Re: [PATCH 2/2] Yama: add PTRACE exception tracking

[Tetsuo Handa]

Kees Cook wrote:
> +static spinlock_t ptracer_relations_lock;
static DEFINE_SPINLOCK(ptracer_relations_lock);

> +static int yama_ptracer_add(struct task_struct *tracer,
> +			    struct task_struct *tracee)
> +{
> +	struct ptrace_relation *relation;
> +
> +	relation = kzalloc(sizeof(*relation), GFP_KERNEL);
You can use kmalloc() since all fields are initialized within this function.
> +	if (!relation)
> +		return -ENOMEM;
> +	relation->tracer = tracer;
> +	relation->tracee = tracee;
> +	spin_lock(&ptracer_relations_lock);
> +	list_add(&relation->node, &ptracer_relations);
> +	spin_unlock(&ptracer_relations_lock);
> +
> +	return 0;
> +}

> +static int ptracer_exception_found(struct task_struct *tracer,
> +				   struct task_struct *tracee)
> +{
> +	int rc = 0;
> +	struct ptrace_relation *relation;
> +	struct task_struct *parent = NULL;
> +
> +	spin_lock(&ptracer_relations_lock);
> +	list_for_each_entry(relation, &ptracer_relations, node)
> +		if (relation->tracee == tracee) {
> +			parent = relation->tracer;
> +			break;
> +		}
> +	if (task_is_descendant(parent, tracer))
> +		rc = 1;
> +	spin_unlock(&ptracer_relations_lock);

Can't we release ptracer_relations_lock before calling
task_is_descendant() since task_is_descendant() won't
access "struct ptrace_relation" on ptracer_relations list.

> @@ -32,27 +204,20 @@ static int yama_ptrace_access_check(struct task_struct *child,
>  {
>  	int rc;
>  
> +	/* If standard caps disallows it, so does Yama.  We should
> +	 * should only tighten restrictions further.
s/should should/should/
> +	 */

> @@ -221,6 +388,8 @@ static __init int yama_init(void)
>  
>  	printk(KERN_INFO "Yama: becoming mindful.\n");
>  
> +	spin_lock_init(&ptracer_relations_lock);
> +
You can statically initialize by using DEFINE_SPINLOCK().
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/