linux/security/apparmor
Andy Lutomirski 259e5e6c75 Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs
With this change, calling
  prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)
disables privilege granting operations at execve-time.  For example, a
process will not be able to execute a setuid binary to change their uid
or gid if this bit is set.  The same is true for file capabilities.

Additionally, LSM_UNSAFE_NO_NEW_PRIVS is defined to ensure that
LSMs respect the requested behavior.

To determine if the NO_NEW_PRIVS bit is set, a task may call
  prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
It returns 1 if set and 0 if it is not set. If any of the arguments are
non-zero, it will return -1 and set errno to -EINVAL.
(PR_SET_NO_NEW_PRIVS behaves similarly.)

This functionality is desired for the proposed seccomp filter patch
series.  By using PR_SET_NO_NEW_PRIVS, it allows a task to modify the
system call behavior for itself and its child tasks without being
able to impact the behavior of a more privileged task.

Another potential use is making certain privileged operations
unprivileged.  For example, chroot may be considered "safe" if it cannot
affect privileged tasks.

Note, this patch causes execve to fail when PR_SET_NO_NEW_PRIVS is
set and AppArmor is in use.  It is fixed in a subsequent patch.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Will Drewry <wad@chromium.org>
Acked-by: Eric Paris <eparis@redhat.com>
Acked-by: Kees Cook <keescook@chromium.org>

v18: updated change desc
v17: using new define values as per 3.4
Signed-off-by: James Morris <james.l.morris@oracle.com>
2012-04-14 11:13:18 +10:00
..
include LSM: shrink sizeof LSM specific portion of common_audit_data 2012-04-03 09:48:40 -07:00
.gitignore .gitignore: ignore apparmor/rlim_names.h 2010-10-21 10:12:35 +11:00
apparmorfs.c AppArmor: export known rlimit names/value mappings in securityfs 2012-02-27 11:38:19 -08:00
audit.c lsm_audit: don't specify the audit pre/post callbacks in 'struct common_audit_data' 2012-04-03 09:49:59 -07:00
capability.c LSM: shrink sizeof LSM specific portion of common_audit_data 2012-04-03 09:48:40 -07:00
context.c AppArmor: contexts used in attaching policy to system objects 2010-08-02 15:35:12 +10:00
domain.c Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs 2012-04-14 11:13:18 +10:00
file.c LSM: shrink sizeof LSM specific portion of common_audit_data 2012-04-03 09:48:40 -07:00
ipc.c LSM: shrink sizeof LSM specific portion of common_audit_data 2012-04-03 09:48:40 -07:00
Kconfig apparmor: depends on NET 2010-08-05 07:36:51 -04:00
lib.c LSM: shrink sizeof LSM specific portion of common_audit_data 2012-04-03 09:48:40 -07:00
lsm.c LSM: shrink sizeof LSM specific portion of common_audit_data 2012-04-03 09:48:40 -07:00
Makefile AppArmor: Fix location of const qualifier on generated string tables 2012-03-19 18:22:46 -07:00
match.c AppArmor: Update dfa matching routines. 2012-03-14 06:15:24 -07:00
path.c AppArmor: Move path failure information into aa_get_name and rename 2012-03-14 06:15:25 -07:00
policy_unpack.c LSM: shrink sizeof LSM specific portion of common_audit_data 2012-04-03 09:48:40 -07:00
policy.c LSM: shrink sizeof LSM specific portion of common_audit_data 2012-04-03 09:48:40 -07:00
procattr.c apparmor: sparse fix: include procattr.h in procattr.c 2011-09-09 16:56:29 -07:00
resource.c LSM: shrink sizeof LSM specific portion of common_audit_data 2012-04-03 09:48:40 -07:00
sid.c AppArmor: core policy routines 2010-08-02 15:38:37 +10:00