ptrace: introduce PTRACE_O_EXITKILL

Ptrace jailers want to be sure that the tracee can never escape
from the control. However if the tracer dies unexpectedly the
tracee continues to run in potentially unsafe mode.

Add the new ptrace option PTRACE_O_EXITKILL. If the tracer exits
it sends SIGKILL to every tracee which has this bit set.

Note that the new option is not equal to the last-option << 1.  Because
currently all options have an event, and the new one starts the eventless
group.  It uses the random 20 bit, so we have the room for 12 more events,
but we can also add the new eventless options below this one.

Suggested by Amnon Shiloh.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Tested-by: Amnon Shiloh <u3557@miso.sublimeip.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Chris Evans <scarybeasts@gmail.com>
Cc: David Howells <dhowells@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index a89ff04bddd9fe214d183060fd2412da53e36959..addfbe7c180e0c5806adf375120e5919cfe35c4b 100644 (file)
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -32,6 +32,8 @@
 #define PT_TRACE_EXIT          PT_EVENT_FLAG(PTRACE_EVENT_EXIT)
 #define PT_TRACE_SECCOMP       PT_EVENT_FLAG(PTRACE_EVENT_SECCOMP)
 
+#define PT_EXITKILL            (PTRACE_O_EXITKILL << PT_OPT_FLAG_SHIFT)
+
 /* single stepping state bits (used on ARM and PA-RISC) */
 #define PT_SINGLESTEP_BIT      31
 #define PT_SINGLESTEP          (1<<PT_SINGLESTEP_BIT)

diff --git a/include/uapi/linux/ptrace.h b/include/uapi/linux/ptrace.h
index 1ef6c056a9e435640aa7c25ec4a72f2ed4af0c2e..022ab186a81252ceaad11708b69a8fcd964f19ed 100644 (file)
--- a/include/uapi/linux/ptrace.h
+++ b/include/uapi/linux/ptrace.h
@@ -73,7 +73,10 @@
 #define PTRACE_O_TRACEEXIT     (1 << PTRACE_EVENT_EXIT)
 #define PTRACE_O_TRACESECCOMP  (1 << PTRACE_EVENT_SECCOMP)
 
-#define PTRACE_O_MASK          0x000000ff
+/* eventless options */
+#define PTRACE_O_EXITKILL      (1 << 20)
+
+#define PTRACE_O_MASK          (0x000000ff | PTRACE_O_EXITKILL)
 
 #include <asm/ptrace.h>
 

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 1f5e55dda955544ca4a3f1f944e967f6b561bea2..ec8118ab2a47edaacda635a5eca0a104db3c09b3 100644 (file)
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -457,6 +457,9 @@ void exit_ptrace(struct task_struct *tracer)
                return;
 
        list_for_each_entry_safe(p, n, &tracer->ptraced, ptrace_entry) {
+               if (unlikely(p->ptrace & PT_EXITKILL))
+                       send_sig_info(SIGKILL, SEND_SIG_FORCED, p);
+
                if (__ptrace_detach(tracer, p))
                        list_add(&p->ptrace_entry, &ptrace_dead);
        }