Yama: add PR_SET_PTRACER_ANY
authorKees Cook <keescook@chromium.org>
Wed, 15 Feb 2012 00:48:09 +0000 (16:48 -0800)
committerJames Morris <jmorris@namei.org>
Wed, 15 Feb 2012 23:25:18 +0000 (10:25 +1100)
commitbf06189e4d14641c0148bea16e9dd24943862215
tree5c62eb24339041baf65b8e42daac42c7a01efc0e
parent3ab1aff89477dafb1aaeafe8c8669114a02b7226
Yama: add PR_SET_PTRACER_ANY

For a process to entirely disable Yama ptrace restrictions, it can use
the special PR_SET_PTRACER_ANY pid to indicate that any otherwise allowed
process may ptrace it. This is stronger than calling PR_SET_PTRACER with
pid "1" because it includes processes in external pid namespaces. This is
currently needed by the Chrome renderer, since its crash handler (Breakpad)
runs external to the renderer's pid namespace.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <jmorris@namei.org>
Documentation/security/Yama.txt
include/linux/prctl.h
security/yama/yama_lsm.c