kernel/git/stable/linux.git/Documentation/security/Yama.txt, branch master

doc: ReSTify Yama.txt

2017-05-18T16:33:04+00:00

Adjusts for ReST markup and moves under LSM admin guide. Signed-off-by: Kees Cook Signed-off-by: Jonathan Corbet

Yama: remove needless CONFIG_SECURITY_YAMA_STACKED

2015-07-28T03:18:19+00:00

Now that minor LSMs can cleanly stack with major LSMs, remove the unneeded config for Yama to be made to explicitly stack. Just selecting the main Yama CONFIG will allow it to work, regardless of the major LSM. Since distros using Yama are already forcing it to stack, this is effectively a no-op change. Additionally add MAINTAINERS entry. Signed-off-by: Kees Cook Signed-off-by: James Morris

doc: spelling error changes

2014-05-05T13:32:05+00:00

Fixed multiple spelling errors. Acked-by: Randy Dunlap Signed-off-by: Carlos E. Garcia Signed-off-by: Jiri Kosina

Yama: higher restrictions should block PTRACE_TRACEME

2012-08-10T09:58:07+00:00

The higher ptrace restriction levels should be blocking even PTRACE_TRACEME requests. The comments in the LSM documentation are misleading about when the checks happen (the parent does not go through security_ptrace_access_check() on a PTRACE_TRACEME call). Signed-off-by: Kees Cook Cc: stable@vger.kernel.org # 3.5.x and later Signed-off-by: James Morris

Yama: add additional ptrace scopes

2012-04-19T03:39:56+00:00

This expands the available Yama ptrace restrictions to include two more modes. Mode 2 requires CAP_SYS_PTRACE for PTRACE_ATTACH, and mode 3 completely disables PTRACE_ATTACH (and locks the sysctl). Signed-off-by: Kees Cook Signed-off-by: James Morris

Yama: add PR_SET_PTRACER_ANY

2012-02-15T23:25:18+00:00

For a process to entirely disable Yama ptrace restrictions, it can use the special PR_SET_PTRACER_ANY pid to indicate that any otherwise allowed process may ptrace it. This is stronger than calling PR_SET_PTRACER with pid "1" because it includes processes in external pid namespaces. This is currently needed by the Chrome renderer, since its crash handler (Breakpad) runs external to the renderer's pid namespace. Signed-off-by: Kees Cook Signed-off-by: James Morris

security: Yama LSM

2012-02-09T22:18:52+00:00

This adds the Yama Linux Security Module to collect DAC security improvements (specifically just ptrace restrictions for now) that have existed in various forms over the years and have been carried outside the mainline kernel by other Linux distributions like Openwall and grsecurity. Signed-off-by: Kees Cook Acked-by: John Johansen Signed-off-by: James Morris