d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add security.bsd.allow_ptrace sysctl

Browse Source 
that disables any access to ptrace(2) for all processes.

Reviewed by:	emaste
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D33986
This commit is contained in:
Konstantin Belousov 2022-01-21 23:52:35 +02:00
parent 55a0aa2162
commit fe6db72708
5 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/compat/freebsd32/freebsd32_misc.c
View File

@ -977,7 +977,11 @@ freebsd32_ptrace(struct thread *td, struct freebsd32_ptrace_args *uap)
struct ptrace_sc_ret32 psr;
} r32;
void *addr;
int data, error = 0, i;
int data, error, i;
if (!allow_ptrace)
return (ENOSYS);
error = 0;
AUDIT_ARG_PID(uap->pid);
AUDIT_ARG_CMD(uap->req);

3
sys/compat/linux/linux_ptrace.c
View File

@ -511,6 +511,9 @@ linux_ptrace(struct thread *td, struct linux_ptrace_args *uap)
pid_t pid;
int error, sig;
if (!allow_ptrace)
return (ENOSYS);
pid = (pid_t)uap->pid;
addr = (void *)uap->addr;

6
sys/kern/kern_prot.c
View File

@ -58,6 +58,7 @@ __FBSDID("$FreeBSD$");
#include <sys/loginclass.h>
#include <sys/malloc.h>
#include <sys/mutex.h>
#include <sys/ptrace.h>
#include <sys/refcount.h>
#include <sys/sx.h>
#include <sys/priv.h>
@ -2485,3 +2486,8 @@ change_svgid(struct ucred *newcred, gid_t svgid)
newcred->cr_svgid = svgid;
}
bool allow_ptrace = true;
SYSCTL_BOOL(_security_bsd, OID_AUTO, allow_ptrace, CTLFLAG_RWTUN,
&allow_ptrace, 0,
"Deny ptrace(2) use by returning ENOSYS");

6
sys/kern/sys_process.c
View File

@ -479,7 +479,11 @@ sys_ptrace(struct thread *td, struct ptrace_args *uap)
int ptevents;
} r;
void *addr;
int error = 0;
int error;
if (!allow_ptrace)
return (ENOSYS);
error = 0;
AUDIT_ARG_PID(uap->pid);
AUDIT_ARG_CMD(uap->req);

2
sys/sys/ptrace.h
View File

@ -243,6 +243,8 @@ int proc_write_dbregs32(struct thread *_td, struct dbreg32 *_dbreg32);
void ptrace_unsuspend(struct proc *p);
extern bool allow_ptrace;
#else /* !_KERNEL */
#include <sys/cdefs.h>