- SELinux apply a different permission to ptrace a child vs non-child

- Reenable debug

5 files changed, 237 insertions, 63 deletions

diff --git a/config-generic b/config-generic
index f565c2f54..b832223d1 100644
--- a/config-generic
+++ b/config-generic
@@ -1464,13 +1464,13 @@ CONFIG_B43_SDIO=y
 CONFIG_B43_BCMA=y
 # CONFIG_B43_BCMA_EXTRA is not set
 CONFIG_B43_BCMA_PIO=y
-# CONFIG_B43_DEBUG is not set
+CONFIG_B43_DEBUG=y
 CONFIG_B43_PHY_LP=y
 CONFIG_B43_PHY_N=y
 CONFIG_B43_PHY_HT=y
 # CONFIG_B43_FORCE_PIO is not set
 CONFIG_B43LEGACY=m
-# CONFIG_B43LEGACY_DEBUG is not set
+CONFIG_B43LEGACY_DEBUG=y
 CONFIG_B43LEGACY_DMA=y
 CONFIG_B43LEGACY_PIO=y
 CONFIG_B43LEGACY_DMA_AND_PIO_MODE=y
@@ -3054,7 +3054,7 @@ CONFIG_USB_STORAGE_REALTEK=m
 CONFIG_REALTEK_AUTOPM=y
 CONFIG_USB_STORAGE_ENE_UB6250=m
 # CONFIG_USB_LIBUSUAL is not set
-# CONFIG_USB_UAS is not set
+CONFIG_USB_UAS=m
 
 
 #
@@ -3959,7 +3959,7 @@ CONFIG_IBMASR=m
 CONFIG_PM_DEBUG=y
 CONFIG_PM_TRACE=y
 CONFIG_PM_TRACE_RTC=y
-# CONFIG_PM_TEST_SUSPEND is not set
+CONFIG_PM_TEST_SUSPEND=y
 CONFIG_PM_RUNTIME=y
 # CONFIG_PM_OPP is not set
 
diff --git a/config-nodebug b/config-nodebug
index aff30011e..c14754265 100644
--- a/config-nodebug
+++ b/config-nodebug
@@ -2,109 +2,109 @@ CONFIG_SND_VERBOSE_PRINTK=y
 CONFIG_SND_DEBUG=y
 CONFIG_SND_PCM_XRUN_DEBUG=y
 
-# CONFIG_DEBUG_ATOMIC_SLEEP is not set
-
-# CONFIG_DEBUG_MUTEXES is not set
-# CONFIG_DEBUG_RT_MUTEXES is not set
-# CONFIG_DEBUG_LOCK_ALLOC is not set
-# CONFIG_PROVE_LOCKING is not set
-# CONFIG_DEBUG_SPINLOCK is not set
-# CONFIG_PROVE_RCU is not set
+CONFIG_DEBUG_ATOMIC_SLEEP=y
+
+CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_RT_MUTEXES=y
+CONFIG_DEBUG_LOCK_ALLOC=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_PROVE_RCU=y
 # CONFIG_PROVE_RCU_REPEATEDLY is not set
-# CONFIG_DEBUG_PER_CPU_MAPS is not set
+CONFIG_DEBUG_PER_CPU_MAPS=y
 CONFIG_CPUMASK_OFFSTACK=y
 
-# CONFIG_CPU_NOTIFIER_ERROR_INJECT is not set
+CONFIG_CPU_NOTIFIER_ERROR_INJECT=m
 
-# CONFIG_FAULT_INJECTION is not set
-# CONFIG_FAILSLAB is not set
-# CONFIG_FAIL_PAGE_ALLOC is not set
-# CONFIG_FAIL_MAKE_REQUEST is not set
-# CONFIG_FAULT_INJECTION_DEBUG_FS is not set
-# CONFIG_FAULT_INJECTION_STACKTRACE_FILTER is not set
-# CONFIG_FAIL_IO_TIMEOUT is not set
-# CONFIG_FAIL_MMC_REQUEST is not set
+CONFIG_FAULT_INJECTION=y
+CONFIG_FAILSLAB=y
+CONFIG_FAIL_PAGE_ALLOC=y
+CONFIG_FAIL_MAKE_REQUEST=y
+CONFIG_FAULT_INJECTION_DEBUG_FS=y
+CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y
+CONFIG_FAIL_IO_TIMEOUT=y
+CONFIG_FAIL_MMC_REQUEST=y
 
-# CONFIG_SLUB_DEBUG_ON is not set
+CONFIG_SLUB_DEBUG_ON=y
 
-# CONFIG_LOCK_STAT is not set
+CONFIG_LOCK_STAT=y
 
-# CONFIG_DEBUG_STACK_USAGE is not set
+CONFIG_DEBUG_STACK_USAGE=y
 
-# CONFIG_ACPI_DEBUG is not set
+CONFIG_ACPI_DEBUG=y
 # CONFIG_ACPI_DEBUG_FUNC_TRACE is not set
 
-# CONFIG_DEBUG_SG is not set
+CONFIG_DEBUG_SG=y
 
 # CONFIG_DEBUG_PAGEALLOC is not set
 
-# CONFIG_DEBUG_WRITECOUNT is not set
-# CONFIG_DEBUG_OBJECTS is not set
+CONFIG_DEBUG_WRITECOUNT=y
+CONFIG_DEBUG_OBJECTS=y
 # CONFIG_DEBUG_OBJECTS_SELFTEST is not set
-# CONFIG_DEBUG_OBJECTS_FREE is not set
-# CONFIG_DEBUG_OBJECTS_TIMERS is not set
-# CONFIG_DEBUG_OBJECTS_RCU_HEAD is not set
+CONFIG_DEBUG_OBJECTS_FREE=y
+CONFIG_DEBUG_OBJECTS_TIMERS=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
 CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
 
-# CONFIG_X86_PTDUMP is not set
+CONFIG_X86_PTDUMP=y
 
-# CONFIG_CAN_DEBUG_DEVICES is not set
+CONFIG_CAN_DEBUG_DEVICES=y
 
-# CONFIG_MODULE_FORCE_UNLOAD is not set
+CONFIG_MODULE_FORCE_UNLOAD=y
 
-# CONFIG_SYSCTL_SYSCALL_CHECK is not set
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 
-# CONFIG_DEBUG_NOTIFIERS is not set
+CONFIG_DEBUG_NOTIFIERS=y
 
-# CONFIG_DMA_API_DEBUG is not set
+CONFIG_DMA_API_DEBUG=y
 
-# CONFIG_MMIOTRACE is not set
+CONFIG_MMIOTRACE=y
 
-# CONFIG_DEBUG_CREDENTIALS is not set
+CONFIG_DEBUG_CREDENTIALS=y
 
 # off in both production debug and nodebug builds,
 #  on in rawhide nodebug builds
-# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
+CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
 
-# CONFIG_EXT4_DEBUG is not set
+CONFIG_EXT4_DEBUG=y
 
-# CONFIG_DEBUG_PERF_USE_VMALLOC is not set
+CONFIG_DEBUG_PERF_USE_VMALLOC=y
 
-# CONFIG_JBD2_DEBUG is not set
+CONFIG_JBD2_DEBUG=y
 
-# CONFIG_DEBUG_BLK_CGROUP is not set
+CONFIG_DEBUG_BLK_CGROUP=y
 
-# CONFIG_DRBD_FAULT_INJECTION is not set
+CONFIG_DRBD_FAULT_INJECTION=y
 
-# CONFIG_ATH_DEBUG is not set
-# CONFIG_CARL9170_DEBUGFS is not set
-# CONFIG_IWLWIFI_DEVICE_TRACING is not set
+CONFIG_ATH_DEBUG=y
+CONFIG_CARL9170_DEBUGFS=y
+CONFIG_IWLWIFI_DEVICE_TRACING=y
 
-# CONFIG_DEBUG_OBJECTS_WORK is not set
+CONFIG_DEBUG_OBJECTS_WORK=y
 
-# CONFIG_DMADEVICES_DEBUG is not set
-# CONFIG_DMADEVICES_VDEBUG is not set
+CONFIG_DMADEVICES_DEBUG=y
+CONFIG_DMADEVICES_VDEBUG=y
 
 CONFIG_PM_ADVANCED_DEBUG=y
 
-# CONFIG_CEPH_LIB_PRETTYDEBUG is not set
-# CONFIG_QUOTA_DEBUG is not set
+CONFIG_CEPH_LIB_PRETTYDEBUG=y
+CONFIG_QUOTA_DEBUG=y
 
 CONFIG_PCI_DEFAULT_USE_CRS=y
 
 CONFIG_KGDB_KDB=y
 CONFIG_KDB_KEYBOARD=y
 
-# CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER is not set
-# CONFIG_TEST_LIST_SORT is not set
+CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER=y
+CONFIG_TEST_LIST_SORT=y
 
-# CONFIG_DETECT_HUNG_TASK is not set
+CONFIG_DETECT_HUNG_TASK=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
 # CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
 
-# CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK is not set
+CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y
 
-# CONFIG_DEBUG_KMEMLEAK is not set
+CONFIG_DEBUG_KMEMLEAK=y
 CONFIG_DEBUG_KMEMLEAK_EARLY_LOG_SIZE=1024
 # CONFIG_DEBUG_KMEMLEAK_TEST is not set
 CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF=y
diff --git a/config-x86-generic b/config-x86-generic
index 859d92dcb..4243d2233 100644
--- a/config-x86-generic
+++ b/config-x86-generic
@@ -313,7 +313,7 @@ CONFIG_STRICT_DEVMEM=y
 # CONFIG_NO_BOOTMEM is not set
 
 # CONFIG_MEMTEST is not set
-# CONFIG_MAXSMP is not set
+CONFIG_MAXSMP=y
 
 
 CONFIG_HP_ILO=m
diff --git a/kernel.spec b/kernel.spec
index fbb0cb068..c6fdf3227 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -62,7 +62,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 2
+%global baserelease 3
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -163,7 +163,7 @@ Summary: The Linux kernel
 # Set debugbuildsenabled to 1 for production (build separate debug kernels)
 #  and 0 for rawhide (all kernels are debug kernels).
 # See also 'make debug' and 'make release'.
-%define debugbuildsenabled 1
+%define debugbuildsenabled 0
 
 # Want to build a vanilla kernel build without any non-upstream patches?
 %define with_vanilla %{?_with_vanilla: 1} %{?!_with_vanilla: 0}
@@ -176,7 +176,7 @@ Summary: The Linux kernel
 %define doc_build_fail true
 %endif
 
-%define rawhide_skip_docs 0
+%define rawhide_skip_docs 1
 %if 0%{?rawhide_skip_docs}
 %define with_doc 0
 %define doc_build_fail true
@@ -746,6 +746,9 @@ Patch21400: unhandled-irqs-switch-to-polling.patch
 
 Patch22000: weird-root-dentry-name-debug.patch
 
+#selinux ptrace child permissions
+Patch22001: selinux-apply-different-permission-to-ptrace-child.patch
+
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1429,6 +1432,9 @@ ApplyPatch unhandled-irqs-switch-to-polling.patch
 
 ApplyPatch weird-root-dentry-name-debug.patch
 
+#selinux ptrace child permissions
+ApplyPatch selinux-apply-different-permission-to-ptrace-child.patch
+
 #Highbank clock functions
 ApplyPatch highbank-export-clock-functions.patch 
 
@@ -2293,6 +2299,12 @@ fi
 #                 ||----w |
 #                 ||     ||
 %changelog
+* Mon Apr 09 2012 Justin M. Forbes <jforbes@redhat.com> - 3.4.0-0.rc2.git0.3
+- Reenable debugging options.
+
+* Mon Apr 09 2012 Justin M. Forbes <jforbes@redhat.com>
+- SELinux apply a different permission to ptrace a child vs non-child
+
 * Mon Apr 09 2012 Justin M. Forbes <jforbes@redhat.com> - 3.4.0-0.rc2.git0.2
 - Disable debugging options.
 
diff --git a/selinux-apply-different-permission-to-ptrace-child.patch b/selinux-apply-different-permission-to-ptrace-child.patch
new file mode 100644
index 000000000..90baad840
--- /dev/null
+++ b/selinux-apply-different-permission-to-ptrace-child.patch
@@ -0,0 +1,162 @@
+Some applications, like gdb, are able to ptrace both children or other
+completely unrelated tasks.  We would like to be able to discern these two
+things and to be able to allow gdb to ptrace it's children, but not to be
+able to ptrace unrelated tasks for security reasons.
+
+Upstream is a bit weary of this patch as it may be incomplete.  They are
+not fundamentally opposed to the patch, I was just ask to see if I could
+flush out any needed refinement in Fedora where we already had the
+problem.  We may find that we need to emulate the YAMA non-child
+registration module in order to completely deal with 'normal' ptrace on
+a system.  At the moment however, this patch will at least let us get
+gdb working for many users in Fedora (See fedora-devel-list for a
+discussion of the current issues people are complaining about in F17
+without this)
+
+---
+
+ security/selinux/hooks.c            |   38 +++++++++++++++++++++++++++++++++++
+ security/selinux/include/classmap.h |    2 +-
+ security/selinux/include/security.h |    2 ++
+ security/selinux/selinuxfs.c        |    3 ++-
+ security/selinux/ss/services.c      |    3 +++
+ 5 files changed, 46 insertions(+), 2 deletions(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 1a4acf4..b226f26 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1805,6 +1805,39 @@ static inline u32 open_file_to_av(struct file *file)
+ 
+ /* Hook functions begin here. */
+ 
++/**
++ * task_is_descendant - walk up a process family tree looking for a match
++ * @parent: the process to compare against while walking up from child
++ * @child: the process to start from while looking upwards for parent
++ *
++ * Returns 1 if child is a descendant of parent, 0 if not.
++ */
++static int task_is_descendant(struct task_struct *parent,
++			      struct task_struct *child)
++{
++	int rc = 0;
++	struct task_struct *walker = child;
++
++	if (!parent || !child)
++		return 0;
++
++	rcu_read_lock();
++	if (!thread_group_leader(parent))
++		parent = rcu_dereference(parent->group_leader);
++	while (walker->pid > 0) {
++		if (!thread_group_leader(walker))
++			walker = rcu_dereference(walker->group_leader);
++		if (walker == parent) {
++			rc = 1;
++			break;
++		}
++		walker = rcu_dereference(walker->real_parent);
++	}
++	rcu_read_unlock();
++
++	return rc;
++}
++
+ static int selinux_ptrace_access_check(struct task_struct *child,
+ 				     unsigned int mode)
+ {
+@@ -1820,6 +1853,9 @@ static int selinux_ptrace_access_check(struct task_struct *child,
+ 		return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
+ 	}
+ 
++
++	if (selinux_policycap_ptrace_child && task_is_descendant(current, child))
++		return current_has_perm(child, PROCESS__PTRACE_CHILD);
+ 	return current_has_perm(child, PROCESS__PTRACE);
+ }
+ 
+@@ -1831,6 +1867,8 @@ static int selinux_ptrace_traceme(struct task_struct *parent)
+ 	if (rc)
+ 		return rc;
+ 
++	if (selinux_policycap_ptrace_child && task_is_descendant(parent, current))
++		return task_has_perm(parent, current, PROCESS__PTRACE_CHILD);
+ 	return task_has_perm(parent, current, PROCESS__PTRACE);
+ }
+ 
+diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
+index 39e678c..72c08b9 100644
+--- a/security/selinux/include/classmap.h
++++ b/security/selinux/include/classmap.h
+@@ -29,7 +29,7 @@ struct security_class_mapping secclass_map[] = {
+ 	    "getattr", "setexec", "setfscreate", "noatsecure", "siginh",
+ 	    "setrlimit", "rlimitinh", "dyntransition", "setcurrent",
+ 	    "execmem", "execstack", "execheap", "setkeycreate",
+-	    "setsockcreate", NULL } },
++	    "setsockcreate", "ptrace_child", NULL } },
+ 	{ "system",
+ 	  { "ipc_info", "syslog_read", "syslog_mod",
+ 	    "syslog_console", "module_request", NULL } },
+diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
+index dde2005..ac14b0a 100644
+--- a/security/selinux/include/security.h
++++ b/security/selinux/include/security.h
+@@ -68,12 +68,14 @@ extern int selinux_enabled;
+ enum {
+ 	POLICYDB_CAPABILITY_NETPEER,
+ 	POLICYDB_CAPABILITY_OPENPERM,
++	POLICYDB_CAPABILITY_PTRACE_CHILD,
+ 	__POLICYDB_CAPABILITY_MAX
+ };
+ #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
+ 
+ extern int selinux_policycap_netpeer;
+ extern int selinux_policycap_openperm;
++extern int selinux_policycap_ptrace_child;
+ 
+ /*
+  * type_datum properties
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 4e93f9e..3379765 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -44,7 +44,8 @@
+ /* Policy capability filenames */
+ static char *policycap_names[] = {
+ 	"network_peer_controls",
+-	"open_perms"
++	"open_perms",
++	"ptrace_child",
+ };
+ 
+ unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
+diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
+index 9b7e7ed..4d12a6e 100644
+--- a/security/selinux/ss/services.c
++++ b/security/selinux/ss/services.c
+@@ -72,6 +72,7 @@
+ 
+ int selinux_policycap_netpeer;
+ int selinux_policycap_openperm;
++int selinux_policycap_ptrace_child;
+ 
+ static DEFINE_RWLOCK(policy_rwlock);
+ 
+@@ -1812,6 +1813,8 @@ static void security_load_policycaps(void)
+ 						  POLICYDB_CAPABILITY_NETPEER);
+ 	selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps,
+ 						  POLICYDB_CAPABILITY_OPENPERM);
++	selinux_policycap_ptrace_child = ebitmap_get_bit(&policydb.policycaps,
++						  POLICYDB_CAPABILITY_PTRACE_CHILD);
+ }
+ 
+ static int security_preserve_bools(struct policydb *p);
+
+
+
+
+_______________________________________________
+kernel mailing list
+kernel@lists.fedoraproject.org
+https://admin.fedoraproject.org/mailman/listinfo/kernel