Yama: enable link restrictions when selected
Systems running with Yama enabled expect restrictions on various
potentially dangerous operations that could create backward-compaibility
issues with rare userspace corner-cases. Since 561ec64ae67e ("VFS:
don't do protected {sym,hard}links by default") has disabled VFS link
restrictions by default, enable them for systems using Yama.
Cc: stable@vger.kernel.org # v3.6
Signed-off-by: Kees Cook <keescook@chromium.org>
diff --git a/security/yama/Kconfig b/security/yama/Kconfig
index 90c605e..5efcb4d 100644
--- a/security/yama/Kconfig
+++ b/security/yama/Kconfig
@@ -9,4 +9,8 @@
Like capabilities, this security module stacks with other LSMs.
Further information can be found in Documentation/security/Yama.txt.
+ Enables the VFS link restriction sysctls (protected_symlinks and
+ protected_hardlinks) by default. Further information can be found
+ in Documentation/security/Yama.txt.
+
If you are unsure how to answer this question, answer N.
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index 0309f21..2104909 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -12,6 +12,7 @@
*
*/
+#include <linux/fs.h>
#include <linux/lsm_hooks.h>
#include <linux/sysctl.h>
#include <linux/ptrace.h>
@@ -473,4 +474,8 @@
pr_info("Yama: becoming mindful.\n");
security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks));
yama_init_sysctl();
+
+ /* Enable link restrictions when Yama is enabled. */
+ sysctl_protected_symlinks = 1;
+ sysctl_protected_hardlinks = 1;
}
