2005-04-17 06:20:36 +08:00
|
|
|
#ifndef _LINUX_PRCTL_H
|
|
|
|
|
#define _LINUX_PRCTL_H
|
|
|
|
|
|
|
|
|
|
/* Values to pass as first argument to prctl() */
|
|
|
|
|
|
|
|
|
|
#define PR_SET_PDEATHSIG 1 /* Second arg is a signal */
|
|
|
|
|
#define PR_GET_PDEATHSIG 2 /* Second arg is a ptr to return the signal */
|
|
|
|
|
|
|
|
|
|
/* Get/set current->mm->dumpable */
|
|
|
|
|
#define PR_GET_DUMPABLE 3
|
|
|
|
|
#define PR_SET_DUMPABLE 4
|
|
|
|
|
|
|
|
|
|
/* Get/set unaligned access control bits (if meaningful) */
|
|
|
|
|
#define PR_GET_UNALIGN 5
|
|
|
|
|
#define PR_SET_UNALIGN 6
|
|
|
|
|
# define PR_UNALIGN_NOPRINT 1 /* silently fix up unaligned user accesses */
|
|
|
|
|
# define PR_UNALIGN_SIGBUS 2 /* generate SIGBUS on unaligned user access */
|
|
|
|
|
|
capabilities: implement per-process securebits
Filesystem capability support makes it possible to do away with (set)uid-0
based privilege and use capabilities instead. That is, with filesystem
support for capabilities but without this present patch, it is (conceptually)
possible to manage a system with capabilities alone and never need to obtain
privilege via (set)uid-0.
Of course, conceptually isn't quite the same as currently possible since few
user applications, certainly not enough to run a viable system, are currently
prepared to leverage capabilities to exercise privilege. Further, many
applications exist that may never get upgraded in this way, and the kernel
will continue to want to support their setuid-0 base privilege needs.
Where pure-capability applications evolve and replace setuid-0 binaries, it is
desirable that there be a mechanisms by which they can contain their
privilege. In addition to leveraging the per-process bounding and inheritable
sets, this should include suppressing the privilege of the uid-0 superuser
from the process' tree of children.
The feature added by this patch can be leveraged to suppress the privilege
associated with (set)uid-0. This suppression requires CAP_SETPCAP to
initiate, and only immediately affects the 'current' process (it is inherited
through fork()/exec()). This reimplementation differs significantly from the
historical support for securebits which was system-wide, unwieldy and which
has ultimately withered to a dead relic in the source of the modern kernel.
With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
all legacy privilege (through uid=0) for itself and all subsequently
fork()'d/exec()'d children with:
prctl(PR_SET_SECUREBITS, 0x2f);
This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
enabled at configure time.
[akpm@linux-foundation.org: fix uninitialised var warning]
[serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Reviewed-by: James Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 17:13:40 +08:00
|
|
|
/* Get/set whether or not to drop capabilities on setuid() away from
|
|
|
|
|
* uid 0 (as per security/commoncap.c) */
|
2005-04-17 06:20:36 +08:00
|
|
|
#define PR_GET_KEEPCAPS 7
|
|
|
|
|
#define PR_SET_KEEPCAPS 8
|
|
|
|
|
|
|
|
|
|
/* Get/set floating-point emulation control bits (if meaningful) */
|
|
|
|
|
#define PR_GET_FPEMU 9
|
|
|
|
|
#define PR_SET_FPEMU 10
|
|
|
|
|
# define PR_FPEMU_NOPRINT 1 /* silently emulate fp operations accesses */
|
|
|
|
|
# define PR_FPEMU_SIGFPE 2 /* don't emulate fp operations, send SIGFPE instead */
|
|
|
|
|
|
|
|
|
|
/* Get/set floating-point exception mode (if meaningful) */
|
|
|
|
|
#define PR_GET_FPEXC 11
|
|
|
|
|
#define PR_SET_FPEXC 12
|
|
|
|
|
# define PR_FP_EXC_SW_ENABLE 0x80 /* Use FPEXC for FP exception enables */
|
|
|
|
|
# define PR_FP_EXC_DIV 0x010000 /* floating point divide by zero */
|
|
|
|
|
# define PR_FP_EXC_OVF 0x020000 /* floating point overflow */
|
|
|
|
|
# define PR_FP_EXC_UND 0x040000 /* floating point underflow */
|
|
|
|
|
# define PR_FP_EXC_RES 0x080000 /* floating point inexact result */
|
|
|
|
|
# define PR_FP_EXC_INV 0x100000 /* floating point invalid operation */
|
|
|
|
|
# define PR_FP_EXC_DISABLED 0 /* FP exceptions disabled */
|
|
|
|
|
# define PR_FP_EXC_NONRECOV 1 /* async non-recoverable exc. mode */
|
|
|
|
|
# define PR_FP_EXC_ASYNC 2 /* async recoverable exception mode */
|
|
|
|
|
# define PR_FP_EXC_PRECISE 3 /* precise exception mode */
|
|
|
|
|
|
|
|
|
|
/* Get/set whether we use statistical process timing or accurate timestamp
|
|
|
|
|
* based process timing */
|
|
|
|
|
#define PR_GET_TIMING 13
|
|
|
|
|
#define PR_SET_TIMING 14
|
|
|
|
|
# define PR_TIMING_STATISTICAL 0 /* Normal, traditional,
|
|
|
|
|
statistical process timing */
|
|
|
|
|
# define PR_TIMING_TIMESTAMP 1 /* Accurate timestamp based
|
|
|
|
|
process timing */
|
|
|
|
|
|
|
|
|
|
#define PR_SET_NAME 15 /* Set process name */
|
|
|
|
|
#define PR_GET_NAME 16 /* Get process name */
|
|
|
|
|
|
2006-06-07 14:10:19 +08:00
|
|
|
/* Get/set process endian */
|
|
|
|
|
#define PR_GET_ENDIAN 19
|
|
|
|
|
#define PR_SET_ENDIAN 20
|
|
|
|
|
# define PR_ENDIAN_BIG 0
|
|
|
|
|
# define PR_ENDIAN_LITTLE 1 /* True little endian mode */
|
|
|
|
|
# define PR_ENDIAN_PPC_LITTLE 2 /* "PowerPC" pseudo little endian */
|
|
|
|
|
|
2007-07-16 14:41:32 +08:00
|
|
|
/* Get/set process seccomp mode */
|
|
|
|
|
#define PR_GET_SECCOMP 21
|
|
|
|
|
#define PR_SET_SECCOMP 22
|
|
|
|
|
|
capabilities: implement per-process securebits
Filesystem capability support makes it possible to do away with (set)uid-0
based privilege and use capabilities instead. That is, with filesystem
support for capabilities but without this present patch, it is (conceptually)
possible to manage a system with capabilities alone and never need to obtain
privilege via (set)uid-0.
Of course, conceptually isn't quite the same as currently possible since few
user applications, certainly not enough to run a viable system, are currently
prepared to leverage capabilities to exercise privilege. Further, many
applications exist that may never get upgraded in this way, and the kernel
will continue to want to support their setuid-0 base privilege needs.
Where pure-capability applications evolve and replace setuid-0 binaries, it is
desirable that there be a mechanisms by which they can contain their
privilege. In addition to leveraging the per-process bounding and inheritable
sets, this should include suppressing the privilege of the uid-0 superuser
from the process' tree of children.
The feature added by this patch can be leveraged to suppress the privilege
associated with (set)uid-0. This suppression requires CAP_SETPCAP to
initiate, and only immediately affects the 'current' process (it is inherited
through fork()/exec()). This reimplementation differs significantly from the
historical support for securebits which was system-wide, unwieldy and which
has ultimately withered to a dead relic in the source of the modern kernel.
With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
all legacy privilege (through uid=0) for itself and all subsequently
fork()'d/exec()'d children with:
prctl(PR_SET_SECUREBITS, 0x2f);
This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
enabled at configure time.
[akpm@linux-foundation.org: fix uninitialised var warning]
[serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Reviewed-by: James Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 17:13:40 +08:00
|
|
|
/* Get/set the capability bounding set (as per security/commoncap.c) */
|
capabilities: introduce per-process capability bounding set
The capability bounding set is a set beyond which capabilities cannot grow.
Currently cap_bset is per-system. It can be manipulated through sysctl,
but only init can add capabilities. Root can remove capabilities. By
default it includes all caps except CAP_SETPCAP.
This patch makes the bounding set per-process when file capabilities are
enabled. It is inherited at fork from parent. Noone can add elements,
CAP_SETPCAP is required to remove them.
One example use of this is to start a safer container. For instance, until
device namespaces or per-container device whitelists are introduced, it is
best to take CAP_MKNOD away from a container.
The bounding set will not affect pP and pE immediately. It will only
affect pP' and pE' after subsequent exec()s. It also does not affect pI,
and exec() does not constrain pI'. So to really start a shell with no way
of regain CAP_MKNOD, you would do
prctl(PR_CAPBSET_DROP, CAP_MKNOD);
cap_t cap = cap_get_proc();
cap_value_t caparray[1];
caparray[0] = CAP_MKNOD;
cap_set_flag(cap, CAP_INHERITABLE, 1, caparray, CAP_DROP);
cap_set_proc(cap);
cap_free(cap);
The following test program will get and set the bounding
set (but not pI). For instance
./bset get
(lists capabilities in bset)
./bset drop cap_net_raw
(starts shell with new bset)
(use capset, setuid binary, or binary with
file capabilities to try to increase caps)
************************************************************
cap_bound.c
************************************************************
#include <sys/prctl.h>
#include <linux/capability.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#ifndef PR_CAPBSET_READ
#define PR_CAPBSET_READ 23
#endif
#ifndef PR_CAPBSET_DROP
#define PR_CAPBSET_DROP 24
#endif
int usage(char *me)
{
printf("Usage: %s get\n", me);
printf(" %s drop <capability>\n", me);
return 1;
}
#define numcaps 32
char *captable[numcaps] = {
"cap_chown",
"cap_dac_override",
"cap_dac_read_search",
"cap_fowner",
"cap_fsetid",
"cap_kill",
"cap_setgid",
"cap_setuid",
"cap_setpcap",
"cap_linux_immutable",
"cap_net_bind_service",
"cap_net_broadcast",
"cap_net_admin",
"cap_net_raw",
"cap_ipc_lock",
"cap_ipc_owner",
"cap_sys_module",
"cap_sys_rawio",
"cap_sys_chroot",
"cap_sys_ptrace",
"cap_sys_pacct",
"cap_sys_admin",
"cap_sys_boot",
"cap_sys_nice",
"cap_sys_resource",
"cap_sys_time",
"cap_sys_tty_config",
"cap_mknod",
"cap_lease",
"cap_audit_write",
"cap_audit_control",
"cap_setfcap"
};
int getbcap(void)
{
int comma=0;
unsigned long i;
int ret;
printf("i know of %d capabilities\n", numcaps);
printf("capability bounding set:");
for (i=0; i<numcaps; i++) {
ret = prctl(PR_CAPBSET_READ, i);
if (ret < 0)
perror("prctl");
else if (ret==1)
printf("%s%s", (comma++) ? ", " : " ", captable[i]);
}
printf("\n");
return 0;
}
int capdrop(char *str)
{
unsigned long i;
int found=0;
for (i=0; i<numcaps; i++) {
if (strcmp(captable[i], str) == 0) {
found=1;
break;
}
}
if (!found)
return 1;
if (prctl(PR_CAPBSET_DROP, i)) {
perror("prctl");
return 1;
}
return 0;
}
int main(int argc, char *argv[])
{
if (argc<2)
return usage(argv[0]);
if (strcmp(argv[1], "get")==0)
return getbcap();
if (strcmp(argv[1], "drop")!=0 || argc<3)
return usage(argv[0]);
if (capdrop(argv[2])) {
printf("unknown capability\n");
return 1;
}
return execl("/bin/bash", "/bin/bash", NULL);
}
************************************************************
[serue@us.ibm.com: fix typo]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>a
Signed-off-by: "Serge E. Hallyn" <serue@us.ibm.com>
Tested-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-02-05 14:29:45 +08:00
|
|
|
#define PR_CAPBSET_READ 23
|
|
|
|
|
#define PR_CAPBSET_DROP 24
|
|
|
|
|
|
2008-04-12 00:54:17 +08:00
|
|
|
/* Get/set the process' ability to use the timestamp counter instruction */
|
|
|
|
|
#define PR_GET_TSC 25
|
|
|
|
|
#define PR_SET_TSC 26
|
|
|
|
|
# define PR_TSC_ENABLE 1 /* allow the use of the timestamp counter */
|
|
|
|
|
# define PR_TSC_SIGSEGV 2 /* throw a SIGSEGV instead of reading the TSC */
|
|
|
|
|
|
capabilities: implement per-process securebits
Filesystem capability support makes it possible to do away with (set)uid-0
based privilege and use capabilities instead. That is, with filesystem
support for capabilities but without this present patch, it is (conceptually)
possible to manage a system with capabilities alone and never need to obtain
privilege via (set)uid-0.
Of course, conceptually isn't quite the same as currently possible since few
user applications, certainly not enough to run a viable system, are currently
prepared to leverage capabilities to exercise privilege. Further, many
applications exist that may never get upgraded in this way, and the kernel
will continue to want to support their setuid-0 base privilege needs.
Where pure-capability applications evolve and replace setuid-0 binaries, it is
desirable that there be a mechanisms by which they can contain their
privilege. In addition to leveraging the per-process bounding and inheritable
sets, this should include suppressing the privilege of the uid-0 superuser
from the process' tree of children.
The feature added by this patch can be leveraged to suppress the privilege
associated with (set)uid-0. This suppression requires CAP_SETPCAP to
initiate, and only immediately affects the 'current' process (it is inherited
through fork()/exec()). This reimplementation differs significantly from the
historical support for securebits which was system-wide, unwieldy and which
has ultimately withered to a dead relic in the source of the modern kernel.
With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
all legacy privilege (through uid=0) for itself and all subsequently
fork()'d/exec()'d children with:
prctl(PR_SET_SECUREBITS, 0x2f);
This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
enabled at configure time.
[akpm@linux-foundation.org: fix uninitialised var warning]
[serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Reviewed-by: James Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 17:13:40 +08:00
|
|
|
/* Get/set securebits (as per security/commoncap.c) */
|
|
|
|
|
#define PR_GET_SECUREBITS 27
|
|
|
|
|
#define PR_SET_SECUREBITS 28
|
|
|
|
|
|
2008-09-02 06:52:40 +08:00
|
|
|
/*
|
|
|
|
|
* Get/set the timerslack as used by poll/select/nanosleep
|
|
|
|
|
* A value of 0 means "use default"
|
|
|
|
|
*/
|
|
|
|
|
#define PR_SET_TIMERSLACK 29
|
|
|
|
|
#define PR_GET_TIMERSLACK 30
|
|
|
|
|
|
perf: Do the big rename: Performance Counters -> Performance Events
Bye-bye Performance Counters, welcome Performance Events!
In the past few months the perfcounters subsystem has grown out its
initial role of counting hardware events, and has become (and is
becoming) a much broader generic event enumeration, reporting, logging,
monitoring, analysis facility.
Naming its core object 'perf_counter' and naming the subsystem
'perfcounters' has become more and more of a misnomer. With pending
code like hw-breakpoints support the 'counter' name is less and
less appropriate.
All in one, we've decided to rename the subsystem to 'performance
events' and to propagate this rename through all fields, variables
and API names. (in an ABI compatible fashion)
The word 'event' is also a bit shorter than 'counter' - which makes
it slightly more convenient to write/handle as well.
Thanks goes to Stephane Eranian who first observed this misnomer and
suggested a rename.
User-space tooling and ABI compatibility is not affected - this patch
should be function-invariant. (Also, defconfigs were not touched to
keep the size down.)
This patch has been generated via the following script:
FILES=$(find * -type f | grep -vE 'oprofile|[^K]config')
sed -i \
-e 's/PERF_EVENT_/PERF_RECORD_/g' \
-e 's/PERF_COUNTER/PERF_EVENT/g' \
-e 's/perf_counter/perf_event/g' \
-e 's/nb_counters/nb_events/g' \
-e 's/swcounter/swevent/g' \
-e 's/tpcounter_event/tp_event/g' \
$FILES
for N in $(find . -name perf_counter.[ch]); do
M=$(echo $N | sed 's/perf_counter/perf_event/g')
mv $N $M
done
FILES=$(find . -name perf_event.*)
sed -i \
-e 's/COUNTER_MASK/REG_MASK/g' \
-e 's/COUNTER/EVENT/g' \
-e 's/\<event\>/event_id/g' \
-e 's/counter/event/g' \
-e 's/Counter/Event/g' \
$FILES
... to keep it as correct as possible. This script can also be
used by anyone who has pending perfcounters patches - it converts
a Linux kernel tree over to the new naming. We tried to time this
change to the point in time where the amount of pending patches
is the smallest: the end of the merge window.
Namespace clashes were fixed up in a preparatory patch - and some
stylistic fallout will be fixed up in a subsequent patch.
( NOTE: 'counters' are still the proper terminology when we deal
with hardware registers - and these sed scripts are a bit
over-eager in renaming them. I've undone some of that, but
in case there's something left where 'counter' would be
better than 'event' we can undo that on an individual basis
instead of touching an otherwise nicely automated patch. )
Suggested-by: Stephane Eranian <eranian@google.com>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Paul Mackerras <paulus@samba.org>
Reviewed-by: Arjan van de Ven <arjan@linux.intel.com>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: David Howells <dhowells@redhat.com>
Cc: Kyle McMartin <kyle@mcmartin.ca>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: <linux-arch@vger.kernel.org>
LKML-Reference: <new-submission>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
2009-09-21 18:02:48 +08:00
|
|
|
#define PR_TASK_PERF_EVENTS_DISABLE 31
|
|
|
|
|
#define PR_TASK_PERF_EVENTS_ENABLE 32
|
2008-12-11 21:59:31 +08:00
|
|
|
|
2009-10-04 08:20:11 +08:00
|
|
|
/*
|
|
|
|
|
* Set early/late kill mode for hwpoison memory corruption.
|
|
|
|
|
* This influences when the process gets killed on a memory corruption.
|
|
|
|
|
*/
|
2009-09-16 17:50:14 +08:00
|
|
|
#define PR_MCE_KILL 33
|
2009-10-04 08:20:11 +08:00
|
|
|
# define PR_MCE_KILL_CLEAR 0
|
|
|
|
|
# define PR_MCE_KILL_SET 1
|
|
|
|
|
|
|
|
|
|
# define PR_MCE_KILL_LATE 0
|
|
|
|
|
# define PR_MCE_KILL_EARLY 1
|
|
|
|
|
# define PR_MCE_KILL_DEFAULT 2
|
|
|
|
|
|
|
|
|
|
#define PR_MCE_KILL_GET 34
|
2009-09-16 17:50:14 +08:00
|
|
|
|
2012-01-13 09:20:55 +08:00
|
|
|
/*
|
|
|
|
|
* Tune up process memory map specifics.
|
|
|
|
|
*/
|
|
|
|
|
#define PR_SET_MM 35
|
|
|
|
|
# define PR_SET_MM_START_CODE 1
|
|
|
|
|
# define PR_SET_MM_END_CODE 2
|
|
|
|
|
# define PR_SET_MM_START_DATA 3
|
|
|
|
|
# define PR_SET_MM_END_DATA 4
|
|
|
|
|
# define PR_SET_MM_START_STACK 5
|
|
|
|
|
# define PR_SET_MM_START_BRK 6
|
|
|
|
|
# define PR_SET_MM_BRK 7
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
#endif /* _LINUX_PRCTL_H */
|