself)) |
237 | myself = rcu_dereference(myself->group_leader); |
238 | get_task_struct(t: myself); |
239 | rcu_read_unlock(); |
240 | |
241 | if (arg2 == 0) { |
242 | yama_ptracer_del(NULL, tracee: myself); |
243 | rc = 0; |
244 | } else if (arg2 == PR_SET_PTRACER_ANY || (int)arg2 == -1) { |
245 | rc = yama_ptracer_add(NULL, tracee: myself); |
246 | } else { |
247 | struct task_struct *tracer; |
248 | |
249 | tracer = find_get_task_by_vpid(nr: arg2); |
250 | if (!tracer) { |
251 | rc = -EINVAL; |
252 | } else { |
253 | rc = yama_ptracer_add(tracer, tracee: myself); |
254 | put_task_struct(t: tracer); |
255 | } |
256 | } |
257 | |
258 | put_task_struct(t: myself); |
259 | break; |
260 | } |
261 | |
262 | return rc; |
263 | } |
264 | |
265 | /** |
266 | * task_is_descendant - walk up a process family tree looking for a match |
267 | * @parent: the process to compare against while walking up from child |
268 | * @child: the process to start from while looking upwards for parent |
269 | * |
270 | * Returns 1 if child is a descendant of parent, 0 if not. |
271 | */ |
272 | static int task_is_descendant(struct task_struct *parent, |
273 | struct task_struct *child) |
274 | { |
275 | int rc = 0; |
276 | struct task_struct *walker = child; |
277 | |
278 | if (!parent || !child) |
279 | return 0; |
280 | |
281 | rcu_read_lock(); |
282 | if (!thread_group_leader(p: parent)) |
283 | parent = rcu_dereference(parent->group_leader); |
284 | while (walker->pid > 0) { |
285 | if (!thread_group_leader(p: walker)) |
286 | walker = rcu_dereference(walker->group_leader); |
287 | if (walker == parent) { |
288 | rc = 1; |
289 | break; |
290 | } |
291 | walker = rcu_dereference(walker->real_parent); |
292 | } |
293 | rcu_read_unlock(); |
294 | |
295 | return rc; |
296 | } |
297 | |
298 | /** |
299 | * ptracer_exception_found - tracer registered as exception for this tracee |
300 | * @tracer: the task_struct of the process attempting ptrace |
301 | * @tracee: the task_struct of the process to be ptraced |
302 | * |
303 | * Returns 1 if tracer has a ptracer exception ancestor for tracee. |
304 | */ |
305 | static int ptracer_exception_found(struct task_struct *tracer, |
306 | struct task_struct *tracee) |
307 | { |
308 | int rc = 0; |
309 | struct ptrace_relation *relation; |
310 | struct task_struct *parent = NULL; |
311 | bool found = false; |
312 | |
313 | rcu_read_lock(); |
314 | |
315 | /* |
316 | * If there's already an active tracing relationship, then make an |
317 | * exception for the sake of other accesses, like process_vm_rw(). |
318 | */ |
319 | parent = ptrace_parent(task: tracee); |
320 | if (parent != NULL && same_thread_group(p1: parent, p2: tracer)) { |
321 | rc = 1; |
322 | goto unlock; |
323 | } |
324 | |
325 | /* Look for a PR_SET_PTRACER relationship. */ |
326 | if (!thread_group_leader(p: tracee)) |
327 | tracee = rcu_dereference(tracee->group_leader); |
328 | list_for_each_entry_rcu(relation, &ptracer_relations, node) { |
329 | if (relation->invalid) |
330 | continue; |
331 | if (relation->tracee == tracee) { |
332 | parent = relation->tracer; |
333 | found = true; |
334 | break; |
335 | } |
336 | } |
337 | |
338 | if (found && (parent == NULL || task_is_descendant(parent, child: tracer))) |
339 | rc = 1; |
340 | |
341 | unlock: |
342 | rcu_read_unlock(); |
343 | |
344 | return rc; |
345 | } |
346 | |
347 | /** |
348 | * yama_ptrace_access_check - validate PTRACE_ATTACH calls |
349 | * @child: task that current task is attempting to ptrace |
350 | * @mode: ptrace attach mode |
351 | * |
352 | * Returns 0 if following the ptrace is allowed, -ve on error. |
353 | */ |
354 | static int yama_ptrace_access_check(struct task_struct *child, |
355 | unsigned int mode) |
356 | { |
357 | int rc = 0; |
358 | |
359 | /* require ptrace target be a child of ptracer on attach */ |
360 | if (mode & PTRACE_MODE_ATTACH) { |
361 | switch (ptrace_scope) { |
362 | case YAMA_SCOPE_DISABLED: |
363 | /* No additional restrictions. */ |
364 | break; |
365 | case YAMA_SCOPE_RELATIONAL: |
366 | rcu_read_lock(); |
367 | if (!pid_alive(p: child)) |
368 | rc = -EPERM; |
369 | if (!rc && !task_is_descendant(current, child) && |
370 | !ptracer_exception_found(current, tracee: child) && |
371 | !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE)) |
372 | rc = -EPERM; |
373 | rcu_read_unlock(); |
374 | break; |
375 | case YAMA_SCOPE_CAPABILITY: |
376 | rcu_read_lock(); |
377 | if (!ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE)) |
378 | rc = -EPERM; |
379 | rcu_read_unlock(); |
380 | break; |
381 | case YAMA_SCOPE_NO_ATTACH: |
382 | default: |
383 | rc = -EPERM; |
384 | break; |
385 | } |
386 | } |
387 | |
388 | if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0) |
389 | report_access(access: "attach" , target: child, current); |
390 | |
391 | return rc; |
392 | } |
393 | |
394 | /** |
395 | * yama_ptrace_traceme - validate PTRACE_TRACEME calls |
396 | * @parent: task that will become the ptracer of the current task |
397 | * |
398 | * Returns 0 if following the ptrace is allowed, -ve on error. |
399 | */ |
400 | static int yama_ptrace_traceme(struct task_struct *parent) |
401 | { |
402 | int rc = 0; |
403 | |
404 | /* Only disallow PTRACE_TRACEME on more aggressive settings. */ |
405 | switch (ptrace_scope) { |
406 | case YAMA_SCOPE_CAPABILITY: |
407 | if (!has_ns_capability(t: parent, current_user_ns(), CAP_SYS_PTRACE)) |
408 | rc = -EPERM; |
409 | break; |
410 | case YAMA_SCOPE_NO_ATTACH: |
411 | rc = -EPERM; |
412 | break; |
413 | } |
414 | |
415 | if (rc) { |
416 | task_lock(current); |
417 | report_access(access: "traceme" , current, agent: parent); |
418 | task_unlock(current); |
419 | } |
420 | |
421 | return rc; |
422 | } |
423 | |
424 | static struct security_hook_list yama_hooks[] __ro_after_init = { |
425 | LSM_HOOK_INIT(ptrace_access_check, yama_ptrace_access_check), |
426 | LSM_HOOK_INIT(ptrace_traceme, yama_ptrace_traceme), |
427 | LSM_HOOK_INIT(task_prctl, yama_task_prctl), |
428 | LSM_HOOK_INIT(task_free, yama_task_free), |
429 | }; |
430 | |
431 | #ifdef CONFIG_SYSCTL |
432 | static int yama_dointvec_minmax(struct ctl_table *table, int write, |
433 | void *buffer, size_t *lenp, loff_t *ppos) |
434 | { |
435 | struct ctl_table table_copy; |
436 | |
437 | if (write && !capable(CAP_SYS_PTRACE)) |
438 | return -EPERM; |
439 | |
440 | /* Lock the max value if it ever gets set. */ |
441 | table_copy = *table; |
442 | if (*(int *)table_copy.data == *(int *)table_copy.extra2) |
443 | table_copy.extra1 = table_copy.extra2; |
444 | |
445 | return proc_dointvec_minmax(&table_copy, write, buffer, lenp, ppos); |
446 | } |
447 | |
448 | static int max_scope = YAMA_SCOPE_NO_ATTACH; |
449 | |
450 | static struct ctl_table yama_sysctl_table[] = { |
451 | { |
452 | .procname = "ptrace_scope" , |
453 | .data = &ptrace_scope, |
454 | .maxlen = sizeof(int), |
455 | .mode = 0644, |
456 | .proc_handler = yama_dointvec_minmax, |
457 | .extra1 = SYSCTL_ZERO, |
458 | .extra2 = &max_scope, |
459 | }, |
460 | { } |
461 | }; |
462 | static void __init yama_init_sysctl(void) |
463 | { |
464 | if (!register_sysctl("kernel/yama" , yama_sysctl_table)) |
465 | panic(fmt: "Yama: sysctl registration failed.\n" ); |
466 | } |
467 | #else |
468 | static inline void yama_init_sysctl(void) { } |
469 | #endif /* CONFIG_SYSCTL */ |
470 | |
471 | static int __init yama_init(void) |
472 | { |
473 | pr_info("Yama: becoming mindful.\n" ); |
474 | security_add_hooks(hooks: yama_hooks, ARRAY_SIZE(yama_hooks), lsm: "yama" ); |
475 | yama_init_sysctl(); |
476 | return 0; |
477 | } |
478 | |
479 | DEFINE_LSM(yama) = { |
480 | .name = "yama" , |
481 | .init = yama_init, |
482 | }; |
483 | |