diff --git a/README b/README index 0d85b36..408fe70 100644 --- a/README +++ b/README @@ -52,6 +52,7 @@ check_file - check file owner/mode in addition to directory. default on kill - kill the offending process and its parent when it gets denied execution from TPE, unless it's root. default off log - whether to log denied execs to the ring buffer. default on +log_max - maximun parent processes in a single log entry. default 50 log_floodburst - number of log entries before logging is disabled. default 5 log_floodtime - seconds until re-enabling logging after floodburst. default 5 paranoid - denies execs for root of files not owned by root. default off diff --git a/core.c b/core.c index 28ecb12..8029142 100644 --- a/core.c +++ b/core.c @@ -62,16 +62,25 @@ void parent_task_walk(struct task_struct *task) { struct task_struct *parent; char filename[MAX_FILE_LEN]; + int c = 0; + walk: + c++; if (task && task->mm) { + if (tpe_log_max && c > tpe_log_max) { + printk("tpe log_max %d reached", tpe_log_max); + return; + } + parent = get_task_parent(task); printk("%s (uid:%d)", exe_from_mm(task->mm, filename, MAX_FILE_LEN), get_task_uid(task)); if (parent && task->pid != 1) { printk(", "); - parent_task_walk(parent); + task = parent; + goto walk; } } diff --git a/module.h b/module.h index 24589ad..583cc20 100644 --- a/module.h +++ b/module.h @@ -76,6 +76,7 @@ extern int tpe_check_file; extern int tpe_paranoid; extern int tpe_kill; extern int tpe_log; +extern int tpe_log_max; extern int tpe_log_floodtime; extern int tpe_log_floodburst; extern int tpe_dmesg; diff --git a/sysctl.c b/sysctl.c index c96b417..cc29e01 100644 --- a/sysctl.c +++ b/sysctl.c @@ -10,6 +10,7 @@ int tpe_check_file = 1; int tpe_paranoid = 0; int tpe_kill = 0; int tpe_log = 1; +int tpe_log_max = 50; int tpe_log_floodtime = LOG_FLOODTIME; int tpe_log_floodburst = LOG_FLOODBURST; int tpe_dmesg = 0; @@ -117,6 +118,14 @@ static ctl_table tpe_table[] = { .mode = 0644, .proc_handler = &proc_dointvec, }, + { + .ctl_name = CTL_UNNUMBERED, + .procname = "log_max", + .data = &tpe_log_max, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = &proc_dointvec, + }, { .ctl_name = CTL_UNNUMBERED, .procname = "log_floodtime",