>From 1070920f261ff717acfd4b050d2fd1254d86021c Mon Sep 17 00:00:00 2001 From: Mark Wielaard Date: Sat, 1 Aug 2015 19:18:10 +0200 Subject: [PATCH] Set yama ptrace_scope default (rhbz 1209492) --- config-generic | 2 ++ kernel.spec | 6 ++++ yama-set-ptrace_scope-default.patch | 61 +++++++++++++++++++++++++++++++++++++ 3 files changed, 69 insertions(+) create mode 100644 yama-set-ptrace_scope-default.patch diff --git a/config-generic b/config-generic index 8553fc9..9d43fa7 100644 --- a/config-generic +++ b/config-generic @@ -4685,7 +4685,9 @@ CONFIG_SECURITY_SELINUX_AVC_STATS=y # CONFIG_SECURITY_SMACK is not set # CONFIG_SECURITY_TOMOYO is not set # CONFIG_SECURITY_APPARMOR is not set +# (rhbz 1209492) we only want yama enabled with ptrace_scope set to zero. CONFIG_SECURITY_YAMA=y +CONFIG_SECURITY_YAMA_PTRACE_DEFAULT=0 CONFIG_SECURITY_YAMA_STACKED=y CONFIG_AUDIT=y CONFIG_AUDITSYSCALL=y diff --git a/kernel.spec b/kernel.spec index 0c0c9ae..3bbe67a 100644 --- a/kernel.spec +++ b/kernel.spec @@ -582,6 +582,9 @@ Patch502: firmware-Drop-WARN-from-usermodehelper_read_trylock-.patch Patch503: drm-i915-turn-off-wc-mmaps.patch +# rhbz 1209492 +Patch504: yama-set-ptrace_scope-default.patch + # END OF PATCH DEFINITIONS %endif @@ -2017,6 +2020,9 @@ fi # # %changelog +* Sat Aug 01 2015 Mark Wielaard +- Set yama ptrace_scope default (rhbz 1209492) + * Fri Jul 31 2015 Josh Boyer - 4.2.0-0.rc4.git4.1 - Linux v4.2-rc4-111-g8400935737bf diff --git a/yama-set-ptrace_scope-default.patch b/yama-set-ptrace_scope-default.patch new file mode 100644 index 0000000..5e36e56 --- /dev/null +++ b/yama-set-ptrace_scope-default.patch @@ -0,0 +1,61 @@ +yama: make the default ptrace_scope value a Kconfig option + +From: Paul Moore + +By default a Yama enabled system boots into a "restricted ptrace" +mode, while desirable from a security point of view, it does alter +the classic Linux ptrace() permissions and is seen by some as a +serious API breakage. It is possible to alter the ptrace_scope at +runtime through the normal sysctl methods, but there are some +distributions which insist on using the kernel compile time defaults +for Yama while at the same time complaining about the API break. +Needless to say, this makes it very difficult to enable Yama in these +distribution kernels. + +This patch creates CONFIG_SECURITY_YAMA_PTRACE_DEFAULT, a new Kconfig +option, which allows a user to set the compile time default for Yama's +ptrace_scope setting. The default value is set to "1" to preserve +Yama's defaults. + +Signed-off-by: Paul Moore +--- + security/yama/Kconfig | 12 ++++++++++++ + security/yama/yama_lsm.c | 2 +- + 2 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/security/yama/Kconfig b/security/yama/Kconfig +index 90c605e..2cf9bad 100644 +--- a/security/yama/Kconfig ++++ b/security/yama/Kconfig +@@ -10,6 +10,18 @@ + + If you are unsure how to answer this question, answer N. + ++config SECURITY_YAMA_PTRACE_DEFAULT ++ int "Yama default ptrace_scope value" ++ depends on SECURITY_YAMA ++ range 0 3 ++ default 1 ++ help ++ This sets the default ptrace_scope value as described in ++ Documentation/security/Yama.txt. Historically Yama has always had ++ a default value of 1, enabling some ptrace restrictions, but the ++ classic, unrestricted Linux ptrace behavior is possible with a value ++ of 0. ++ + config SECURITY_YAMA_STACKED + bool "Yama stacked with other LSMs" + depends on SECURITY_YAMA +diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c +index d3c19c9..16a35ec 100644 +--- a/security/yama/yama_lsm.c ++++ b/security/yama/yama_lsm.c +@@ -24,7 +24,7 @@ + #define YAMA_SCOPE_CAPABILITY 2 + #define YAMA_SCOPE_NO_ATTACH 3 + +-static int ptrace_scope = YAMA_SCOPE_RELATIONAL; ++static int ptrace_scope = CONFIG_SECURITY_YAMA_PTRACE_DEFAULT; + + /* describe a ptrace relationship for potential exception */ + struct ptrace_relation { -- 2.4.3