Merge branch 'for-linus/seccomp' into for-next/seccomp (7ef95e3d) · Commits · 戴 / test

kernel/ptrace.c

+5 −11

Original line number	Diff line number	Diff line
		@@ -264,17 +264,11 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
		return ret;
		}

		static bool ptrace_has_cap(const struct cred cred, struct user_namespace ns,
		unsigned int mode)
		static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
		{
		int ret;

		if (mode & PTRACE_MODE_NOAUDIT)
		ret = security_capable(cred, ns, CAP_SYS_PTRACE, CAP_OPT_NOAUDIT);
		else
		ret = security_capable(cred, ns, CAP_SYS_PTRACE, CAP_OPT_NONE);

		return ret == 0;
		return ns_capable_noaudit(ns, CAP_SYS_PTRACE);
		return ns_capable(ns, CAP_SYS_PTRACE);
		}

		/* Returns 0 on success, -errno on denial. */
		@@ -326,7 +320,7 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
		gid_eq(caller_gid, tcred->sgid) &&
		gid_eq(caller_gid, tcred->gid))
		goto ok;
		if (ptrace_has_cap(cred, tcred->user_ns, mode))
		if (ptrace_has_cap(tcred->user_ns, mode))
		goto ok;
		rcu_read_unlock();
		return -EPERM;
		@@ -345,7 +339,7 @@ ok:
		mm = task->mm;
		if (mm &&
		((get_dumpable(mm) != SUID_DUMP_USER) &&
		!ptrace_has_cap(cred, mm->user_ns, mode)))
		!ptrace_has_cap(mm->user_ns, mode)))
		return -EPERM;

		return security_ptrace_access_check(task, mode);

+2 −3

Original line number	Diff line number	Diff line
		@@ -38,7 +38,7 @@
		#include <linux/filter.h>
		#include <linux/pid.h>
		#include <linux/ptrace.h>
		#include <linux/security.h>
		#include <linux/capability.h>
		#include <linux/tracehook.h>
		#include <linux/uaccess.h>
		#include <linux/anon_inodes.h>
		@@ -649,8 +649,7 @@ static struct seccomp_filter seccomp_prepare_filter(struct sock_fprog fprog)
		* behavior of privileged children.
		*/
		if (!task_no_new_privs(current) &&
		security_capable(current_cred(), current_user_ns(),
		CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) != 0)
		!ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
		return ERR_PTR(-EACCES);

		/* Allocate a new seccomp_filter */

+4 −4

Original line number	Diff line number	Diff line
		@@ -1758,10 +1758,10 @@ TEST_F(TRACE_poke, getpid_runs_normally)
		* and the code is stored as a positive value. \
		*/ \
		if (_result < 0) { \
		SYSCALL_RET(_regs) = -result; \
		SYSCALL_RET(_regs) = -_result; \
		(_regs).ccr \|= 0x10000000; \
		} else { \
		SYSCALL_RET(_regs) = result; \
		SYSCALL_RET(_regs) = _result; \
		(_regs).ccr &= ~0x10000000; \
		} \
		} while (0)
		@@ -1804,8 +1804,8 @@ TEST_F(TRACE_poke, getpid_runs_normally)
		#define SYSCALL_RET(_regs) (_regs).a[(_regs).windowbase * 4 + 2]
		#elif defined(__sh__)
		# define ARCH_REGS struct pt_regs
		# define SYSCALL_NUM(_regs) (_regs).gpr[3]
		# define SYSCALL_RET(_regs) (_regs).gpr[0]
		# define SYSCALL_NUM(_regs) (_regs).regs[3]
		# define SYSCALL_RET(_regs) (_regs).regs[0]
		#else
		# error "Do not know how to find your architecture's registers and syscalls"
		#endif