From patchwork Fri May 11 09:37:07 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexey Gladkov X-Patchwork-Id: 10393799 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E297260236 for ; Fri, 11 May 2018 09:55:26 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AA3AF2237D for ; Fri, 11 May 2018 09:55:26 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9DE2D2843B; Fri, 11 May 2018 09:55:26 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, FREEMAIL_FROM,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 31D372237D for ; Fri, 11 May 2018 09:55:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751649AbeEKJzV (ORCPT ); Fri, 11 May 2018 05:55:21 -0400 Received: from monster.unsafe.ru ([5.9.28.80]:42568 "EHLO mail.unsafe.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752315AbeEKJzS (ORCPT ); Fri, 11 May 2018 05:55:18 -0400 Received: from comp-core-i7-2640m-0182e6 (nat-pool-brq-t.redhat.com [213.175.37.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.unsafe.ru (Postfix) with ESMTPSA id C9DF7C61A9F; Fri, 11 May 2018 09:47:04 +0000 (UTC) Date: Fri, 11 May 2018 11:37:07 +0200 From: Alexey Gladkov To: Kees Cook , Andy Lutomirski , Andrew Morton , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, linux-security-module@vger.kernel.org, linux-api@vger.kernel.org Cc: Greg Kroah-Hartman , Alexander Viro , Akinobu Mita , Oleg Nesterov , Jeff Layton , Ingo Molnar , Alexey Dobriyan , "Eric W. Biederman" , Linus Torvalds , aniel Micay , Jonathan Corbet , bfields@fieldses.org, Stephen Rothwell , solar@openwall.com, "Dmitry V. Levin" , Djalal Harouni Subject: [PATCH v5 7/7] proc: add option to mount only a pids subset Message-ID: <20180511093707.GA1403@comp-core-i7-2640m-0182e6> MIME-Version: 1.0 Content-Disposition: inline Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP This allows to hide all files and directories in the procfs that are not related to tasks. Signed-off-by: Alexey Gladkov --- fs/proc/generic.c | 20 ++++++++++++++++++++ fs/proc/inode.c | 7 +++++++ fs/proc/root.c | 12 ++++++++++-- include/linux/proc_fs.h | 21 +++++++++++++++++++++ 4 files changed, 58 insertions(+), 2 deletions(-) diff --git a/fs/proc/generic.c b/fs/proc/generic.c index 2078e70..af1295c 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -266,6 +266,11 @@ struct dentry *proc_lookup_de(struct inode *dir, struct dentry *dentry, struct dentry *proc_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) { + struct proc_fs_info *fs_info = proc_sb(dir->i_sb); + + if (proc_fs_pidonly(fs_info)) + return ERR_PTR(-ENOENT); + return proc_lookup_de(dir, dentry, PDE(dir)); } @@ -322,10 +327,24 @@ int proc_readdir_de(struct file *file, struct dir_context *ctx, int proc_readdir(struct file *file, struct dir_context *ctx) { struct inode *inode = file_inode(file); + struct proc_fs_info *fs_info = proc_sb(inode->i_sb); + + if (proc_fs_pidonly(fs_info)) + return 1; return proc_readdir_de(file, ctx, PDE(inode)); } +static int proc_dir_open(struct inode *inode, struct file *file) +{ + struct proc_fs_info *fs_info = proc_sb(inode->i_sb); + + if (proc_fs_pidonly(fs_info)) + return -ENOENT; + + return 0; +} + /* * These are the generic /proc directory operations. They * use the in-memory "struct proc_dir_entry" tree to parse @@ -335,6 +354,7 @@ static const struct file_operations proc_dir_operations = { .llseek = generic_file_llseek, .read = generic_read_dir, .iterate_shared = proc_readdir, + .open = proc_dir_open, }; /* diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 5e62598..9b7d9cb 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -125,6 +125,9 @@ static int proc_show_options(struct seq_file *seq, struct dentry *root) if (limit_pids > PROC_LIMIT_PIDS_OFF) seq_printf(seq, ",limit_pids=%u", limit_pids); + if (proc_fs_pidonly(fs_info)) + seq_printf(seq, ",pidonly"); + return 0; } @@ -338,12 +341,16 @@ proc_reg_get_unmapped_area(struct file *file, unsigned long orig_addr, static int proc_reg_open(struct inode *inode, struct file *file) { + struct proc_fs_info *fs_info = proc_sb(inode->i_sb); struct proc_dir_entry *pde = PDE(inode); int rv = 0; int (*open)(struct inode *, struct file *); int (*release)(struct inode *, struct file *); struct pde_opener *pdeo; + if (proc_fs_pidonly(fs_info)) + return -ENOENT; + /* * Ensure that * 1) PDE's ->release hook will be called no matter what diff --git a/fs/proc/root.c b/fs/proc/root.c index c72d22c..daa318e 100644 --- a/fs/proc/root.c +++ b/fs/proc/root.c @@ -28,17 +28,18 @@ #include "internal.h" enum { - Opt_gid, Opt_hidepid, Opt_limit_pids, Opt_err, + Opt_gid, Opt_hidepid, Opt_limit_pids, Opt_pidonly, Opt_err, }; static const match_table_t tokens = { {Opt_hidepid, "hidepid=%u"}, {Opt_gid, "gid=%u"}, {Opt_limit_pids, "limit_pids=%u"}, + {Opt_pidonly, "pidonly"}, {Opt_err, NULL}, }; -/* We only parse 'limit_pids' option here */ +/* We only parse 'limit_pids' and 'pidonly' option here */ int proc_parse_early_options(char *options, struct proc_fs_info *fs_info) { char *p, *opts, *orig; @@ -74,6 +75,11 @@ int proc_parse_early_options(char *options, struct proc_fs_info *fs_info) proc_fs_set_newinstance(fs_info, true); pr_info("proc: mounting a new procfs instance "); break; + case Opt_pidonly: + proc_fs_set_pidonly(fs_info, PROC_PIDONLY_ON); + proc_fs_set_newinstance(fs_info, true); + pr_info("proc: mounting a new procfs instance "); + break; case Opt_gid: case Opt_hidepid: break; @@ -126,6 +132,7 @@ int proc_parse_options(char *options, struct proc_fs_info *fs_info) } proc_fs_set_hide_pid(fs_info, option); break; + case Opt_pidonly: case Opt_limit_pids: break; default: @@ -198,6 +205,7 @@ static struct dentry *proc_mount(struct file_system_type *fs_type, /* Set it as early as possible */ proc_fs_set_newinstance(fs_info, false); proc_fs_set_limit_pids(fs_info, PROC_LIMIT_PIDS_OFF); + proc_fs_set_pidonly(fs_info, PROC_PIDONLY_OFF); if (flags & SB_KERNMOUNT) { ns = data; diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h index 70e8b10..77137c1 100644 --- a/include/linux/proc_fs.h +++ b/include/linux/proc_fs.h @@ -18,6 +18,11 @@ enum { /* definitions for proc mount option limit_pids */ PROC_LIMIT_PIDS_PTRACE = 1, /* Limit pids to only ptracable pids */ }; +enum { + PROC_PIDONLY_OFF = 0, + PROC_PIDONLY_ON = 1, +}; + struct proc_fs_info { struct super_block *sb; struct pid_namespace *pid_ns; @@ -26,6 +31,7 @@ struct proc_fs_info { struct dentry *proc_thread_self; /* For /proc/thread-self/ */ bool newinstance; /* Private flag for new separated instances */ int limit_pids:1; + int pidonly:1; }; #ifdef CONFIG_PROC_FS @@ -60,6 +66,16 @@ static inline int proc_fs_set_limit_pids(struct proc_fs_info *fs_info, int value return 0; } +static inline int proc_fs_set_pidonly(struct proc_fs_info *fs_info, int value) +{ + if (value != PROC_PIDONLY_ON && value != PROC_PIDONLY_OFF) + return -EINVAL; + + fs_info->pidonly = value; + + return 0; +} + static inline int proc_fs_hide_pid(struct proc_fs_info *fs_info) { return fs_info->pid_ns->hide_pid; @@ -80,6 +96,11 @@ static inline int proc_fs_limit_pids(struct proc_fs_info *fs_info) return fs_info->limit_pids; } +static inline int proc_fs_pidonly(struct proc_fs_info *fs_info) +{ + return fs_info->pidonly; +} + extern void proc_root_init(void); extern void proc_flush_task(struct task_struct *);