<commit_before>diff -rupN linux-3.14.27-orig/security/Kconfig linux-3.14.27/security/Kconfig
--- linux-3.14.27-orig/security/Kconfig	2015-01-07 21:35:59.461971583 +0200
+++ linux-3.14.27/security/Kconfig	2015-01-07 21:36:06.841971758 +0200
@@ -122,6 +122,7 @@ source security/smack/Kconfig
 source security/tomoyo/Kconfig
 source security/apparmor/Kconfig
 source security/yama/Kconfig
+source security/rlsd/Kconfig
 
 source security/integrity/Kconfig
 
@@ -132,6 +133,7 @@ choice
 	default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
 	default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
 	default DEFAULT_SECURITY_YAMA if SECURITY_YAMA
+	default DEFAULT_SECURITY_RLSD if SECURITY_RLSD
 	default DEFAULT_SECURITY_DAC
 
 	help
@@ -153,6 +155,9 @@ choice
 	config DEFAULT_SECURITY_YAMA
 		bool "Yama" if SECURITY_YAMA=y
 
+	config DEFAULT_SECURITY_RLSD
+		bool "RLSD" if SECURITY_RLSD=y
+	
 	config DEFAULT_SECURITY_DAC
 		bool "Unix Discretionary Access Controls"
 
@@ -165,6 +170,7 @@ config DEFAULT_SECURITY
 	default "tomoyo" if DEFAULT_SECURITY_TOMOYO
 	default "apparmor" if DEFAULT_SECURITY_APPARMOR
 	default "yama" if DEFAULT_SECURITY_YAMA
+	default "rlsd" if DEFAULT_SECURITY_RLSD
 	default "" if DEFAULT_SECURITY_DAC
 
 endmenu
diff -rupN linux-3.14.27-orig/security/Makefile linux-3.14.27/security/Makefile
--- linux-3.14.27-orig/security/Makefile	2015-01-07 21:35:59.461971583 +0200
+++ linux-3.14.27/security/Makefile	2015-01-07 21:36:06.845971759 +0200
@@ -8,6 +8,7 @@ subdir-$(CONFIG_SECURITY_SMACK)		+= smac
 subdir-$(CONFIG_SECURITY_TOMOYO)        += tomoyo
 subdir-$(CONFIG_SECURITY_APPARMOR)	+= apparmor
 subdir-$(CONFIG_SECURITY_YAMA)		+= yama
+subdir-$(CONFIG_SECURITY_RLSD)		+= rlsd
 
 # always enable default capabilities
 obj-y					+= commoncap.o
@@ -22,6 +23,7 @@ obj-$(CONFIG_AUDIT)			+= lsm_audit.o
 obj-$(CONFIG_SECURITY_TOMOYO)		+= tomoyo/built-in.o
 obj-$(CONFIG_SECURITY_APPARMOR)		+= apparmor/built-in.o
 obj-$(CONFIG_SECURITY_YAMA)		+= yama/built-in.o
+obj-$(CONFIG_SECURITY_RLSD)		+= rlsd/built-in.o
 obj-$(CONFIG_CGROUP_DEVICE)		+= device_cgroup.o
 
 # Object integrity file lists
diff -rupN linux-3.14.27-orig/security/rlsd/Kconfig linux-3.14.27/security/rlsd/Kconfig
--- linux-3.14.27-orig/security/rlsd/Kconfig	1970-01-01 02:00:00.000000000 +0200
+++ linux-3.14.27/security/rlsd/Kconfig	2015-01-07 21:36:06.845971759 +0200
@@ -0,0 +1,10 @@
+config SECURITY_RLSD
+	bool "RLSD support"
+	depends on SECURITY
+	select SECURITYFS
+	select SECURITY_PATH
+	default n
+	help
+	  This selects the RLSD security module.
+
+	  If you are unsure how to answer this question, answer N.
diff -rupN linux-3.14.27-orig/security/rlsd/Makefile linux-3.14.27/security/rlsd/Makefile
--- linux-3.14.27-orig/security/rlsd/Makefile	1970-01-01 02:00:00.000000000 +0200
+++ linux-3.14.27/security/rlsd/Makefile	2015-01-07 21:36:06.845971759 +0200
@@ -0,0 +1,3 @@
+obj-$(CONFIG_SECURITY_RLSD) := rlsd.o
+
+rlsd-y := rlsd_lsm.o
diff -rupN linux-3.14.27-orig/security/rlsd/rlsd_lsm.c linux-3.14.27/security/rlsd/rlsd_lsm.c
--- linux-3.14.27-orig/security/rlsd/rlsd_lsm.c	1970-01-01 02:00:00.000000000 +0200
+++ linux-3.14.27/security/rlsd/rlsd_lsm.c	2015-01-07 23:19:44.894119540 +0200
@@ -0,0 +1,300 @@
+/*
+ * RLSD Linux Security Module
+ *
+ * Author: <NAME> <<EMAIL>>
+ *
+ */
+
+#include <linux/security.h>
+#include <linux/sched.h>
+#include <linux/mount.h>
+#include <linux/fs.h>
+#include <linux/ptrace.h>
+#include <linux/prctl.h>
+#include <linux/mman.h>
+#include <linux/binfmts.h>
+#include <linux/cred.h>
+#include <linux/dcache.h>
+#include <linux/stat.h>
+#include <linux/path.h>
+#ifdef CONFIG_SECURITY_NETWORK
+#	include <linux/socket.h>
+#endif
+#include <linux/types.h>
+#include <linux/printk.h>
+#include <linux/string.h>
+
+static bool rlsd_enabled = 1;
+
+static int __init rlsd_enabled_setup(char *str)
+{
+	unsigned long enabled;
+	int error;
+	if (str) {
+		error = strict_strtoul(str, 0, &enabled);
+		if (!error)
+			rlsd_enabled = enabled ? 1 : 0;
+	}
+	return 1;
+}
+
+__setup("secure=", rlsd_enabled_setup);
+
+static int rlsd_ptrace_traceme(struct task_struct *parent)
+{
+	char name[sizeof(parent->comm)];
+	struct task_struct *child;
+
+	if (!parent)
+		return -EINVAL;
+
+	child = current;
+	printk(KERN_ALERT "rlsd: denied PTRACE_TRACEME from %lu (%s)\n",
+	       (unsigned long) child->pid,
+	       get_task_comm(name, child));
+	return -EPERM;
+}
+
+static int rlsd_ptrace_access_check(struct task_struct *child,
+                                    unsigned int mode)
+{
+	char pname[sizeof(child->comm)];
+	struct task_struct *parent;
+
+	if (!child)
+		return -EINVAL;
+
+	if (PTRACE_MODE_ATTACH != mode)
+		return cap_ptrace_access_check(child, mode);
+
+	/* access child->comm directly - ptrace_may_access() (kernel/ptrace.c)
+	 * already locks */
+	parent = current;
+	printk(KERN_ALERT "rlsd: denied attach of %lu (%s) to %lu (%s)\n",
+	       (unsigned long) parent->pid,
+	       get_task_comm(pname, parent),
+	       (unsigned long) child->pid,
+	       child->comm);
+	return -EPERM;
+}
+
+static int rlsd_sb_umount(struct vfsmount *mnt, int flags)
+{
+	char name[FIELD_SIZEOF(struct task_struct, comm)];
+	struct task_struct *tsk;
+
+	if (!mnt)
+		return -EINVAL;
+	if (!mnt->mnt_sb)
+		return -EINVAL;
+	if (!mnt->mnt_sb->s_type)
+		return -EINVAL;
+	if (!mnt->mnt_sb->s_type->name)
+		return -EINVAL;
+
+	if ((0 == strcmp("proc", mnt->mnt_sb->s_type->name)) ||
+	    (0 == strcmp("sysfs", mnt->mnt_sb->s_type->name)) ||
+	    (0 == strcmp("devtmpfs", mnt->mnt_sb->s_type->name)) ||
+	    (0 == strcmp("devpts", mnt->mnt_sb->s_type->name)) ||
+	    ((0 == strcmp("fuse", mnt->mnt_sb->s_type->name)) &&
+	     (0 == strcmp("logfence", mnt->mnt_sb->s_subtype)))) {
+		tsk = current;
+		(void) get_task_comm(name, tsk);
+		if ((mnt->mnt_sb->s_subtype) && (mnt->mnt_sb->s_subtype[0])) {
+			printk(KERN_ALERT "rlsd: denied unmount of %s.%s from %lu (%s)\n",
+			       mnt->mnt_sb->s_type->name,
+			       mnt->mnt_sb->s_subtype,
+			       (unsigned long) tsk->pid,
+			       name);
+		}
+		else {
+			printk(KERN_ALERT "rlsd: denied unmount of %s from %lu (%s)\n",
+			       mnt->mnt_sb->s_type->name,
+			       (unsigned long) tsk->pid,
+			       name);
+		}
+		return -EPERM;
+	}
+
+	return 0;
+}
+
+static inline int rlsd_task_prctl(int option,
+                                  unsigned long arg2,
+                                  unsigned long arg3,
+                                  unsigned long arg4,<commit_msg>Slightly prettified the LSM module.<commit_after>diff -rupN linux-3.14.27-orig/security/Kconfig linux-3.14.27/security/Kconfig
--- linux-3.14.27-orig/security/Kconfig	2015-01-07 21:35:59.461971583 +0200
+++ linux-3.14.27/security/Kconfig	2015-01-07 21:36:06.841971758 +0200
@@ -122,6 +122,7 @@ source security/smack/Kconfig
 source security/tomoyo/Kconfig
 source security/apparmor/Kconfig
 source security/yama/Kconfig
+source security/rlsd/Kconfig
 
 source security/integrity/Kconfig
 
@@ -132,6 +133,7 @@ choice
 	default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
 	default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
 	default DEFAULT_SECURITY_YAMA if SECURITY_YAMA
+	default DEFAULT_SECURITY_RLSD if SECURITY_RLSD
 	default DEFAULT_SECURITY_DAC
 
 	help
@@ -153,6 +155,9 @@ choice
 	config DEFAULT_SECURITY_YAMA
 		bool "Yama" if SECURITY_YAMA=y
 
+	config DEFAULT_SECURITY_RLSD
+		bool "RLSD" if SECURITY_RLSD=y
+	
 	config DEFAULT_SECURITY_DAC
 		bool "Unix Discretionary Access Controls"
 
@@ -165,6 +170,7 @@ config DEFAULT_SECURITY
 	default "tomoyo" if DEFAULT_SECURITY_TOMOYO
 	default "apparmor" if DEFAULT_SECURITY_APPARMOR
 	default "yama" if DEFAULT_SECURITY_YAMA
+	default "rlsd" if DEFAULT_SECURITY_RLSD
 	default "" if DEFAULT_SECURITY_DAC
 
 endmenu
diff -rupN linux-3.14.27-orig/security/Makefile linux-3.14.27/security/Makefile
--- linux-3.14.27-orig/security/Makefile	2015-01-07 21:35:59.461971583 +0200
+++ linux-3.14.27/security/Makefile	2015-01-07 21:36:06.845971759 +0200
@@ -8,6 +8,7 @@ subdir-$(CONFIG_SECURITY_SMACK)		+= smac
 subdir-$(CONFIG_SECURITY_TOMOYO)        += tomoyo
 subdir-$(CONFIG_SECURITY_APPARMOR)	+= apparmor
 subdir-$(CONFIG_SECURITY_YAMA)		+= yama
+subdir-$(CONFIG_SECURITY_RLSD)		+= rlsd
 
 # always enable default capabilities
 obj-y					+= commoncap.o
@@ -22,6 +23,7 @@ obj-$(CONFIG_AUDIT)			+= lsm_audit.o
 obj-$(CONFIG_SECURITY_TOMOYO)		+= tomoyo/built-in.o
 obj-$(CONFIG_SECURITY_APPARMOR)		+= apparmor/built-in.o
 obj-$(CONFIG_SECURITY_YAMA)		+= yama/built-in.o
+obj-$(CONFIG_SECURITY_RLSD)		+= rlsd/built-in.o
 obj-$(CONFIG_CGROUP_DEVICE)		+= device_cgroup.o
 
 # Object integrity file lists
diff -rupN linux-3.14.27-orig/security/rlsd/Kconfig linux-3.14.27/security/rlsd/Kconfig
--- linux-3.14.27-orig/security/rlsd/Kconfig	1970-01-01 02:00:00.000000000 +0200
+++ linux-3.14.27/security/rlsd/Kconfig	2015-01-07 21:36:06.845971759 +0200
@@ -0,0 +1,10 @@
+config SECURITY_RLSD
+	bool "RLSD support"
+	depends on SECURITY
+	select SECURITYFS
+	select SECURITY_PATH
+	default n
+	help
+	  This selects the RLSD security module.
+
+	  If you are unsure how to answer this question, answer N.
diff -rupN linux-3.14.27-orig/security/rlsd/Makefile linux-3.14.27/security/rlsd/Makefile
--- linux-3.14.27-orig/security/rlsd/Makefile	1970-01-01 02:00:00.000000000 +0200
+++ linux-3.14.27/security/rlsd/Makefile	2015-01-07 21:36:06.845971759 +0200
@@ -0,0 +1,3 @@
+obj-$(CONFIG_SECURITY_RLSD) := rlsd.o
+
+rlsd-y := rlsd_lsm.o
diff -rupN linux-3.14.27-orig/security/rlsd/rlsd_lsm.c linux-3.14.27/security/rlsd/rlsd_lsm.c
--- linux-3.14.27-orig/security/rlsd/rlsd_lsm.c	1970-01-01 02:00:00.000000000 +0200
+++ linux-3.14.27/security/rlsd/rlsd_lsm.c	2015-01-07 23:49:07.438161429 +0200
@@ -0,0 +1,301 @@
+/*
+ * RLSD Linux Security Module
+ *
+ * Author: <NAME> <<EMAIL>>
+ *
+ */
+
+#include <linux/security.h>
+#include <linux/sched.h>
+#include <linux/mount.h>
+#include <linux/fs.h>
+#include <linux/ptrace.h>
+#include <linux/prctl.h>
+#include <linux/mman.h>
+#include <linux/binfmts.h>
+#include <linux/cred.h>
+#include <linux/dcache.h>
+#include <linux/stat.h>
+#include <linux/path.h>
+#ifdef CONFIG_SECURITY_NETWORK
+#	include <linux/socket.h>
+#endif
+#include <linux/types.h>
+#include <linux/printk.h>
+#include <linux/string.h>
+
+static bool rlsd_enabled = 1;
+
+static int __init rlsd_enabled_setup(char *str)
+{
+	unsigned long enabled;
+	int error;
+	if (str) {
+		error = strict_strtoul(str, 0, &enabled);
+		if (!error)
+			rlsd_enabled = enabled ? 1 : 0;
+	}
+	return 1;
+}
+
+__setup("secure=", rlsd_enabled_setup);
+
+static int rlsd_ptrace_traceme(struct task_struct *parent)
+{
+	char name[sizeof(parent->comm)];
+	struct task_struct *child;
+
+	if (!parent)
+		return -EINVAL;
+
+	child = current;
+	printk(KERN_ALERT "rlsd: denied PTRACE_TRACEME from %lu (%s)\n",
+	       (unsigned long) child->pid,
+	       get_task_comm(name, child));
+	return -EPERM;
+}
+
+static int rlsd_ptrace_access_check(struct task_struct *child,
+                                    unsigned int mode)
+{
+	char pname[sizeof(child->comm)];
+	struct task_struct *parent;
+
+	if (!child)
+		return -EINVAL;
+
+	if (PTRACE_MODE_ATTACH != mode)
+		return cap_ptrace_access_check(child, mode);
+
+	/* access child->comm directly - ptrace_may_access() (kernel/ptrace.c)
+	 * already locks */
+	parent = current;
+	printk(KERN_ALERT "rlsd: denied attach of %lu (%s) to %lu (%s)\n",
+	       (unsigned long) parent->pid,
+	       get_task_comm(pname, parent),
+	       (unsigned long) child->pid,
+	       child->comm);
+	return -EPERM;
+}
+
+static int rlsd_sb_umount(struct vfsmount *mnt, int flags)
+{
+	char name[FIELD_SIZEOF(struct task_struct, comm)];
+	struct task_struct *tsk;
+
+	if (!mnt)
+		return -EINVAL;
+	if (!mnt->mnt_sb)
+		return -EINVAL;
+	if (!mnt->mnt_sb->s_type)
+		return -EINVAL;
+	if (!mnt->mnt_sb->s_type->name)
+		return -EINVAL;
+
+	if ((0 == strcmp("proc", mnt->mnt_sb->s_type->name)) ||
+	    (0 == strcmp("sysfs", mnt->mnt_sb->s_type->name)) ||
+	    (0 == strcmp("devtmpfs", mnt->mnt_sb->s_type->name)) ||
+	    (0 == strcmp("devpts", mnt->mnt_sb->s_type->name))) {
+		tsk = current;
+		printk(KERN_ALERT "rlsd: denied unmount of %s from %lu (%s)\n",
+		       mnt->mnt_sb->s_type->name,
+		       (unsigned long) tsk->pid,
+		       get_task_comm(name, tsk));
+		return -EPERM;
+	}
+
+	if ((mnt->mnt_sb->s_subtype) &&
+	    (mnt->mnt_sb->s_subtype[0]) &&
+	    (0 == strcmp("fuse", mnt->mnt_sb->s_type->name)) &&
+	    (0 == strcmp("logfence", mnt->mnt_sb->s_subtype))) {
+		tsk = current;
+		printk(KERN_ALERT "rlsd: denied unmount of %s.%s from %lu (%s)\n",
+		       mnt->mnt_sb->s_type->name,
+		       mnt->mnt_sb->s_subtype,
+		       (unsigned long) tsk->pid,
+		       get_task_comm(name, tsk));
+		return -EPERM;
+	}
+
+	return 0;
+}
+
+static inline int rlsd_task_prctl(int option,
+                                  unsigned long arg2,
+                                  unsigned long arg3,
+                                  unsigned long arg4,
{'fraction_non_alphanumeric': 0.16468421456526744, 'fraction_numerical': 0.0679917120712148, 'mean_word_length': 3.7423580786026203, 'pattern_counts': {'":': 0, '<': 41, '<?xml version=': 0, '>': 129, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 6, 'word_list_counts': {'cursed_substrings.json': 8, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3489214', 'n_tokens_mistral': 6151, 'n_tokens_neox': 5516, 'n_words': 965}