← Back to branch summary

~ubuntu-branches/ubuntu/wily/apparmor/wily

« back to all changes in this revision

Viewing changes to kernel-patches/for-mainline/ptrace.diff

  • Committer: Bazaar Package Importer
  • Author(s): Kees Cook
  • Date: 2011-04-27 10:38:07 UTC
  • mfrom: (5.1.118 natty)
  • Revision ID: james.westby@ubuntu.com-20110427103807-ym3rhwys6o84ith0
Tags: 2.6.1-2
debian/copyright: clarify for some full organization names.

Show diffs side-by-side

added added

removed removed

Lines of Context:
kernel-patches/for-mainline/ptrace.diff
1
 
Index: b/security/apparmor/lsm.c
2
 
===================================================================
3
 
--- a/security/apparmor/lsm.c
4
 
+++ b/security/apparmor/lsm.c
5
 
@@ -74,10 +74,28 @@ static int aa_reject_syscall(struct task
6
 
 static int apparmor_ptrace(struct task_struct *parent,
7
 
                            struct task_struct *child)
8
 
 {
9
 
-       int error = cap_ptrace(parent, child);
10
 
+       int error;
11
 
+
12
 
+       /**
13
 
+        * Right now, we only allow confined processes to ptrace other
14
 
+        * processes if they have CAP_SYS_PTRACE. We could allow ptrace
15
 
+        * under the rules that the kernel normally permits if the two
16
 
+        * processes are running under the same profile, but then we
17
 
+        * would probably have to reject profile changes for processes
18
 
+        * that are being ptraces as well as for processes ptracing
19
 
+        * others.
20
 
+        */
21
 
+
22
 
+       error = cap_ptrace(parent, child);
23
 
+       if (!error) {
24
 
+               struct aa_profile *profile;
25
 
 
26
 
-       if (!error)
27
 
-               error = aa_reject_syscall(parent, GFP_KERNEL, "ptrace");
28
 
+               profile = aa_get_profile(parent);
29
 
+               if (profile) {
30
 
+                       error = aa_capability(profile, CAP_SYS_PTRACE);
31
 
+               }
32
 
+               aa_put_profile(profile);
33
 
+       }
34
 
 
35
 
        return error;
36
 
 }