2005-04-17 06:20:36 +08:00
|
|
|
#ifndef _LINUX__INIT_TASK_H
|
|
|
|
|
#define _LINUX__INIT_TASK_H
|
|
|
|
|
|
2005-09-10 04:04:13 +08:00
|
|
|
#include <linux/rcupdate.h>
|
2006-07-03 15:24:42 +08:00
|
|
|
#include <linux/irqflags.h>
|
2006-10-02 17:18:14 +08:00
|
|
|
#include <linux/utsname.h>
|
[PATCH] lockdep: core
Do 'make oldconfig' and accept all the defaults for new config options -
reboot into the kernel and if everything goes well it should boot up fine and
you should have /proc/lockdep and /proc/lockdep_stats files.
Typically if the lock validator finds some problem it will print out
voluminous debug output that begins with "BUG: ..." and which syslog output
can be used by kernel developers to figure out the precise locking scenario.
What does the lock validator do? It "observes" and maps all locking rules as
they occur dynamically (as triggered by the kernel's natural use of spinlocks,
rwlocks, mutexes and rwsems). Whenever the lock validator subsystem detects a
new locking scenario, it validates this new rule against the existing set of
rules. If this new rule is consistent with the existing set of rules then the
new rule is added transparently and the kernel continues as normal. If the
new rule could create a deadlock scenario then this condition is printed out.
When determining validity of locking, all possible "deadlock scenarios" are
considered: assuming arbitrary number of CPUs, arbitrary irq context and task
context constellations, running arbitrary combinations of all the existing
locking scenarios. In a typical system this means millions of separate
scenarios. This is why we call it a "locking correctness" validator - for all
rules that are observed the lock validator proves it with mathematical
certainty that a deadlock could not occur (assuming that the lock validator
implementation itself is correct and its internal data structures are not
corrupted by some other kernel subsystem). [see more details and conditionals
of this statement in include/linux/lockdep.h and
Documentation/lockdep-design.txt]
Furthermore, this "all possible scenarios" property of the validator also
enables the finding of complex, highly unlikely multi-CPU multi-context races
via single single-context rules, increasing the likelyhood of finding bugs
drastically. In practical terms: the lock validator already found a bug in
the upstream kernel that could only occur on systems with 3 or more CPUs, and
which needed 3 very unlikely code sequences to occur at once on the 3 CPUs.
That bug was found and reported on a single-CPU system (!). So in essence a
race will be found "piecemail-wise", triggering all the necessary components
for the race, without having to reproduce the race scenario itself! In its
short existence the lock validator found and reported many bugs before they
actually caused a real deadlock.
To further increase the efficiency of the validator, the mapping is not per
"lock instance", but per "lock-class". For example, all struct inode objects
in the kernel have inode->inotify_mutex. If there are 10,000 inodes cached,
then there are 10,000 lock objects. But ->inotify_mutex is a single "lock
type", and all locking activities that occur against ->inotify_mutex are
"unified" into this single lock-class. The advantage of the lock-class
approach is that all historical ->inotify_mutex uses are mapped into a single
(and as narrow as possible) set of locking rules - regardless of how many
different tasks or inode structures it took to build this set of rules. The
set of rules persist during the lifetime of the kernel.
To see the rough magnitude of checking that the lock validator does, here's a
portion of /proc/lockdep_stats, fresh after bootup:
lock-classes: 694 [max: 2048]
direct dependencies: 1598 [max: 8192]
indirect dependencies: 17896
all direct dependencies: 16206
dependency chains: 1910 [max: 8192]
in-hardirq chains: 17
in-softirq chains: 105
in-process chains: 1065
stack-trace entries: 38761 [max: 131072]
combined max dependencies: 2033928
hardirq-safe locks: 24
hardirq-unsafe locks: 176
softirq-safe locks: 53
softirq-unsafe locks: 137
irq-safe locks: 59
irq-unsafe locks: 176
The lock validator has observed 1598 actual single-thread locking patterns,
and has validated all possible 2033928 distinct locking scenarios.
More details about the design of the lock validator can be found in
Documentation/lockdep-design.txt, which can also found at:
http://redhat.com/~mingo/lockdep-patches/lockdep-design.txt
[bunk@stusta.de: cleanups]
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-03 15:24:50 +08:00
|
|
|
#include <linux/lockdep.h>
|
2006-10-02 17:18:20 +08:00
|
|
|
#include <linux/ipc.h>
|
2006-12-08 18:37:59 +08:00
|
|
|
#include <linux/pid_namespace.h>
|
2007-07-16 14:40:59 +08:00
|
|
|
#include <linux/user_namespace.h>
|
capabilities: implement per-process securebits
Filesystem capability support makes it possible to do away with (set)uid-0
based privilege and use capabilities instead. That is, with filesystem
support for capabilities but without this present patch, it is (conceptually)
possible to manage a system with capabilities alone and never need to obtain
privilege via (set)uid-0.
Of course, conceptually isn't quite the same as currently possible since few
user applications, certainly not enough to run a viable system, are currently
prepared to leverage capabilities to exercise privilege. Further, many
applications exist that may never get upgraded in this way, and the kernel
will continue to want to support their setuid-0 base privilege needs.
Where pure-capability applications evolve and replace setuid-0 binaries, it is
desirable that there be a mechanisms by which they can contain their
privilege. In addition to leveraging the per-process bounding and inheritable
sets, this should include suppressing the privilege of the uid-0 superuser
from the process' tree of children.
The feature added by this patch can be leveraged to suppress the privilege
associated with (set)uid-0. This suppression requires CAP_SETPCAP to
initiate, and only immediately affects the 'current' process (it is inherited
through fork()/exec()). This reimplementation differs significantly from the
historical support for securebits which was system-wide, unwieldy and which
has ultimately withered to a dead relic in the source of the modern kernel.
With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
all legacy privilege (through uid=0) for itself and all subsequently
fork()'d/exec()'d children with:
prctl(PR_SET_SECUREBITS, 0x2f);
This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
enabled at configure time.
[akpm@linux-foundation.org: fix uninitialised var warning]
[serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Reviewed-by: James Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 17:13:40 +08:00
|
|
|
#include <linux/securebits.h>
|
2007-09-12 17:55:17 +08:00
|
|
|
#include <net/net_namespace.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2008-05-09 06:19:16 +08:00
|
|
|
extern struct files_struct init_files;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
#define INIT_KIOCTX(name, which_mm) \
|
|
|
|
|
{ \
|
|
|
|
|
.users = ATOMIC_INIT(1), \
|
|
|
|
|
.dead = 0, \
|
|
|
|
|
.mm = &which_mm, \
|
|
|
|
|
.user_id = 0, \
|
|
|
|
|
.next = NULL, \
|
|
|
|
|
.wait = __WAIT_QUEUE_HEAD_INITIALIZER(name.wait), \
|
2006-07-03 15:24:34 +08:00
|
|
|
.ctx_lock = __SPIN_LOCK_UNLOCKED(name.ctx_lock), \
|
2005-04-17 06:20:36 +08:00
|
|
|
.reqs_active = 0U, \
|
|
|
|
|
.max_reqs = ~0U, \
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#define INIT_MM(name) \
|
|
|
|
|
{ \
|
|
|
|
|
.mm_rb = RB_ROOT, \
|
|
|
|
|
.pgd = swapper_pg_dir, \
|
|
|
|
|
.mm_users = ATOMIC_INIT(2), \
|
|
|
|
|
.mm_count = ATOMIC_INIT(1), \
|
|
|
|
|
.mmap_sem = __RWSEM_INITIALIZER(name.mmap_sem), \
|
2006-07-03 15:24:34 +08:00
|
|
|
.page_table_lock = __SPIN_LOCK_UNLOCKED(name.page_table_lock), \
|
2005-04-17 06:20:36 +08:00
|
|
|
.mmlist = LIST_HEAD_INIT(name.mmlist), \
|
|
|
|
|
.cpu_vm_mask = CPU_MASK_ALL, \
|
|
|
|
|
}
|
|
|
|
|
|
2006-12-08 18:37:55 +08:00
|
|
|
#define INIT_SIGNALS(sig) { \
|
|
|
|
|
.count = ATOMIC_INIT(1), \
|
2005-04-17 06:20:36 +08:00
|
|
|
.wait_chldexit = __WAIT_QUEUE_HEAD_INITIALIZER(sig.wait_chldexit),\
|
2006-12-08 18:37:55 +08:00
|
|
|
.shared_pending = { \
|
2005-04-17 06:20:36 +08:00
|
|
|
.list = LIST_HEAD_INIT(sig.shared_pending.list), \
|
2006-12-08 18:37:55 +08:00
|
|
|
.signal = {{0}}}, \
|
2005-04-17 06:20:36 +08:00
|
|
|
.posix_timers = LIST_HEAD_INIT(sig.posix_timers), \
|
|
|
|
|
.cpu_timers = INIT_CPU_TIMERS(sig.cpu_timers), \
|
|
|
|
|
.rlim = INIT_RLIMITS, \
|
|
|
|
|
}
|
|
|
|
|
|
2006-10-02 17:18:06 +08:00
|
|
|
extern struct nsproxy init_nsproxy;
|
|
|
|
|
#define INIT_NSPROXY(nsproxy) { \
|
2006-12-08 18:37:59 +08:00
|
|
|
.pid_ns = &init_pid_ns, \
|
2006-10-02 17:18:06 +08:00
|
|
|
.count = ATOMIC_INIT(1), \
|
2006-10-02 17:18:14 +08:00
|
|
|
.uts_ns = &init_uts_ns, \
|
2006-12-08 18:37:56 +08:00
|
|
|
.mnt_ns = NULL, \
|
2007-09-13 15:16:29 +08:00
|
|
|
INIT_NET_NS(net_ns) \
|
2006-10-02 17:18:20 +08:00
|
|
|
INIT_IPC_NS(ipc_ns) \
|
2007-07-16 14:40:59 +08:00
|
|
|
.user_ns = &init_user_ns, \
|
2006-10-02 17:18:06 +08:00
|
|
|
}
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
#define INIT_SIGHAND(sighand) { \
|
|
|
|
|
.count = ATOMIC_INIT(1), \
|
|
|
|
|
.action = { { { .sa_handler = NULL, } }, }, \
|
2006-07-03 15:24:34 +08:00
|
|
|
.siglock = __SPIN_LOCK_UNLOCKED(sighand.siglock), \
|
2007-09-21 03:40:16 +08:00
|
|
|
.signalfd_wqh = __WAIT_QUEUE_HEAD_INITIALIZER(sighand.signalfd_wqh), \
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
extern struct group_info init_groups;
|
|
|
|
|
|
2007-05-11 13:23:00 +08:00
|
|
|
#define INIT_STRUCT_PID { \
|
|
|
|
|
.count = ATOMIC_INIT(1), \
|
|
|
|
|
.tasks = { \
|
|
|
|
|
{ .first = &init_task.pids[PIDTYPE_PID].node }, \
|
|
|
|
|
{ .first = &init_task.pids[PIDTYPE_PGID].node }, \
|
|
|
|
|
{ .first = &init_task.pids[PIDTYPE_SID].node }, \
|
|
|
|
|
}, \
|
|
|
|
|
.rcu = RCU_HEAD_INIT, \
|
2007-10-19 14:40:03 +08:00
|
|
|
.level = 0, \
|
|
|
|
|
.numbers = { { \
|
|
|
|
|
.nr = 0, \
|
|
|
|
|
.ns = &init_pid_ns, \
|
|
|
|
|
.pid_chain = { .next = NULL, .pprev = NULL }, \
|
|
|
|
|
}, } \
|
2007-05-11 13:23:00 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#define INIT_PID_LINK(type) \
|
|
|
|
|
{ \
|
|
|
|
|
.node = { \
|
|
|
|
|
.next = NULL, \
|
|
|
|
|
.pprev = &init_struct_pid.tasks[type].first, \
|
|
|
|
|
}, \
|
|
|
|
|
.pid = &init_struct_pid, \
|
|
|
|
|
}
|
|
|
|
|
|
2008-01-10 17:53:18 +08:00
|
|
|
#ifdef CONFIG_AUDITSYSCALL
|
|
|
|
|
#define INIT_IDS \
|
2008-01-08 23:06:53 +08:00
|
|
|
.loginuid = -1, \
|
|
|
|
|
.sessionid = -1,
|
2008-01-10 17:53:18 +08:00
|
|
|
#else
|
|
|
|
|
#define INIT_IDS
|
|
|
|
|
#endif
|
capabilities: introduce per-process capability bounding set
The capability bounding set is a set beyond which capabilities cannot grow.
Currently cap_bset is per-system. It can be manipulated through sysctl,
but only init can add capabilities. Root can remove capabilities. By
default it includes all caps except CAP_SETPCAP.
This patch makes the bounding set per-process when file capabilities are
enabled. It is inherited at fork from parent. Noone can add elements,
CAP_SETPCAP is required to remove them.
One example use of this is to start a safer container. For instance, until
device namespaces or per-container device whitelists are introduced, it is
best to take CAP_MKNOD away from a container.
The bounding set will not affect pP and pE immediately. It will only
affect pP' and pE' after subsequent exec()s. It also does not affect pI,
and exec() does not constrain pI'. So to really start a shell with no way
of regain CAP_MKNOD, you would do
prctl(PR_CAPBSET_DROP, CAP_MKNOD);
cap_t cap = cap_get_proc();
cap_value_t caparray[1];
caparray[0] = CAP_MKNOD;
cap_set_flag(cap, CAP_INHERITABLE, 1, caparray, CAP_DROP);
cap_set_proc(cap);
cap_free(cap);
The following test program will get and set the bounding
set (but not pI). For instance
./bset get
(lists capabilities in bset)
./bset drop cap_net_raw
(starts shell with new bset)
(use capset, setuid binary, or binary with
file capabilities to try to increase caps)
************************************************************
cap_bound.c
************************************************************
#include <sys/prctl.h>
#include <linux/capability.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#ifndef PR_CAPBSET_READ
#define PR_CAPBSET_READ 23
#endif
#ifndef PR_CAPBSET_DROP
#define PR_CAPBSET_DROP 24
#endif
int usage(char *me)
{
printf("Usage: %s get\n", me);
printf(" %s drop <capability>\n", me);
return 1;
}
#define numcaps 32
char *captable[numcaps] = {
"cap_chown",
"cap_dac_override",
"cap_dac_read_search",
"cap_fowner",
"cap_fsetid",
"cap_kill",
"cap_setgid",
"cap_setuid",
"cap_setpcap",
"cap_linux_immutable",
"cap_net_bind_service",
"cap_net_broadcast",
"cap_net_admin",
"cap_net_raw",
"cap_ipc_lock",
"cap_ipc_owner",
"cap_sys_module",
"cap_sys_rawio",
"cap_sys_chroot",
"cap_sys_ptrace",
"cap_sys_pacct",
"cap_sys_admin",
"cap_sys_boot",
"cap_sys_nice",
"cap_sys_resource",
"cap_sys_time",
"cap_sys_tty_config",
"cap_mknod",
"cap_lease",
"cap_audit_write",
"cap_audit_control",
"cap_setfcap"
};
int getbcap(void)
{
int comma=0;
unsigned long i;
int ret;
printf("i know of %d capabilities\n", numcaps);
printf("capability bounding set:");
for (i=0; i<numcaps; i++) {
ret = prctl(PR_CAPBSET_READ, i);
if (ret < 0)
perror("prctl");
else if (ret==1)
printf("%s%s", (comma++) ? ", " : " ", captable[i]);
}
printf("\n");
return 0;
}
int capdrop(char *str)
{
unsigned long i;
int found=0;
for (i=0; i<numcaps; i++) {
if (strcmp(captable[i], str) == 0) {
found=1;
break;
}
}
if (!found)
return 1;
if (prctl(PR_CAPBSET_DROP, i)) {
perror("prctl");
return 1;
}
return 0;
}
int main(int argc, char *argv[])
{
if (argc<2)
return usage(argv[0]);
if (strcmp(argv[1], "get")==0)
return getbcap();
if (strcmp(argv[1], "drop")!=0 || argc<3)
return usage(argv[0]);
if (capdrop(argv[2])) {
printf("unknown capability\n");
return 1;
}
return execl("/bin/bash", "/bin/bash", NULL);
}
************************************************************
[serue@us.ibm.com: fix typo]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>a
Signed-off-by: "Serge E. Hallyn" <serue@us.ibm.com>
Tested-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-02-05 14:29:45 +08:00
|
|
|
|
|
|
|
|
#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
|
|
|
|
|
/*
|
|
|
|
|
* Because of the reduced scope of CAP_SETPCAP when filesystem
|
|
|
|
|
* capabilities are in effect, it is safe to allow CAP_SETPCAP to
|
|
|
|
|
* be available in the default configuration.
|
|
|
|
|
*/
|
|
|
|
|
# define CAP_INIT_BSET CAP_FULL_SET
|
|
|
|
|
#else
|
|
|
|
|
# define CAP_INIT_BSET CAP_INIT_EFF_SET
|
|
|
|
|
#endif
|
|
|
|
|
|
2008-11-14 07:39:16 +08:00
|
|
|
extern struct cred init_cred;
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
/*
|
|
|
|
|
* INIT_TASK is used to set up the first task table, touch at
|
|
|
|
|
* your own risk!. Base=0, limit=0x1fffff (=2MB)
|
|
|
|
|
*/
|
|
|
|
|
#define INIT_TASK(tsk) \
|
|
|
|
|
{ \
|
|
|
|
|
.state = 0, \
|
2007-05-09 17:35:17 +08:00
|
|
|
.stack = &init_thread_info, \
|
2005-04-17 06:20:36 +08:00
|
|
|
.usage = ATOMIC_INIT(2), \
|
2008-07-25 16:47:37 +08:00
|
|
|
.flags = PF_KTHREAD, \
|
2005-04-17 06:20:36 +08:00
|
|
|
.lock_depth = -1, \
|
|
|
|
|
.prio = MAX_PRIO-20, \
|
|
|
|
|
.static_prio = MAX_PRIO-20, \
|
2006-06-27 17:54:51 +08:00
|
|
|
.normal_prio = MAX_PRIO-20, \
|
2005-04-17 06:20:36 +08:00
|
|
|
.policy = SCHED_NORMAL, \
|
|
|
|
|
.cpus_allowed = CPU_MASK_ALL, \
|
|
|
|
|
.mm = NULL, \
|
|
|
|
|
.active_mm = &init_mm, \
|
2008-04-20 01:45:00 +08:00
|
|
|
.se = { \
|
|
|
|
|
.group_node = LIST_HEAD_INIT(tsk.se.group_node), \
|
|
|
|
|
}, \
|
2008-01-26 04:08:27 +08:00
|
|
|
.rt = { \
|
|
|
|
|
.run_list = LIST_HEAD_INIT(tsk.rt.run_list), \
|
2008-01-26 04:08:30 +08:00
|
|
|
.time_slice = HZ, \
|
|
|
|
|
.nr_cpus_allowed = NR_CPUS, \
|
|
|
|
|
}, \
|
2005-04-17 06:20:36 +08:00
|
|
|
.tasks = LIST_HEAD_INIT(tsk.tasks), \
|
2008-03-25 09:36:23 +08:00
|
|
|
.ptraced = LIST_HEAD_INIT(tsk.ptraced), \
|
|
|
|
|
.ptrace_entry = LIST_HEAD_INIT(tsk.ptrace_entry), \
|
2005-04-17 06:20:36 +08:00
|
|
|
.real_parent = &tsk, \
|
|
|
|
|
.parent = &tsk, \
|
|
|
|
|
.children = LIST_HEAD_INIT(tsk.children), \
|
|
|
|
|
.sibling = LIST_HEAD_INIT(tsk.sibling), \
|
|
|
|
|
.group_leader = &tsk, \
|
2008-11-14 07:39:17 +08:00
|
|
|
.cred = &init_cred, \
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-14 07:39:23 +08:00
|
|
|
.cred_exec_mutex = \
|
|
|
|
|
__MUTEX_INITIALIZER(tsk.cred_exec_mutex), \
|
2005-04-17 06:20:36 +08:00
|
|
|
.comm = "swapper", \
|
|
|
|
|
.thread = INIT_THREAD, \
|
|
|
|
|
.fs = &init_fs, \
|
|
|
|
|
.files = &init_files, \
|
|
|
|
|
.signal = &init_signals, \
|
|
|
|
|
.sighand = &init_sighand, \
|
2006-10-02 17:18:06 +08:00
|
|
|
.nsproxy = &init_nsproxy, \
|
2005-04-17 06:20:36 +08:00
|
|
|
.pending = { \
|
|
|
|
|
.list = LIST_HEAD_INIT(tsk.pending.list), \
|
|
|
|
|
.signal = {{0}}}, \
|
|
|
|
|
.blocked = {{0}}, \
|
2006-07-03 15:24:34 +08:00
|
|
|
.alloc_lock = __SPIN_LOCK_UNLOCKED(tsk.alloc_lock), \
|
2005-04-17 06:20:36 +08:00
|
|
|
.journal_info = NULL, \
|
|
|
|
|
.cpu_timers = INIT_CPU_TIMERS(tsk.cpu_timers), \
|
2005-06-27 16:55:12 +08:00
|
|
|
.fs_excl = ATOMIC_INIT(0), \
|
2007-05-08 15:30:08 +08:00
|
|
|
.pi_lock = __SPIN_LOCK_UNLOCKED(tsk.pi_lock), \
|
2008-09-02 06:52:40 +08:00
|
|
|
.timer_slack_ns = 50000, /* 50 usec default slack */ \
|
2007-05-11 13:23:00 +08:00
|
|
|
.pids = { \
|
|
|
|
|
[PIDTYPE_PID] = INIT_PID_LINK(PIDTYPE_PID), \
|
|
|
|
|
[PIDTYPE_PGID] = INIT_PID_LINK(PIDTYPE_PGID), \
|
|
|
|
|
[PIDTYPE_SID] = INIT_PID_LINK(PIDTYPE_SID), \
|
|
|
|
|
}, \
|
2007-10-17 14:25:50 +08:00
|
|
|
.dirties = INIT_PROP_LOCAL_SINGLE(dirties), \
|
2008-01-10 17:53:18 +08:00
|
|
|
INIT_IDS \
|
2006-07-03 15:24:42 +08:00
|
|
|
INIT_TRACE_IRQFLAGS \
|
[PATCH] lockdep: core
Do 'make oldconfig' and accept all the defaults for new config options -
reboot into the kernel and if everything goes well it should boot up fine and
you should have /proc/lockdep and /proc/lockdep_stats files.
Typically if the lock validator finds some problem it will print out
voluminous debug output that begins with "BUG: ..." and which syslog output
can be used by kernel developers to figure out the precise locking scenario.
What does the lock validator do? It "observes" and maps all locking rules as
they occur dynamically (as triggered by the kernel's natural use of spinlocks,
rwlocks, mutexes and rwsems). Whenever the lock validator subsystem detects a
new locking scenario, it validates this new rule against the existing set of
rules. If this new rule is consistent with the existing set of rules then the
new rule is added transparently and the kernel continues as normal. If the
new rule could create a deadlock scenario then this condition is printed out.
When determining validity of locking, all possible "deadlock scenarios" are
considered: assuming arbitrary number of CPUs, arbitrary irq context and task
context constellations, running arbitrary combinations of all the existing
locking scenarios. In a typical system this means millions of separate
scenarios. This is why we call it a "locking correctness" validator - for all
rules that are observed the lock validator proves it with mathematical
certainty that a deadlock could not occur (assuming that the lock validator
implementation itself is correct and its internal data structures are not
corrupted by some other kernel subsystem). [see more details and conditionals
of this statement in include/linux/lockdep.h and
Documentation/lockdep-design.txt]
Furthermore, this "all possible scenarios" property of the validator also
enables the finding of complex, highly unlikely multi-CPU multi-context races
via single single-context rules, increasing the likelyhood of finding bugs
drastically. In practical terms: the lock validator already found a bug in
the upstream kernel that could only occur on systems with 3 or more CPUs, and
which needed 3 very unlikely code sequences to occur at once on the 3 CPUs.
That bug was found and reported on a single-CPU system (!). So in essence a
race will be found "piecemail-wise", triggering all the necessary components
for the race, without having to reproduce the race scenario itself! In its
short existence the lock validator found and reported many bugs before they
actually caused a real deadlock.
To further increase the efficiency of the validator, the mapping is not per
"lock instance", but per "lock-class". For example, all struct inode objects
in the kernel have inode->inotify_mutex. If there are 10,000 inodes cached,
then there are 10,000 lock objects. But ->inotify_mutex is a single "lock
type", and all locking activities that occur against ->inotify_mutex are
"unified" into this single lock-class. The advantage of the lock-class
approach is that all historical ->inotify_mutex uses are mapped into a single
(and as narrow as possible) set of locking rules - regardless of how many
different tasks or inode structures it took to build this set of rules. The
set of rules persist during the lifetime of the kernel.
To see the rough magnitude of checking that the lock validator does, here's a
portion of /proc/lockdep_stats, fresh after bootup:
lock-classes: 694 [max: 2048]
direct dependencies: 1598 [max: 8192]
indirect dependencies: 17896
all direct dependencies: 16206
dependency chains: 1910 [max: 8192]
in-hardirq chains: 17
in-softirq chains: 105
in-process chains: 1065
stack-trace entries: 38761 [max: 131072]
combined max dependencies: 2033928
hardirq-safe locks: 24
hardirq-unsafe locks: 176
softirq-safe locks: 53
softirq-unsafe locks: 137
irq-safe locks: 59
irq-unsafe locks: 176
The lock validator has observed 1598 actual single-thread locking patterns,
and has validated all possible 2033928 distinct locking scenarios.
More details about the design of the lock validator can be found in
Documentation/lockdep-design.txt, which can also found at:
http://redhat.com/~mingo/lockdep-patches/lockdep-design.txt
[bunk@stusta.de: cleanups]
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-03 15:24:50 +08:00
|
|
|
INIT_LOCKDEP \
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#define INIT_CPU_TIMERS(cpu_timers) \
|
|
|
|
|
{ \
|
|
|
|
|
LIST_HEAD_INIT(cpu_timers[0]), \
|
|
|
|
|
LIST_HEAD_INIT(cpu_timers[1]), \
|
|
|
|
|
LIST_HEAD_INIT(cpu_timers[2]), \
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#endif
|