Eric W. Biederman df26c40e56 [PATCH] proc: Cleanup proc_fd_access_allowed ... In process of getting proc_fd_access_allowed to work it has developed a few warts. In particular the special case that always allows introspection and the special case to allow inspection of kernel threads. The special case for introspection is needed for /proc/self/mem. The special case for kernel threads really should be overridable by security modules. So consolidate these checks into ptrace.c:may_attach(). The check to always allow introspection is trivial. The check to allow access to kernel threads, and zombies is a little trickier. mem_read and mem_write already verify an mm exists so it isn't needed twice. proc_fd_access_allowed only doesn't want a check to verify task->mm exits, s it prevents all access to kernel threads. So just move the task->mm check into ptrace_attach where it is needed for practical reasons. I did a quick audit and none of the security modules in the kernel seem to care if they are passed a task without an mm into security_ptrace. So the above move should be safe and it allows security modules to come up with more restrictive policy. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Cc: Stephen Smalley <sds@tycho.nsa.gov> Cc: Chris Wright <chrisw@sous-sol.org> Cc: James Morris <jmorris@namei.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>		2006-06-26 09:58:26 -07:00
..
irq	[PATCH] adjust handle_IRR_event() return type	2006-06-23 07:43:08 -07:00
power	Revert "swsusp special saveable pages support" commits	2006-06-25 18:41:00 -07:00
time	[PATCH] time: rename clocksource functions	2006-06-26 09:58:21 -07:00
.gitignore	gitignore: ignore more generated files	2006-01-03 11:35:26 +01:00
acct.c	[PATCH] pacct: none-delayed process accounting accumulation	2006-06-25 10:01:25 -07:00
audit.c	[PATCH] log more info for directory entry change events	2006-06-20 05:25:28 -04:00
audit.h	[PATCH] log more info for directory entry change events	2006-06-20 05:25:28 -04:00
auditfilter.c	[PATCH] log more info for directory entry change events	2006-06-20 05:25:28 -04:00
auditsc.c	[PATCH] Doc: add audit & acct to DocBook	2006-06-23 07:43:07 -07:00
capability.c	[PATCH] refactor capable() to one implementation, add __capable() helper	2006-03-25 08:22:56 -08:00
compat.c	[PATCH] N32 sigset and __COMPAT_ENDIAN_SWAP__	2006-06-25 10:01:15 -07:00
configs.c	update the email address of Randy Dunlap	2006-01-03 13:37:51 +01:00
cpu.c	[PATCH] Convert kernel/cpu.c to mutexes	2006-06-26 09:58:16 -07:00
cpuset.c	[PATCH] proc: Use struct pid not struct task_ref	2006-06-26 09:58:26 -07:00
dma.c	Linux-2.6.12-rc2	2005-04-16 15:20:36 -07:00
exec_domain.c	[PATCH] Fix module refcount leak in __set_personality()	2006-03-24 07:33:30 -08:00
exit.c	[PATCH] proc: Rewrite the proc dentry flush on exit optimization	2006-06-26 09:58:24 -07:00
extable.c	[PATCH] symbol_put_addr() locks kernel	2006-05-15 11:20:55 -07:00
fork.c	[PATCH] proc: Rewrite the proc dentry flush on exit optimization	2006-06-26 09:58:24 -07:00
futex_compat.c	[PATCH] futex: check and validate timevals	2006-03-31 12:18:59 -08:00
futex.c	[PATCH] VFS: Permit filesystem to override root dentry on mount	2006-06-23 07:42:45 -07:00
hrtimer.c	[PATCH] ktime/hrtimer: fix kernel-doc comments	2006-06-25 10:01:23 -07:00
itimer.c	[PATCH] hrtimers: remove data field	2006-03-26 08:57:03 -08:00
kallsyms.c	[PATCH] fix missing includes	2005-10-30 17:37:32 -08:00
Kconfig.hz	[PATCH] i386: Selectable Frequency of the Timer Interrupt	2005-06-23 09:45:10 -07:00
Kconfig.preempt	[PATCH] sched: voluntary kernel preemption	2005-06-25 16:24:45 -07:00
kexec.c	[PATCH] Add a sysfs file to determine if a kexec kernel is loaded	2006-06-23 07:43:02 -07:00
kfifo.c	[PATCH] gfp flags annotations - part 1	2005-10-08 15:00:57 -07:00
kmod.c	[PATCH] wait_for_helper: trivial style cleanup	2006-03-28 18:36:41 -08:00
kprobes.c	[PATCH] Notify page fault call chain	2006-06-26 09:58:22 -07:00
ksysfs.c	[PATCH] Add a sysfs file to determine if a kexec kernel is loaded	2006-06-23 07:43:02 -07:00
kthread.c	[PATCH] kthread: move kernel-doc and put it into DocBook	2006-06-25 10:01:24 -07:00
Makefile	[PATCH] Time: Use clocksource infrastructure for update_wall_time	2006-06-26 09:58:20 -07:00
module.c	[PATCH] ensure NULL deref can't possibly happen in is_exported()	2006-06-25 10:00:59 -07:00
mutex-debug.c	[PATCH] work around ppc64 bootup bug by making mutex-debugging save/restore irqs	2006-06-26 09:58:16 -07:00
mutex-debug.h	[PATCH] work around ppc64 bootup bug by making mutex-debugging save/restore irqs	2006-06-26 09:58:16 -07:00
mutex.c	[PATCH] work around ppc64 bootup bug by making mutex-debugging save/restore irqs	2006-06-26 09:58:16 -07:00
mutex.h	[PATCH] work around ppc64 bootup bug by making mutex-debugging save/restore irqs	2006-06-26 09:58:16 -07:00
panic.c	[PATCH] the scheduled unexport of panic_timeout	2006-04-11 06:18:40 -07:00
params.c	[PATCH] Change dash2underscore() return value to char	2006-03-28 09:16:03 -08:00
pid.c	[PATCH] pidhash: Refactor the pid hash table	2006-03-31 12:19:00 -08:00
posix-cpu-timers.c	[PATCH] arm_timer: remove a racy and obsolete PF_EXITING check	2006-06-17 10:52:13 -07:00
posix-timers.c	[PATCH] hrtimers: remove data field	2006-03-26 08:57:03 -08:00
printk.c	[PATCH] printk time parameter	2006-06-25 10:01:13 -07:00
profile.c	[PATCH] Remove __devinit and __cpuinit from notifier_call definitions	2006-04-26 08:30:03 -07:00
ptrace.c	[PATCH] proc: Cleanup proc_fd_access_allowed	2006-06-26 09:58:26 -07:00
rcupdate.c	[PATCH] Make RCU API inaccessible to non-GPL Linux kernel modules	2006-06-23 07:43:07 -07:00
rcutorture.c	[PATCH] for_each_possible_cpu: fixes for generic part	2006-03-28 09:16:05 -08:00
relay.c	[PATCH] relay: consolidate sendfile() and read() code	2006-03-23 19:58:45 +01:00
resource.c	[PATCH] kernel/resource.c: __check_region(): remove pointless __deprecated	2006-01-10 08:02:02 -08:00
sched.c	[PATCH] cpu hotplug: fix CPU_UP_CANCEL handling	2006-06-25 10:01:22 -07:00
seccomp.c	Linux-2.6.12-rc2	2005-04-16 15:20:36 -07:00
signal.c	[PATCH] collect sid of those who send signals to auditd	2006-06-20 05:25:21 -04:00
softirq.c	[PATCH] cpu hotplug: fix CPU_UP_CANCEL handling	2006-06-25 10:01:22 -07:00
softlockup.c	[PATCH] cpu hotplug: fix CPU_UP_CANCEL handling	2006-06-25 10:01:22 -07:00
spinlock.c	[PATCH] BUILD_LOCK_OPS: cleanup preempt_disable() usage	2006-03-23 07:38:16 -08:00
stop_machine.c	[PATCH] kthread: convert stop_machine into a kthread	2006-06-25 10:01:22 -07:00
sys_ni.c	[PATCH] sys_move_pages: 32bit support (i386, x86_64)	2006-06-23 07:42:53 -07:00
sys.c	[PATCH] kernel/sys.c: cleanups	2006-06-25 10:01:06 -07:00
sysctl.c	[PATCH] Get rid of /proc/sys/proc	2006-06-25 10:01:15 -07:00
time.c	[PATCH] Time: Introduce arch generic time accessors	2006-06-26 09:58:20 -07:00
timer.c	[PATCH] fix and optimize clock source update	2006-06-26 09:58:21 -07:00
uid16.c	[PATCH] Add more prevent_tail_call()	2006-04-19 16:27:18 -07:00
user.c	[PATCH] selinux: add hooks for key subsystem	2006-06-22 15:05:55 -07:00
wait.c	Linux-2.6.12-rc2	2005-04-16 15:20:36 -07:00
workqueue.c	[PATCH] cpu hotplug: fix CPU_UP_CANCEL handling	2006-06-25 10:01:22 -07:00