From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com Sender: Vasiliy Kulikov From: Vasiliy Kulikov Date: Wed, 15 Jun 2011 22:51:35 +0400 Message-Id: <1308163895-5963-1-git-send-email-segoon@openwall.com> Subject: [kernel-hardening] [RFC 0/5 v4] procfs: introduce hidepid=, hidenet=, gid= mount options To: linux-kernel@vger.kernel.org Cc: kernel-hardening@lists.openwall.com, Andrew Morton , Greg Kroah-Hartman , "David S. Miller" , Arnd Bergmann List-ID: This patch series adds support of procfs mount options and adds mount options to restrict /proc// directories to owners and /proc//net/* to root. Additional group may be defined via gid=, and this group will be privileged to study others /proc// and networking information. Similar features are implemented for old kernels in -ow patches (for Linux 2.2 and 2.4) and for Linux 2.6 in -grsecurity, but both of them are implemented as configure options, not cofigurable in runtime, with changes of gid of /proc//, and without backward-compatible /proc//net/* handling. The first patch introduces mount option parsing without any new options. The second patch adds options of /proc// restrictions. The third patch makes net_create() globally visible. The fourth patch adds options of /proc//net/ restrictions. The fifth patch adds documentations for options above. Vasiliy Kulikov (5): procfs: parse mount options procfs: add hidepid= and gid= mount options net: restore net_create and make it globally visible procfs: Add hidenet/nohidenet procfs mount options. procfs: add documentation for procfs mount options Documentation/filesystems/proc.txt | 51 ++++++++++++++++++++++ fs/proc/base.c | 62 ++++++++++++++++++++++++++- fs/proc/inode.c | 20 +++++++++ fs/proc/internal.h | 1 + fs/proc/proc_net.c | 26 +++++++++++ fs/proc/root.c | 83 +++++++++++++++++++++++++++++++++++- include/linux/pid_namespace.h | 3 + include/net/net_namespace.h | 2 + net/core/net_namespace.c | 12 +++-- 9 files changed, 253 insertions(+), 7 deletions(-)