[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <1308163895-5963-1-git-send-email-segoon@openwall.com>
Date: Wed, 15 Jun 2011 22:51:35 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: linux-kernel@...r.kernel.org
Cc: kernel-hardening@...ts.openwall.com,
Andrew Morton <akpm@...ux-foundation.org>,
Greg Kroah-Hartman <gregkh@...e.de>,
"David S. Miller" <davem@...emloft.net>,
Arnd Bergmann <arnd@...db.de>
Subject: [RFC 0/5 v4] procfs: introduce hidepid=, hidenet=, gid= mount options
This patch series adds support of procfs mount options and adds
mount options to restrict /proc/<pid>/ directories to owners and
/proc/<pid>/net/* to root. Additional group may be defined via
gid=, and this group will be privileged to study others /proc/<pid>/
and networking information.
Similar features are implemented for old kernels in -ow patches (for
Linux 2.2 and 2.4) and for Linux 2.6 in -grsecurity, but both of them
are implemented as configure options, not cofigurable in runtime, with
changes of gid of /proc/<pid>/, and without backward-compatible
/proc/<pid>/net/* handling.
The first patch introduces mount option parsing without any new options.
The second patch adds options of /proc/<pid>/ restrictions.
The third patch makes net_create() globally visible.
The fourth patch adds options of /proc/<pid>/net/ restrictions.
The fifth patch adds documentations for options above.
Vasiliy Kulikov (5):
procfs: parse mount options
procfs: add hidepid= and gid= mount options
net: restore net_create and make it globally visible
procfs: Add hidenet/nohidenet procfs mount options.
procfs: add documentation for procfs mount options
Documentation/filesystems/proc.txt | 51 ++++++++++++++++++++++
fs/proc/base.c | 62 ++++++++++++++++++++++++++-
fs/proc/inode.c | 20 +++++++++
fs/proc/internal.h | 1 +
fs/proc/proc_net.c | 26 +++++++++++
fs/proc/root.c | 83 +++++++++++++++++++++++++++++++++++-
include/linux/pid_namespace.h | 3 +
include/net/net_namespace.h | 2 +
net/core/net_namespace.c | 12 +++--
9 files changed, 253 insertions(+), 7 deletions(-)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
