path: root/security/yama
diff options
authorKees Cook <>2012-09-04 13:32:13 -0700
committerJames Morris <>2012-09-05 14:12:31 -0700
commitc6993e4ac002c92bc75379212e9179c36d4bf7ee (patch)
treecdb4c800ea3cf4003b07087166cc767dab79032f /security/yama
parent81198078d7da4240f3cbfc2c6a8ea6cd417f51a7 (diff)
security: allow Yama to be unconditionally stacked
Unconditionally call Yama when CONFIG_SECURITY_YAMA_STACKED is selected, no matter what LSM module is primary. Ubuntu and Chrome OS already carry patches to do this, and Fedora has voiced interest in doing this as well. Instead of having multiple distributions (or LSM authors) carrying these patches, just allow Yama to be called unconditionally when selected by the new CONFIG. Signed-off-by: Kees Cook <> Acked-by: Serge E. Hallyn <> Acked-by: Eric Paris <> Acked-by: John Johansen <> Signed-off-by: James Morris <>
Diffstat (limited to 'security/yama')
2 files changed, 18 insertions, 4 deletions
diff --git a/security/yama/Kconfig b/security/yama/Kconfig
index 51d6709d8bbd..20ef5143c0c0 100644
--- a/security/yama/Kconfig
+++ b/security/yama/Kconfig
@@ -11,3 +11,11 @@ config SECURITY_YAMA
Further information can be found in Documentation/security/Yama.txt.
If you are unsure how to answer this question, answer N.
+ bool "Yama stacked with other LSMs"
+ depends on SECURITY_YAMA
+ default n
+ help
+ When Yama is built into the kernel, force it to stack with the
+ selected primary LSM.
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index d51b7c76c37d..9ca43c1ea630 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -100,7 +100,7 @@ static void yama_ptracer_del(struct task_struct *tracer,
* yama_task_free - check for task_pid to remove from exception list
* @task: task being removed
-static void yama_task_free(struct task_struct *task)
+void yama_task_free(struct task_struct *task)
yama_ptracer_del(task, task);
@@ -116,7 +116,7 @@ static void yama_task_free(struct task_struct *task)
* Return 0 on success, -ve on error. -ENOSYS is returned when Yama
* does not handle the given option.
-static int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,
+int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,
unsigned long arg4, unsigned long arg5)
int rc;
@@ -243,7 +243,7 @@ static int ptracer_exception_found(struct task_struct *tracer,
* Returns 0 if following the ptrace is allowed, -ve on error.
-static int yama_ptrace_access_check(struct task_struct *child,
+int yama_ptrace_access_check(struct task_struct *child,
unsigned int mode)
int rc;
@@ -296,7 +296,7 @@ static int yama_ptrace_access_check(struct task_struct *child,
* Returns 0 if following the ptrace is allowed, -ve on error.
-static int yama_ptrace_traceme(struct task_struct *parent)
+int yama_ptrace_traceme(struct task_struct *parent)
int rc;
@@ -330,6 +330,7 @@ static int yama_ptrace_traceme(struct task_struct *parent)
return rc;
static struct security_operations yama_ops = {
.name = "yama",
@@ -338,6 +339,7 @@ static struct security_operations yama_ops = {
.task_prctl = yama_task_prctl,
.task_free = yama_task_free,
static int yama_dointvec_minmax(struct ctl_table *table, int write,
@@ -384,13 +386,17 @@ static struct ctl_table yama_sysctl_table[] = {
static __init int yama_init(void)
if (!security_module_enable(&yama_ops))
return 0;
printk(KERN_INFO "Yama: becoming mindful.\n");
if (register_security(&yama_ops))
panic("Yama: kernel registration failed.\n");
if (!register_sysctl_paths(yama_sysctl_path, yama_sysctl_table))