On Thursday, July 18, 2024 03:04 EEST, Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote: > On Wed, 17 Jul 2024 at 15:24, Kees Cook <kees@xxxxxxxxxx> wrote: > > > > > In particular, this patch would make it easy to make that > > > SECURITY_PROC_MEM_RESTRICT_FOLL_FORCE config option be a "choice" > > > where you pick "never, ptrace, always" by just changing the rules in > > > proc_is_ptracing(). > > > > So the original patch could be reduced to just the single tristate option > > instead of 3 tristates? I think that would be a decent middle ground, > > and IIUC, will still provide the coverage Chrome OS is looking for[1]. > > So here's what I kind of think might be ok. > > ENTIRELY UNTESTED! This is more of a "look, something like this, > perhaps" patch than a real one. > > If somebody tests this, and it is ok for Chrome OS, you can consider > this signed-off-on, but only with actual testing. I might have gotten > something hroribly wrong. Thanks for the patch! I tested it on ChromeOS and it does what it intends, just with two minor fixes applied: --- a/security/Kconfig +++ b/security/Kconfig -config CONFIG_PROC_MEM_FORCE_PTRACE +config PROC_MEM_FORCE_PTRACE ..... -config CONFIG_PROC_MEM_NO_FORCE +config PROC_MEM_NO_FORCE As Kees suggested, I'll add a bootparam with a simple __ro_after_init variable to select this and then send a v2 for review.
