proc: Report no_new_privs state
Subsystems (2)
PATCH 1/1 proc: Report no_new_privs state
Similar to being able to examine if a process has been correctly confined with seccomp, the state of no_new_privs is equally interesting, so this adds it to /proc/$pid/status.
Signed-off-by Kees Cook <[email protected]>
--- Documentation/filesystems/proc.txt | 2 ++ fs/proc/array.c | 5 +++-- 2 files changed, 5 insertions(+), 2 deletions(-)
Documentation/filesystems/proc.txt +2 -0
@@ -191,6 +191,7 @@ read the file /proc/PID/status: CapPrm: 0000000000000000 CapEff: 0000000000000000 CapBnd: ffffffffffffffff + NoNewPrivs: 0 Seccomp: 0 voluntary_ctxt_switches: 0 nonvoluntary_ctxt_switches: 1
@@ -262,6 +263,7 @@ Table 1-2: Contents of the status files (as of 4.1) CapPrm bitmap of permitted capabilities CapEff bitmap of effective capabilities CapBnd bitmap of capabilities bounding set + NoNewPrivs no_new_privs, like prctl(PR_GET_NO_NEW_PRIV, ...) Seccomp seccomp mode, like prctl(PR_GET_SECCOMP, ...) Cpus_allowed mask of CPUs on which this process may run Cpus_allowed_list Same as previous, but in "list format"
fs/proc/array.c +3 -2
@@ -342,10 +342,11 @@ static inline void task_cap(struct seq_file *m, struct task_struct *p)static inline void task_seccomp (struct seq_file *m,struct task_struct *p) { +seq_put_decimal_ull (m,"NoNewPrivs:\t" ,task_no_new_privs (p));#ifdef CONFIG_SECCOMP -seq_put_decimal_ull (m,"Seccomp:\t" , p->seccomp.mode); -seq_putc (m,'\n' ); +seq_put_decimal_ull (m,"\nSeccomp:\t" , p->seccomp.mode);#endif +seq_putc (m,'\n' ); } static inline void task_context_switch_counts(struct seq_file *m,
Signature · 6 lines
2.7.4 -- Kees Cook Nexus Security
Quoted 5 lines · Kees Cook
Similar to being able to examine if a process has been correctly confined with seccomp, the state of
no_new_privsis equally interesting, so this adds it to/proc/$pid/status.Signed-off-by Kees Cook <[email protected]>
(Note: The proc.5 manpage also lists all the entries of the "status" file, so it should also be updated.)
Reviewed-by Jann Horn <[email protected]>
Quoted 50 lines
--- Documentation/filesystems/proc.txt | 2 ++ fs/proc/array.c | 5 +++-- 2 files changed, 5 insertions(+), 2 deletions(-)Documentation/filesystems/proc.txt +2
-0@@ -191,6 +191,7 @@ read the file /proc/PID/status: CapPrm: 0000000000000000 CapEff: 0000000000000000 CapBnd: ffffffffffffffff + NoNewPrivs: 0 Seccomp: 0 voluntary_ctxt_switches: 0 nonvoluntary_ctxt_switches: 1@@ -262,6 +263,7 @@ Table 1-2: Contents of the status files (as of 4.1) CapPrm bitmap of permitted capabilities CapEff bitmap of effective capabilities CapBnd bitmap of capabilities bounding set + NoNewPrivs no_new_privs, like prctl(PR_GET_NO_NEW_PRIV, ...) Seccomp seccomp mode, like prctl(PR_GET_SECCOMP, ...) Cpus_allowed mask of CPUs on which this process may run Cpus_allowed_list Same as previous, but in "list format"fs/proc/array.c +3
-2@@ -342,10 +342,11 @@ static inline void task_cap(struct seq_file *m, struct task_struct *p)static inline void task_seccomp (struct seq_file *m,struct task_struct *p) { +seq_put_decimal_ull (m,"NoNewPrivs:\t" ,task_no_new_privs (p));#ifdef CONFIG_SECCOMP -seq_put_decimal_ull (m,"Seccomp:\t" , p->seccomp.mode); -seq_putc (m,'\n' ); +seq_put_decimal_ull (m,"\nSeccomp:\t" , p->seccomp.mode);#endif +seq_putc (m,'\n' ); } static inline void task_context_switch_counts(struct seq_file *m,Signature · 6 lines
2.7.4 -- Kees Cook Nexus Security