#define YAMA_SCOPE_DISABLED    0
#define YAMA_SCOPE_RELATIONAL    1
#define YAMA_SCOPE_CAPABILITY    2
#define YAMA_SCOPE_NO_ATTACH    3

//test.c  #include<stdio.h>int main(){while(1){sleep(20);static int i = 0;
    }return 0;}

void __init yama_add_hooks(void)
{pr_info("Yama: becoming mindful.\n");        //打印相关信息，可以通过dmesg |  grep Yama:查看security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks));   //添加安全模块函数yama_init_sysctl();                                    //在中sysctl进行注册
}

static void __init yama_init_sysctl(void)
{if (!register_sysctl_paths(yama_sysctl_path, yama_sysctl_table))panic("Yama: sysctl registration failed.\n");
}

struct ctl_path yama_sysctl_path[] = {{ .procname = "kernel", },{ .procname = "yama", },{ }
};

static int zero;//自动初始化为0
static int max_scope = YAMA_SCOPE_NO_ATTACH;

static struct ctl_table yama_sysctl_table[] = {{.procname       = "ptrace_scope",     //文件名.data           = &ptrace_scope,         //实际参数在内核中的数据结构.maxlen         = sizeof(int),              //对超过该最大长度的字符串截掉后面超长的部分..mode           = 0644,                        //条目在proc文件系统下的权限.proc_handler   = yama_dointvec_minmax,  //如上，对.proc_handler进行hook.extra1         = &zero,                        //proc_handler的参数，即范围为0~3.extra2         = &max_scope,},{ }
};

static int yama_dointvec_minmax(struct ctl_table *table, int write,void __user *buffer, size_t *lenp, loff_t *ppos)
{struct ctl_table table_copy;/*capable来对权限做出检查，检查是否有权对指定的资源进行操作，该函数返回0则代表无权操作这里对ptrace_scope进行读写需要write置1而且需要用户有CAP_SYS_PTRACE权限*/if (write && !capable(CAP_SYS_PTRACE))         return -EPERM;//当设置为最大值时，不再允许修改该参数table_copy = *table;if (*(int *)table_copy.data == *(int *)table_copy.extra2)table_copy.extra1 = table_copy.extra2;return proc_dointvec_minmax(&table_copy, write, buffer, lenp, ppos);
}

static struct security_hook_list yama_hooks[] = {//上面两个hook就是对ptrace的两种方式进行分别check
    LSM_HOOK_INIT(ptrace_access_check, yama_ptrace_access_check),LSM_HOOK_INIT(ptrace_traceme, yama_ptrace_traceme),LSM_HOOK_INIT(task_prctl, yama_task_prctl),LSM_HOOK_INIT(task_free, yama_task_free),
};

struct security_hook_list {
       struct list_head                list;       struct list_head                *head;
       union security_list_options     hook;
};

static int yama_ptrace_access_check(struct task_struct *child,unsigned int mode)
{int rc = 0;/* require ptrace target be a child of ptracer on attach */if (mode & PTRACE_MODE_ATTACH) {switch (ptrace_scope) {case YAMA_SCOPE_DISABLED:/* No additional restrictions. */break;case YAMA_SCOPE_RELATIONAL:                  //进程可以跟踪有血缘关系（后代）的进程rcu_read_lock();                                  if (!task_is_descendant(current, child) &&              //简单的遍历，查看进程是否是后代!ptracer_exception_found(current, child) &&     //检测是否已有祖先attach了!ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))rc = -EPERM;rcu_read_unlock();break;case YAMA_SCOPE_CAPABILITY:               //拥有CAP_SYS_PTRACE能力的进程才可以使用ptracercu_read_lock();if (!ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))rc = -EPERM;rcu_read_unlock();break;case YAMA_SCOPE_NO_ATTACH:           //无法进行ptracedefault:rc = -EPERM;break;}}if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0) {printk_ratelimited(KERN_NOTICE"ptrace of pid %d was attempted by: %s (pid %d)\n",child->pid, current->comm, current->pid);}return rc;
}

int yama_ptrace_traceme(struct task_struct *parent)
{int rc = 0;/* Only disallow PTRACE_TRACEME on more aggressive settings. */switch (ptrace_scope) {case YAMA_SCOPE_CAPABILITY:/*当用户父进程有CAP_SYS_PTRACE没有CAP_SYS_PTRACE时，返回失败*/if (!has_ns_capability(parent, current_user_ns(), CAP_SYS_PTRACE))rc = -EPERM;break;/*如果YAMA_SCOPE_NO_ATTACH,直接返回失败*/case YAMA_SCOPE_NO_ATTACH:rc = -EPERM;break;}

    LSM_HOOK_INIT(task_prctl, yama_task_prctl),LSM_HOOK_INIT(task_free, yama_task_free),