aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKees Cook2012-12-17 18:03:14 -0600
committerLinus Torvalds2012-12-17 19:15:22 -0600
commit2f4b3bf6b2318cfaa177ec5a802f4d8d6afbd816 (patch)
treed4db7dc0ff5972232e2edbf08004e4ee838823c2
parent834f82e2aa9a8ede94b17b656329f850c1471514 (diff)
downloadkernel-omap-2f4b3bf6b2318cfaa177ec5a802f4d8d6afbd816.tar.gz
kernel-omap-2f4b3bf6b2318cfaa177ec5a802f4d8d6afbd816.tar.xz
kernel-omap-2f4b3bf6b2318cfaa177ec5a802f4d8d6afbd816.zip
/proc/pid/status: add "Seccomp" field
It is currently impossible to examine the state of seccomp for a given process. While attaching with gdb and attempting "call prctl(PR_GET_SECCOMP,...)" will work with some situations, it is not reliable. If the process is in seccomp mode 1, this query will kill the process (prctl not allowed), if the process is in mode 2 with prctl not allowed, it will similarly be killed, and in weird cases, if prctl is filtered to return errno 0, it can look like seccomp is disabled. When reviewing the state of running processes, there should be a way to externally examine the seccomp mode. ("Did this build of Chrome end up using seccomp?" "Did my distro ship ssh with seccomp enabled?") This adds the "Seccomp" line to /proc/$pid/status. Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: James Morris <jmorris@namei.org> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--Documentation/filesystems/proc.txt2
-rw-r--r--fs/proc/array.c8
2 files changed, 10 insertions, 0 deletions
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index 74cb394e6888..12665ee7094a 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -181,6 +181,7 @@ read the file /proc/PID/status:
181 CapPrm: 0000000000000000 181 CapPrm: 0000000000000000
182 CapEff: 0000000000000000 182 CapEff: 0000000000000000
183 CapBnd: ffffffffffffffff 183 CapBnd: ffffffffffffffff
184 Seccomp: 0
184 voluntary_ctxt_switches: 0 185 voluntary_ctxt_switches: 0
185 nonvoluntary_ctxt_switches: 1 186 nonvoluntary_ctxt_switches: 1
186 187
@@ -237,6 +238,7 @@ Table 1-2: Contents of the status files (as of 2.6.30-rc7)
237 CapPrm bitmap of permitted capabilities 238 CapPrm bitmap of permitted capabilities
238 CapEff bitmap of effective capabilities 239 CapEff bitmap of effective capabilities
239 CapBnd bitmap of capabilities bounding set 240 CapBnd bitmap of capabilities bounding set
241 Seccomp seccomp mode, like prctl(PR_GET_SECCOMP, ...)
240 Cpus_allowed mask of CPUs on which this process may run 242 Cpus_allowed mask of CPUs on which this process may run
241 Cpus_allowed_list Same as previous, but in "list format" 243 Cpus_allowed_list Same as previous, but in "list format"
242 Mems_allowed mask of memory nodes allowed to this process 244 Mems_allowed mask of memory nodes allowed to this process
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 377a37366dde..077235ffb38b 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -336,6 +336,13 @@ static inline void task_cap(struct seq_file *m, struct task_struct *p)
336 render_cap_t(m, "CapBnd:\t", &cap_bset); 336 render_cap_t(m, "CapBnd:\t", &cap_bset);
337} 337}
338 338
339static inline void task_seccomp(struct seq_file *m, struct task_struct *p)
340{
341#ifdef CONFIG_SECCOMP
342 seq_printf(m, "Seccomp:\t%d\n", p->seccomp.mode);
343#endif
344}
345
339static inline void task_context_switch_counts(struct seq_file *m, 346static inline void task_context_switch_counts(struct seq_file *m,
340 struct task_struct *p) 347 struct task_struct *p)
341{ 348{
@@ -369,6 +376,7 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
369 } 376 }
370 task_sig(m, task); 377 task_sig(m, task);
371 task_cap(m, task); 378 task_cap(m, task);
379 task_seccomp(m, task);
372 task_cpus_allowed(m, task); 380 task_cpus_allowed(m, task);
373 cpuset_task_status_allowed(m, task); 381 cpuset_task_status_allowed(m, task);
374 task_context_switch_counts(m, task); 382 task_context_switch_counts(m, task);