Andy Lutomirski 259e5e6c75 Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs ... With this change, calling prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) disables privilege granting operations at execve-time. For example, a process will not be able to execute a setuid binary to change their uid or gid if this bit is set. The same is true for file capabilities. Additionally, LSM_UNSAFE_NO_NEW_PRIVS is defined to ensure that LSMs respect the requested behavior. To determine if the NO_NEW_PRIVS bit is set, a task may call prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0); It returns 1 if set and 0 if it is not set. If any of the arguments are non-zero, it will return -1 and set errno to -EINVAL. (PR_SET_NO_NEW_PRIVS behaves similarly.) This functionality is desired for the proposed seccomp filter patch series. By using PR_SET_NO_NEW_PRIVS, it allows a task to modify the system call behavior for itself and its child tasks without being able to impact the behavior of a more privileged task. Another potential use is making certain privileged operations unprivileged. For example, chroot may be considered "safe" if it cannot affect privileged tasks. Note, this patch causes execve to fail when PR_SET_NO_NEW_PRIVS is set and AppArmor is in use. It is fixed in a subsequent patch. Signed-off-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: Will Drewry <wad@chromium.org> Acked-by: Eric Paris <eparis@redhat.com> Acked-by: Kees Cook <keescook@chromium.org> v18: updated change desc v17: using new define values as per 3.4 Signed-off-by: James Morris <james.l.morris@oracle.com>		2012-04-14 11:13:18 +10:00
..
debug	KGDB/KDB regression fixes	2012-04-04 17:26:08 -07:00
events	Merge branch 'linus' into perf/urgent	2012-03-26 17:19:03 +02:00
gcov	…
irq	Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2012-03-30 18:08:05 -07:00
power	PM / QoS: add pm_qos_update_request_timeout() API	2012-03-28 23:31:24 +02:00
sched	Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2012-03-31 13:35:31 -07:00
time	Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2012-03-29 14:16:48 -07:00
trace	Merge branch 'akpm' (Andrew's patch-bomb)	2012-04-05 15:30:34 -07:00
.gitignore	…
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.locks	locking/kconfig: Simplify INLINE_SPIN_UNLOCK usage	2012-03-23 13:18:57 +01:00
Kconfig.preempt	locking/kconfig: Simplify INLINE_SPIN_UNLOCK usage	2012-03-23 13:18:57 +01:00
Makefile	sysctl: Move the implementation into fs/proc/proc_sysctl.c	2012-01-24 16:37:54 -08:00
acct.c	Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2012-01-08 12:19:57 -08:00
async.c	kernel/async: remove redundant declaration.	2012-01-13 09:32:18 +10:30
audit.c	constify path argument of audit_log_d_path()	2012-03-20 21:29:40 -04:00
audit.h	audit: remove AUDIT_SETUP_CONTEXT as it isn't used	2012-01-17 16:16:57 -05:00
audit_tree.c	…
audit_watch.c	…
auditfilter.c	audit: allow interfield comparison in audit rules	2012-01-17 16:17:01 -05:00
auditsc.c	kernel-doc: fix new warnings in auditsc.c	2012-01-23 08:44:53 -08:00
backtracetest.c	…
bounds.c	…
capability.c	Revert "capabitlies: ns_capable can use the cap helpers rather than lsm call"	2012-01-17 10:19:41 -08:00
cgroup.c	cgroup: cgroup_attach_task() could return -errno after success	2012-03-29 22:03:33 -07:00
cgroup_freezer.c	cgroup: remove cgroup_subsys argument from callbacks	2012-02-02 09:20:22 -08:00
compat.c	compat: Add helper functions to read/write struct timeval, timespec	2012-02-20 12:48:47 -08:00
configs.c	…
cpu.c	Merge branch 'pm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm	2012-01-08 13:10:57 -08:00
cpu_pm.c	…
cpuset.c	Autogenerated GPG tag for Rusty D1ADB8F1: 15EE 8D6C AB0E 7F0C F999 BFCB D920 0E6C D1AD B8F1	2012-04-02 08:53:24 -07:00
crash_dump.c	…
cred.c	security: trim security.h	2012-02-14 10:45:42 +11:00
delayacct.c	…
dma.c	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
elfcore.c	…
exec_domain.c	…
exit.c	Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2012-03-29 18:12:23 -07:00
extable.c	…
fork.c	prctl: add PR_{SET,GET}_CHILD_SUBREAPER to allow simple process supervision	2012-03-23 16:58:32 -07:00
freezer.c	PM / Freezer: Remove references to TIF_FREEZE in comments	2012-03-04 23:08:54 +01:00
futex.c	futex: Mark get_robust_list as deprecated	2012-03-29 11:37:17 +02:00
futex_compat.c	futex: Mark get_robust_list as deprecated	2012-03-29 11:37:17 +02:00
groups.c	…
hrtimer.c	…
hung_task.c	hung_task: fix the broken rcu_lock_break() logic	2012-03-05 15:49:42 -08:00
irq_work.c	irq_work: fix compile failure on MIPS from system.h split	2012-04-02 08:48:04 -07:00
itimer.c	[S390] cputime: add sparse checking and cleanup	2011-12-15 14:56:19 +01:00
jump_label.c	static keys: Inline the static_key_enabled() function	2012-02-28 20:01:08 +01:00
kallsyms.c	…
kexec.c	Merge branch 'akpm' (Andrew's patch-bomb)	2012-03-28 17:19:28 -07:00
kfifo.c	…
kmod.c	PM / Sleep: Mitigate race between the freezer and request_firmware()	2012-03-28 23:30:28 +02:00
kprobes.c	kprobes: return proper error code from register_kprobe()	2012-03-05 15:49:42 -08:00
ksysfs.c	…
kthread.c	…
latencytop.c	…
lockdep.c	lockdep: Add CPU-idle/offline warning to lockdep-RCU splat	2012-02-21 09:06:06 -08:00
lockdep_internals.h	…
lockdep_proc.c	…
lockdep_states.h	…
module.c	module: Remove module size limit	2012-03-26 12:50:53 +10:30
mutex-debug.c	…
mutex-debug.h	…
mutex.c	sched/rt: Use schedule_preempt_disabled()	2012-03-01 10:28:03 +01:00
mutex.h	…
notifier.c	…
nsproxy.c	…
padata.c	padata: Fix cpu hotplug	2012-03-29 19:52:46 +08:00
panic.c	panic: don't print redundant backtraces on oops	2012-01-12 20:13:11 -08:00
params.c	params: <level>_initcall-like kernel parameters	2012-03-26 12:50:51 +10:30
pid.c	vfs: fix panic in __d_lookup() with high dentry hashtable counts	2012-02-13 20:45:38 -05:00
pid_namespace.c	pidns: add reboot_pid_ns() to handle the reboot syscall	2012-03-28 17:14:36 -07:00
posix-cpu-timers.c	[S390] cputime: add sparse checking and cleanup	2011-12-15 14:56:19 +01:00
posix-timers.c	…
printk.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2012-03-20 10:31:44 -07:00
profile.c	…
ptrace.c	ptrace: remove PTRACE_SEIZE_DEVEL bit	2012-03-23 16:58:41 -07:00
range.c	…
rcu.h	rcu: Allow nesting of rcu_idle_enter() and rcu_idle_exit()	2012-02-21 09:06:12 -08:00
rcupdate.c	rcu: Check for illegal use of RCU from offlined CPUs	2012-02-21 09:06:03 -08:00
rcutiny.c	rcu: Add RCU_NONIDLE() for idle-loop RCU read-side critical sections	2012-02-21 09:06:13 -08:00
rcutiny_plugin.h	rcu: Simplify unboosting checks	2012-02-21 09:03:43 -08:00
rcutorture.c	PTR_ERR should be called before its argument is cleared.	2012-02-21 09:06:10 -08:00
rcutree.c	rcu: Stop spurious warnings from synchronize_sched_expedited	2012-02-21 15:33:34 -08:00
rcutree.h	rcu: Rework detection of use of RCU by offline CPUs	2012-02-21 09:06:07 -08:00
rcutree_plugin.h	rcu: Hold off RCU_FAST_NO_HZ after timer posted	2012-02-21 09:42:30 -08:00
rcutree_trace.c	rcu: Rework detection of use of RCU by offline CPUs	2012-02-21 09:06:07 -08:00
relay.c	relay: prevent integer overflow in relay_open()	2012-02-10 09:04:49 +01:00
res_counter.c	net: introduce res_counter_charge_nofail() for socket allocations	2012-01-22 15:08:46 -05:00
resource.c	kernel/resource.c: move EXPORT_SYMBOL right after definition	2012-02-03 23:37:07 +01:00
rtmutex-debug.c	…
rtmutex-debug.h	…
rtmutex-tester.c	rtmutex-tester: convert sysdev_class to a regular subsystem	2011-12-14 14:54:22 -08:00
rtmutex.c	Revert "rcu: Permit rt_mutex_unlock() with irqs disabled"	2011-12-11 10:33:18 -08:00
rtmutex.h	…
rtmutex_common.h	…
rwsem.c	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
seccomp.c	seccomp: audit abnormal end to a process due to seccomp	2012-01-17 16:16:55 -05:00
semaphore.c	…
signal.c	Disintegrate and delete asm/system.h	2012-03-28 15:58:21 -07:00
smp.c	smp: add func to IPI cpus based on parameter func	2012-03-28 17:14:35 -07:00
softirq.c	Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2012-03-20 10:32:09 -07:00
spinlock.c	locking/kconfig: Simplify INLINE_SPIN_UNLOCK usage	2012-03-23 13:18:57 +01:00
srcu.c	rcu: Call out dangers of expedited RCU primitives	2012-02-21 09:06:08 -08:00
stacktrace.c	…
stop_machine.c	…
sys.c	Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs	2012-04-14 11:13:18 +10:00
sys_ni.c	…
sysctl.c	sysctl: fix write access to dmesg_restrict/kptr_restrict	2012-04-05 14:51:43 +10:00
sysctl_binary.c	binary_sysctl(): fix memory leak	2011-12-20 10:25:04 -08:00
taskstats.c	…
test_kprobes.c	…
time.c	time: Remove bogus comments	2012-03-15 18:17:55 -07:00
timeconst.pl	…
timer.c	Merge branch 'core-debugobjects-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2012-01-06 07:53:34 -08:00
tracepoint.c	static keys: Introduce 'struct static_key', static_key_true()/false() and static_key_slow_[inc|dec]()	2012-02-24 10:05:59 +01:00
tsacct.c	[S390] cputime: add sparse checking and cleanup	2011-12-15 14:56:19 +01:00
uid16.c	…
up.c	…
user-return-notifier.c	…
user.c	…
user_namespace.c	…
utsname.c	…
utsname_sysctl.c	…
wait.c	lockdep/waitqueues: Add better annotation	2011-12-21 10:07:39 +01:00
watchdog.c	kernel/watchdog.c: add comment to watchdog() exit path	2012-03-23 16:58:32 -07:00
workqueue.c	Merge branch 'for-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq	2012-03-20 18:13:22 -07:00
workqueue_sched.h	…