1
2
3
4
5
6
7
8
9
10

struct {
	__uint(type, BPF_MAP_TYPE_HASH);
	__type(key, u32);
	__type(value, u64); // rule: permissions + flags
	__uint(max_entries, OUTER_MAP_ENTRIES_MAX);
} v_ptrace SEC(".maps");

static __always_inline u64 *get_ptrace_rule(u32 mnt_ns) {
    return bpf_map_lookup_elem(&v_ptrace, &mnt_ns);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

SEC("lsm/ptrace_access_check")
int BPF_PROG(varmor_ptrace_access_check, struct task_struct *child, unsigned int mode) {
  // Retrieve the current task
  struct task_struct *current = (struct task_struct *)bpf_get_current_task();
  u32 current_mnt_ns = get_task_mnt_ns_id(current);
  u32 child_mnt_ns = get_task_mnt_ns_id(child);
  
  // Whether the current task has ptrace access control rule
  u64 *rule = get_ptrace_rule(current_mnt_ns);
  if (rule != 0) {
    DEBUG_PRINT("================ lsm/ptrace_access_check ================");
    if (!ptrace_permission_check(current_mnt_ns, child_mnt_ns, *rule, (mode & PTRACE_MODE_READ) ? AA_PTRACE_READ : AA_PTRACE_TRACE))
      return -EPERM;
  }

  // Whether the child task has ptrace access control rule
  // We allow tasks from the init mnt ns by default
  rule = get_ptrace_rule(child_mnt_ns);
  if (current_mnt_ns != init_mnt_ns && rule != 0) {
    DEBUG_PRINT("================ lsm/ptrace_access_check ================");
    if (!ptrace_permission_check(current_mnt_ns, child_mnt_ns, *rule, (mode & PTRACE_MODE_READ) ? AA_MAY_BE_READ : AA_MAY_BE_TRACED))
      return -EPERM;
  }

  return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

static int apparmor_ptrace_access_check(struct task_struct *child,
					unsigned int mode)
{
	struct aa_label *tracer, *tracee;
	int error;

	tracer = __begin_current_label_crit_section();
	tracee = aa_get_task_label(child);
	error = aa_may_ptrace(tracer, tracee,
			(mode & PTRACE_MODE_READ) ? AA_PTRACE_READ
						  : AA_PTRACE_TRACE);
	aa_put_label(tracee);
	__end_current_label_crit_section(tracer);

	return error;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

#define PRECISE_MATCH 0x00000001
#define GREEDY_MATCH  0x00000002

static __always_inline bool ptrace_permission_check(u32 current_mnt_ns, u32 child_mnt_ns, u64 rule, u32 request_permission) {
  DEBUG_PRINT("current task(mnt ns: %u) request the vArmor ptrace permission(0x%x) of child task(mnt ns: %u)", 
          current_mnt_ns, request_permission, child_mnt_ns);

  u32 permissions = rule >> 32;
  u32 flags = (u32)(rule & 0xffffffff);

  if (permissions & request_permission) {
    // deny all tasks
    if (flags & GREEDY_MATCH) {
      DEBUG_PRINT("access denied");
      return false;
    }

    // only deny tasks outside the container
    if (flags & PRECISE_MATCH && current_mnt_ns != child_mnt_ns) {
      DEBUG_PRINT("access denied");
      return false;
    }
  }

  DEBUG_PRINT("access allowed");
  return true;
}

1
2

u32 permissions = rule >> 32;
u32 flags = (u32)(rule & 0xffffffff);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

type PtraceRule struct {
	// StrictMode is used to indicate whether to restrict ptrace permissions for all source and destination processes.
	// If set to false, it restricts ptrace permissions only for processes in other containers.
	// If set to true, it restricts ptrace permissions for all processes (except those within the init mnt namespace)
	StrictMode bool `json:"strictMode,omitempty"`
	// Permissions are used to indicate which ptrace-related permissions of the target container should be restricted.
	// Available values: trace, traceby, read, readby.
	//
	// trace, traceby
	//    For "write" operations, or other operations that are more dangerous, such as: ptrace attaching (PTRACE_ATTACH) to
	//    another process or calling process_vm_writev(2).
	// read, readby
	//    For "read" operations or other operations that are less dangerous, such as: get_robust_list(2); kcmp(2); reading
	//    /proc/pid/auxv, /proc/pid/environ, or /proc/pid/stat; or readlink(2) of a /proc/pid/ns/* file.
	Permissions []string `json:"permissions,omitempty"`
}

type PtraceContent struct {
	Permissions uint32 `json:"permissions"`
	Flags       uint32 `json:"flags"`
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

ptrace:
    properties:
        permissions:
        description: "Permissions are used to indicate which
            ptrace-related permissions of the target container
            should be restricted. Available values: trace, traceby,
            read, readby. \n trace, traceby For \"write\" operations,
            or other operations that are more dangerous, such
            as: ptrace attaching (PTRACE_ATTACH) to another
            process or calling process_vm_writev(2). read, readby
            For \"read\" operations or other operations that
            are less dangerous, such as: get_robust_list(2);
            kcmp(2); reading /proc/pid/auxv, /proc/pid/environ,
            or /proc/pid/stat; or readlink(2) of a /proc/pid/ns/*
            file."
        items:
            type: string
        type: array
        strictMode:
        description: StrictMode is used to indicate whether
            to restrict ptrace permissions for all source and
            destination processes. If set to false, it restricts
            ptrace permissions only for processes in other containers.
            If set to true, it restricts ptrace permissions
            for all processes (except those within the init
            mnt namespace)
        type: boolean
type: object