]> git.pld-linux.org Git - packages/kernel.git/blame - grsecurity-2.1.9-2.6.18.patch
projects / packages / kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- take from suse kernel-source-2.6.22.5-31.src.rpm -> patches.fixes.tar.bz2 -> patche...
[packages/kernel.git] / grsecurity-2.1.9-2.6.18.patch
CommitLineData
51335a6d 1diff -urNp linux-2.6.18/arch/alpha/kernel/module.c linux-2.6.18/arch/alpha/kernel/module.c
2--- linux-2.6.18/arch/alpha/kernel/module.c 2006-09-19 23:42:06.000000000 -0400
3+++ linux-2.6.18/arch/alpha/kernel/module.c 2006-09-22 20:45:03.000000000 -0400
4@@ -177,7 +177,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
5
6 /* The small sections were sorted to the end of the segment.
7 The following should definitely cover them. */
8- gp = (u64)me->module_core + me->core_size - 0x8000;
9+ gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
10 got = sechdrs[me->arch.gotsecindex].sh_addr;
11
12 for (i = 0; i < n; i++) {
13diff -urNp linux-2.6.18/arch/alpha/kernel/osf_sys.c linux-2.6.18/arch/alpha/kernel/osf_sys.c
14--- linux-2.6.18/arch/alpha/kernel/osf_sys.c 2006-09-19 23:42:06.000000000 -0400
15+++ linux-2.6.18/arch/alpha/kernel/osf_sys.c 2006-09-22 20:45:03.000000000 -0400
16@@ -1273,6 +1273,10 @@ arch_get_unmapped_area(struct file *filp
17 merely specific addresses, but regions of memory -- perhaps
18 this feature should be incorporated into all ports? */
19
20+#ifdef CONFIG_PAX_RANDMMAP
21+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP) || !filp)
22+#endif
23+
24 if (addr) {
25 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
26 if (addr != (unsigned long) -ENOMEM)
27@@ -1280,8 +1284,8 @@ arch_get_unmapped_area(struct file *filp
28 }
29
30 /* Next, try allocating at TASK_UNMAPPED_BASE. */
31- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
32- len, limit);
33+ addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
34+
35 if (addr != (unsigned long) -ENOMEM)
36 return addr;
37
38diff -urNp linux-2.6.18/arch/alpha/kernel/ptrace.c linux-2.6.18/arch/alpha/kernel/ptrace.c
39--- linux-2.6.18/arch/alpha/kernel/ptrace.c 2006-09-19 23:42:06.000000000 -0400
40+++ linux-2.6.18/arch/alpha/kernel/ptrace.c 2006-09-22 20:04:35.000000000 -0400
41@@ -15,6 +15,7 @@
42 #include <linux/slab.h>
43 #include <linux/security.h>
44 #include <linux/signal.h>
45+#include <linux/grsecurity.h>
46
47 #include <asm/uaccess.h>
48 #include <asm/pgtable.h>
49@@ -283,6 +284,9 @@ do_sys_ptrace(long request, long pid, lo
50 goto out_notsk;
51 }
52
53+ if (gr_handle_ptrace(child, request))
54+ goto out;
55+
56 if (request == PTRACE_ATTACH) {
57 ret = ptrace_attach(child);
58 goto out;
59diff -urNp linux-2.6.18/arch/alpha/mm/fault.c linux-2.6.18/arch/alpha/mm/fault.c
60--- linux-2.6.18/arch/alpha/mm/fault.c 2006-09-19 23:42:06.000000000 -0400
61+++ linux-2.6.18/arch/alpha/mm/fault.c 2006-09-22 20:45:03.000000000 -0400
62@@ -24,6 +24,7 @@
63 #include <linux/smp_lock.h>
64 #include <linux/interrupt.h>
65 #include <linux/module.h>
66+#include <linux/binfmts.h>
67
68 #include <asm/system.h>
69 #include <asm/uaccess.h>
70@@ -55,6 +56,124 @@ __load_new_mm_context(struct mm_struct *
71 __reload_thread(pcb);
72 }
73
74+#ifdef CONFIG_PAX_PAGEEXEC
75+/*
76+ * PaX: decide what to do with offenders (regs->pc = fault address)
77+ *
78+ * returns 1 when task should be killed
79+ * 2 when patched PLT trampoline was detected
80+ * 3 when unpatched PLT trampoline was detected
81+ */
82+static int pax_handle_fetch_fault(struct pt_regs *regs)
83+{
84+
85+#ifdef CONFIG_PAX_EMUPLT
86+ int err;
87+
88+ do { /* PaX: patched PLT emulation #1 */
89+ unsigned int ldah, ldq, jmp;
90+
91+ err = get_user(ldah, (unsigned int *)regs->pc);
92+ err |= get_user(ldq, (unsigned int *)(regs->pc+4));
93+ err |= get_user(jmp, (unsigned int *)(regs->pc+8));
94+
95+ if (err)
96+ break;
97+
98+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
99+ (ldq & 0xFFFF0000U) == 0xA77B0000U &&
100+ jmp == 0x6BFB0000U)
101+ {
102+ unsigned long r27, addr;
103+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
104+ unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
105+
106+ addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
107+ err = get_user(r27, (unsigned long*)addr);
108+ if (err)
109+ break;
110+
111+ regs->r27 = r27;
112+ regs->pc = r27;
113+ return 2;
114+ }
115+ } while (0);
116+
117+ do { /* PaX: patched PLT emulation #2 */
118+ unsigned int ldah, lda, br;
119+
120+ err = get_user(ldah, (unsigned int *)regs->pc);
121+ err |= get_user(lda, (unsigned int *)(regs->pc+4));
122+ err |= get_user(br, (unsigned int *)(regs->pc+8));
123+
124+ if (err)
125+ break;
126+
127+ if ((ldah & 0xFFFF0000U)== 0x277B0000U &&
128+ (lda & 0xFFFF0000U) == 0xA77B0000U &&
129+ (br & 0xFFE00000U) == 0xC3E00000U)
130+ {
131+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
132+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
133+ unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
134+
135+ regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
136+ regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
137+ return 2;
138+ }
139+ } while (0);
140+
141+ do { /* PaX: unpatched PLT emulation */
142+ unsigned int br;
143+
144+ err = get_user(br, (unsigned int *)regs->pc);
145+
146+ if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
147+ unsigned int br2, ldq, nop, jmp;
148+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
149+
150+ addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
151+ err = get_user(br2, (unsigned int *)addr);
152+ err |= get_user(ldq, (unsigned int *)(addr+4));
153+ err |= get_user(nop, (unsigned int *)(addr+8));
154+ err |= get_user(jmp, (unsigned int *)(addr+12));
155+ err |= get_user(resolver, (unsigned long *)(addr+16));
156+
157+ if (err)
158+ break;
159+
160+ if (br2 == 0xC3600000U &&
161+ ldq == 0xA77B000CU &&
162+ nop == 0x47FF041FU &&
163+ jmp == 0x6B7B0000U)
164+ {
165+ regs->r28 = regs->pc+4;
166+ regs->r27 = addr+16;
167+ regs->pc = resolver;
168+ return 3;
169+ }
170+ }
171+ } while (0);
172+#endif
173+
174+ return 1;
175+}
176+
177+void pax_report_insns(void *pc, void *sp)
178+{
179+ unsigned long i;
180+
181+ printk(KERN_ERR "PAX: bytes at PC: ");
182+ for (i = 0; i < 5; i++) {
183+ unsigned int c;
184+ if (get_user(c, (unsigned int*)pc+i))
185+ printk("???????? ");
186+ else
187+ printk("%08x ", c);
188+ }
189+ printk("\n");
190+}
191+#endif
192
193 /*
194 * This routine handles page faults. It determines the address,
195@@ -132,8 +251,29 @@ do_page_fault(unsigned long address, uns
196 good_area:
197 si_code = SEGV_ACCERR;
198 if (cause < 0) {
199- if (!(vma->vm_flags & VM_EXEC))
200+ if (!(vma->vm_flags & VM_EXEC)) {
201+
202+#ifdef CONFIG_PAX_PAGEEXEC
203+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
204+ goto bad_area;
205+
206+ up_read(&mm->mmap_sem);
207+ switch(pax_handle_fetch_fault(regs)) {
208+
209+#ifdef CONFIG_PAX_EMUPLT
210+ case 2:
211+ case 3:
212+ return;
213+#endif
214+
215+ }
216+ pax_report_fault(regs, (void*)regs->pc, (void*)rdusp());
217+ do_exit(SIGKILL);
218+#else
219 goto bad_area;
220+#endif
221+
222+ }
223 } else if (!cause) {
224 /* Allow reads even for write-only mappings */
225 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
226diff -urNp linux-2.6.18/arch/arm/mm/mmap.c linux-2.6.18/arch/arm/mm/mmap.c
227--- linux-2.6.18/arch/arm/mm/mmap.c 2006-09-19 23:42:06.000000000 -0400
228+++ linux-2.6.18/arch/arm/mm/mmap.c 2006-09-22 20:45:03.000000000 -0400
229@@ -61,6 +61,10 @@ arch_get_unmapped_area(struct file *filp
230 if (len > TASK_SIZE)
231 return -ENOMEM;
232
233+#ifdef CONFIG_PAX_RANDMMAP
234+ if (!(mm->pax_flags & MF_PAX_RANDMMAP) || !filp)
235+#endif
236+
237 if (addr) {
238 if (do_align)
239 addr = COLOUR_ALIGN(addr, pgoff);
240@@ -75,7 +79,7 @@ arch_get_unmapped_area(struct file *filp
241 if (len > mm->cached_hole_size) {
242 start_addr = addr = mm->free_area_cache;
243 } else {
244- start_addr = addr = TASK_UNMAPPED_BASE;
245+ start_addr = addr = mm->mmap_base;
246 mm->cached_hole_size = 0;
247 }
248
249@@ -92,8 +96,8 @@ full_search:
250 * Start a new search - just in case we missed
251 * some holes.
252 */
253- if (start_addr != TASK_UNMAPPED_BASE) {
254- start_addr = addr = TASK_UNMAPPED_BASE;
255+ if (start_addr != mm->mmap_base) {
256+ start_addr = addr = mm->mmap_base;
257 mm->cached_hole_size = 0;
258 goto full_search;
259 }
260diff -urNp linux-2.6.18/arch/i386/boot/compressed/head.S linux-2.6.18/arch/i386/boot/compressed/head.S
261--- linux-2.6.18/arch/i386/boot/compressed/head.S 2006-09-19 23:42:06.000000000 -0400
262+++ linux-2.6.18/arch/i386/boot/compressed/head.S 2006-09-22 20:45:03.000000000 -0400
263@@ -39,11 +39,13 @@ startup_32:
264 movl %eax,%gs
265
266 lss stack_start,%esp
267+ movl 0x000000,%ecx
268 xorl %eax,%eax
269 1: incl %eax # check that A20 really IS enabled
270 movl %eax,0x000000 # loop forever if it isn't
271 cmpl %eax,0x100000
272 je 1b
273+ movl %ecx,0x000000
274
275 /*
276 * Initialize eflags. Some BIOS's leave bits like NT set. This would
277diff -urNp linux-2.6.18/arch/i386/Kconfig linux-2.6.18/arch/i386/Kconfig
278--- linux-2.6.18/arch/i386/Kconfig 2006-09-19 23:42:06.000000000 -0400
279+++ linux-2.6.18/arch/i386/Kconfig 2006-09-22 20:45:03.000000000 -0400
280@@ -793,7 +793,7 @@ config HOTPLUG_CPU
281
282 config COMPAT_VDSO
283 bool "Compat VDSO support"
284- default y
285+ default n
286 help
287 Map the VDSO to the predictable old-style address too.
288 ---help---
289@@ -988,7 +988,7 @@ config PCI
290 choice
291 prompt "PCI access mode"
292 depends on PCI && !X86_VISWS
293- default PCI_GOANY
294+ default PCI_GODIRECT
295 ---help---
296 On PCI systems, the BIOS can be used to detect the PCI devices and
297 determine their configuration. However, some old PCI motherboards
298@@ -1020,7 +1020,7 @@ endchoice
299
300 config PCI_BIOS
301 bool
302- depends on !X86_VISWS && PCI && (PCI_GOBIOS || PCI_GOANY)
303+ depends on !X86_VISWS && PCI && PCI_GOBIOS
304 default y
305
306 config PCI_DIRECT
307diff -urNp linux-2.6.18/arch/i386/Kconfig.cpu linux-2.6.18/arch/i386/Kconfig.cpu
308--- linux-2.6.18/arch/i386/Kconfig.cpu 2006-09-19 23:42:06.000000000 -0400
309+++ linux-2.6.18/arch/i386/Kconfig.cpu 2006-09-22 20:45:03.000000000 -0400
310@@ -251,7 +251,7 @@ config X86_PPRO_FENCE
311
312 config X86_F00F_BUG
313 bool
314- depends on M586MMX || M586TSC || M586 || M486 || M386
315+ depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
316 default y
317
318 config X86_WP_WORKS_OK
319@@ -281,7 +281,7 @@ config X86_CMPXCHG64
320
321 config X86_ALIGNMENT_16
322 bool
323- depends on MWINCHIP3D || MWINCHIP2 || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
324+ depends on MWINCHIP3D || MWINCHIP2 || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
325 default y
326
327 config X86_GOOD_APIC
328diff -urNp linux-2.6.18/arch/i386/Kconfig.debug linux-2.6.18/arch/i386/Kconfig.debug
329--- linux-2.6.18/arch/i386/Kconfig.debug 2006-09-19 23:42:06.000000000 -0400
330+++ linux-2.6.18/arch/i386/Kconfig.debug 2006-09-22 20:45:03.000000000 -0400
331@@ -48,7 +48,7 @@ config DEBUG_PAGEALLOC
332
333 config DEBUG_RODATA
334 bool "Write protect kernel read-only data structures"
335- depends on DEBUG_KERNEL
336+ depends on DEBUG_KERNEL && 0
337 help
338 Mark the kernel read-only data as write-protected in the pagetables,
339 in order to catch accidental (and incorrect) writes to such const
340diff -urNp linux-2.6.18/arch/i386/kernel/alternative.c linux-2.6.18/arch/i386/kernel/alternative.c
341--- linux-2.6.18/arch/i386/kernel/alternative.c 2006-09-19 23:42:06.000000000 -0400
342+++ linux-2.6.18/arch/i386/kernel/alternative.c 2006-09-22 20:45:03.000000000 -0400
343@@ -3,6 +3,7 @@
344 #include <linux/list.h>
345 #include <asm/alternative.h>
346 #include <asm/sections.h>
347+#include <asm/desc.h>
348
349 static int no_replacement = 0;
350 static int smp_alt_once = 0;
351@@ -142,6 +143,12 @@ void apply_alternatives(struct alt_instr
352 u8 *instr;
353 int diff, i, k;
354
355+#ifdef CONFIG_PAX_KERNEXEC
356+ unsigned long cr0;
357+
358+ pax_open_kernel(cr0);
359+#endif
360+
361 DPRINTK("%s: alt table %p -> %p\n", __FUNCTION__, start, end);
362 for (a = start; a < end; a++) {
363 BUG_ON(a->replacementlen > a->instrlen);
364@@ -156,16 +163,21 @@ void apply_alternatives(struct alt_instr
365 __FUNCTION__, a->instr, instr);
366 }
367 #endif
368- memcpy(instr, a->replacement, a->replacementlen);
369+ memcpy(instr + __KERNEL_TEXT_OFFSET, a->replacement, a->replacementlen);
370 diff = a->instrlen - a->replacementlen;
371 /* Pad the rest with nops */
372 for (i = a->replacementlen; diff > 0; diff -= k, i += k) {
373 k = diff;
374 if (k > ASM_NOP_MAX)
375 k = ASM_NOP_MAX;
376- memcpy(a->instr + i, noptable[k], k);
377+ memcpy(a->instr + i + __KERNEL_TEXT_OFFSET, noptable[k], k);
378 }
379 }
380+
381+#ifdef CONFIG_PAX_KERNEXEC
382+ pax_close_kernel(cr0);
383+#endif
384+
385 }
386
387 #ifdef CONFIG_SMP
388@@ -174,50 +186,96 @@ static void alternatives_smp_save(struct
389 {
390 struct alt_instr *a;
391
392+#ifdef CONFIG_PAX_KERNEXEC
393+ unsigned long cr0;
394+
395+ pax_open_kernel(cr0);
396+#endif
397+
398 DPRINTK("%s: alt table %p-%p\n", __FUNCTION__, start, end);
399 for (a = start; a < end; a++) {
400 memcpy(a->replacement + a->replacementlen,
401- a->instr,
402+ a->instr + __KERNEL_TEXT_OFFSET,
403 a->instrlen);
404 }
405+
406+#ifdef CONFIG_PAX_KERNEXEC
407+ pax_close_kernel(cr0);
408+#endif
409+
410 }
411
412 static void alternatives_smp_apply(struct alt_instr *start, struct alt_instr *end)
413 {
414 struct alt_instr *a;
415
416+#ifdef CONFIG_PAX_KERNEXEC
417+ unsigned long cr0;
418+
419+ pax_open_kernel(cr0);
420+#endif
421+
422 for (a = start; a < end; a++) {
423- memcpy(a->instr,
424+ memcpy(a->instr + __KERNEL_TEXT_OFFSET,
425 a->replacement + a->replacementlen,
426 a->instrlen);
427 }
428+
429+#ifdef CONFIG_PAX_KERNEXEC
430+ pax_close_kernel(cr0);
431+#endif
432+
433 }
434
435 static void alternatives_smp_lock(u8 **start, u8 **end, u8 *text, u8 *text_end)
436 {
437- u8 **ptr;
438+ u8 *ptr;
439+
440+#ifdef CONFIG_PAX_KERNEXEC
441+ unsigned long cr0;
442
443- for (ptr = start; ptr < end; ptr++) {
444- if (*ptr < text)
445+ pax_open_kernel(cr0);
446+#endif
447+
448+ for (; start < end; start++) {
449+ ptr = *start + __KERNEL_TEXT_OFFSET;
450+ if (ptr < text)
451 continue;
452- if (*ptr > text_end)
453+ if (ptr > text_end)
454 continue;
455- **ptr = 0xf0; /* lock prefix */
456+ *ptr = 0xf0; /* lock prefix */
457 };
458+
459+#ifdef CONFIG_PAX_KERNEXEC
460+ pax_close_kernel(cr0);
461+#endif
462+
463 }
464
465 static void alternatives_smp_unlock(u8 **start, u8 **end, u8 *text, u8 *text_end)
466 {
467 unsigned char **noptable = find_nop_table();
468- u8 **ptr;
469+ u8 *ptr;
470+
471+#ifdef CONFIG_PAX_KERNEXEC
472+ unsigned long cr0;
473+
474+ pax_open_kernel(cr0);
475+#endif
476
477- for (ptr = start; ptr < end; ptr++) {
478- if (*ptr < text)
479+ for (; start < end; start++) {
480+ ptr = *start + __KERNEL_TEXT_OFFSET;
481+ if (ptr < text)
482 continue;
483- if (*ptr > text_end)
484+ if (ptr > text_end)
485 continue;
486- **ptr = noptable[1][0];
487+ *ptr = noptable[1][0];
488 };
489+
490+#ifdef CONFIG_PAX_KERNEXEC
491+ pax_close_kernel(cr0);
492+#endif
493+
494 }
495
496 struct smp_alt_module {
497diff -urNp linux-2.6.18/arch/i386/kernel/apic.c linux-2.6.18/arch/i386/kernel/apic.c
498--- linux-2.6.18/arch/i386/kernel/apic.c 2006-09-19 23:42:06.000000000 -0400
499+++ linux-2.6.18/arch/i386/kernel/apic.c 2006-09-22 20:45:03.000000000 -0400
500@@ -1187,7 +1187,7 @@ inline void smp_local_timer_interrupt(st
501 {
502 profile_tick(CPU_PROFILING, regs);
503 #ifdef CONFIG_SMP
504- update_process_times(user_mode_vm(regs));
505+ update_process_times(user_mode(regs));
506 #endif
507
508 /*
509diff -urNp linux-2.6.18/arch/i386/kernel/apm.c linux-2.6.18/arch/i386/kernel/apm.c
510--- linux-2.6.18/arch/i386/kernel/apm.c 2006-09-19 23:42:06.000000000 -0400
511+++ linux-2.6.18/arch/i386/kernel/apm.c 2006-09-22 20:45:03.000000000 -0400
512@@ -234,7 +234,7 @@
513 #include "io_ports.h"
514
515 extern unsigned long get_cmos_time(void);
516-extern void machine_real_restart(unsigned char *, int);
517+extern void machine_real_restart(const unsigned char *, unsigned int);
518
519 #if defined(CONFIG_APM_DISPLAY_BLANK) && defined(CONFIG_VT)
520 extern int (*console_blank_hook)(int);
521@@ -588,9 +588,18 @@ static u8 apm_bios_call(u32 func, u32 eb
522 struct desc_struct save_desc_40;
523 struct desc_struct *gdt;
524
525+#ifdef CONFIG_PAX_KERNEXEC
526+ unsigned long cr0;
527+#endif
528+
529 cpus = apm_save_cpus();
530
531 cpu = get_cpu();
532+
533+#ifdef CONFIG_PAX_KERNEXEC
534+ pax_open_kernel(cr0);
535+#endif
536+
537 gdt = get_cpu_gdt_table(cpu);
538 save_desc_40 = gdt[0x40 / 8];
539 gdt[0x40 / 8] = bad_bios_desc;
540@@ -602,6 +611,11 @@ static u8 apm_bios_call(u32 func, u32 eb
541 APM_DO_RESTORE_SEGS;
542 local_irq_restore(flags);
543 gdt[0x40 / 8] = save_desc_40;
544+
545+#ifdef CONFIG_PAX_KERNEXEC
546+ pax_close_kernel(cr0);
547+#endif
548+
549 put_cpu();
550 apm_restore_cpus(cpus);
551
552@@ -632,9 +646,18 @@ static u8 apm_bios_call_simple(u32 func,
553 struct desc_struct save_desc_40;
554 struct desc_struct *gdt;
555
556+#ifdef CONFIG_PAX_KERNEXEC
557+ unsigned long cr0;
558+#endif
559+
560 cpus = apm_save_cpus();
561
562 cpu = get_cpu();
563+
564+#ifdef CONFIG_PAX_KERNEXEC
565+ pax_open_kernel(cr0);
566+#endif
567+
568 gdt = get_cpu_gdt_table(cpu);
569 save_desc_40 = gdt[0x40 / 8];
570 gdt[0x40 / 8] = bad_bios_desc;
571@@ -646,6 +669,11 @@ static u8 apm_bios_call_simple(u32 func,
572 APM_DO_RESTORE_SEGS;
573 local_irq_restore(flags);
574 gdt[0x40 / 8] = save_desc_40;
575+
576+#ifdef CONFIG_PAX_KERNEXEC
577+ pax_close_kernel(cr0);
578+#endif
579+
580 put_cpu();
581 apm_restore_cpus(cpus);
582 return error;
583@@ -909,7 +937,7 @@ recalc:
584
585 static void apm_power_off(void)
586 {
587- unsigned char po_bios_call[] = {
588+ const unsigned char po_bios_call[] = {
589 0xb8, 0x00, 0x10, /* movw $0x1000,ax */
590 0x8e, 0xd0, /* movw ax,ss */
591 0xbc, 0x00, 0xf0, /* movw $0xf000,sp */
592diff -urNp linux-2.6.18/arch/i386/kernel/asm-offsets.c linux-2.6.18/arch/i386/kernel/asm-offsets.c
593--- linux-2.6.18/arch/i386/kernel/asm-offsets.c 2006-09-19 23:42:06.000000000 -0400
594+++ linux-2.6.18/arch/i386/kernel/asm-offsets.c 2006-09-22 20:45:03.000000000 -0400
595@@ -71,6 +71,7 @@ void foo(void)
596 sizeof(struct tss_struct));
597
598 DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
599+ DEFINE(PTRS_PER_PTE_asm, PTRS_PER_PTE);
600 DEFINE(VDSO_PRELINK, VDSO_PRELINK);
601
602 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
603diff -urNp linux-2.6.18/arch/i386/kernel/cpu/common.c linux-2.6.18/arch/i386/kernel/cpu/common.c
604--- linux-2.6.18/arch/i386/kernel/cpu/common.c 2006-09-19 23:42:06.000000000 -0400
605+++ linux-2.6.18/arch/i386/kernel/cpu/common.c 2006-09-22 20:45:03.000000000 -0400
606@@ -4,7 +4,6 @@
607 #include <linux/smp.h>
608 #include <linux/module.h>
609 #include <linux/percpu.h>
610-#include <linux/bootmem.h>
611 #include <asm/semaphore.h>
612 #include <asm/processor.h>
613 #include <asm/i387.h>
614@@ -21,16 +20,18 @@
615
616 #include "cpu.h"
617
618-DEFINE_PER_CPU(struct Xgt_desc_struct, cpu_gdt_descr);
619-EXPORT_PER_CPU_SYMBOL(cpu_gdt_descr);
620-
621 DEFINE_PER_CPU(unsigned char, cpu_16bit_stack[CPU_16BIT_STACK_SIZE]);
622 EXPORT_PER_CPU_SYMBOL(cpu_16bit_stack);
623
624 static int cachesize_override __cpuinitdata = -1;
625 static int disable_x86_fxsr __cpuinitdata;
626 static int disable_x86_serial_nr __cpuinitdata = 1;
627+
628+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC)
629+static int disable_x86_sep __cpuinitdata = 1;
630+#else
631 static int disable_x86_sep __cpuinitdata;
632+#endif
633
634 struct cpu_dev * cpu_devs[X86_VENDOR_NUM] = {};
635
636@@ -591,11 +592,10 @@ void __init early_cpu_init(void)
637 void __cpuinit cpu_init(void)
638 {
639 int cpu = smp_processor_id();
640- struct tss_struct * t = &per_cpu(init_tss, cpu);
641+ struct tss_struct * t = init_tss + cpu;
642 struct thread_struct *thread = &current->thread;
643- struct desc_struct *gdt;
644+ struct desc_struct *gdt = get_cpu_gdt_table(cpu);
645 __u32 stk16_off = (__u32)&per_cpu(cpu_16bit_stack, cpu);
646- struct Xgt_desc_struct *cpu_gdt_descr = &per_cpu(cpu_gdt_descr, cpu);
647
648 if (cpu_test_and_set(cpu, cpu_initialized)) {
649 printk(KERN_WARNING "CPU#%d already initialized!\n", cpu);
650@@ -612,36 +612,12 @@ void __cpuinit cpu_init(void)
651 set_in_cr4(X86_CR4_TSD);
652 }
653
654- /* The CPU hotplug case */
655- if (cpu_gdt_descr->address) {
656- gdt = (struct desc_struct *)cpu_gdt_descr->address;
657- memset(gdt, 0, PAGE_SIZE);
658- goto old_gdt;
659- }
660- /*
661- * This is a horrible hack to allocate the GDT. The problem
662- * is that cpu_init() is called really early for the boot CPU
663- * (and hence needs bootmem) but much later for the secondary
664- * CPUs, when bootmem will have gone away
665- */
666- if (NODE_DATA(0)->bdata->node_bootmem_map) {
667- gdt = (struct desc_struct *)alloc_bootmem_pages(PAGE_SIZE);
668- /* alloc_bootmem_pages panics on failure, so no check */
669- memset(gdt, 0, PAGE_SIZE);
670- } else {
671- gdt = (struct desc_struct *)get_zeroed_page(GFP_KERNEL);
672- if (unlikely(!gdt)) {
673- printk(KERN_CRIT "CPU%d failed to allocate GDT\n", cpu);
674- for (;;)
675- local_irq_enable();
676- }
677- }
678-old_gdt:
679 /*
680 * Initialize the per-CPU GDT with the boot GDT,
681 * and set up the GDT descriptor:
682 */
683- memcpy(gdt, cpu_gdt_table, GDT_SIZE);
684+ if (cpu)
685+ memcpy(gdt, cpu_gdt_table, GDT_SIZE);
686
687 /* Set up GDT entry for 16bit stack */
688 *(__u64 *)(&gdt[GDT_ENTRY_ESPFIX_SS]) |=
689@@ -649,10 +625,10 @@ old_gdt:
690 ((((__u64)stk16_off) << 32) & 0xff00000000000000ULL) |
691 (CPU_16BIT_STACK_SIZE - 1);
692
693- cpu_gdt_descr->size = GDT_SIZE - 1;
694- cpu_gdt_descr->address = (unsigned long)gdt;
695+ cpu_gdt_descr[cpu].size = GDT_SIZE - 1;
696+ cpu_gdt_descr[cpu].address = (unsigned long)gdt;
697
698- load_gdt(cpu_gdt_descr);
699+ load_gdt(&cpu_gdt_descr[cpu]);
700 load_idt(&idt_descr);
701
702 /*
703@@ -667,7 +643,7 @@ old_gdt:
704 load_esp0(t, thread);
705 set_tss_desc(cpu,t);
706 load_TR_desc();
707- load_LDT(&init_mm.context);
708+ _load_LDT(&init_mm.context);
709
710 #ifdef CONFIG_DOUBLEFAULT
711 /* Set up doublefault TSS pointer in the GDT */
712@@ -675,7 +651,7 @@ old_gdt:
713 #endif
714
715 /* Clear %fs and %gs. */
716- asm volatile ("xorl %eax, %eax; movl %eax, %fs; movl %eax, %gs");
717+ asm volatile ("movl %0, %%fs; movl %0, %%gs" : : "r"(0));
718
719 /* Clear all 6 debug registers: */
720 set_debugreg(0, 0);
721diff -urNp linux-2.6.18/arch/i386/kernel/crash.c linux-2.6.18/arch/i386/kernel/crash.c
722--- linux-2.6.18/arch/i386/kernel/crash.c 2006-09-19 23:42:06.000000000 -0400
723+++ linux-2.6.18/arch/i386/kernel/crash.c 2006-09-22 20:45:03.000000000 -0400
724@@ -105,7 +105,7 @@ static int crash_nmi_callback(struct pt_
725 return 1;
726 local_irq_disable();
727
728- if (!user_mode_vm(regs)) {
729+ if (!user_mode(regs)) {
730 crash_fixup_ss_esp(&fixed_regs, regs);
731 regs = &fixed_regs;
732 }
733diff -urNp linux-2.6.18/arch/i386/kernel/doublefault.c linux-2.6.18/arch/i386/kernel/doublefault.c
734--- linux-2.6.18/arch/i386/kernel/doublefault.c 2006-09-19 23:42:06.000000000 -0400
735+++ linux-2.6.18/arch/i386/kernel/doublefault.c 2006-09-22 20:45:03.000000000 -0400
736@@ -11,7 +11,7 @@
737
738 #define DOUBLEFAULT_STACKSIZE (1024)
739 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
740-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
741+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
742
743 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + 0x1000000)
744
745@@ -57,10 +57,10 @@ struct tss_struct doublefault_tss __cach
746 .eip = (unsigned long) doublefault_fn,
747 .eflags = X86_EFLAGS_SF | 0x2, /* 0x2 bit is always set */
748 .esp = STACK_START,
749- .es = __USER_DS,
750+ .es = __KERNEL_DS,
751 .cs = __KERNEL_CS,
752 .ss = __KERNEL_DS,
753- .ds = __USER_DS,
754+ .ds = __KERNEL_DS,
755
756 .__cr3 = __pa(swapper_pg_dir)
757 };
758diff -urNp linux-2.6.18/arch/i386/kernel/efi.c linux-2.6.18/arch/i386/kernel/efi.c
759--- linux-2.6.18/arch/i386/kernel/efi.c 2006-09-19 23:42:06.000000000 -0400
760+++ linux-2.6.18/arch/i386/kernel/efi.c 2006-09-22 20:45:03.000000000 -0400
761@@ -63,82 +63,43 @@ extern void * boot_ioremap(unsigned long
762
763 static unsigned long efi_rt_eflags;
764 static DEFINE_SPINLOCK(efi_rt_lock);
765-static pgd_t efi_bak_pg_dir_pointer[2];
766+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS] __attribute__ ((aligned (4096)));
767
768-static void efi_call_phys_prelog(void)
769+static void __init efi_call_phys_prelog(void)
770 {
771- unsigned long cr4;
772- unsigned long temp;
773- struct Xgt_desc_struct *cpu_gdt_descr;
774-
775 spin_lock(&efi_rt_lock);
776 local_irq_save(efi_rt_eflags);
777
778- cpu_gdt_descr = &per_cpu(cpu_gdt_descr, 0);
779-
780- /*
781- * If I don't have PSE, I should just duplicate two entries in page
782- * directory. If I have PSE, I just need to duplicate one entry in
783- * page directory.
784- */
785- cr4 = read_cr4();
786-
787- if (cr4 & X86_CR4_PSE) {
788- efi_bak_pg_dir_pointer[0].pgd =
789- swapper_pg_dir[pgd_index(0)].pgd;
790- swapper_pg_dir[0].pgd =
791- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
792- } else {
793- efi_bak_pg_dir_pointer[0].pgd =
794- swapper_pg_dir[pgd_index(0)].pgd;
795- efi_bak_pg_dir_pointer[1].pgd =
796- swapper_pg_dir[pgd_index(0x400000)].pgd;
797- swapper_pg_dir[pgd_index(0)].pgd =
798- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
799- temp = PAGE_OFFSET + 0x400000;
800- swapper_pg_dir[pgd_index(0x400000)].pgd =
801- swapper_pg_dir[pgd_index(temp)].pgd;
802- }
803+ clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
804+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + USER_PGD_PTRS,
805+ USER_PGD_PTRS >= KERNEL_PGD_PTRS ? KERNEL_PGD_PTRS : USER_PGD_PTRS);
806
807 /*
808 * After the lock is released, the original page table is restored.
809 */
810- local_flush_tlb();
811+ __flush_tlb_all();
812
813- cpu_gdt_descr->address = __pa(cpu_gdt_descr->address);
814- load_gdt(cpu_gdt_descr);
815+ cpu_gdt_descr[0].address = __pa(cpu_gdt_descr[0].address);
816+ load_gdt((struct Xgt_desc_struct *) __pa(&cpu_gdt_descr[0]));
817 }
818
819-static void efi_call_phys_epilog(void)
820+static void __init efi_call_phys_epilog(void)
821 {
822- unsigned long cr4;
823- struct Xgt_desc_struct *cpu_gdt_descr = &per_cpu(cpu_gdt_descr, 0);
824-
825- cpu_gdt_descr->address = (unsigned long)__va(cpu_gdt_descr->address);
826- load_gdt(cpu_gdt_descr);
827+ cpu_gdt_descr[0].address = (unsigned long) __va(cpu_gdt_descr[0].address);
828+ load_gdt(&cpu_gdt_descr[0]);
829
830- cr4 = read_cr4();
831-
832- if (cr4 & X86_CR4_PSE) {
833- swapper_pg_dir[pgd_index(0)].pgd =
834- efi_bak_pg_dir_pointer[0].pgd;
835- } else {
836- swapper_pg_dir[pgd_index(0)].pgd =
837- efi_bak_pg_dir_pointer[0].pgd;
838- swapper_pg_dir[pgd_index(0x400000)].pgd =
839- efi_bak_pg_dir_pointer[1].pgd;
840- }
841+ clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
842
843 /*
844 * After the lock is released, the original page table is restored.
845 */
846- local_flush_tlb();
847+ __flush_tlb_all();
848
849 local_irq_restore(efi_rt_eflags);
850 spin_unlock(&efi_rt_lock);
851 }
852
853-static efi_status_t
854+static efi_status_t __init
855 phys_efi_set_virtual_address_map(unsigned long memory_map_size,
856 unsigned long descriptor_size,
857 u32 descriptor_version,
858@@ -154,7 +115,7 @@ phys_efi_set_virtual_address_map(unsigne
859 return status;
860 }
861
862-static efi_status_t
863+static efi_status_t __init
864 phys_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
865 {
866 efi_status_t status;
867diff -urNp linux-2.6.18/arch/i386/kernel/efi_stub.S linux-2.6.18/arch/i386/kernel/efi_stub.S
868--- linux-2.6.18/arch/i386/kernel/efi_stub.S 2006-09-19 23:42:06.000000000 -0400
869+++ linux-2.6.18/arch/i386/kernel/efi_stub.S 2006-09-22 20:45:03.000000000 -0400
870@@ -6,6 +6,7 @@
871 */
872
873 #include <linux/linkage.h>
874+#include <linux/init.h>
875 #include <asm/page.h>
876 #include <asm/pgtable.h>
877
878@@ -21,7 +22,7 @@
879 * service functions will comply with gcc calling convention, too.
880 */
881
882-.text
883+__INIT
884 ENTRY(efi_call_phys)
885 /*
886 * 0. The function can only be called in Linux kernel. So CS has been
887@@ -37,9 +38,7 @@ ENTRY(efi_call_phys)
888 * The mapping of lower virtual memory has been created in prelog and
889 * epilog.
890 */
891- movl $1f, %edx
892- subl $__PAGE_OFFSET, %edx
893- jmp *%edx
894+ jmp 1f-__PAGE_OFFSET
895 1:
896
897 /*
898@@ -48,14 +47,8 @@ ENTRY(efi_call_phys)
899 * parameter 2, ..., param n. To make things easy, we save the return
900 * address of efi_call_phys in a global variable.
901 */
902- popl %edx
903- movl %edx, saved_return_addr
904- /* get the function pointer into ECX*/
905- popl %ecx
906- movl %ecx, efi_rt_function_ptr
907- movl $2f, %edx
908- subl $__PAGE_OFFSET, %edx
909- pushl %edx
910+ popl (saved_return_addr)
911+ popl (efi_rt_function_ptr)
912
913 /*
914 * 3. Clear PG bit in %CR0.
915@@ -74,9 +67,8 @@ ENTRY(efi_call_phys)
916 /*
917 * 5. Call the physical function.
918 */
919- jmp *%ecx
920+ call *(efi_rt_function_ptr-__PAGE_OFFSET)
921
922-2:
923 /*
924 * 6. After EFI runtime service returns, control will return to
925 * following instruction. We'd better readjust stack pointer first.
926@@ -86,37 +78,29 @@ ENTRY(efi_call_phys)
927 /*
928 * 7. Restore PG bit
929 */
930- movl %cr0, %edx
931- orl $0x80000000, %edx
932- movl %edx, %cr0
933- jmp 1f
934-1:
935 /*
936 * 8. Now restore the virtual mode from flat mode by
937 * adding EIP with PAGE_OFFSET.
938 */
939- movl $1f, %edx
940- jmp *%edx
941+ movl %cr0, %edx
942+ orl $0x80000000, %edx
943+ movl %edx, %cr0
944+ jmp 1f+__PAGE_OFFSET
945 1:
946
947 /*
948 * 9. Balance the stack. And because EAX contain the return value,
949 * we'd better not clobber it.
950 */
951- leal efi_rt_function_ptr, %edx
952- movl (%edx), %ecx
953- pushl %ecx
954+ pushl (efi_rt_function_ptr)
955
956 /*
957- * 10. Push the saved return address onto the stack and return.
958+ * 10. Return to the saved return address.
959 */
960- leal saved_return_addr, %edx
961- movl (%edx), %ecx
962- pushl %ecx
963- ret
964+ jmpl *(saved_return_addr)
965 .previous
966
967-.data
968+__INITDATA
969 saved_return_addr:
970 .long 0
971 efi_rt_function_ptr:
972diff -urNp linux-2.6.18/arch/i386/kernel/entry.S linux-2.6.18/arch/i386/kernel/entry.S
973--- linux-2.6.18/arch/i386/kernel/entry.S 2006-09-19 23:42:06.000000000 -0400
974+++ linux-2.6.18/arch/i386/kernel/entry.S 2006-09-22 20:45:03.000000000 -0400
975@@ -98,7 +98,7 @@ VM_MASK = 0x00020000
976 #define resume_userspace_sig resume_userspace
977 #endif
978
979-#define SAVE_ALL \
980+#define __SAVE_ALL(_DS) \
981 cld; \
982 pushl %es; \
983 CFI_ADJUST_CFA_OFFSET 4;\
984@@ -127,10 +127,24 @@ VM_MASK = 0x00020000
985 pushl %ebx; \
986 CFI_ADJUST_CFA_OFFSET 4;\
987 CFI_REL_OFFSET ebx, 0;\
988- movl $(__USER_DS), %edx; \
989+ movl $(_DS), %edx; \
990 movl %edx, %ds; \
991 movl %edx, %es;
992
993+#ifdef CONFIG_PAX_KERNEXEC
994+#define SAVE_ALL \
995+ __SAVE_ALL(__KERNEL_DS) \
996+ movl %cr0, %edx; \
997+ movl %edx, %esi; \
998+ orl $0x10000, %edx; \
999+ xorl %edx, %esi; \
1000+ movl %edx, %cr0;
1001+#elif defined(CONFIG_COMPAT_VDSO)
1002+#define SAVE_ALL __SAVE_ALL(__USER_DS)
1003+#else
1004+#define SAVE_ALL __SAVE_ALL(__KERNEL_DS)
1005+#endif
1006+
1007 #define RESTORE_INT_REGS \
1008 popl %ebx; \
1009 CFI_ADJUST_CFA_OFFSET -4;\
1010@@ -234,7 +248,19 @@ check_userspace:
1011 movl EFLAGS(%esp), %eax # mix EFLAGS and CS
1012 movb CS(%esp), %al
1013 testl $(VM_MASK | 3), %eax
1014+
1015+#ifdef CONFIG_PAX_KERNEXEC
1016+ jnz resume_userspace
1017+
1018+ movl %cr0, %edx
1019+ xorl %esi, %edx
1020+ movl %edx, %cr0
1021+ jmp resume_kernel
1022+#else
1023 jz resume_kernel
1024+#endif
1025+
1026+
1027 ENTRY(resume_userspace)
1028 cli # make sure we don't miss an interrupt
1029 # setting need_resched or sigpending
1030@@ -289,10 +315,9 @@ sysenter_past_esp:
1031 /*CFI_REL_OFFSET cs, 0*/
1032 /*
1033 * Push current_thread_info()->sysenter_return to the stack.
1034- * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
1035- * pushed above; +8 corresponds to copy_thread's esp0 setting.
1036 */
1037- pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
1038+ GET_THREAD_INFO(%ebp)
1039+ pushl TI_sysenter_return(%esp)
1040 CFI_ADJUST_CFA_OFFSET 4
1041 CFI_REL_OFFSET eip, 0
1042
1043@@ -300,9 +325,20 @@ sysenter_past_esp:
1044 * Load the potential sixth argument from user stack.
1045 * Careful about security.
1046 */
1047+ movl 12(%esp),%ebp
1048+
1049+#ifdef CONFIG_PAX_MEMORY_UDEREF
1050+ pushl $(__USER_DS)
1051+ CFI_ADJUST_CFA_OFFSET 4
1052+ pop %ds
1053+ CFI_ADJUST_CFA_OFFSET -4
1054+1: movl %ds:(%ebp),%ebp
1055+#else
1056 cmpl $__PAGE_OFFSET-3,%ebp
1057 jae syscall_fault
1058 1: movl (%ebp),%ebp
1059+#endif
1060+
1061 .section __ex_table,"a"
1062 .align 4
1063 .long 1b,syscall_fault
1064@@ -325,15 +361,37 @@ sysenter_past_esp:
1065 movl TI_flags(%ebp), %ecx
1066 testw $_TIF_ALLWORK_MASK, %cx
1067 jne syscall_exit_work
1068+
1069+#ifdef CONFIG_PAX_RANDKSTACK
1070+ pushl %eax
1071+ CFI_ADJUST_CFA_OFFSET 4
1072+ call pax_randomize_kstack
1073+ popl %eax
1074+ CFI_ADJUST_CFA_OFFSET -4
1075+#endif
1076+
1077 /* if something modifies registers it must also disable sysexit */
1078 movl EIP(%esp), %edx
1079 movl OLDESP(%esp), %ecx
1080+1: mov DS(%esp), %ds
1081+2: mov ES(%esp), %es
1082 xorl %ebp,%ebp
1083 TRACE_IRQS_ON
1084 sti
1085 sysexit
1086 CFI_ENDPROC
1087
1088+.section .fixup,"ax"
1089+3: movl $0,DS(%esp)
1090+ jmp 1b
1091+4: movl $0,ES(%esp)
1092+ jmp 2b
1093+.previous
1094+.section __ex_table,"a"
1095+ .align 4
1096+ .long 1b,3b
1097+ .long 2b,4b
1098+.previous
1099
1100 # system call handler stub
1101 ENTRY(system_call)
1102@@ -364,6 +422,10 @@ syscall_exit:
1103 testw $_TIF_ALLWORK_MASK, %cx # current->work
1104 jne syscall_exit_work
1105
1106+#ifdef CONFIG_PAX_RANDKSTACK
1107+ call pax_randomize_kstack
1108+#endif
1109+
1110 restore_all:
1111 movl EFLAGS(%esp), %eax # mix EFLAGS, SS and CS
1112 # Warning: OLDSS(%esp) contains the wrong/random values if we
1113@@ -542,7 +604,7 @@ syscall_badsys:
1114 * Build the entry stubs and pointer table with
1115 * some assembler magic.
1116 */
1117-.data
1118+.section .rodata,"a",@progbits
1119 ENTRY(interrupt)
1120 .text
1121
1122@@ -557,7 +619,7 @@ ENTRY(irq_entries_start)
1123 1: pushl $~(vector)
1124 CFI_ADJUST_CFA_OFFSET 4
1125 jmp common_interrupt
1126-.data
1127+.section .rodata,"a",@progbits
1128 .long 1b
1129 .text
1130 vector=vector+1
1131@@ -638,10 +700,19 @@ error_code:
1132 movl %eax, ORIG_EAX(%esp)
1133 movl %ecx, ES(%esp)
1134 /*CFI_REL_OFFSET es, ES*/
1135- movl $(__USER_DS), %ecx
1136+ movl $(__KERNEL_DS), %ecx
1137 movl %ecx, %ds
1138 movl %ecx, %es
1139 movl %esp,%eax # pt_regs pointer
1140+
1141+#ifdef CONFIG_PAX_KERNEXEC
1142+ movl %cr0, %ecx
1143+ movl %ecx, %esi
1144+ orl $0x10000, %ecx
1145+ xorl %ecx, %esi
1146+ movl %ecx, %cr0
1147+#endif
1148+
1149 call *%edi
1150 jmp ret_from_exception
1151 CFI_ENDPROC
1152@@ -760,6 +831,13 @@ nmi_stack_correct:
1153 xorl %edx,%edx # zero error code
1154 movl %esp,%eax # pt_regs pointer
1155 call do_nmi
1156+
1157+#ifdef CONFIG_PAX_KERNEXEC
1158+ movl %cr0, %edx
1159+ xorl %esi, %edx
1160+ movl %edx, %cr0
1161+#endif
1162+
1163 jmp restore_nocheck_notrace
1164 CFI_ENDPROC
1165
1166@@ -797,6 +875,13 @@ nmi_16bit_stack:
1167 CFI_ADJUST_CFA_OFFSET -20 # the frame has now moved
1168 xorl %edx,%edx # zero error code
1169 call do_nmi
1170+
1171+#ifdef CONFIG_PAX_KERNEXEC
1172+ movl %cr0, %edx
1173+ xorl %esi, %edx
1174+ movl %edx, %cr0
1175+#endif
1176+
1177 RESTORE_REGS
1178 lss 12+4(%esp), %esp # back to 16bit stack
1179 1: iret
1180@@ -932,8 +1017,8 @@ ENTRY(arch_unwind_init_running)
1181 movl %edi, EDI(%edx)
1182 movl %ebp, EBP(%edx)
1183 movl %ebx, EAX(%edx)
1184- movl $__USER_DS, DS(%edx)
1185- movl $__USER_DS, ES(%edx)
1186+ movl $__KERNEL_DS, DS(%edx)
1187+ movl $__KERNEL_DS, ES(%edx)
1188 movl %ebx, ORIG_EAX(%edx)
1189 movl %ecx, EIP(%edx)
1190 movl 12(%esp), %ecx
1191@@ -949,7 +1034,6 @@ ENTRY(arch_unwind_init_running)
1192 ENDPROC(arch_unwind_init_running)
1193 #endif
1194
1195-.section .rodata,"a"
1196 #include "syscall_table.S"
1197
1198 syscall_table_size=(.-sys_call_table)
1199diff -urNp linux-2.6.18/arch/i386/kernel/head.S linux-2.6.18/arch/i386/kernel/head.S
1200--- linux-2.6.18/arch/i386/kernel/head.S 2006-09-19 23:42:06.000000000 -0400
1201+++ linux-2.6.18/arch/i386/kernel/head.S 2006-09-22 20:45:03.000000000 -0400
1202@@ -45,6 +45,16 @@
1203 */
1204 #define INIT_MAP_BEYOND_END (128*1024)
1205
1206+#ifdef CONFIG_PAX_KERNEXEC
1207+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
1208+.fill 4096,1,0xcc
1209+#endif
1210+
1211+/*
1212+ * Real beginning of normal "text" segment
1213+ */
1214+ENTRY(stext)
1215+ENTRY(_stext)
1216
1217 /*
1218 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
1219@@ -66,6 +76,26 @@ ENTRY(startup_32)
1220 movl %eax,%fs
1221 movl %eax,%gs
1222
1223+#ifdef CONFIG_PAX_MEMORY_UDEREF
1224+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),%eax
1225+ movl %eax,(cpu_gdt_table - __PAGE_OFFSET + GDT_ENTRY_KERNEL_DS * 8 + 4)
1226+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),%eax
1227+ movl %eax,(cpu_gdt_table - __PAGE_OFFSET + GDT_ENTRY_DEFAULT_USER_DS * 8 + 4)
1228+#endif
1229+
1230+#ifdef CONFIG_PAX_KERNEXEC
1231+ movl $ __KERNEL_TEXT_OFFSET,%eax
1232+ movw %ax,(cpu_gdt_table - __PAGE_OFFSET + __KERNEL_CS + 2)
1233+ rorl $16,%eax
1234+ movb %al,(cpu_gdt_table - __PAGE_OFFSET + __KERNEL_CS + 4)
1235+ movb %ah,(cpu_gdt_table - __PAGE_OFFSET + __KERNEL_CS + 7)
1236+
1237+ movb %al,(boot_gdt_table - __PAGE_OFFSET + __BOOT_CS + 4)
1238+ movb %ah,(boot_gdt_table - __PAGE_OFFSET + __BOOT_CS + 7)
1239+ rorl $16,%eax
1240+ movw %ax,(boot_gdt_table - __PAGE_OFFSET + __BOOT_CS + 2)
1241+#endif
1242+
1243 /*
1244 * Clear BSS first so that there are no surprises...
1245 * No need to cld as DF is already clear from cld above...
1246@@ -113,24 +143,42 @@ ENTRY(startup_32)
1247 * Warning: don't use %esi or the stack in this code. However, %esp
1248 * can be used as a GPR if you really need it...
1249 */
1250-page_pde_offset = (__PAGE_OFFSET >> 20);
1251-
1252+#ifdef CONFIG_X86_PAE
1253+page_pde_offset = ((__PAGE_OFFSET >> 21) * (4096 / PTRS_PER_PTE_asm));
1254+#else
1255+page_pde_offset = ((__PAGE_OFFSET >> 22) * (4096 / PTRS_PER_PTE_asm));
1256+#endif
1257 movl $(pg0 - __PAGE_OFFSET), %edi
1258+#ifdef CONFIG_X86_PAE
1259+ movl $(swapper_pm_dir - __PAGE_OFFSET), %edx
1260+#else
1261 movl $(swapper_pg_dir - __PAGE_OFFSET), %edx
1262- movl $0x007, %eax /* 0x007 = PRESENT+RW+USER */
1263+#endif
1264+ movl $0x063, %eax /* 0x063 = DIRTY+ACCESSED+PRESENT+RW */
1265 10:
1266- leal 0x007(%edi),%ecx /* Create PDE entry */
1267+ leal 0x063(%edi),%ecx /* Create PDE entry */
1268 movl %ecx,(%edx) /* Store identity PDE entry */
1269 movl %ecx,page_pde_offset(%edx) /* Store kernel PDE entry */
1270+#ifdef CONFIG_X86_PAE
1271+ movl $0,4(%edx)
1272+ movl $0,page_pde_offset+4(%edx)
1273+ addl $8,%edx
1274+ movl $512, %ecx
1275+#else
1276 addl $4,%edx
1277 movl $1024, %ecx
1278+#endif
1279 11:
1280 stosl
1281+#ifdef CONFIG_X86_PAE
1282+ movl $0,(%edi)
1283+ addl $4,%edi
1284+#endif
1285 addl $0x1000,%eax
1286 loop 11b
1287 /* End condition: we must map up to and including INIT_MAP_BEYOND_END */
1288- /* bytes beyond the end of our own page tables; the +0x007 is the attribute bits */
1289- leal (INIT_MAP_BEYOND_END+0x007)(%edi),%ebp
1290+ /* bytes beyond the end of our own page tables; the +0x063 is the attribute bits */
1291+ leal (INIT_MAP_BEYOND_END+0x063)(%edi),%ebp
1292 cmpl %ebp,%eax
1293 jb 10b
1294 movl %edi,(init_pg_tables_end - __PAGE_OFFSET)
1295@@ -153,6 +201,11 @@ ENTRY(startup_32_smp)
1296 movl %eax,%fs
1297 movl %eax,%gs
1298
1299+ /* This is a secondary processor (AP) */
1300+ xorl %ebx,%ebx
1301+ incl %ebx
1302+#endif /* CONFIG_SMP */
1303+
1304 /*
1305 * New page tables may be in 4Mbyte page mode and may
1306 * be using the global pages.
1307@@ -168,26 +221,27 @@ ENTRY(startup_32_smp)
1308 * not yet offset PAGE_OFFSET..
1309 */
1310 #define cr4_bits mmu_cr4_features-__PAGE_OFFSET
1311+3:
1312 movl cr4_bits,%edx
1313 andl %edx,%edx
1314- jz 6f
1315+ jz 5f
1316 movl %cr4,%eax # Turn on paging options (PSE,PAE,..)
1317 orl %edx,%eax
1318 movl %eax,%cr4
1319
1320- btl $5, %eax # check if PAE is enabled
1321- jnc 6f
1322+#ifdef CONFIG_X86_PAE
1323+ movl %ebx,%edi
1324
1325 /* Check if extended functions are implemented */
1326 movl $0x80000000, %eax
1327 cpuid
1328 cmpl $0x80000000, %eax
1329- jbe 6f
1330+ jbe 4f
1331 mov $0x80000001, %eax
1332 cpuid
1333 /* Execute Disable bit supported? */
1334 btl $20, %edx
1335- jnc 6f
1336+ jnc 4f
1337
1338 /* Setup EFER (Extended Feature Enable Register) */
1339 movl $0xc0000080, %ecx
1340@@ -196,14 +250,12 @@ ENTRY(startup_32_smp)
1341 btsl $11, %eax
1342 /* Make changes effective */
1343 wrmsr
1344+ btsl $63,__supported_pte_mask-__PAGE_OFFSET
1345
1346-6:
1347- /* This is a secondary processor (AP) */
1348- xorl %ebx,%ebx
1349- incl %ebx
1350-
1351-3:
1352-#endif /* CONFIG_SMP */
1353+4:
1354+ movl %edi,%ebx
1355+#endif
1356+5:
1357
1358 /*
1359 * Enable paging
1360@@ -228,9 +280,7 @@ ENTRY(startup_32_smp)
1361
1362 #ifdef CONFIG_SMP
1363 andl %ebx,%ebx
1364- jz 1f /* Initial CPU cleans BSS */
1365- jmp checkCPUtype
1366-1:
1367+ jnz checkCPUtype /* Initial CPU cleans BSS */
1368 #endif /* CONFIG_SMP */
1369
1370 /*
1371@@ -307,8 +357,6 @@ is386: movl $2,%ecx # set MP
1372 ljmp $(__KERNEL_CS),$1f
1373 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
1374 movl %eax,%ss # after changing gdt.
1375-
1376- movl $(__USER_DS),%eax # DS/ES contains default USER segment
1377 movl %eax,%ds
1378 movl %eax,%es
1379
1380@@ -376,63 +424,71 @@ rp_sidt:
1381 /* This is the default interrupt "handler" :-) */
1382 ALIGN
1383 ignore_int:
1384- cld
1385 #ifdef CONFIG_PRINTK
1386- pushl %eax
1387- pushl %ecx
1388- pushl %edx
1389- pushl %es
1390- pushl %ds
1391+ cld
1392 movl $(__KERNEL_DS),%eax
1393 movl %eax,%ds
1394 movl %eax,%es
1395- pushl 16(%esp)
1396- pushl 24(%esp)
1397- pushl 32(%esp)
1398- pushl 40(%esp)
1399+ pushl 12(%esp)
1400+ pushl 12(%esp)
1401+ pushl 12(%esp)
1402+ pushl 12(%esp)
1403 pushl $int_msg
1404 #ifdef CONFIG_EARLY_PRINTK
1405 call early_printk
1406 #else
1407 call printk
1408 #endif
1409- addl $(5*4),%esp
1410- popl %ds
1411- popl %es
1412- popl %edx
1413- popl %ecx
1414- popl %eax
1415 #endif
1416- iret
1417+1: hlt
1418+ jmp 1b
1419
1420-/*
1421- * Real beginning of normal "text" segment
1422- */
1423-ENTRY(stext)
1424-ENTRY(_stext)
1425-
1426-/*
1427- * BSS section
1428- */
1429-.section ".bss.page_aligned","w"
1430+.section .swapper_pg_dir,"a",@progbits
1431 ENTRY(swapper_pg_dir)
1432+#ifdef CONFIG_X86_PAE
1433+ .long swapper_pm_dir-__PAGE_OFFSET+1
1434+ .long 0
1435+ .long swapper_pm_dir+512*8-__PAGE_OFFSET+1
1436+ .long 0
1437+ .long swapper_pm_dir+512*16-__PAGE_OFFSET+1
1438+ .long 0
1439+ .long swapper_pm_dir+512*24-__PAGE_OFFSET+1
1440+ .long 0
1441+#else
1442 .fill 1024,4,0
1443+#endif
1444+
1445+#ifdef CONFIG_X86_PAE
1446+.section .swapper_pm_dir,"a",@progbits
1447+ENTRY(swapper_pm_dir)
1448+ .fill 512,8,0
1449+ .fill 512,8,0
1450+ .fill 512,8,0
1451+ .fill 512,8,0
1452+#endif
1453+
1454+.section .empty_zero_page,"a",@progbits
1455 ENTRY(empty_zero_page)
1456 .fill 4096,1,0
1457
1458 /*
1459- * This starts the data section.
1460- */
1461-.data
1462+ * The IDT has to be page-aligned to simplify the Pentium
1463+ * F0 0F bug workaround.. We have a special link segment
1464+ * for this.
1465+ */
1466+.section .idt,"a",@progbits
1467+ENTRY(idt_table)
1468+ .fill 256,8,0
1469+
1470+.section .rodata,"a",@progbits
1471+ready: .byte 0
1472
1473 ENTRY(stack_start)
1474- .long init_thread_union+THREAD_SIZE
1475+ .long init_thread_union+THREAD_SIZE-8
1476 .long __BOOT_DS
1477
1478-ready: .byte 0
1479-
1480 int_msg:
1481- .asciz "Unknown interrupt or fault at EIP %p %p %p\n"
1482+ .asciz "Unknown interrupt, stack: %p %p %p %p\n"
1483
1484 /*
1485 * The IDT and GDT 'descriptors' are a strange 48-bit object
1486@@ -458,10 +514,12 @@ idt_descr:
1487
1488 # boot GDT descriptor (later on used by CPU#0):
1489 .word 0 # 32 bit align gdt_desc.address
1490-cpu_gdt_descr:
1491+ENTRY(cpu_gdt_descr)
1492 .word GDT_ENTRIES*8-1
1493 .long cpu_gdt_table
1494
1495+ .fill NR_CPUS*8-6,1,0 # space for the other GDT descriptors
1496+
1497 /*
1498 * The boot_gdt_table must mirror the equivalent in setup.S and is
1499 * used only for booting.
1500@@ -469,13 +527,13 @@ cpu_gdt_descr:
1501 .align L1_CACHE_BYTES
1502 ENTRY(boot_gdt_table)
1503 .fill GDT_ENTRY_BOOT_CS,8,0
1504- .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
1505- .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
1506+ .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
1507+ .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
1508
1509 /*
1510 * The Global Descriptor Table contains 28 quadwords, per-CPU.
1511 */
1512- .align L1_CACHE_BYTES
1513+ .align PAGE_SIZE_asm
1514 ENTRY(cpu_gdt_table)
1515 .quad 0x0000000000000000 /* NULL descriptor */
1516 .quad 0x0000000000000000 /* 0x0b reserved */
1517@@ -490,10 +548,10 @@ ENTRY(cpu_gdt_table)
1518 .quad 0x0000000000000000 /* 0x53 reserved */
1519 .quad 0x0000000000000000 /* 0x5b reserved */
1520
1521- .quad 0x00cf9a000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
1522- .quad 0x00cf92000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
1523- .quad 0x00cffa000000ffff /* 0x73 user 4GB code at 0x00000000 */
1524- .quad 0x00cff2000000ffff /* 0x7b user 4GB data at 0x00000000 */
1525+ .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
1526+ .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
1527+ .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
1528+ .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
1529
1530 .quad 0x0000000000000000 /* 0x80 TSS descriptor */
1531 .quad 0x0000000000000000 /* 0x88 LDT descriptor */
1532@@ -503,24 +561,30 @@ ENTRY(cpu_gdt_table)
1533 * They code segments and data segments have fixed 64k limits,
1534 * the transfer segment sizes are set at run time.
1535 */
1536- .quad 0x00409a000000ffff /* 0x90 32-bit code */
1537- .quad 0x00009a000000ffff /* 0x98 16-bit code */
1538- .quad 0x000092000000ffff /* 0xa0 16-bit data */
1539- .quad 0x0000920000000000 /* 0xa8 16-bit data */
1540- .quad 0x0000920000000000 /* 0xb0 16-bit data */
1541+ .quad 0x00409b000000ffff /* 0x90 32-bit code */
1542+ .quad 0x00009b000000ffff /* 0x98 16-bit code */
1543+ .quad 0x000093000000ffff /* 0xa0 16-bit data */
1544+ .quad 0x0000930000000000 /* 0xa8 16-bit data */
1545+ .quad 0x0000930000000000 /* 0xb0 16-bit data */
1546
1547 /*
1548 * The APM segments have byte granularity and their bases
1549 * are set at run time. All have 64k limits.
1550 */
1551- .quad 0x00409a000000ffff /* 0xb8 APM CS code */
1552- .quad 0x00009a000000ffff /* 0xc0 APM CS 16 code (16 bit) */
1553- .quad 0x004092000000ffff /* 0xc8 APM DS data */
1554+ .quad 0x00409b000000ffff /* 0xb8 APM CS code */
1555+ .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
1556+ .quad 0x004093000000ffff /* 0xc8 APM DS data */
1557
1558- .quad 0x0000920000000000 /* 0xd0 - ESPFIX 16-bit SS */
1559+ .quad 0x0000930000000000 /* 0xd0 - ESPFIX 16-bit SS */
1560 .quad 0x0000000000000000 /* 0xd8 - unused */
1561 .quad 0x0000000000000000 /* 0xe0 - unused */
1562 .quad 0x0000000000000000 /* 0xe8 - unused */
1563 .quad 0x0000000000000000 /* 0xf0 - unused */
1564 .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
1565
1566+ /* Be sure this is zeroed to avoid false validations in Xen */
1567+ .fill PAGE_SIZE_asm / 8 - GDT_ENTRIES,8,0
1568+
1569+#ifdef CONFIG_SMP
1570+ .fill (NR_CPUS-1) * (PAGE_SIZE_asm / 8),8,0 /* other CPU's GDT */
1571+#endif
1572diff -urNp linux-2.6.18/arch/i386/kernel/i386_ksyms.c linux-2.6.18/arch/i386/kernel/i386_ksyms.c
1573--- linux-2.6.18/arch/i386/kernel/i386_ksyms.c 2006-09-19 23:42:06.000000000 -0400
1574+++ linux-2.6.18/arch/i386/kernel/i386_ksyms.c 2006-09-22 20:45:03.000000000 -0400
1575@@ -2,12 +2,16 @@
1576 #include <asm/checksum.h>
1577 #include <asm/desc.h>
1578
1579+EXPORT_SYMBOL_GPL(cpu_gdt_table);
1580+
1581 EXPORT_SYMBOL(__down_failed);
1582 EXPORT_SYMBOL(__down_failed_interruptible);
1583 EXPORT_SYMBOL(__down_failed_trylock);
1584 EXPORT_SYMBOL(__up_wakeup);
1585 /* Networking helper routines. */
1586 EXPORT_SYMBOL(csum_partial_copy_generic);
1587+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
1588+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
1589
1590 EXPORT_SYMBOL(__get_user_1);
1591 EXPORT_SYMBOL(__get_user_2);
1592diff -urNp linux-2.6.18/arch/i386/kernel/init_task.c linux-2.6.18/arch/i386/kernel/init_task.c
1593--- linux-2.6.18/arch/i386/kernel/init_task.c 2006-09-19 23:42:06.000000000 -0400
1594+++ linux-2.6.18/arch/i386/kernel/init_task.c 2006-09-22 20:45:03.000000000 -0400
1595@@ -42,5 +42,5 @@ EXPORT_SYMBOL(init_task);
1596 * per-CPU TSS segments. Threads are completely 'soft' on Linux,
1597 * no more per-task TSS's.
1598 */
1599-DEFINE_PER_CPU(struct tss_struct, init_tss) ____cacheline_internodealigned_in_smp = INIT_TSS;
1600+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
1601
1602diff -urNp linux-2.6.18/arch/i386/kernel/io_apic.c linux-2.6.18/arch/i386/kernel/io_apic.c
1603--- linux-2.6.18/arch/i386/kernel/io_apic.c 2006-09-19 23:42:06.000000000 -0400
1604+++ linux-2.6.18/arch/i386/kernel/io_apic.c 2006-09-22 20:45:03.000000000 -0400
1605@@ -272,8 +272,8 @@ static void set_ioapic_affinity_irq(unsi
1606 # define TDprintk(x...) do { printk("<%ld:%s:%d>: ", jiffies, __FILE__, __LINE__); printk(x); } while (0)
1607 # define Dprintk(x...) do { TDprintk(x); } while (0)
1608 # else
1609-# define TDprintk(x...)
1610-# define Dprintk(x...)
1611+# define TDprintk(x...) do {} while (0)
1612+# define Dprintk(x...) do {} while (0)
1613 # endif
1614
1615 #define IRQBALANCE_CHECK_ARCH -999
1616diff -urNp linux-2.6.18/arch/i386/kernel/ioport.c linux-2.6.18/arch/i386/kernel/ioport.c
1617--- linux-2.6.18/arch/i386/kernel/ioport.c 2006-09-19 23:42:06.000000000 -0400
1618+++ linux-2.6.18/arch/i386/kernel/ioport.c 2006-09-22 20:45:03.000000000 -0400
1619@@ -16,6 +16,7 @@
1620 #include <linux/stddef.h>
1621 #include <linux/slab.h>
1622 #include <linux/thread_info.h>
1623+#include <linux/grsecurity.h>
1624
1625 /* Set EXTENT bits starting at BASE in BITMAP to value TURN_ON. */
1626 static void set_bitmap(unsigned long *bitmap, unsigned int base, unsigned int extent, int new_value)
1627@@ -64,9 +65,16 @@ asmlinkage long sys_ioperm(unsigned long
1628
1629 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
1630 return -EINVAL;
1631+#ifdef CONFIG_GRKERNSEC_IO
1632+ if (turn_on) {
1633+ gr_handle_ioperm();
1634+#else
1635 if (turn_on && !capable(CAP_SYS_RAWIO))
1636+#endif
1637 return -EPERM;
1638-
1639+#ifdef CONFIG_GRKERNSEC_IO
1640+ }
1641+#endif
1642 /*
1643 * If it's the first ioperm() call in this thread's lifetime, set the
1644 * IO bitmap up. ioperm() is much less timing critical than clone(),
1645@@ -89,7 +97,7 @@ asmlinkage long sys_ioperm(unsigned long
1646 * because the ->io_bitmap_max value must match the bitmap
1647 * contents:
1648 */
1649- tss = &per_cpu(init_tss, get_cpu());
1650+ tss = init_tss + get_cpu();
1651
1652 set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
1653
1654@@ -143,8 +151,13 @@ asmlinkage long sys_iopl(unsigned long u
1655 return -EINVAL;
1656 /* Trying to gain more privileges? */
1657 if (level > old) {
1658+#ifdef CONFIG_GRKERNSEC_IO
1659+ gr_handle_iopl();
1660+ return -EPERM;
1661+#else
1662 if (!capable(CAP_SYS_RAWIO))
1663 return -EPERM;
1664+#endif
1665 }
1666 t->iopl = level << 12;
1667 regs->eflags = (regs->eflags & ~X86_EFLAGS_IOPL) | t->iopl;
1668diff -urNp linux-2.6.18/arch/i386/kernel/irq.c linux-2.6.18/arch/i386/kernel/irq.c
1669--- linux-2.6.18/arch/i386/kernel/irq.c 2006-09-19 23:42:06.000000000 -0400
1670+++ linux-2.6.18/arch/i386/kernel/irq.c 2006-09-22 20:45:03.000000000 -0400
1671@@ -97,7 +97,7 @@ fastcall unsigned int do_IRQ(struct pt_r
1672 int arg1, arg2, ebx;
1673
1674 /* build the stack frame on the IRQ stack */
1675- isp = (u32*) ((char*)irqctx + sizeof(*irqctx));
1676+ isp = (u32*) ((char*)irqctx + sizeof(*irqctx)) - 2;
1677 irqctx->tinfo.task = curctx->tinfo.task;
1678 irqctx->tinfo.previous_esp = current_stack_pointer;
1679
1680@@ -133,10 +133,10 @@ fastcall unsigned int do_IRQ(struct pt_r
1681 * gcc's 3.0 and earlier don't handle that correctly.
1682 */
1683 static char softirq_stack[NR_CPUS * THREAD_SIZE]
1684- __attribute__((__aligned__(THREAD_SIZE)));
1685+ __attribute__((__aligned__(THREAD_SIZE), __section__(".bss.page_aligned")));
1686
1687 static char hardirq_stack[NR_CPUS * THREAD_SIZE]
1688- __attribute__((__aligned__(THREAD_SIZE)));
1689+ __attribute__((__aligned__(THREAD_SIZE), __section__(".bss.page_aligned")));
1690
1691 /*
1692 * allocate per-cpu stacks for hardirq and for softirq processing
1693@@ -196,7 +196,7 @@ asmlinkage void do_softirq(void)
1694 irqctx->tinfo.previous_esp = current_stack_pointer;
1695
1696 /* build the stack frame on the softirq stack */
1697- isp = (u32*) ((char*)irqctx + sizeof(*irqctx));
1698+ isp = (u32*) ((char*)irqctx + sizeof(*irqctx)) - 2;
1699
1700 asm volatile(
1701 " xchgl %%ebx,%%esp \n"
1702diff -urNp linux-2.6.18/arch/i386/kernel/kprobes.c linux-2.6.18/arch/i386/kernel/kprobes.c
1703--- linux-2.6.18/arch/i386/kernel/kprobes.c 2006-09-19 23:42:06.000000000 -0400
1704+++ linux-2.6.18/arch/i386/kernel/kprobes.c 2006-09-22 20:45:03.000000000 -0400
1705@@ -648,7 +648,7 @@ int __kprobes kprobe_exceptions_notify(s
1706 struct die_args *args = (struct die_args *)data;
1707 int ret = NOTIFY_DONE;
1708
1709- if (args->regs && user_mode_vm(args->regs))
1710+ if (args->regs && user_mode(args->regs))
1711 return ret;
1712
1713 switch (val) {
1714diff -urNp linux-2.6.18/arch/i386/kernel/ldt.c linux-2.6.18/arch/i386/kernel/ldt.c
1715--- linux-2.6.18/arch/i386/kernel/ldt.c 2006-09-19 23:42:06.000000000 -0400
1716+++ linux-2.6.18/arch/i386/kernel/ldt.c 2006-09-22 20:45:03.000000000 -0400
1717@@ -103,6 +103,19 @@ int init_new_context(struct task_struct
1718 retval = copy_ldt(&mm->context, &old_mm->context);
1719 up(&old_mm->context.sem);
1720 }
1721+
1722+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
1723+ if (!mm->context.user_cs_limit) {
1724+ mm->context.user_cs_base = 0UL;
1725+ mm->context.user_cs_limit = ~0UL;
1726+
1727+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
1728+ cpus_clear(mm->context.cpu_user_cs_mask);
1729+#endif
1730+
1731+ }
1732+#endif
1733+
1734 return retval;
1735 }
1736
1737@@ -160,7 +173,7 @@ static int read_default_ldt(void __user
1738 {
1739 int err;
1740 unsigned long size;
1741- void *address;
1742+ const void *address;
1743
1744 err = 0;
1745 address = &default_ldt[0];
1746@@ -215,6 +228,13 @@ static int write_ldt(void __user * ptr,
1747 }
1748 }
1749
1750+#ifdef CONFIG_PAX_SEGMEXEC
1751+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
1752+ error = -EINVAL;
1753+ goto out_unlock;
1754+ }
1755+#endif
1756+
1757 entry_1 = LDT_entry_a(&ldt_info);
1758 entry_2 = LDT_entry_b(&ldt_info);
1759 if (oldmode)
1760diff -urNp linux-2.6.18/arch/i386/kernel/module.c linux-2.6.18/arch/i386/kernel/module.c
1761--- linux-2.6.18/arch/i386/kernel/module.c 2006-09-19 23:42:06.000000000 -0400
1762+++ linux-2.6.18/arch/i386/kernel/module.c 2006-09-22 20:45:03.000000000 -0400
1763@@ -21,6 +21,7 @@
1764 #include <linux/fs.h>
1765 #include <linux/string.h>
1766 #include <linux/kernel.h>
1767+#include <asm/desc.h>
1768
1769 #if 0
1770 #define DEBUGP printk
1771@@ -32,9 +33,30 @@ void *module_alloc(unsigned long size)
1772 {
1773 if (size == 0)
1774 return NULL;
1775+
1776+#ifdef CONFIG_PAX_KERNEXEC
1777+ return vmalloc(size);
1778+#else
1779 return vmalloc_exec(size);
1780+#endif
1781+
1782 }
1783
1784+#ifdef CONFIG_PAX_KERNEXEC
1785+void *module_alloc_exec(unsigned long size)
1786+{
1787+ struct vm_struct *area;
1788+
1789+ if (size == 0)
1790+ return NULL;
1791+
1792+ area = __get_vm_area(size, 0, (unsigned long)&MODULES_VADDR, (unsigned long)&MODULES_END);
1793+ if (area)
1794+ return area->addr;
1795+
1796+ return NULL;
1797+}
1798+#endif
1799
1800 /* Free memory returned from module_alloc */
1801 void module_free(struct module *mod, void *module_region)
1802@@ -44,6 +66,45 @@ void module_free(struct module *mod, voi
1803 table entries. */
1804 }
1805
1806+#ifdef CONFIG_PAX_KERNEXEC
1807+void module_free_exec(struct module *mod, void *module_region)
1808+{
1809+ struct vm_struct **p, *tmp;
1810+
1811+ if (!module_region)
1812+ return;
1813+
1814+ if ((PAGE_SIZE-1) & (unsigned long)module_region) {
1815+ printk(KERN_ERR "Trying to module_free_exec() bad address (%p)\n", module_region);
1816+ WARN_ON(1);
1817+ return;
1818+ }
1819+
1820+ write_lock(&vmlist_lock);
1821+ for (p = &vmlist ; (tmp = *p) != NULL ;p = &tmp->next)
1822+ if (tmp->addr == module_region)
1823+ break;
1824+
1825+ if (tmp) {
1826+ unsigned long cr0;
1827+
1828+ pax_open_kernel(cr0);
1829+ memset(tmp->addr, 0xCC, tmp->size);
1830+ pax_close_kernel(cr0);
1831+
1832+ *p = tmp->next;
1833+ kfree(tmp);
1834+ }
1835+ write_unlock(&vmlist_lock);
1836+
1837+ if (!tmp) {
1838+ printk(KERN_ERR "Trying to module_free_exec() nonexistent vm area (%p)\n",
1839+ module_region);
1840+ WARN_ON(1);
1841+ }
1842+}
1843+#endif
1844+
1845 /* We don't need anything special. */
1846 int module_frob_arch_sections(Elf_Ehdr *hdr,
1847 Elf_Shdr *sechdrs,
1848@@ -62,14 +123,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
1849 unsigned int i;
1850 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
1851 Elf32_Sym *sym;
1852- uint32_t *location;
1853+ uint32_t *plocation, location;
1854
1855 DEBUGP("Applying relocate section %u to %u\n", relsec,
1856 sechdrs[relsec].sh_info);
1857 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
1858 /* This is where to make the change */
1859- location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
1860- + rel[i].r_offset;
1861+ plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
1862+ location = (uint32_t)plocation;
1863+ if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
1864+ plocation = (void *)plocation + __KERNEL_TEXT_OFFSET;
1865 /* This is the symbol it is referring to. Note that all
1866 undefined symbols have been resolved. */
1867 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
1868@@ -78,11 +141,11 @@ int apply_relocate(Elf32_Shdr *sechdrs,
1869 switch (ELF32_R_TYPE(rel[i].r_info)) {
1870 case R_386_32:
1871 /* We add the value into the location given */
1872- *location += sym->st_value;
1873+ *plocation += sym->st_value;
1874 break;
1875 case R_386_PC32:
1876 /* Add the value, subtract its postition */
1877- *location += sym->st_value - (uint32_t)location;
1878+ *plocation += sym->st_value - location;
1879 break;
1880 default:
1881 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
1882diff -urNp linux-2.6.18/arch/i386/kernel/process.c linux-2.6.18/arch/i386/kernel/process.c
1883--- linux-2.6.18/arch/i386/kernel/process.c 2006-09-19 23:42:06.000000000 -0400
1884+++ linux-2.6.18/arch/i386/kernel/process.c 2006-09-22 20:45:03.000000000 -0400
1885@@ -68,7 +68,7 @@ EXPORT_SYMBOL(boot_option_idle_override)
1886 */
1887 unsigned long thread_saved_pc(struct task_struct *tsk)
1888 {
1889- return ((unsigned long *)tsk->thread.esp)[3];
1890+ return tsk->thread.eip;
1891 }
1892
1893 /*
1894@@ -293,7 +293,7 @@ void show_regs(struct pt_regs * regs)
1895 printk("EIP: %04x:[<%08lx>] CPU: %d\n",0xffff & regs->xcs,regs->eip, smp_processor_id());
1896 print_symbol("EIP is at %s\n", regs->eip);
1897
1898- if (user_mode_vm(regs))
1899+ if (user_mode(regs))
1900 printk(" ESP: %04x:%08lx",0xffff & regs->xss,regs->esp);
1901 printk(" EFLAGS: %08lx %s (%s %.*s)\n",
1902 regs->eflags, print_tainted(), system_utsname.release,
1903@@ -342,8 +342,8 @@ int kernel_thread(int (*fn)(void *), voi
1904 regs.ebx = (unsigned long) fn;
1905 regs.edx = (unsigned long) arg;
1906
1907- regs.xds = __USER_DS;
1908- regs.xes = __USER_DS;
1909+ regs.xds = __KERNEL_DS;
1910+ regs.xes = __KERNEL_DS;
1911 regs.orig_eax = -1;
1912 regs.eip = (unsigned long) kernel_thread_helper;
1913 regs.xcs = __KERNEL_CS;
1914@@ -364,7 +364,7 @@ void exit_thread(void)
1915 struct task_struct *tsk = current;
1916 struct thread_struct *t = &tsk->thread;
1917 int cpu = get_cpu();
1918- struct tss_struct *tss = &per_cpu(init_tss, cpu);
1919+ struct tss_struct *tss = init_tss + cpu;
1920
1921 kfree(t->io_bitmap_ptr);
1922 t->io_bitmap_ptr = NULL;
1923@@ -385,6 +385,9 @@ void flush_thread(void)
1924 {
1925 struct task_struct *tsk = current;
1926
1927+ __asm__("mov %0,%%fs\n"
1928+ "mov %0,%%gs\n"
1929+ : : "r" (0) : "memory");
1930 memset(tsk->thread.debugreg, 0, sizeof(unsigned long)*8);
1931 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
1932 clear_tsk_thread_flag(tsk, TIF_DEBUG);
1933@@ -418,7 +421,7 @@ int copy_thread(int nr, unsigned long cl
1934 struct task_struct *tsk;
1935 int err;
1936
1937- childregs = task_pt_regs(p);
1938+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
1939 *childregs = *regs;
1940 childregs->eax = 0;
1941 childregs->esp = esp;
1942@@ -462,6 +465,11 @@ int copy_thread(int nr, unsigned long cl
1943 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
1944 goto out;
1945
1946+#ifdef CONFIG_PAX_SEGMEXEC
1947+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
1948+ goto out;
1949+#endif
1950+
1951 desc = p->thread.tls_array + idx - GDT_ENTRY_TLS_MIN;
1952 desc->a = LDT_entry_a(&info);
1953 desc->b = LDT_entry_b(&info);
1954@@ -641,7 +649,11 @@ struct task_struct fastcall * __switch_t
1955 struct thread_struct *prev = &prev_p->thread,
1956 *next = &next_p->thread;
1957 int cpu = smp_processor_id();
1958- struct tss_struct *tss = &per_cpu(init_tss, cpu);
1959+ struct tss_struct *tss = init_tss + cpu;
1960+
1961+#ifdef CONFIG_PAX_KERNEXEC
1962+ unsigned long cr0;
1963+#endif
1964
1965 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
1966
1967@@ -664,11 +676,23 @@ struct task_struct fastcall * __switch_t
1968 savesegment(fs, prev->fs);
1969 savesegment(gs, prev->gs);
1970
1971+#ifdef CONFIG_PAX_KERNEXEC
1972+ pax_open_kernel(cr0);
1973+#endif
1974+
1975+#ifdef CONFIG_PAX_MEMORY_UDEREF
1976+ __set_fs(get_fs(), cpu);
1977+#endif
1978+
1979 /*
1980 * Load the per-thread Thread-Local Storage descriptor.
1981 */
1982 load_TLS(next, cpu);
1983
1984+#ifdef CONFIG_PAX_KERNEXEC
1985+ pax_close_kernel(cr0);
1986+#endif
1987+
1988 /*
1989 * Restore %fs and %gs if needed.
1990 *
1991@@ -813,8 +837,18 @@ asmlinkage int sys_set_thread_area(struc
1992 struct desc_struct *desc;
1993 int cpu, idx;
1994
1995+#ifdef CONFIG_PAX_KERNEXEC
1996+ unsigned long cr0;
1997+#endif
1998+
1999 if (copy_from_user(&info, u_info, sizeof(info)))
2000 return -EFAULT;
2001+
2002+#ifdef CONFIG_PAX_SEGMEXEC
2003+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
2004+ return -EINVAL;
2005+#endif
2006+
2007 idx = info.entry_number;
2008
2009 /*
2010@@ -846,8 +880,17 @@ asmlinkage int sys_set_thread_area(struc
2011 desc->a = LDT_entry_a(&info);
2012 desc->b = LDT_entry_b(&info);
2013 }
2014+
2015+#ifdef CONFIG_PAX_KERNEXEC
2016+ pax_open_kernel(cr0);
2017+#endif
2018+
2019 load_TLS(t, cpu);
2020
2021+#ifdef CONFIG_PAX_KERNEXEC
2022+ pax_close_kernel(cr0);
2023+#endif
2024+
2025 put_cpu();
2026
2027 return 0;
2028@@ -903,9 +946,27 @@ asmlinkage int sys_get_thread_area(struc
2029 return 0;
2030 }
2031
2032-unsigned long arch_align_stack(unsigned long sp)
2033+#ifdef CONFIG_PAX_RANDKSTACK
2034+asmlinkage void pax_randomize_kstack(void)
2035 {
2036- if (randomize_va_space)
2037- sp -= get_random_int() % 8192;
2038- return sp & ~0xf;
2039+ struct tss_struct *tss = init_tss + smp_processor_id();
2040+ unsigned long time;
2041+
2042+ if (!randomize_va_space)
2043+ return;
2044+
2045+ rdtscl(time);
2046+
2047+ /* P4 seems to return a 0 LSB, ignore it */
2048+#ifdef CONFIG_MPENTIUM4
2049+ time &= 0x1EUL;
2050+ time <<= 2;
2051+#else
2052+ time &= 0xFUL;
2053+ time <<= 3;
2054+#endif
2055+
2056+ tss->esp0 ^= time;
2057+ current->thread.esp0 = tss->esp0;
2058 }
2059+#endif
2060diff -urNp linux-2.6.18/arch/i386/kernel/ptrace.c linux-2.6.18/arch/i386/kernel/ptrace.c
2061--- linux-2.6.18/arch/i386/kernel/ptrace.c 2006-09-19 23:42:06.000000000 -0400
2062+++ linux-2.6.18/arch/i386/kernel/ptrace.c 2006-09-22 20:45:03.000000000 -0400
2063@@ -17,6 +17,7 @@
2064 #include <linux/audit.h>
2065 #include <linux/seccomp.h>
2066 #include <linux/signal.h>
2067+#include <linux/grsecurity.h>
2068
2069 #include <asm/uaccess.h>
2070 #include <asm/pgtable.h>
2071@@ -342,6 +343,11 @@ ptrace_set_thread_area(struct task_struc
2072 if (copy_from_user(&info, user_desc, sizeof(info)))
2073 return -EFAULT;
2074
2075+#ifdef CONFIG_PAX_SEGMEXEC
2076+ if ((child->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
2077+ return -EINVAL;
2078+#endif
2079+
2080 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
2081 return -EINVAL;
2082
2083@@ -432,6 +438,17 @@ long arch_ptrace(struct task_struct *chi
2084 if(addr == (long) &dummy->u_debugreg[5]) break;
2085 if(addr < (long) &dummy->u_debugreg[4] &&
2086 ((unsigned long) data) >= TASK_SIZE-3) break;
2087+
2088+#ifdef CONFIG_GRKERNSEC
2089+ if(addr >= (long) &dummy->u_debugreg[0] &&
2090+ addr <= (long) &dummy->u_debugreg[3]){
2091+ long reg = (addr - (long) &dummy->u_debugreg[0]) >> 2;
2092+ long type = (child->thread.debugreg[7] >> (DR_CONTROL_SHIFT + 4*reg)) & 3;
2093+ long align = (child->thread.debugreg[7] >> (DR_CONTROL_SHIFT + 2 + 4*reg)) & 3;
2094+ if((type & 1) && (data & align))
2095+ break;
2096+ }
2097+#endif
2098
2099 /* Sanity-check data. Take one half-byte at once with
2100 * check = (val >> (16 + 4*i)) & 0xf. It contains the
2101@@ -648,7 +665,7 @@ void send_sigtrap(struct task_struct *ts
2102 info.si_code = TRAP_BRKPT;
2103
2104 /* User-mode eip? */
2105- info.si_addr = user_mode_vm(regs) ? (void __user *) regs->eip : NULL;
2106+ info.si_addr = user_mode(regs) ? (void __user *) regs->eip : NULL;
2107
2108 /* Send us the fakey SIGTRAP */
2109 force_sig_info(SIGTRAP, &info, tsk);
2110diff -urNp linux-2.6.18/arch/i386/kernel/reboot.c linux-2.6.18/arch/i386/kernel/reboot.c
2111--- linux-2.6.18/arch/i386/kernel/reboot.c 2006-09-19 23:42:06.000000000 -0400
2112+++ linux-2.6.18/arch/i386/kernel/reboot.c 2006-09-22 20:45:03.000000000 -0400
2113@@ -24,7 +24,7 @@
2114 void (*pm_power_off)(void);
2115 EXPORT_SYMBOL(pm_power_off);
2116
2117-static int reboot_mode;
2118+static unsigned short reboot_mode;
2119 static int reboot_thru_bios;
2120
2121 #ifdef CONFIG_SMP
2122@@ -137,18 +137,18 @@ core_initcall(reboot_init);
2123 doesn't work with at least one type of 486 motherboard. It is easy
2124 to stop this code working; hence the copious comments. */
2125
2126-static unsigned long long
2127+static const unsigned long long
2128 real_mode_gdt_entries [3] =
2129 {
2130 0x0000000000000000ULL, /* Null descriptor */
2131- 0x00009a000000ffffULL, /* 16-bit real-mode 64k code at 0x00000000 */
2132- 0x000092000100ffffULL /* 16-bit real-mode 64k data at 0x00000100 */
2133+ 0x00009b000000ffffULL, /* 16-bit real-mode 64k code at 0x00000000 */
2134+ 0x000093000100ffffULL /* 16-bit real-mode 64k data at 0x00000100 */
2135 };
2136
2137 static struct
2138 {
2139 unsigned short size __attribute__ ((packed));
2140- unsigned long long * base __attribute__ ((packed));
2141+ const unsigned long long * base __attribute__ ((packed));
2142 }
2143 real_mode_gdt = { sizeof (real_mode_gdt_entries) - 1, real_mode_gdt_entries },
2144 real_mode_idt = { 0x3ff, NULL },
2145@@ -174,7 +174,7 @@ no_idt = { 0, NULL };
2146 More could be done here to set up the registers as if a CPU reset had
2147 occurred; hopefully real BIOSs don't assume much. */
2148
2149-static unsigned char real_mode_switch [] =
2150+static const unsigned char real_mode_switch [] =
2151 {
2152 0x66, 0x0f, 0x20, 0xc0, /* movl %cr0,%eax */
2153 0x66, 0x83, 0xe0, 0x11, /* andl $0x00000011,%eax */
2154@@ -188,7 +188,7 @@ static unsigned char real_mode_switch []
2155 0x24, 0x10, /* f: andb $0x10,al */
2156 0x66, 0x0f, 0x22, 0xc0 /* movl %eax,%cr0 */
2157 };
2158-static unsigned char jump_to_bios [] =
2159+static const unsigned char jump_to_bios [] =
2160 {
2161 0xea, 0x00, 0x00, 0xff, 0xff /* ljmp $0xffff,$0x0000 */
2162 };
2163@@ -198,10 +198,14 @@ static unsigned char jump_to_bios [] =
2164 * specified by the code and length parameters.
2165 * We assume that length will aways be less that 100!
2166 */
2167-void machine_real_restart(unsigned char *code, int length)
2168+void machine_real_restart(const unsigned char *code, unsigned int length)
2169 {
2170 unsigned long flags;
2171
2172+#ifdef CONFIG_PAX_KERNEXEC
2173+ unsigned long cr0;
2174+#endif
2175+
2176 local_irq_disable();
2177
2178 /* Write zero to CMOS register number 0x0f, which the BIOS POST
2179@@ -222,8 +226,16 @@ void machine_real_restart(unsigned char
2180 from the kernel segment. This assumes the kernel segment starts at
2181 virtual address PAGE_OFFSET. */
2182
2183- memcpy (swapper_pg_dir, swapper_pg_dir + USER_PGD_PTRS,
2184- sizeof (swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
2185+#ifdef CONFIG_PAX_KERNEXEC
2186+ pax_open_kernel(cr0);
2187+#endif
2188+
2189+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + USER_PGD_PTRS,
2190+ USER_PGD_PTRS >= KERNEL_PGD_PTRS ? KERNEL_PGD_PTRS : USER_PGD_PTRS);
2191+
2192+#ifdef CONFIG_PAX_KERNEXEC
2193+ pax_close_kernel(cr0);
2194+#endif
2195
2196 /*
2197 * Use `swapper_pg_dir' as our page directory.
2198@@ -236,7 +248,7 @@ void machine_real_restart(unsigned char
2199 REBOOT.COM programs, and the previous reset routine did this
2200 too. */
2201
2202- *((unsigned short *)0x472) = reboot_mode;
2203+ __put_user(reboot_mode, (unsigned short __user *)0x472);
2204
2205 /* For the switch to real mode, copy some code to low memory. It has
2206 to be in the first 64k because it is running in 16-bit mode, and it
2207@@ -244,9 +256,9 @@ void machine_real_restart(unsigned char
2208 off paging. Copy it near the end of the first page, out of the way
2209 of BIOS variables. */
2210
2211- memcpy ((void *) (0x1000 - sizeof (real_mode_switch) - 100),
2212+ flags = __copy_to_user ((void __user *) (0x1000 - sizeof (real_mode_switch) - 100),
2213 real_mode_switch, sizeof (real_mode_switch));
2214- memcpy ((void *) (0x1000 - 100), code, length);
2215+ flags = __copy_to_user ((void __user *) (0x1000 - 100), code, length);
2216
2217 /* Set up the IDT for real mode. */
2218
2219@@ -328,7 +340,7 @@ void machine_emergency_restart(void)
2220 __asm__ __volatile__("int3");
2221 }
2222 /* rebooting needs to touch the page at absolute addr 0 */
2223- *((unsigned short *)__va(0x472)) = reboot_mode;
2224+ __put_user(reboot_mode, (unsigned short __user *)0x472);
2225 for (;;) {
2226 mach_reboot_fixups(); /* for board specific fixups */
2227 mach_reboot();
2228diff -urNp linux-2.6.18/arch/i386/kernel/setup.c linux-2.6.18/arch/i386/kernel/setup.c
2229--- linux-2.6.18/arch/i386/kernel/setup.c 2006-09-19 23:42:06.000000000 -0400
2230+++ linux-2.6.18/arch/i386/kernel/setup.c 2006-09-22 20:45:03.000000000 -0400
2231@@ -87,7 +87,11 @@ struct cpuinfo_x86 new_cpu_data __initda
2232 struct cpuinfo_x86 boot_cpu_data __read_mostly = { 0, 0, 0, 0, -1, 1, 0, 0, -1 };
2233 EXPORT_SYMBOL(boot_cpu_data);
2234
2235+#ifdef CONFIG_X86_PAE
2236+unsigned long mmu_cr4_features = X86_CR4_PAE;
2237+#else
2238 unsigned long mmu_cr4_features;
2239+#endif
2240
2241 #ifdef CONFIG_ACPI
2242 int acpi_disabled = 0;
2243@@ -1489,14 +1493,14 @@ void __init setup_arch(char **cmdline_p)
2244
2245 if (!MOUNT_ROOT_RDONLY)
2246 root_mountflags &= ~MS_RDONLY;
2247- init_mm.start_code = (unsigned long) _text;
2248- init_mm.end_code = (unsigned long) _etext;
2249+ init_mm.start_code = (unsigned long) _text + __KERNEL_TEXT_OFFSET;
2250+ init_mm.end_code = (unsigned long) _etext + __KERNEL_TEXT_OFFSET;
2251 init_mm.end_data = (unsigned long) _edata;
2252 init_mm.brk = init_pg_tables_end + PAGE_OFFSET;
2253
2254- code_resource.start = virt_to_phys(_text);
2255- code_resource.end = virt_to_phys(_etext)-1;
2256- data_resource.start = virt_to_phys(_etext);
2257+ code_resource.start = virt_to_phys(_text + __KERNEL_TEXT_OFFSET);
2258+ code_resource.end = virt_to_phys(_etext + __KERNEL_TEXT_OFFSET)-1;
2259+ data_resource.start = virt_to_phys(_data);
2260 data_resource.end = virt_to_phys(_edata)-1;
2261
2262 parse_cmdline_early(cmdline_p);
2263diff -urNp linux-2.6.18/arch/i386/kernel/signal.c linux-2.6.18/arch/i386/kernel/signal.c
2264--- linux-2.6.18/arch/i386/kernel/signal.c 2006-09-19 23:42:06.000000000 -0400
2265+++ linux-2.6.18/arch/i386/kernel/signal.c 2006-09-22 20:45:03.000000000 -0400
2266@@ -447,6 +447,7 @@ static int setup_rt_frame(int sig, struc
2267 goto give_sigsegv;
2268
2269 /* Set up to return from userspace. */
2270+
2271 restorer = (void *)VDSO_SYM(&__kernel_rt_sigreturn);
2272 if (ka->sa.sa_flags & SA_RESTORER)
2273 restorer = ka->sa.sa_restorer;
2274@@ -580,7 +581,7 @@ static void fastcall do_signal(struct pt
2275 * before reaching here, so testing against kernel
2276 * CS suffices.
2277 */
2278- if (!user_mode(regs))
2279+ if (!user_mode_novm(regs))
2280 return;
2281
2282 if (test_thread_flag(TIF_RESTORE_SIGMASK))
2283diff -urNp linux-2.6.18/arch/i386/kernel/smpboot.c linux-2.6.18/arch/i386/kernel/smpboot.c
2284--- linux-2.6.18/arch/i386/kernel/smpboot.c 2006-09-19 23:42:06.000000000 -0400
2285+++ linux-2.6.18/arch/i386/kernel/smpboot.c 2006-09-22 20:45:03.000000000 -0400
2286@@ -1055,7 +1055,6 @@ static int __cpuinit __smp_prepare_cpu(i
2287 struct warm_boot_cpu_info info;
2288 struct work_struct task;
2289 int apicid, ret;
2290- struct Xgt_desc_struct *cpu_gdt_descr = &per_cpu(cpu_gdt_descr, cpu);
2291
2292 apicid = x86_cpu_to_apicid[cpu];
2293 if (apicid == BAD_APICID) {
2294@@ -1067,13 +1066,7 @@ static int __cpuinit __smp_prepare_cpu(i
2295 * the CPU isn't initialized at boot time, allocate gdt table here.
2296 * cpu_init will initialize it
2297 */
2298- if (!cpu_gdt_descr->address) {
2299- cpu_gdt_descr->address = get_zeroed_page(GFP_KERNEL);
2300- if (!cpu_gdt_descr->address)
2301- printk(KERN_CRIT "CPU%d failed to allocate GDT\n", cpu);
2302- ret = -ENOMEM;
2303- goto exit;
2304- }
2305+ cpu_gdt_descr[cpu].address = get_cpu_gdt_table(cpu);
2306
2307 info.complete = &done;
2308 info.apicid = apicid;
2309@@ -1084,7 +1077,7 @@ static int __cpuinit __smp_prepare_cpu(i
2310
2311 /* init low mem mapping */
2312 clone_pgd_range(swapper_pg_dir, swapper_pg_dir + USER_PGD_PTRS,
2313- KERNEL_PGD_PTRS);
2314+ USER_PGD_PTRS >= KERNEL_PGD_PTRS ? KERNEL_PGD_PTRS : USER_PGD_PTRS);
2315 flush_tlb_all();
2316 schedule_work(&task);
2317 wait_for_completion(&done);
2318diff -urNp linux-2.6.18/arch/i386/kernel/syscall_table.S linux-2.6.18/arch/i386/kernel/syscall_table.S
2319--- linux-2.6.18/arch/i386/kernel/syscall_table.S 2006-09-19 23:42:06.000000000 -0400
2320+++ linux-2.6.18/arch/i386/kernel/syscall_table.S 2006-09-22 20:45:03.000000000 -0400
2321@@ -1,3 +1,4 @@
2322+.section .rodata,"a",@progbits
2323 ENTRY(sys_call_table)
2324 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
2325 .long sys_exit
2326diff -urNp linux-2.6.18/arch/i386/kernel/sysenter.c linux-2.6.18/arch/i386/kernel/sysenter.c
2327--- linux-2.6.18/arch/i386/kernel/sysenter.c 2006-09-19 23:42:06.000000000 -0400
2328+++ linux-2.6.18/arch/i386/kernel/sysenter.c 2006-09-22 20:45:03.000000000 -0400
2329@@ -45,7 +45,7 @@ extern asmlinkage void sysenter_entry(vo
2330 void enable_sep_cpu(void)
2331 {
2332 int cpu = get_cpu();
2333- struct tss_struct *tss = &per_cpu(init_tss, cpu);
2334+ struct tss_struct *tss = init_tss + cpu;
2335
2336 if (!boot_cpu_has(X86_FEATURE_SEP)) {
2337 put_cpu();
2338@@ -125,16 +125,36 @@ int arch_setup_additional_pages(struct l
2339 unsigned long addr;
2340 int ret;
2341
2342+#ifdef CONFIG_PAX_SEGMEXEC
2343+ struct vm_area_struct *vma_m = NULL;
2344+#endif
2345+
2346+ vma = kmem_cache_zalloc(vm_area_cachep, SLAB_KERNEL);
2347+ if (!vma)
2348+ return -ENOMEM;
2349+
2350+#ifdef CONFIG_PAX_SEGMEXEC
2351+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
2352+ vma_m = kmem_cache_zalloc(vm_area_cachep, SLAB_KERNEL);
2353+ if (!vma_m) {
2354+ kmem_cache_free(vm_area_cachep, vma);
2355+ return -ENOMEM;
2356+ }
2357+ }
2358+#endif
2359+
2360 down_write(&mm->mmap_sem);
2361- addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
2362+ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
2363 if (IS_ERR_VALUE(addr)) {
2364 ret = addr;
2365- goto up_fail;
2366- }
2367
2368- vma = kmem_cache_zalloc(vm_area_cachep, SLAB_KERNEL);
2369- if (!vma) {
2370- ret = -ENOMEM;
2371+ kmem_cache_free(vm_area_cachep, vma);
2372+
2373+#ifdef CONFIG_PAX_SEGMEXEC
2374+ if (vma_m)
2375+ kmem_cache_free(vm_area_cachep, vma_m);
2376+#endif
2377+
2378 goto up_fail;
2379 }
2380
2381@@ -142,17 +162,48 @@ int arch_setup_additional_pages(struct l
2382 vma->vm_end = addr + PAGE_SIZE;
2383 /* MAYWRITE to allow gdb to COW and set breakpoints */
2384 vma->vm_flags = VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYEXEC|VM_MAYWRITE;
2385+
2386+#ifdef CONFIG_PAX_MPROTECT
2387+ if (mm->pax_flags & MF_PAX_MPROTECT)
2388+ vma->vm_flags &= ~VM_MAYWRITE;
2389+#endif
2390+
2391 vma->vm_flags |= mm->def_flags;
2392- vma->vm_page_prot = protection_map[vma->vm_flags & 7];
2393+ vma->vm_page_prot = protection_map[vma->vm_flags & (VM_READ|VM_WRITE|VM_EXEC)];
2394 vma->vm_ops = &syscall_vm_ops;
2395 vma->vm_mm = mm;
2396
2397 ret = insert_vm_struct(mm, vma);
2398 if (unlikely(ret)) {
2399 kmem_cache_free(vm_area_cachep, vma);
2400+
2401+#ifdef CONFIG_PAX_SEGMEXEC
2402+ if (vma_m)
2403+ kmem_cache_free(vm_area_cachep, vma_m);
2404+#endif
2405+
2406 goto up_fail;
2407 }
2408
2409+#ifdef CONFIG_PAX_SEGMEXEC
2410+ if (vma_m) {
2411+ *vma_m = *vma;
2412+ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
2413+ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
2414+ ret = insert_vm_struct(mm, vma_m);
2415+ if (unlikely(ret)) {
2416+ kmem_cache_free(vm_area_cachep, vma_m);
2417+ goto up_fail;
2418+ }
2419+ vma_m->vm_flags |= VM_MIRROR;
2420+ vma->vm_flags |= VM_MIRROR;
2421+ vma_m->vm_mirror = vma->vm_start - vma_m->vm_start;
2422+ vma->vm_mirror = vma_m->vm_start - vma->vm_start;
2423+ vma_m->vm_pgoff = vma->vm_pgoff;
2424+ mm->total_vm++;
2425+ }
2426+#endif
2427+
2428 current->mm->context.vdso = (void *)addr;
2429 current_thread_info()->sysenter_return =
2430 (void *)VDSO_SYM(&SYSENTER_RETURN);
2431@@ -164,8 +215,17 @@ up_fail:
2432
2433 const char *arch_vma_name(struct vm_area_struct *vma)
2434 {
2435- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
2436+ if (vma->vm_start == (unsigned long)vma->vm_mm->context.vdso)
2437 return "[vdso]";
2438+
2439+#ifdef CONFIG_PAX_SEGMEXEC
2440+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_MIRROR))
2441+ return NULL;
2442+
2443+ if (vma->vm_start + vma->vm_mirror == (unsigned long)vma->vm_mm->context.vdso)
2444+ return "[vdso]";
2445+#endif
2446+
2447 return NULL;
2448 }
2449
2450diff -urNp linux-2.6.18/arch/i386/kernel/sys_i386.c linux-2.6.18/arch/i386/kernel/sys_i386.c
2451--- linux-2.6.18/arch/i386/kernel/sys_i386.c 2006-09-19 23:42:06.000000000 -0400
2452+++ linux-2.6.18/arch/i386/kernel/sys_i386.c 2006-09-22 20:45:03.000000000 -0400
2453@@ -99,6 +99,191 @@ out:
2454 return err;
2455 }
2456
2457+unsigned long
2458+arch_get_unmapped_area(struct file *filp, unsigned long addr,
2459+ unsigned long len, unsigned long pgoff, unsigned long flags)
2460+{
2461+ struct mm_struct *mm = current->mm;
2462+ struct vm_area_struct *vma;
2463+ unsigned long start_addr, task_size = TASK_SIZE;
2464+
2465+#ifdef CONFIG_PAX_SEGMEXEC
2466+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
2467+ task_size = SEGMEXEC_TASK_SIZE;
2468+#endif
2469+
2470+ if (len > task_size)
2471+ return -ENOMEM;
2472+
2473+#ifdef CONFIG_PAX_RANDMMAP
2474+ if (!(mm->pax_flags & MF_PAX_RANDMMAP) || !filp)
2475+#endif
2476+
2477+ if (addr) {
2478+ addr = PAGE_ALIGN(addr);
2479+ vma = find_vma(mm, addr);
2480+ if (task_size - len >= addr &&
2481+ (!vma || addr + len <= vma->vm_start))
2482+ return addr;
2483+ }
2484+ if (len > mm->cached_hole_size) {
2485+ start_addr = addr = mm->free_area_cache;
2486+ } else {
2487+ start_addr = addr = mm->mmap_base;
2488+ mm->cached_hole_size = 0;
2489+ }
2490+
2491+#ifdef CONFIG_PAX_PAGEEXEC
2492+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
2493+ start_addr = 0x00110000UL;
2494+
2495+#ifdef CONFIG_PAX_RANDMMAP
2496+ if (mm->pax_flags & MF_PAX_RANDMMAP)
2497+ start_addr += mm->delta_mmap & 0x03FFF000UL;
2498+#endif
2499+
2500+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
2501+ start_addr = addr = mm->mmap_base;
2502+ else
2503+ addr = start_addr;
2504+ }
2505+#endif
2506+
2507+full_search:
2508+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
2509+ /* At this point: (!vma || addr < vma->vm_end). */
2510+ if (task_size - len < addr) {
2511+ /*
2512+ * Start a new search - just in case we missed
2513+ * some holes.
2514+ */
2515+ if (start_addr != mm->mmap_base) {
2516+ start_addr = addr = mm->mmap_base;
2517+ mm->cached_hole_size = 0;
2518+ goto full_search;
2519+ }
2520+ return -ENOMEM;
2521+ }
2522+ if (!vma || addr + len <= vma->vm_start) {
2523+ /*
2524+ * Remember the place where we stopped the search:
2525+ */
2526+ mm->free_area_cache = addr + len;
2527+ return addr;
2528+ }
2529+ if (addr + mm->cached_hole_size < vma->vm_start)
2530+ mm->cached_hole_size = vma->vm_start - addr;
2531+ addr = vma->vm_end;
2532+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
2533+ start_addr = addr = mm->mmap_base;
2534+ goto full_search;
2535+ }
2536+ }
2537+}
2538+
2539+unsigned long
2540+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
2541+ const unsigned long len, const unsigned long pgoff,
2542+ const unsigned long flags)
2543+{
2544+ struct vm_area_struct *vma;
2545+ struct mm_struct *mm = current->mm;
2546+ unsigned long base = mm->mmap_base, addr = addr0, task_size = TASK_SIZE;
2547+
2548+#ifdef CONFIG_PAX_SEGMEXEC
2549+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
2550+ task_size = SEGMEXEC_TASK_SIZE;
2551+#endif
2552+
2553+ /* requested length too big for entire address space */
2554+ if (len > task_size)
2555+ return -ENOMEM;
2556+
2557+#ifdef CONFIG_PAX_PAGEEXEC
2558+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
2559+ goto bottomup;
2560+#endif
2561+
2562+#ifdef CONFIG_PAX_RANDMMAP
2563+ if (!(mm->pax_flags & MF_PAX_RANDMMAP) || !filp)
2564+#endif
2565+
2566+ /* requesting a specific address */
2567+ if (addr) {
2568+ addr = PAGE_ALIGN(addr);
2569+ vma = find_vma(mm, addr);
2570+ if (task_size - len >= addr &&
2571+ (!vma || addr + len <= vma->vm_start))
2572+ return addr;
2573+ }
2574+
2575+ /* check if free_area_cache is useful for us */
2576+ if (len <= mm->cached_hole_size) {
2577+ mm->cached_hole_size = 0;
2578+ mm->free_area_cache = mm->mmap_base;
2579+ }
2580+
2581+ /* either no address requested or can't fit in requested address hole */
2582+ addr = mm->free_area_cache;
2583+
2584+ /* make sure it can fit in the remaining address space */
2585+ if (addr > len) {
2586+ vma = find_vma(mm, addr-len);
2587+ if (!vma || addr <= vma->vm_start)
2588+ /* remember the address as a hint for next time */
2589+ return (mm->free_area_cache = addr-len);
2590+ }
2591+
2592+ if (mm->mmap_base < len)
2593+ goto bottomup;
2594+
2595+ addr = mm->mmap_base-len;
2596+
2597+ do {
2598+ /*
2599+ * Lookup failure means no vma is above this address,
2600+ * else if new region fits below vma->vm_start,
2601+ * return with success:
2602+ */
2603+ vma = find_vma(mm, addr);
2604+ if (!vma || addr+len <= vma->vm_start)
2605+ /* remember the address as a hint for next time */
2606+ return (mm->free_area_cache = addr);
2607+
2608+ /* remember the largest hole we saw so far */
2609+ if (addr + mm->cached_hole_size < vma->vm_start)
2610+ mm->cached_hole_size = vma->vm_start - addr;
2611+
2612+ /* try just below the current vma->vm_start */
2613+ addr = vma->vm_start-len;
2614+ } while (len < vma->vm_start);
2615+
2616+bottomup:
2617+ /*
2618+ * A failed mmap() very likely causes application failure,
2619+ * so fall back to the bottom-up function here. This scenario
2620+ * can happen with large stack limits and large mmap()
2621+ * allocations.
2622+ */
2623+ mm->mmap_base = TASK_UNMAPPED_BASE;
2624+
2625+#ifdef CONFIG_PAX_RANDMMAP
2626+ if (mm->pax_flags & MF_PAX_RANDMMAP)
2627+ mm->mmap_base += mm->delta_mmap;
2628+#endif
2629+
2630+ mm->free_area_cache = mm->mmap_base;
2631+ mm->cached_hole_size = ~0UL;
2632+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
2633+ /*
2634+ * Restore the topdown base:
2635+ */
2636+ mm->mmap_base = base;
2637+ mm->free_area_cache = base;
2638+ mm->cached_hole_size = ~0UL;
2639+
2640+ return addr;
2641+}
2642
2643 struct sel_arg_struct {
2644 unsigned long n;
2645diff -urNp linux-2.6.18/arch/i386/kernel/time.c linux-2.6.18/arch/i386/kernel/time.c
2646--- linux-2.6.18/arch/i386/kernel/time.c 2006-09-19 23:42:06.000000000 -0400
2647+++ linux-2.6.18/arch/i386/kernel/time.c 2006-09-22 20:45:03.000000000 -0400
2648@@ -135,7 +135,7 @@ unsigned long profile_pc(struct pt_regs
2649 {
2650 unsigned long pc = instruction_pointer(regs);
2651
2652- if (!user_mode_vm(regs) && in_lock_functions(pc))
2653+ if (!user_mode(regs) && in_lock_functions(pc))
2654 return *(unsigned long *)(regs->ebp + 4);
2655
2656 return pc;
2657diff -urNp linux-2.6.18/arch/i386/kernel/traps.c linux-2.6.18/arch/i386/kernel/traps.c
2658--- linux-2.6.18/arch/i386/kernel/traps.c 2006-09-19 23:42:06.000000000 -0400
2659+++ linux-2.6.18/arch/i386/kernel/traps.c 2006-09-22 20:45:03.000000000 -0400
2660@@ -28,6 +28,7 @@
2661 #include <linux/kprobes.h>
2662 #include <linux/kexec.h>
2663 #include <linux/unwind.h>
2664+#include <linux/binfmts.h>
2665
2666 #ifdef CONFIG_EISA
2667 #include <linux/ioport.h>
2668@@ -58,18 +59,13 @@
2669
2670 asmlinkage int system_call(void);
2671
2672-struct desc_struct default_ldt[] = { { 0, 0 }, { 0, 0 }, { 0, 0 },
2673+const struct desc_struct default_ldt[] = { { 0, 0 }, { 0, 0 }, { 0, 0 },
2674 { 0, 0 }, { 0, 0 } };
2675
2676 /* Do we ignore FPU interrupts ? */
2677 char ignore_fpu_irq = 0;
2678
2679-/*
2680- * The IDT has to be page-aligned to simplify the Pentium
2681- * F0 0F bug workaround.. We have a special link segment
2682- * for this.
2683- */
2684-struct desc_struct idt_table[256] __attribute__((__section__(".data.idt"))) = { {0, 0}, };
2685+extern struct desc_struct idt_table[256];
2686
2687 asmlinkage void divide_error(void);
2688 asmlinkage void debug(void);
2689@@ -149,7 +145,7 @@ static inline unsigned long print_contex
2690 #else
2691 while (valid_stack_ptr(tinfo, stack)) {
2692 addr = *stack++;
2693- if (__kernel_text_address(addr))
2694+ if (__kernel_text_address(addr + __KERNEL_TEXT_OFFSET))
2695 print_addr_and_symbol(addr, log_lvl);
2696 }
2697 #endif
2698@@ -285,7 +281,7 @@ void show_registers(struct pt_regs *regs
2699
2700 esp = (unsigned long) (&regs->esp);
2701 savesegment(ss, ss);
2702- if (user_mode_vm(regs)) {
2703+ if (user_mode(regs)) {
2704 in_kernel = 0;
2705 esp = regs->esp;
2706 ss = regs->xss & 0xffff;
2707@@ -313,13 +309,15 @@ void show_registers(struct pt_regs *regs
2708 */
2709 if (in_kernel) {
2710 u8 __user *eip;
2711+ mm_segment_t old_fs = get_fs();
2712
2713 printk("\n" KERN_EMERG "Stack: ");
2714 show_stack_log_lvl(NULL, regs, (unsigned long *)esp, KERN_EMERG);
2715
2716 printk(KERN_EMERG "Code: ");
2717
2718- eip = (u8 __user *)regs->eip - 43;
2719+ set_fs(KERNEL_DS);
2720+ eip = (u8 __user *)regs->eip - 43 + __KERNEL_TEXT_OFFSET;
2721 for (i = 0; i < 64; i++, eip++) {
2722 unsigned char c;
2723
2724@@ -327,26 +325,29 @@ void show_registers(struct pt_regs *regs
2725 printk(" Bad EIP value.");
2726 break;
2727 }
2728- if (eip == (u8 __user *)regs->eip)
2729+ if (eip == (u8 __user *)regs->eip + __KERNEL_TEXT_OFFSET)
2730 printk("<%02x> ", c);
2731 else
2732 printk("%02x ", c);
2733 }
2734+ set_fs(old_fs);
2735 }
2736 printk("\n");
2737 }
2738
2739 static void handle_BUG(struct pt_regs *regs)
2740 {
2741- unsigned long eip = regs->eip;
2742+ unsigned long eip = regs->eip + __KERNEL_TEXT_OFFSET;
2743 unsigned short ud2;
2744+ mm_segment_t old_fs = get_fs();
2745
2746+ set_fs(KERNEL_DS);
2747 if (eip < PAGE_OFFSET)
2748- return;
2749+ goto out;
2750 if (__get_user(ud2, (unsigned short __user *)eip))
2751- return;
2752+ goto out;
2753 if (ud2 != 0x0b0f)
2754- return;
2755+ goto out;
2756
2757 printk(KERN_EMERG "------------[ cut here ]------------\n");
2758
2759@@ -356,17 +357,22 @@ static void handle_BUG(struct pt_regs *r
2760 char *file;
2761 char c;
2762
2763- if (__get_user(line, (unsigned short __user *)(eip + 2)))
2764+ if (__get_user(line, (unsigned short __user *)(eip + 7)))
2765+ break;
2766+ if (__get_user(file, (char * __user *)(eip + 3)) ||
2767+ file < _text + __KERNEL_TEXT_OFFSET)
2768 break;
2769- if (__get_user(file, (char * __user *)(eip + 4)) ||
2770- (unsigned long)file < PAGE_OFFSET || __get_user(c, file))
2771+ if (__get_user(c, file))
2772 file = "<bad filename>";
2773
2774 printk(KERN_EMERG "kernel BUG at %s:%d!\n", file, line);
2775- return;
2776+ goto out;
2777 } while (0);
2778 #endif
2779 printk(KERN_EMERG "Kernel BUG at [verbose debug info unavailable]\n");
2780+
2781+out:
2782+ set_fs(old_fs);
2783 }
2784
2785 /* This is gone through when something in the kernel
2786@@ -465,7 +471,7 @@ void die(const char * str, struct pt_reg
2787
2788 static inline void die_if_kernel(const char * str, struct pt_regs * regs, long err)
2789 {
2790- if (!user_mode_vm(regs))
2791+ if (!user_mode(regs))
2792 die(str, regs, err);
2793 }
2794
2795@@ -483,7 +489,7 @@ static void __kprobes do_trap(int trapnr
2796 goto trap_signal;
2797 }
2798
2799- if (!user_mode(regs))
2800+ if (!user_mode_novm(regs))
2801 goto kernel_trap;
2802
2803 trap_signal: {
2804@@ -571,7 +577,7 @@ fastcall void __kprobes do_general_prote
2805 long error_code)
2806 {
2807 int cpu = get_cpu();
2808- struct tss_struct *tss = &per_cpu(init_tss, cpu);
2809+ struct tss_struct *tss = &init_tss[cpu];
2810 struct thread_struct *thread = &current->thread;
2811
2812 /*
2813@@ -607,9 +613,25 @@ fastcall void __kprobes do_general_prote
2814 if (regs->eflags & VM_MASK)
2815 goto gp_in_vm86;
2816
2817- if (!user_mode(regs))
2818+ if (!user_mode_novm(regs))
2819 goto gp_in_kernel;
2820
2821+#ifdef CONFIG_PAX_PAGEEXEC
2822+ if (current->mm && (current->mm->pax_flags & MF_PAX_PAGEEXEC)) {
2823+ struct mm_struct *mm = current->mm;
2824+ unsigned long limit;
2825+
2826+ down_write(&mm->mmap_sem);
2827+ limit = mm->context.user_cs_limit;
2828+ if (limit < TASK_SIZE) {
2829+ track_exec_limit(mm, limit, TASK_SIZE, PROT_EXEC);
2830+ up_write(&mm->mmap_sem);
2831+ return;
2832+ }
2833+ up_write(&mm->mmap_sem);
2834+ }
2835+#endif
2836+
2837 current->thread.error_code = error_code;
2838 current->thread.trap_no = 13;
2839 force_sig(SIGSEGV, current);
2840@@ -625,6 +647,13 @@ gp_in_kernel:
2841 if (notify_die(DIE_GPF, "general protection fault", regs,
2842 error_code, 13, SIGSEGV) == NOTIFY_STOP)
2843 return;
2844+
2845+#ifdef CONFIG_PAX_KERNEXEC
2846+ if ((regs->xcs & 0xFFFF) == __KERNEL_CS)
2847+ die("PAX: suspicious general protection fault", regs, error_code);
2848+ else
2849+#endif
2850+
2851 die("general protection fault", regs, error_code);
2852 }
2853 }
2854@@ -698,7 +727,7 @@ void die_nmi (struct pt_regs *regs, cons
2855 /* If we are in kernel we are probably nested up pretty bad
2856 * and might aswell get out now while we still can.
2857 */
2858- if (!user_mode_vm(regs)) {
2859+ if (!user_mode(regs)) {
2860 current->thread.trap_no = 2;
2861 crash_kexec(regs);
2862 }
2863@@ -851,7 +880,7 @@ fastcall void __kprobes do_debug(struct
2864 * check for kernel mode by just checking the CPL
2865 * of CS.
2866 */
2867- if (!user_mode(regs))
2868+ if (!user_mode_novm(regs))
2869 goto clear_TF_reenable;
2870 }
2871
2872@@ -1141,7 +1170,19 @@ do { \
2873 */
2874 void set_intr_gate(unsigned int n, void *addr)
2875 {
2876+
2877+#ifdef CONFIG_PAX_KERNEXEC
2878+ unsigned long cr0;
2879+
2880+ pax_open_kernel(cr0);
2881+#endif
2882+
2883 _set_gate(idt_table+n,14,0,addr,__KERNEL_CS);
2884+
2885+#ifdef CONFIG_PAX_KERNEXEC
2886+ pax_close_kernel(cr0);
2887+#endif
2888+
2889 }
2890
2891 /*
2892diff -urNp linux-2.6.18/arch/i386/kernel/vm86.c linux-2.6.18/arch/i386/kernel/vm86.c
2893--- linux-2.6.18/arch/i386/kernel/vm86.c 2006-09-19 23:42:06.000000000 -0400
2894+++ linux-2.6.18/arch/i386/kernel/vm86.c 2006-09-22 20:45:03.000000000 -0400
2895@@ -122,7 +122,7 @@ struct pt_regs * fastcall save_v86_state
2896 do_exit(SIGSEGV);
2897 }
2898
2899- tss = &per_cpu(init_tss, get_cpu());
2900+ tss = init_tss + get_cpu();
2901 current->thread.esp0 = current->thread.saved_esp0;
2902 current->thread.sysenter_cs = __KERNEL_CS;
2903 load_esp0(tss, &current->thread);
2904@@ -296,7 +296,7 @@ static void do_sys_vm86(struct kernel_vm
2905 savesegment(fs, tsk->thread.saved_fs);
2906 savesegment(gs, tsk->thread.saved_gs);
2907
2908- tss = &per_cpu(init_tss, get_cpu());
2909+ tss = init_tss + get_cpu();
2910 tsk->thread.esp0 = (unsigned long) &info->VM86_TSS_ESP0;
2911 if (cpu_has_sep)
2912 tsk->thread.sysenter_cs = 0;
2913diff -urNp linux-2.6.18/arch/i386/kernel/vmlinux.lds.S linux-2.6.18/arch/i386/kernel/vmlinux.lds.S
2914--- linux-2.6.18/arch/i386/kernel/vmlinux.lds.S 2006-09-19 23:42:06.000000000 -0400
2915+++ linux-2.6.18/arch/i386/kernel/vmlinux.lds.S 2006-09-22 20:45:03.000000000 -0400
2916@@ -4,10 +4,19 @@
2917
2918 #define LOAD_OFFSET __PAGE_OFFSET
2919
2920+#include <linux/config.h>
2921+
2922 #include <asm-generic/vmlinux.lds.h>
2923 #include <asm/thread_info.h>
2924 #include <asm/page.h>
2925 #include <asm/cache.h>
2926+#include <asm/segment.h>
2927+
2928+#ifdef CONFIG_X86_PAE
2929+#define PMD_SHIFT 21
2930+#else
2931+#define PMD_SHIFT 22
2932+#endif
2933
2934 OUTPUT_FORMAT("elf32-i386", "elf32-i386", "elf32-i386")
2935 OUTPUT_ARCH(i386)
2936@@ -16,75 +25,14 @@ jiffies = jiffies_64;
2937 SECTIONS
2938 {
2939 . = __KERNEL_START;
2940- phys_startup_32 = startup_32 - LOAD_OFFSET;
2941- /* read-only */
2942- _text = .; /* Text and read-only data */
2943- .text : AT(ADDR(.text) - LOAD_OFFSET) {
2944- *(.text)
2945- SCHED_TEXT
2946- LOCK_TEXT
2947- KPROBES_TEXT
2948- *(.fixup)
2949- *(.gnu.warning)
2950- } = 0x9090
2951-
2952- _etext = .; /* End of text section */
2953-
2954- . = ALIGN(16); /* Exception table */
2955- __start___ex_table = .;
2956- __ex_table : AT(ADDR(__ex_table) - LOAD_OFFSET) { *(__ex_table) }
2957- __stop___ex_table = .;
2958-
2959- RODATA
2960+ phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
2961
2962- . = ALIGN(4);
2963- __tracedata_start = .;
2964- .tracedata : AT(ADDR(.tracedata) - LOAD_OFFSET) {
2965- *(.tracedata)
2966- }
2967- __tracedata_end = .;
2968-
2969- /* writeable */
2970- .data : AT(ADDR(.data) - LOAD_OFFSET) { /* Data */
2971- *(.data)
2972- CONSTRUCTORS
2973+ .text.startup : AT(ADDR(.text.startup) - LOAD_OFFSET) {
2974+ BYTE(0xEA) /* jmp far */
2975+ LONG(phys_startup_32)
2976+ SHORT(__BOOT_CS)
2977 }
2978
2979- . = ALIGN(4096);
2980- __nosave_begin = .;
2981- .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) { *(.data.nosave) }
2982- . = ALIGN(4096);
2983- __nosave_end = .;
2984-
2985- . = ALIGN(4096);
2986- .data.page_aligned : AT(ADDR(.data.page_aligned) - LOAD_OFFSET) {
2987- *(.data.idt)
2988- }
2989-
2990- . = ALIGN(32);
2991- .data.cacheline_aligned : AT(ADDR(.data.cacheline_aligned) - LOAD_OFFSET) {
2992- *(.data.cacheline_aligned)
2993- }
2994-
2995- /* rarely changed data like cpu maps */
2996- . = ALIGN(32);
2997- .data.read_mostly : AT(ADDR(.data.read_mostly) - LOAD_OFFSET) { *(.data.read_mostly) }
2998- _edata = .; /* End of data section */
2999-
3000-#ifdef CONFIG_STACK_UNWIND
3001- . = ALIGN(4);
3002- .eh_frame : AT(ADDR(.eh_frame) - LOAD_OFFSET) {
3003- __start_unwind = .;
3004- *(.eh_frame)
3005- __end_unwind = .;
3006- }
3007-#endif
3008-
3009- . = ALIGN(THREAD_SIZE); /* init_task */
3010- .data.init_task : AT(ADDR(.data.init_task) - LOAD_OFFSET) {
3011- *(.data.init_task)
3012- }
3013-
3014 /* might get freed after init */
3015 . = ALIGN(4096);
3016 __smp_alt_begin = .;
3017@@ -108,11 +56,6 @@ SECTIONS
3018 /* will be freed after init */
3019 . = ALIGN(4096); /* Init code and data */
3020 __init_begin = .;
3021- .init.text : AT(ADDR(.init.text) - LOAD_OFFSET) {
3022- _sinittext = .;
3023- *(.init.text)
3024- _einittext = .;
3025- }
3026 .init.data : AT(ADDR(.init.data) - LOAD_OFFSET) { *(.init.data) }
3027 . = ALIGN(16);
3028 __setup_start = .;
3029@@ -144,9 +87,7 @@ SECTIONS
3030 .altinstr_replacement : AT(ADDR(.altinstr_replacement) - LOAD_OFFSET) {
3031 *(.altinstr_replacement)
3032 }
3033- /* .exit.text is discard at runtime, not link time, to deal with references
3034- from .altinstructions and .eh_frame */
3035- .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) { *(.exit.text) }
3036+
3037 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) { *(.exit.data) }
3038 . = ALIGN(4096);
3039 __initramfs_start = .;
3040@@ -156,10 +97,124 @@ SECTIONS
3041 __per_cpu_start = .;
3042 .data.percpu : AT(ADDR(.data.percpu) - LOAD_OFFSET) { *(.data.percpu) }
3043 __per_cpu_end = .;
3044+
3045+ /* read-only */
3046+
3047 . = ALIGN(4096);
3048- __init_end = .;
3049+ .init.text (. - __KERNEL_TEXT_OFFSET) : AT(ADDR(.init.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
3050+ _sinittext = .;
3051+ *(.init.text)
3052+ _einittext = .;
3053+ }
3054+
3055+ /* .exit.text is discard at runtime, not link time, to deal with references
3056+ from .altinstructions and .eh_frame */
3057+ .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) { *(.exit.text) }
3058+
3059+#ifdef CONFIG_PAX_KERNEXEC
3060+ .text.align : AT(ADDR(.text.align) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
3061+ . = ALIGN(__KERNEL_TEXT_OFFSET - LOAD_OFFSET) - 1;
3062+ BYTE(0)
3063+ }
3064+#else
3065+ . = ALIGN(4096);
3066+#endif
3067+
3068+ __init_end = . + __KERNEL_TEXT_OFFSET;
3069 /* freed after init ends here */
3070-
3071+
3072+ _text = .; /* Text and read-only data */
3073+ .text : AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
3074+ *(.text)
3075+ SCHED_TEXT
3076+ LOCK_TEXT
3077+ KPROBES_TEXT
3078+ *(.fixup)
3079+ *(.gnu.warning)
3080+ } = 0x9090
3081+
3082+ _etext = .; /* End of text section */
3083+ . += __KERNEL_TEXT_OFFSET;
3084+ . = ALIGN(16); /* Exception table */
3085+ __start___ex_table = .;
3086+ __ex_table : AT(ADDR(__ex_table) - LOAD_OFFSET) { *(__ex_table) }
3087+ __stop___ex_table = .;
3088+
3089+ . = ALIGN(4096);
3090+ .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
3091+ *(.empty_zero_page)
3092+
3093+#ifdef CONFIG_X86_PAE
3094+ *(.swapper_pm_dir)
3095+#endif
3096+
3097+ *(.swapper_pg_dir)
3098+ *(.idt)
3099+ }
3100+
3101+ RODATA
3102+
3103+ . = ALIGN(4);
3104+ __tracedata_start = .;
3105+ .tracedata : AT(ADDR(.tracedata) - LOAD_OFFSET) {
3106+ *(.tracedata)
3107+ }
3108+ __tracedata_end = .;
3109+
3110+#ifdef CONFIG_PAX_KERNEXEC
3111+ . = ALIGN(4096);
3112+ MODULES_VADDR = .;
3113+
3114+ .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
3115+ . += (4 * 1024 * 1024);
3116+ . = ALIGN(1 << PMD_SHIFT) - 1;
3117+ BYTE(0)
3118+ }
3119+
3120+ MODULES_END = .;
3121+#else
3122+ . = ALIGN(32);
3123+#endif
3124+
3125+ /* writeable */
3126+ .data : AT(ADDR(.data) - LOAD_OFFSET) { /* Data */
3127+ _data = .;
3128+ *(.data)
3129+ CONSTRUCTORS
3130+ }
3131+
3132+ . = ALIGN(4096);
3133+ __nosave_begin = .;
3134+ .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) { *(.data.nosave) }
3135+ . = ALIGN(4096);
3136+ __nosave_end = .;
3137+
3138+ . = ALIGN(32);
3139+ .data.cacheline_aligned : AT(ADDR(.data.cacheline_aligned) - LOAD_OFFSET) {
3140+ *(.data.cacheline_aligned)
3141+ }
3142+
3143+ /* rarely changed data like cpu maps */
3144+ . = ALIGN(32);
3145+ .data.read_mostly : AT(ADDR(.data.read_mostly) - LOAD_OFFSET) { *(.data.read_mostly) }
3146+
3147+#ifdef CONFIG_STACK_UNWIND
3148+ . = ALIGN(4);
3149+ .eh_frame : AT(ADDR(.eh_frame) - LOAD_OFFSET) {
3150+ __start_unwind = .;
3151+ *(.eh_frame)
3152+ __end_unwind = .;
3153+ }
3154+#endif
3155+
3156+ . = ALIGN(THREAD_SIZE); /* init_task */
3157+ .data.init_task : AT(ADDR(.data.init_task) - LOAD_OFFSET) {
3158+ *(.data.init_task)
3159+ }
3160+
3161+ _edata = .; /* End of data section */
3162+
3163+ . = ALIGN(4096);
3164 __bss_start = .; /* BSS */
3165 .bss.page_aligned : AT(ADDR(.bss.page_aligned) - LOAD_OFFSET) {
3166 *(.bss.page_aligned)
3167diff -urNp linux-2.6.18/arch/i386/lib/checksum.S linux-2.6.18/arch/i386/lib/checksum.S
3168--- linux-2.6.18/arch/i386/lib/checksum.S 2006-09-19 23:42:06.000000000 -0400
3169+++ linux-2.6.18/arch/i386/lib/checksum.S 2006-09-22 20:45:03.000000000 -0400
3170@@ -26,7 +26,8 @@
3171 */
3172
3173 #include <asm/errno.h>
3174-
3175+#include <asm/segment.h>
3176+
3177 /*
3178 * computes a partial checksum, e.g. for TCP/UDP fragments
3179 */
3180@@ -280,12 +281,23 @@ unsigned int csum_partial_copy_generic (
3181
3182 .align 4
3183 .globl csum_partial_copy_generic
3184-
3185+.globl csum_partial_copy_generic_to_user
3186+.globl csum_partial_copy_generic_from_user
3187+
3188 #ifndef CONFIG_X86_USE_PPRO_CHECKSUM
3189
3190 #define ARGBASE 16
3191 #define FP 12
3192-
3193+
3194+csum_partial_copy_generic_to_user:
3195+ pushl $(__USER_DS)
3196+ popl %es
3197+ jmp csum_partial_copy_generic
3198+
3199+csum_partial_copy_generic_from_user:
3200+ pushl $(__USER_DS)
3201+ popl %ds
3202+
3203 csum_partial_copy_generic:
3204 subl $4,%esp
3205 pushl %edi
3206@@ -304,7 +316,7 @@ csum_partial_copy_generic:
3207 jmp 4f
3208 SRC(1: movw (%esi), %bx )
3209 addl $2, %esi
3210-DST( movw %bx, (%edi) )
3211+DST( movw %bx, %es:(%edi) )
3212 addl $2, %edi
3213 addw %bx, %ax
3214 adcl $0, %eax
3215@@ -316,30 +328,30 @@ DST( movw %bx, (%edi) )
3216 SRC(1: movl (%esi), %ebx )
3217 SRC( movl 4(%esi), %edx )
3218 adcl %ebx, %eax
3219-DST( movl %ebx, (%edi) )
3220+DST( movl %ebx, %es:(%edi) )
3221 adcl %edx, %eax
3222-DST( movl %edx, 4(%edi) )
3223+DST( movl %edx, %es:4(%edi) )
3224
3225 SRC( movl 8(%esi), %ebx )
3226 SRC( movl 12(%esi), %edx )
3227 adcl %ebx, %eax
3228-DST( movl %ebx, 8(%edi) )
3229+DST( movl %ebx, %es:8(%edi) )
3230 adcl %edx, %eax
3231-DST( movl %edx, 12(%edi) )
3232+DST( movl %edx, %es:12(%edi) )
3233
3234 SRC( movl 16(%esi), %ebx )
3235 SRC( movl 20(%esi), %edx )
3236 adcl %ebx, %eax
3237-DST( movl %ebx, 16(%edi) )
3238+DST( movl %ebx, %es:16(%edi) )
3239 adcl %edx, %eax
3240-DST( movl %edx, 20(%edi) )
3241+DST( movl %edx, %es:20(%edi) )
3242
3243 SRC( movl 24(%esi), %ebx )
3244 SRC( movl 28(%esi), %edx )
3245 adcl %ebx, %eax
3246-DST( movl %ebx, 24(%edi) )
3247+DST( movl %ebx, %es:24(%edi) )
3248 adcl %edx, %eax
3249-DST( movl %edx, 28(%edi) )
3250+DST( movl %edx, %es:28(%edi) )
3251
3252 lea 32(%esi), %esi
3253 lea 32(%edi), %edi
3254@@ -353,7 +365,7 @@ DST( movl %edx, 28(%edi) )
3255 shrl $2, %edx # This clears CF
3256 SRC(3: movl (%esi), %ebx )
3257 adcl %ebx, %eax
3258-DST( movl %ebx, (%edi) )
3259+DST( movl %ebx, %es:(%edi) )
3260 lea 4(%esi), %esi
3261 lea 4(%edi), %edi
3262 dec %edx
3263@@ -365,12 +377,12 @@ DST( movl %ebx, (%edi) )
3264 jb 5f
3265 SRC( movw (%esi), %cx )
3266 leal 2(%esi), %esi
3267-DST( movw %cx, (%edi) )
3268+DST( movw %cx, %es:(%edi) )
3269 leal 2(%edi), %edi
3270 je 6f
3271 shll $16,%ecx
3272 SRC(5: movb (%esi), %cl )
3273-DST( movb %cl, (%edi) )
3274+DST( movb %cl, %es:(%edi) )
3275 6: addl %ecx, %eax
3276 adcl $0, %eax
3277 7:
3278@@ -381,7 +393,7 @@ DST( movb %cl, (%edi) )
3279
3280 6001:
3281 movl ARGBASE+20(%esp), %ebx # src_err_ptr
3282- movl $-EFAULT, (%ebx)
3283+ movl $-EFAULT, %ss:(%ebx)
3284
3285 # zero the complete destination - computing the rest
3286 # is too much work
3287@@ -394,11 +406,15 @@ DST( movb %cl, (%edi) )
3288
3289 6002:
3290 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
3291- movl $-EFAULT,(%ebx)
3292+ movl $-EFAULT,%ss:(%ebx)
3293 jmp 5000b
3294
3295 .previous
3296
3297+ pushl %ss
3298+ popl %ds
3299+ pushl %ss
3300+ popl %es
3301 popl %ebx
3302 popl %esi
3303 popl %edi
3304@@ -410,17 +426,28 @@ DST( movb %cl, (%edi) )
3305 /* Version for PentiumII/PPro */
3306
3307 #define ROUND1(x) \
3308+ nop; nop; nop; \
3309 SRC(movl x(%esi), %ebx ) ; \
3310 addl %ebx, %eax ; \
3311- DST(movl %ebx, x(%edi) ) ;
3312+ DST(movl %ebx, %es:x(%edi));
3313
3314 #define ROUND(x) \
3315+ nop; nop; nop; \
3316 SRC(movl x(%esi), %ebx ) ; \
3317 adcl %ebx, %eax ; \
3318- DST(movl %ebx, x(%edi) ) ;
3319+ DST(movl %ebx, %es:x(%edi));
3320
3321 #define ARGBASE 12
3322-
3323+
3324+csum_partial_copy_generic_to_user:
3325+ pushl $(__USER_DS)
3326+ popl %es
3327+ jmp csum_partial_copy_generic
3328+
3329+csum_partial_copy_generic_from_user:
3330+ pushl $(__USER_DS)
3331+ popl %ds
3332+
3333 csum_partial_copy_generic:
3334 pushl %ebx
3335 pushl %edi
3336@@ -439,7 +466,7 @@ csum_partial_copy_generic:
3337 subl %ebx, %edi
3338 lea -1(%esi),%edx
3339 andl $-32,%edx
3340- lea 3f(%ebx,%ebx), %ebx
3341+ lea 3f(%ebx,%ebx,2), %ebx
3342 testl %esi, %esi
3343 jmp *%ebx
3344 1: addl $64,%esi
3345@@ -460,19 +487,19 @@ csum_partial_copy_generic:
3346 jb 5f
3347 SRC( movw (%esi), %dx )
3348 leal 2(%esi), %esi
3349-DST( movw %dx, (%edi) )
3350+DST( movw %dx, %es:(%edi) )
3351 leal 2(%edi), %edi
3352 je 6f
3353 shll $16,%edx
3354 5:
3355 SRC( movb (%esi), %dl )
3356-DST( movb %dl, (%edi) )
3357+DST( movb %dl, %es:(%edi) )
3358 6: addl %edx, %eax
3359 adcl $0, %eax
3360 7:
3361 .section .fixup, "ax"
3362 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
3363- movl $-EFAULT, (%ebx)
3364+ movl $-EFAULT, %ss:(%ebx)
3365 # zero the complete destination (computing the rest is too much work)
3366 movl ARGBASE+8(%esp),%edi # dst
3367 movl ARGBASE+12(%esp),%ecx # len
3368@@ -480,10 +507,14 @@ DST( movb %dl, (%edi) )
3369 rep; stosb
3370 jmp 7b
3371 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
3372- movl $-EFAULT, (%ebx)
3373+ movl $-EFAULT, %ss:(%ebx)
3374 jmp 7b
3375 .previous
3376
3377+ pushl %ss
3378+ popl %ds
3379+ pushl %ss
3380+ popl %es
3381 popl %esi
3382 popl %edi
3383 popl %ebx
3384diff -urNp linux-2.6.18/arch/i386/lib/getuser.S linux-2.6.18/arch/i386/lib/getuser.S
3385--- linux-2.6.18/arch/i386/lib/getuser.S 2006-09-19 23:42:06.000000000 -0400
3386+++ linux-2.6.18/arch/i386/lib/getuser.S 2006-09-22 20:45:03.000000000 -0400
3387@@ -9,6 +9,7 @@
3388 * return value.
3389 */
3390 #include <asm/thread_info.h>
3391+#include <asm/segment.h>
3392
3393
3394 /*
3395@@ -30,8 +31,12 @@ __get_user_1:
3396 GET_THREAD_INFO(%edx)
3397 cmpl TI_addr_limit(%edx),%eax
3398 jae bad_get_user
3399+ pushl $(__USER_DS)
3400+ popl %ds
3401 1: movzbl (%eax),%edx
3402 xorl %eax,%eax
3403+ pushl %ss
3404+ pop %ds
3405 ret
3406
3407 .align 4
3408@@ -42,7 +47,11 @@ __get_user_2:
3409 GET_THREAD_INFO(%edx)
3410 cmpl TI_addr_limit(%edx),%eax
3411 jae bad_get_user
3412+ pushl $(__USER_DS)
3413+ popl %ds
3414 2: movzwl -1(%eax),%edx
3415+ pushl %ss
3416+ pop %ds
3417 xorl %eax,%eax
3418 ret
3419
3420@@ -54,11 +63,17 @@ __get_user_4:
3421 GET_THREAD_INFO(%edx)
3422 cmpl TI_addr_limit(%edx),%eax
3423 jae bad_get_user
3424+ pushl $(__USER_DS)
3425+ popl %ds
3426 3: movl -3(%eax),%edx
3427+ pushl %ss
3428+ pop %ds
3429 xorl %eax,%eax
3430 ret
3431
3432 bad_get_user:
3433+ pushl %ss
3434+ pop %ds
3435 xorl %edx,%edx
3436 movl $-14,%eax
3437 ret
3438diff -urNp linux-2.6.18/arch/i386/lib/mmx.c linux-2.6.18/arch/i386/lib/mmx.c
3439--- linux-2.6.18/arch/i386/lib/mmx.c 2006-09-19 23:42:06.000000000 -0400
3440+++ linux-2.6.18/arch/i386/lib/mmx.c 2006-09-22 20:45:03.000000000 -0400
3441@@ -47,14 +47,30 @@ void *_mmx_memcpy(void *to, const void *
3442 " prefetch 256(%0)\n"
3443 "2: \n"
3444 ".section .fixup, \"ax\"\n"
3445- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
3446+ "3: \n"
3447+
3448+#ifdef CONFIG_PAX_KERNEXEC
3449+ " cli\n"
3450+ " movl %%cr0, %%eax\n"
3451+ " andl $0xFFFEFFFF, %%eax\n"
3452+ " movl %%eax, %%cr0\n"
3453+#endif
3454+
3455+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
3456+
3457+#ifdef CONFIG_PAX_KERNEXEC
3458+ " orl $0x00010000, %%eax\n"
3459+ " movl %%eax, %%cr0\n"
3460+ " sti\n"
3461+#endif
3462+
3463 " jmp 2b\n"
3464 ".previous\n"
3465 ".section __ex_table,\"a\"\n"
3466 " .align 4\n"
3467 " .long 1b, 3b\n"
3468 ".previous"
3469- : : "r" (from) );
3470+ : : "r" (from) : "ax");
3471
3472
3473 for(; i>5; i--)
3474@@ -78,14 +94,30 @@ void *_mmx_memcpy(void *to, const void *
3475 " movq %%mm2, 48(%1)\n"
3476 " movq %%mm3, 56(%1)\n"
3477 ".section .fixup, \"ax\"\n"
3478- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
3479+ "3:\n"
3480+
3481+#ifdef CONFIG_PAX_KERNEXEC
3482+ " cli\n"
3483+ " movl %%cr0, %%eax\n"
3484+ " andl $0xFFFEFFFF, %%eax\n"
3485+ " movl %%eax, %%cr0\n"
3486+#endif
3487+
3488+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
3489+
3490+#ifdef CONFIG_PAX_KERNEXEC
3491+ " orl $0x00010000, %%eax\n"
3492+ " movl %%eax, %%cr0\n"
3493+ " sti\n"
3494+#endif
3495+
3496 " jmp 2b\n"
3497 ".previous\n"
3498 ".section __ex_table,\"a\"\n"
3499 " .align 4\n"
3500 " .long 1b, 3b\n"
3501 ".previous"
3502- : : "r" (from), "r" (to) : "memory");
3503+ : : "r" (from), "r" (to) : "memory", "ax");
3504 from+=64;
3505 to+=64;
3506 }
3507@@ -178,14 +210,30 @@ static void fast_copy_page(void *to, voi
3508 " prefetch 256(%0)\n"
3509 "2: \n"
3510 ".section .fixup, \"ax\"\n"
3511- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
3512+ "3: \n"
3513+
3514+#ifdef CONFIG_PAX_KERNEXEC
3515+ " cli\n"
3516+ " movl %%cr0, %%eax\n"
3517+ " andl $0xFFFEFFFF, %%eax\n"
3518+ " movl %%eax, %%cr0\n"
3519+#endif
3520+
3521+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
3522+
3523+#ifdef CONFIG_PAX_KERNEXEC
3524+ " orl $0x00010000, %%eax\n"
3525+ " movl %%eax, %%cr0\n"
3526+ " sti\n"
3527+#endif
3528+
3529 " jmp 2b\n"
3530 ".previous\n"
3531 ".section __ex_table,\"a\"\n"
3532 " .align 4\n"
3533 " .long 1b, 3b\n"
3534 ".previous"
3535- : : "r" (from) );
3536+ : : "r" (from) : "ax");
3537
3538 for(i=0; i<(4096-320)/64; i++)
3539 {
3540@@ -208,14 +256,30 @@ static void fast_copy_page(void *to, voi
3541 " movq 56(%0), %%mm7\n"
3542 " movntq %%mm7, 56(%1)\n"
3543 ".section .fixup, \"ax\"\n"
3544- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
3545+ "3:\n"
3546+
3547+#ifdef CONFIG_PAX_KERNEXEC
3548+ " cli\n"
3549+ " movl %%cr0, %%eax\n"
3550+ " andl $0xFFFEFFFF, %%eax\n"
3551+ " movl %%eax, %%cr0\n"
3552+#endif
3553+
3554+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
3555+
3556+#ifdef CONFIG_PAX_KERNEXEC
3557+ " orl $0x00010000, %%eax\n"
3558+ " movl %%eax, %%cr0\n"
3559+ " sti\n"
3560+#endif
3561+
3562 " jmp 2b\n"
3563 ".previous\n"
3564 ".section __ex_table,\"a\"\n"
3565 " .align 4\n"
3566 " .long 1b, 3b\n"
3567 ".previous"
3568- : : "r" (from), "r" (to) : "memory");
3569+ : : "r" (from), "r" (to) : "memory", "ax");
3570 from+=64;
3571 to+=64;
3572 }
3573@@ -308,14 +372,30 @@ static void fast_copy_page(void *to, voi
3574 " prefetch 256(%0)\n"
3575 "2: \n"
3576 ".section .fixup, \"ax\"\n"
3577- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
3578+ "3: \n"
3579+
3580+#ifdef CONFIG_PAX_KERNEXEC
3581+ " cli\n"
3582+ " movl %%cr0, %%eax\n"
3583+ " andl $0xFFFEFFFF, %%eax\n"
3584+ " movl %%eax, %%cr0\n"
3585+#endif
3586+
3587+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
3588+
3589+#ifdef CONFIG_PAX_KERNEXEC
3590+ " orl $0x00010000, %%eax\n"
3591+ " movl %%eax, %%cr0\n"
3592+ " sti\n"
3593+#endif
3594+
3595 " jmp 2b\n"
3596 ".previous\n"
3597 ".section __ex_table,\"a\"\n"
3598 " .align 4\n"
3599 " .long 1b, 3b\n"
3600 ".previous"
3601- : : "r" (from) );
3602+ : : "r" (from) : "ax");
3603
3604 for(i=0; i<4096/64; i++)
3605 {
3606@@ -338,14 +418,30 @@ static void fast_copy_page(void *to, voi
3607 " movq %%mm2, 48(%1)\n"
3608 " movq %%mm3, 56(%1)\n"
3609 ".section .fixup, \"ax\"\n"
3610- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
3611+ "3:\n"
3612+
3613+#ifdef CONFIG_PAX_KERNEXEC
3614+ " cli\n"
3615+ " movl %%cr0, %%eax\n"
3616+ " andl $0xFFFEFFFF, %%eax\n"
3617+ " movl %%eax, %%cr0\n"
3618+#endif
3619+
3620+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
3621+
3622+#ifdef CONFIG_PAX_KERNEXEC
3623+ " orl $0x00010000, %%eax\n"
3624+ " movl %%eax, %%cr0\n"
3625+ " sti\n"
3626+#endif
3627+
3628 " jmp 2b\n"
3629 ".previous\n"
3630 ".section __ex_table,\"a\"\n"
3631 " .align 4\n"
3632 " .long 1b, 3b\n"
3633 ".previous"
3634- : : "r" (from), "r" (to) : "memory");
3635+ : : "r" (from), "r" (to) : "memory", "ax");
3636 from+=64;
3637 to+=64;
3638 }
3639diff -urNp linux-2.6.18/arch/i386/lib/putuser.S linux-2.6.18/arch/i386/lib/putuser.S
3640--- linux-2.6.18/arch/i386/lib/putuser.S 2006-09-19 23:42:06.000000000 -0400
3641+++ linux-2.6.18/arch/i386/lib/putuser.S 2006-09-22 20:45:03.000000000 -0400
3642@@ -9,6 +9,7 @@
3643 * return value.
3644 */
3645 #include <asm/thread_info.h>
3646+#include <asm/segment.h>
3647
3648
3649 /*
3650@@ -33,7 +34,11 @@ __put_user_1:
3651 ENTER
3652 cmpl TI_addr_limit(%ebx),%ecx
3653 jae bad_put_user
3654+ pushl $(__USER_DS)
3655+ popl %ds
3656 1: movb %al,(%ecx)
3657+ pushl %ss
3658+ popl %ds
3659 xorl %eax,%eax
3660 EXIT
3661
3662@@ -45,7 +50,11 @@ __put_user_2:
3663 subl $1,%ebx
3664 cmpl %ebx,%ecx
3665 jae bad_put_user
3666+ pushl $(__USER_DS)
3667+ popl %ds
3668 2: movw %ax,(%ecx)
3669+ pushl %ss
3670+ popl %ds
3671 xorl %eax,%eax
3672 EXIT
3673
3674@@ -57,7 +66,11 @@ __put_user_4:
3675 subl $3,%ebx
3676 cmpl %ebx,%ecx
3677 jae bad_put_user
3678+ pushl $(__USER_DS)
3679+ popl %ds
3680 3: movl %eax,(%ecx)
3681+ pushl %ss
3682+ popl %ds
3683 xorl %eax,%eax
3684 EXIT
3685
3686@@ -69,12 +82,18 @@ __put_user_8:
3687 subl $7,%ebx
3688 cmpl %ebx,%ecx
3689 jae bad_put_user
3690+ pushl $(__USER_DS)
3691+ popl %ds
3692 4: movl %eax,(%ecx)
3693 5: movl %edx,4(%ecx)
3694+ pushl %ss
3695+ popl %ds
3696 xorl %eax,%eax
3697 EXIT
3698
3699 bad_put_user:
3700+ pushl %ss
3701+ popl %ds
3702 movl $-14,%eax
3703 EXIT
3704
3705diff -urNp linux-2.6.18/arch/i386/lib/usercopy.c linux-2.6.18/arch/i386/lib/usercopy.c
3706--- linux-2.6.18/arch/i386/lib/usercopy.c 2006-09-19 23:42:06.000000000 -0400
3707+++ linux-2.6.18/arch/i386/lib/usercopy.c 2006-09-22 20:45:03.000000000 -0400
3708@@ -32,6 +32,7 @@ do { \
3709 int __d0, __d1, __d2; \
3710 might_sleep(); \
3711 __asm__ __volatile__( \
3712+ " movw %w10,%%ds\n" \
3713 " testl %1,%1\n" \
3714 " jz 2f\n" \
3715 "0: lodsb\n" \
3716@@ -42,6 +43,8 @@ do { \
3717 " jnz 0b\n" \
3718 "1: subl %1,%0\n" \
3719 "2:\n" \
3720+ " pushl %%ss\n" \
3721+ " popl %%ds\n" \
3722 ".section .fixup,\"ax\"\n" \
3723 "3: movl %5,%0\n" \
3724 " jmp 2b\n" \
3725@@ -52,7 +55,8 @@ do { \
3726 ".previous" \
3727 : "=d"(res), "=c"(count), "=&a" (__d0), "=&S" (__d1), \
3728 "=&D" (__d2) \
3729- : "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
3730+ : "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst),\
3731+ "r"(__USER_DS) \
3732 : "memory"); \
3733 } while (0)
3734
3735@@ -122,10 +126,13 @@ do { \
3736 int __d0; \
3737 might_sleep(); \
3738 __asm__ __volatile__( \
3739+ " movw %w6,%%es\n" \
3740 "0: rep; stosl\n" \
3741 " movl %2,%0\n" \
3742 "1: rep; stosb\n" \
3743 "2:\n" \
3744+ " pushl %%ss\n" \
3745+ " popl %%es\n" \
3746 ".section .fixup,\"ax\"\n" \
3747 "3: lea 0(%2,%0,4),%0\n" \
3748 " jmp 2b\n" \
3749@@ -136,7 +143,8 @@ do { \
3750 " .long 1b,2b\n" \
3751 ".previous" \
3752 : "=&c"(size), "=&D" (__d0) \
3753- : "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0)); \
3754+ : "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0), \
3755+ "r"(__USER_DS)); \
3756 } while (0)
3757
3758 /**
3759@@ -197,14 +205,17 @@ long strnlen_user(const char __user *s,
3760 might_sleep();
3761
3762 __asm__ __volatile__(
3763+ " movw %w8,%%es\n"
3764 " testl %0, %0\n"
3765 " jz 3f\n"
3766- " andl %0,%%ecx\n"
3767+ " movl %0,%%ecx\n"
3768 "0: repne; scasb\n"
3769 " setne %%al\n"
3770 " subl %%ecx,%0\n"
3771 " addl %0,%%eax\n"
3772 "1:\n"
3773+ " pushl %%ss\n"
3774+ " popl %%es\n"
3775 ".section .fixup,\"ax\"\n"
3776 "2: xorl %%eax,%%eax\n"
3777 " jmp 1b\n"
3778@@ -216,7 +227,7 @@ long strnlen_user(const char __user *s,
3779 " .long 0b,2b\n"
3780 ".previous"
3781 :"=r" (n), "=D" (s), "=a" (res), "=c" (tmp)
3782- :"0" (n), "1" (s), "2" (0), "3" (mask)
3783+ :"0" (n), "1" (s), "2" (0), "3" (mask), "r" (__USER_DS)
3784 :"cc");
3785 return res & mask;
3786 }
3787@@ -228,6 +239,7 @@ __copy_user_intel(void __user *to, const
3788 {
3789 int d0, d1;
3790 __asm__ __volatile__(
3791+ " movw %w6, %%es\n"
3792 " .align 2,0x90\n"
3793 "1: movl 32(%4), %%eax\n"
3794 " cmpl $67, %0\n"
3795@@ -236,36 +248,36 @@ __copy_user_intel(void __user *to, const
3796 " .align 2,0x90\n"
3797 "3: movl 0(%4), %%eax\n"
3798 "4: movl 4(%4), %%edx\n"
3799- "5: movl %%eax, 0(%3)\n"
3800- "6: movl %%edx, 4(%3)\n"
3801+ "5: movl %%eax, %%es:0(%3)\n"
3802+ "6: movl %%edx, %%es:4(%3)\n"
3803 "7: movl 8(%4), %%eax\n"
3804 "8: movl 12(%4),%%edx\n"
3805- "9: movl %%eax, 8(%3)\n"
3806- "10: movl %%edx, 12(%3)\n"
3807+ "9: movl %%eax, %%es:8(%3)\n"
3808+ "10: movl %%edx, %%es:12(%3)\n"
3809 "11: movl 16(%4), %%eax\n"
3810 "12: movl 20(%4), %%edx\n"
3811- "13: movl %%eax, 16(%3)\n"
3812- "14: movl %%edx, 20(%3)\n"
3813+ "13: movl %%eax, %%es:16(%3)\n"
3814+ "14: movl %%edx, %%es:20(%3)\n"
3815 "15: movl 24(%4), %%eax\n"
3816 "16: movl 28(%4), %%edx\n"
3817- "17: movl %%eax, 24(%3)\n"
3818- "18: movl %%edx, 28(%3)\n"
3819+ "17: movl %%eax, %%es:24(%3)\n"
3820+ "18: movl %%edx, %%es:28(%3)\n"
3821 "19: movl 32(%4), %%eax\n"
3822 "20: movl 36(%4), %%edx\n"
3823- "21: movl %%eax, 32(%3)\n"
3824- "22: movl %%edx, 36(%3)\n"
3825+ "21: movl %%eax, %%es:32(%3)\n"
3826+ "22: movl %%edx, %%es:36(%3)\n"
3827 "23: movl 40(%4), %%eax\n"
3828 "24: movl 44(%4), %%edx\n"
3829- "25: movl %%eax, 40(%3)\n"
3830- "26: movl %%edx, 44(%3)\n"
3831+ "25: movl %%eax, %%es:40(%3)\n"
3832+ "26: movl %%edx, %%es:44(%3)\n"
3833 "27: movl 48(%4), %%eax\n"
3834 "28: movl 52(%4), %%edx\n"
3835- "29: movl %%eax, 48(%3)\n"
3836- "30: movl %%edx, 52(%3)\n"
3837+ "29: movl %%eax, %%es:48(%3)\n"
3838+ "30: movl %%edx, %%es:52(%3)\n"
3839 "31: movl 56(%4), %%eax\n"
3840 "32: movl 60(%4), %%edx\n"
3841- "33: movl %%eax, 56(%3)\n"
3842- "34: movl %%edx, 60(%3)\n"
3843+ "33: movl %%eax, %%es:56(%3)\n"
3844+ "34: movl %%edx, %%es:60(%3)\n"
3845 " addl $-64, %0\n"
3846 " addl $64, %4\n"
3847 " addl $64, %3\n"
3848@@ -279,6 +291,8 @@ __copy_user_intel(void __user *to, const
3849 "36: movl %%eax, %0\n"
3850 "37: rep; movsb\n"
3851 "100:\n"
3852+ " pushl %%ss\n"
3853+ " popl %%es\n"
3854 ".section .fixup,\"ax\"\n"
3855 "101: lea 0(%%eax,%0,4),%0\n"
3856 " jmp 100b\n"
3857@@ -325,7 +339,7 @@ __copy_user_intel(void __user *to, const
3858 " .long 99b,101b\n"
3859 ".previous"
3860 : "=&c"(size), "=&D" (d0), "=&S" (d1)
3861- : "1"(to), "2"(from), "0"(size)
3862+ : "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
3863 : "eax", "edx", "memory");
3864 return size;
3865 }
3866@@ -335,6 +349,7 @@ __copy_user_zeroing_intel(void *to, cons
3867 {
3868 int d0, d1;
3869 __asm__ __volatile__(
3870+ " movw %w6, %%ds\n"
3871 " .align 2,0x90\n"
3872 "0: movl 32(%4), %%eax\n"
3873 " cmpl $67, %0\n"
3874@@ -343,36 +358,36 @@ __copy_user_zeroing_intel(void *to, cons
3875 " .align 2,0x90\n"
3876 "2: movl 0(%4), %%eax\n"
3877 "21: movl 4(%4), %%edx\n"
3878- " movl %%eax, 0(%3)\n"
3879- " movl %%edx, 4(%3)\n"
3880+ " movl %%eax, %%es:0(%3)\n"
3881+ " movl %%edx, %%es:4(%3)\n"
3882 "3: movl 8(%4), %%eax\n"
3883 "31: movl 12(%4),%%edx\n"
3884- " movl %%eax, 8(%3)\n"
3885- " movl %%edx, 12(%3)\n"
3886+ " movl %%eax, %%es:8(%3)\n"
3887+ " movl %%edx, %%es:12(%3)\n"
3888 "4: movl 16(%4), %%eax\n"
3889 "41: movl 20(%4), %%edx\n"
3890- " movl %%eax, 16(%3)\n"
3891- " movl %%edx, 20(%3)\n"
3892+ " movl %%eax, %%es:16(%3)\n"
3893+ " movl %%edx, %%es:20(%3)\n"
3894 "10: movl 24(%4), %%eax\n"
3895 "51: movl 28(%4), %%edx\n"
3896- " movl %%eax, 24(%3)\n"
3897- " movl %%edx, 28(%3)\n"
3898+ " movl %%eax, %%es:24(%3)\n"
3899+ " movl %%edx, %%es:28(%3)\n"
3900 "11: movl 32(%4), %%eax\n"
3901 "61: movl 36(%4), %%edx\n"
3902- " movl %%eax, 32(%3)\n"
3903- " movl %%edx, 36(%3)\n"
3904+ " movl %%eax, %%es:32(%3)\n"
3905+ " movl %%edx, %%es:36(%3)\n"
3906 "12: movl 40(%4), %%eax\n"
3907 "71: movl 44(%4), %%edx\n"
3908- " movl %%eax, 40(%3)\n"
3909- " movl %%edx, 44(%3)\n"
3910+ " movl %%eax, %%es:40(%3)\n"
3911+ " movl %%edx, %%es:44(%3)\n"
3912 "13: movl 48(%4), %%eax\n"
3913 "81: movl 52(%4), %%edx\n"
3914- " movl %%eax, 48(%3)\n"
3915- " movl %%edx, 52(%3)\n"
3916+ " movl %%eax, %%es:48(%3)\n"
3917+ " movl %%edx, %%es:52(%3)\n"
3918 "14: movl 56(%4), %%eax\n"
3919 "91: movl 60(%4), %%edx\n"
3920- " movl %%eax, 56(%3)\n"
3921- " movl %%edx, 60(%3)\n"
3922+ " movl %%eax, %%es:56(%3)\n"
3923+ " movl %%edx, %%es:60(%3)\n"
3924 " addl $-64, %0\n"
3925 " addl $64, %4\n"
3926 " addl $64, %3\n"
3927@@ -386,6 +401,8 @@ __copy_user_zeroing_intel(void *to, cons
3928 " movl %%eax,%0\n"
3929 "7: rep; movsb\n"
3930 "8:\n"
3931+ " pushl %%ss\n"
3932+ " popl %%ds\n"
3933 ".section .fixup,\"ax\"\n"
3934 "9: lea 0(%%eax,%0,4),%0\n"
3935 "16: pushl %0\n"
3936@@ -420,7 +437,7 @@ __copy_user_zeroing_intel(void *to, cons
3937 " .long 7b,16b\n"
3938 ".previous"
3939 : "=&c"(size), "=&D" (d0), "=&S" (d1)
3940- : "1"(to), "2"(from), "0"(size)
3941+ : "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
3942 : "eax", "edx", "memory");
3943 return size;
3944 }
3945@@ -436,6 +453,7 @@ static unsigned long __copy_user_zeroing
3946 int d0, d1;
3947
3948 __asm__ __volatile__(
3949+ " movw %w6, %%ds\n"
3950 " .align 2,0x90\n"
3951 "0: movl 32(%4), %%eax\n"
3952 " cmpl $67, %0\n"
3953@@ -444,36 +462,36 @@ static unsigned long __copy_user_zeroing
3954 " .align 2,0x90\n"
3955 "2: movl 0(%4), %%eax\n"
3956 "21: movl 4(%4), %%edx\n"
3957- " movnti %%eax, 0(%3)\n"
3958- " movnti %%edx, 4(%3)\n"
3959+ " movnti %%eax, %%es:0(%3)\n"
3960+ " movnti %%edx, %%es:4(%3)\n"
3961 "3: movl 8(%4), %%eax\n"
3962 "31: movl 12(%4),%%edx\n"
3963- " movnti %%eax, 8(%3)\n"
3964- " movnti %%edx, 12(%3)\n"
3965+ " movnti %%eax, %%es:8(%3)\n"
3966+ " movnti %%edx, %%es:12(%3)\n"
3967 "4: movl 16(%4), %%eax\n"
3968 "41: movl 20(%4), %%edx\n"
3969- " movnti %%eax, 16(%3)\n"
3970- " movnti %%edx, 20(%3)\n"
3971+ " movnti %%eax, %%es:16(%3)\n"
3972+ " movnti %%edx, %%es:20(%3)\n"
3973 "10: movl 24(%4), %%eax\n"
3974 "51: movl 28(%4), %%edx\n"
3975- " movnti %%eax, 24(%3)\n"
3976- " movnti %%edx, 28(%3)\n"
3977+ " movnti %%eax, %%es:24(%3)\n"
3978+ " movnti %%edx, %%es:28(%3)\n"
3979 "11: movl 32(%4), %%eax\n"
3980 "61: movl 36(%4), %%edx\n"
3981- " movnti %%eax, 32(%3)\n"
3982- " movnti %%edx, 36(%3)\n"
3983+ " movnti %%eax, %%es:32(%3)\n"
3984+ " movnti %%edx, %%es:36(%3)\n"
3985 "12: movl 40(%4), %%eax\n"
3986 "71: movl 44(%4), %%edx\n"
3987- " movnti %%eax, 40(%3)\n"
3988- " movnti %%edx, 44(%3)\n"
3989+ " movnti %%eax, %%es:40(%3)\n"
3990+ " movnti %%edx, %%es:44(%3)\n"
3991 "13: movl 48(%4), %%eax\n"
3992 "81: movl 52(%4), %%edx\n"
3993- " movnti %%eax, 48(%3)\n"
3994- " movnti %%edx, 52(%3)\n"
3995+ " movnti %%eax, %%es:48(%3)\n"
3996+ " movnti %%edx, %%es:52(%3)\n"
3997 "14: movl 56(%4), %%eax\n"
3998 "91: movl 60(%4), %%edx\n"
3999- " movnti %%eax, 56(%3)\n"
4000- " movnti %%edx, 60(%3)\n"
4001+ " movnti %%eax, %%es:56(%3)\n"
4002+ " movnti %%edx, %%es:60(%3)\n"
4003 " addl $-64, %0\n"
4004 " addl $64, %4\n"
4005 " addl $64, %3\n"
4006@@ -488,6 +506,8 @@ static unsigned long __copy_user_zeroing
4007 " movl %%eax,%0\n"
4008 "7: rep; movsb\n"
4009 "8:\n"
4010+ " pushl %%ss\n"
4011+ " popl %%ds\n"
4012 ".section .fixup,\"ax\"\n"
4013 "9: lea 0(%%eax,%0,4),%0\n"
4014 "16: pushl %0\n"
4015@@ -522,7 +542,7 @@ static unsigned long __copy_user_zeroing
4016 " .long 7b,16b\n"
4017 ".previous"
4018 : "=&c"(size), "=&D" (d0), "=&S" (d1)
4019- : "1"(to), "2"(from), "0"(size)
4020+ : "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
4021 : "eax", "edx", "memory");
4022 return size;
4023 }
4024@@ -533,6 +553,7 @@ static unsigned long __copy_user_intel_n
4025 int d0, d1;
4026
4027 __asm__ __volatile__(
4028+ " movw %w6, %%ds\n"
4029 " .align 2,0x90\n"
4030 "0: movl 32(%4), %%eax\n"
4031 " cmpl $67, %0\n"
4032@@ -541,36 +562,36 @@ static unsigned long __copy_user_intel_n
4033 " .align 2,0x90\n"
4034 "2: movl 0(%4), %%eax\n"
4035 "21: movl 4(%4), %%edx\n"
4036- " movnti %%eax, 0(%3)\n"
4037- " movnti %%edx, 4(%3)\n"
4038+ " movnti %%eax, %%es:0(%3)\n"
4039+ " movnti %%edx, %%es:4(%3)\n"
4040 "3: movl 8(%4), %%eax\n"
4041 "31: movl 12(%4),%%edx\n"
4042- " movnti %%eax, 8(%3)\n"
4043- " movnti %%edx, 12(%3)\n"
4044+ " movnti %%eax, %%es:8(%3)\n"
4045+ " movnti %%edx, %%es:12(%3)\n"
4046 "4: movl 16(%4), %%eax\n"
4047 "41: movl 20(%4), %%edx\n"
4048- " movnti %%eax, 16(%3)\n"
4049- " movnti %%edx, 20(%3)\n"
4050+ " movnti %%eax, %%es:16(%3)\n"
4051+ " movnti %%edx, %%es:20(%3)\n"
4052 "10: movl 24(%4), %%eax\n"
4053 "51: movl 28(%4), %%edx\n"
4054- " movnti %%eax, 24(%3)\n"
4055- " movnti %%edx, 28(%3)\n"
4056+ " movnti %%eax, %%es:24(%3)\n"
4057+ " movnti %%edx, %%es:28(%3)\n"
4058 "11: movl 32(%4), %%eax\n"
4059 "61: movl 36(%4), %%edx\n"
4060- " movnti %%eax, 32(%3)\n"
4061- " movnti %%edx, 36(%3)\n"
4062+ " movnti %%eax, %%es:32(%3)\n"
4063+ " movnti %%edx, %%es:36(%3)\n"
4064 "12: movl 40(%4), %%eax\n"
4065 "71: movl 44(%4), %%edx\n"
4066- " movnti %%eax, 40(%3)\n"
4067- " movnti %%edx, 44(%3)\n"
4068+ " movnti %%eax, %%es:40(%3)\n"
4069+ " movnti %%edx, %%es:44(%3)\n"
4070 "13: movl 48(%4), %%eax\n"
4071 "81: movl 52(%4), %%edx\n"
4072- " movnti %%eax, 48(%3)\n"
4073- " movnti %%edx, 52(%3)\n"
4074+ " movnti %%eax, %%es:48(%3)\n"
4075+ " movnti %%edx, %%es:52(%3)\n"
4076 "14: movl 56(%4), %%eax\n"
4077 "91: movl 60(%4), %%edx\n"
4078- " movnti %%eax, 56(%3)\n"
4079- " movnti %%edx, 60(%3)\n"
4080+ " movnti %%eax, %%es:56(%3)\n"
4081+ " movnti %%edx, %%es:60(%3)\n"
4082 " addl $-64, %0\n"
4083 " addl $64, %4\n"
4084 " addl $64, %3\n"
4085@@ -585,6 +606,8 @@ static unsigned long __copy_user_intel_n
4086 " movl %%eax,%0\n"
4087 "7: rep; movsb\n"
4088 "8:\n"
4089+ " pushl %%ss\n"
4090+ " popl %%ds\n"
4091 ".section .fixup,\"ax\"\n"
4092 "9: lea 0(%%eax,%0,4),%0\n"
4093 "16: jmp 8b\n"
4094@@ -613,7 +636,7 @@ static unsigned long __copy_user_intel_n
4095 " .long 7b,16b\n"
4096 ".previous"
4097 : "=&c"(size), "=&D" (d0), "=&S" (d1)
4098- : "1"(to), "2"(from), "0"(size)
4099+ : "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
4100 : "eax", "edx", "memory");
4101 return size;
4102 }
4103@@ -637,6 +660,7 @@ unsigned long __copy_user_zeroing_intel_
4104 do { \
4105 int __d0, __d1, __d2; \
4106 __asm__ __volatile__( \
4107+ " movw %w8,%%es\n" \
4108 " cmp $7,%0\n" \
4109 " jbe 1f\n" \
4110 " movl %1,%0\n" \
4111@@ -652,6 +676,8 @@ do { \
4112 " movl %3,%0\n" \
4113 "1: rep; movsb\n" \
4114 "2:\n" \
4115+ " pushl %%ss\n" \
4116+ " popl %%es\n" \
4117 ".section .fixup,\"ax\"\n" \
4118 "5: addl %3,%0\n" \
4119 " jmp 2b\n" \
4120@@ -665,7 +691,7 @@ do { \
4121 " .long 1b,2b\n" \
4122 ".previous" \
4123 : "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2) \
4124- : "3"(size), "0"(size), "1"(to), "2"(from) \
4125+ : "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)\
4126 : "memory"); \
4127 } while (0)
4128
4129@@ -673,6 +699,7 @@ do { \
4130 do { \
4131 int __d0, __d1, __d2; \
4132 __asm__ __volatile__( \
4133+ " movw %w8,%%ds\n" \
4134 " cmp $7,%0\n" \
4135 " jbe 1f\n" \
4136 " movl %1,%0\n" \
4137@@ -688,6 +715,8 @@ do { \
4138 " movl %3,%0\n" \
4139 "1: rep; movsb\n" \
4140 "2:\n" \
4141+ " pushl %%ss\n" \
4142+ " popl %%ds\n" \
4143 ".section .fixup,\"ax\"\n" \
4144 "5: addl %3,%0\n" \
4145 " jmp 6f\n" \
4146@@ -707,7 +736,7 @@ do { \
4147 " .long 1b,6b\n" \
4148 ".previous" \
4149 : "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2) \
4150- : "3"(size), "0"(size), "1"(to), "2"(from) \
4151+ : "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)\
4152 : "memory"); \
4153 } while (0)
4154
4155@@ -877,3 +906,45 @@ copy_from_user(void *to, const void __us
4156 return n;
4157 }
4158 EXPORT_SYMBOL(copy_from_user);
4159+
4160+#ifdef CONFIG_PAX_MEMORY_UDEREF
4161+void __set_fs(mm_segment_t x, int cpu)
4162+{
4163+ unsigned long limit = x.seg;
4164+
4165+ current_thread_info()->addr_limit = x;
4166+ if (likely(limit)) {
4167+ limit -= 1UL;
4168+ limit >>= 12;
4169+ }
4170+
4171+ get_cpu_gdt_table(cpu)[GDT_ENTRY_DEFAULT_USER_DS].a = (limit & 0xFFFFUL);
4172+ get_cpu_gdt_table(cpu)[GDT_ENTRY_DEFAULT_USER_DS].b = (limit & 0xF0000UL) | 0xC0F300UL;
4173+}
4174+
4175+void set_fs(mm_segment_t x)
4176+{
4177+ int cpu = get_cpu();
4178+
4179+#ifdef CONFIG_PAX_KERNEXEC
4180+ unsigned long cr0;
4181+
4182+ pax_open_kernel(cr0);
4183+#endif
4184+
4185+ __set_fs(x, cpu);
4186+
4187+#ifdef CONFIG_PAX_KERNEXEC
4188+ pax_close_kernel(cr0);
4189+#endif
4190+
4191+ put_cpu_no_resched();
4192+}
4193+#else
4194+void set_fs(mm_segment_t x)
4195+{
4196+ current_thread_info()->addr_limit = x;
4197+}
4198+#endif
4199+
4200+EXPORT_SYMBOL(set_fs);
4201diff -urNp linux-2.6.18/arch/i386/mach-voyager/voyager_smp.c linux-2.6.18/arch/i386/mach-voyager/voyager_smp.c
4202--- linux-2.6.18/arch/i386/mach-voyager/voyager_smp.c 2006-09-19 23:42:06.000000000 -0400
4203+++ linux-2.6.18/arch/i386/mach-voyager/voyager_smp.c 2006-09-22 20:45:03.000000000 -0400
4204@@ -1295,7 +1295,7 @@ smp_local_timer_interrupt(struct pt_regs
4205 per_cpu(prof_counter, cpu);
4206 }
4207
4208- update_process_times(user_mode_vm(regs));
4209+ update_process_times(user_mode(regs));
4210 }
4211
4212 if( ((1<<cpu) & voyager_extended_vic_processors) == 0)
4213diff -urNp linux-2.6.18/arch/i386/mm/boot_ioremap.c linux-2.6.18/arch/i386/mm/boot_ioremap.c
4214--- linux-2.6.18/arch/i386/mm/boot_ioremap.c 2006-09-19 23:42:06.000000000 -0400
4215+++ linux-2.6.18/arch/i386/mm/boot_ioremap.c 2006-09-22 20:45:03.000000000 -0400
4216@@ -7,53 +7,36 @@
4217 * Written by Dave Hansen <haveblue@us.ibm.com>
4218 */
4219
4220-
4221-/*
4222- * We need to use the 2-level pagetable functions, but CONFIG_X86_PAE
4223- * keeps that from happenning. If anyone has a better way, I'm listening.
4224- *
4225- * boot_pte_t is defined only if this all works correctly
4226- */
4227-
4228-#undef CONFIG_X86_PAE
4229 #include <asm/page.h>
4230 #include <asm/pgtable.h>
4231 #include <asm/tlbflush.h>
4232 #include <linux/init.h>
4233 #include <linux/stddef.h>
4234
4235-/*
4236- * I'm cheating here. It is known that the two boot PTE pages are
4237- * allocated next to each other. I'm pretending that they're just
4238- * one big array.
4239- */
4240-
4241-#define BOOT_PTE_PTRS (PTRS_PER_PTE*2)
4242-#define boot_pte_index(address) \
4243- (((address) >> PAGE_SHIFT) & (BOOT_PTE_PTRS - 1))
4244-
4245-static inline boot_pte_t* boot_vaddr_to_pte(void *address)
4246-{
4247- boot_pte_t* boot_pg = (boot_pte_t*)pg0;
4248- return &boot_pg[boot_pte_index((unsigned long)address)];
4249-}
4250-
4251 /*
4252 * This is only for a caller who is clever enough to page-align
4253 * phys_addr and virtual_source, and who also has a preference
4254 * about which virtual address from which to steal ptes
4255 */
4256-static void __boot_ioremap(unsigned long phys_addr, unsigned long nrpages,
4257- void* virtual_source)
4258+static void __init __boot_ioremap(unsigned long phys_addr, unsigned long nrpages,
4259+ char* virtual_source)
4260 {
4261- boot_pte_t* pte;
4262- int i;
4263- char *vaddr = virtual_source;
4264+ pgd_t *pgd;
4265+ pud_t *pud;
4266+ pmd_t *pmd;
4267+ pte_t* pte;
4268+ unsigned int i;
4269+ unsigned long vaddr = (unsigned long)virtual_source;
4270+
4271+ pgd = pgd_offset_k(vaddr);
4272+ pud = pud_offset(pgd, vaddr);
4273+ pmd = pmd_offset(pud, vaddr);
4274+ pte = pte_offset_kernel(pmd, vaddr);
4275
4276 pte = boot_vaddr_to_pte(virtual_source);
4277 for (i=0; i < nrpages; i++, phys_addr += PAGE_SIZE, pte++) {
4278 set_pte(pte, pfn_pte(phys_addr>>PAGE_SHIFT, PAGE_KERNEL));
4279- __flush_tlb_one(&vaddr[i*PAGE_SIZE]);
4280+ __flush_tlb_one(&virtual_source[i*PAGE_SIZE]);
4281 }
4282 }
4283
4284diff -urNp linux-2.6.18/arch/i386/mm/extable.c linux-2.6.18/arch/i386/mm/extable.c
4285--- linux-2.6.18/arch/i386/mm/extable.c 2006-09-19 23:42:06.000000000 -0400
4286+++ linux-2.6.18/arch/i386/mm/extable.c 2006-09-22 20:45:03.000000000 -0400
4287@@ -11,7 +11,7 @@ int fixup_exception(struct pt_regs *regs
4288 const struct exception_table_entry *fixup;
4289
4290 #ifdef CONFIG_PNPBIOS
4291- if (unlikely((regs->xcs & ~15) == (GDT_ENTRY_PNPBIOS_BASE << 3)))
4292+ if (unlikely(!(regs->eflags & VM_MASK) && ((regs->xcs & 0xFFFCU) == PNP_CS32 || (regs->xcs & 0xFFFCU) == PNP_CS16)))
4293 {
4294 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
4295 extern u32 pnp_bios_is_utter_crap;
4296diff -urNp linux-2.6.18/arch/i386/mm/fault.c linux-2.6.18/arch/i386/mm/fault.c
4297--- linux-2.6.18/arch/i386/mm/fault.c 2006-09-19 23:42:06.000000000 -0400
4298+++ linux-2.6.18/arch/i386/mm/fault.c 2006-09-23 00:26:29.000000000 -0400
4299@@ -22,6 +22,9 @@
4300 #include <linux/highmem.h>
4301 #include <linux/module.h>
4302 #include <linux/kprobes.h>
4303+#include <linux/unistd.h>
4304+#include <linux/compiler.h>
4305+#include <linux/binfmts.h>
4306
4307 #include <asm/system.h>
4308 #include <asm/uaccess.h>
4309@@ -122,9 +125,12 @@ static inline unsigned long get_segment_
4310 *eip_limit = (seg & 3) ? USER_DS.seg : KERNEL_DS.seg;
4311
4312 /* By far the most common cases. */
4313- if (likely(seg == __USER_CS || seg == __KERNEL_CS))
4314+ if (likely(seg == __USER_CS))
4315 return eip;
4316
4317+ if (likely(seg == __KERNEL_CS))
4318+ return eip + __KERNEL_TEXT_OFFSET;
4319+
4320 /* Check the segment exists, is within the current LDT/GDT size,
4321 that kernel/user (ring 0..3) has the appropriate privilege,
4322 that it's a code segment, and get the limit. */
4323@@ -251,6 +257,30 @@ static noinline void force_sig_info_faul
4324
4325 fastcall void do_invalid_op(struct pt_regs *, unsigned long);
4326
4327+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
4328+static int pax_handle_fetch_fault(struct pt_regs *regs);
4329+#endif
4330+
4331+#ifdef CONFIG_PAX_PAGEEXEC
4332+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
4333+{
4334+ pgd_t *pgd;
4335+ pud_t *pud;
4336+ pmd_t *pmd;
4337+
4338+ pgd = pgd_offset(mm, address);
4339+ if (!pgd_present(*pgd))
4340+ return NULL;
4341+ pud = pud_offset(pgd, address);
4342+ if (!pud_present(*pud))
4343+ return NULL;
4344+ pmd = pmd_offset(pud, address);
4345+ if (!pmd_present(*pmd))
4346+ return NULL;
4347+ return pmd;
4348+}
4349+#endif
4350+
4351 static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address)
4352 {
4353 unsigned index = pgd_index(address);
4354@@ -332,13 +362,20 @@ fastcall void __kprobes do_page_fault(st
4355 struct mm_struct *mm;
4356 struct vm_area_struct * vma;
4357 unsigned long address;
4358- unsigned long page;
4359 int write, si_code;
4360
4361+#ifdef CONFIG_PAX_PAGEEXEC
4362+ pmd_t *pmd;
4363+ pte_t *pte;
4364+ spinlock_t *ptl;
4365+ unsigned char pte_mask;
4366+#endif
4367+
4368 /* get the address */
4369 address = read_cr2();
4370
4371 tsk = current;
4372+ mm = tsk->mm;
4373
4374 si_code = SEGV_MAPERR;
4375
4376@@ -377,14 +414,12 @@ fastcall void __kprobes do_page_fault(st
4377 if (regs->eflags & (X86_EFLAGS_IF|VM_MASK))
4378 local_irq_enable();
4379
4380- mm = tsk->mm;
4381-
4382 /*
4383 * If we're in an interrupt, have no user context or are running in an
4384 * atomic region then we must not take the fault..
4385 */
4386 if (in_atomic() || !mm)
4387- goto bad_area_nosemaphore;
4388+ goto bad_area_nopax;
4389
4390 /* When running in the kernel we expect faults to occur only to
4391 * addresses in user space. All other faults represent errors in the
4392@@ -404,10 +439,101 @@ fastcall void __kprobes do_page_fault(st
4393 if (!down_read_trylock(&mm->mmap_sem)) {
4394 if ((error_code & 4) == 0 &&
4395 !search_exception_tables(regs->eip))
4396- goto bad_area_nosemaphore;
4397+ goto bad_area_nopax;
4398 down_read(&mm->mmap_sem);
4399 }
4400
4401+#ifdef CONFIG_PAX_PAGEEXEC
4402+ if (unlikely((error_code & 5) != 5 ||
4403+ (regs->eflags & X86_EFLAGS_VM) ||
4404+ !(mm->pax_flags & MF_PAX_PAGEEXEC)))
4405+ goto not_pax_fault;
4406+
4407+ /* PaX: it's our fault, let's handle it if we can */
4408+
4409+ /* PaX: take a look at read faults before acquiring any locks */
4410+ if (unlikely(!(error_code & 2) && (regs->eip == address))) {
4411+ /* instruction fetch attempt from a protected page in user mode */
4412+ up_read(&mm->mmap_sem);
4413+ switch (pax_handle_fetch_fault(regs)) {
4414+
4415+#ifdef CONFIG_PAX_EMUTRAMP
4416+ case 2:
4417+ return;
4418+#endif
4419+
4420+ }
4421+ pax_report_fault(regs, (void*)regs->eip, (void*)regs->esp);
4422+ do_exit(SIGKILL);
4423+ }
4424+
4425+ pmd = pax_get_pmd(mm, address);
4426+ if (unlikely(!pmd))
4427+ goto not_pax_fault;
4428+
4429+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
4430+ if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
4431+ pte_unmap_unlock(pte, ptl);
4432+ goto not_pax_fault;
4433+ }
4434+
4435+ if (unlikely((error_code & 2) && !pte_write(*pte))) {
4436+ /* write attempt to a protected page in user mode */
4437+ pte_unmap_unlock(pte, ptl);
4438+ goto not_pax_fault;
4439+ }
4440+
4441+#ifdef CONFIG_SMP
4442+ if (likely(address > get_limit(regs->xcs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
4443+#else
4444+ if (likely(address > get_limit(regs->xcs)))
4445+#endif
4446+ {
4447+ set_pte(pte, pte_mkread(*pte));
4448+ __flush_tlb_one(address);
4449+ pte_unmap_unlock(pte, ptl);
4450+ up_read(&mm->mmap_sem);
4451+ return;
4452+ }
4453+
4454+ pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & 2) << (_PAGE_BIT_DIRTY-1));
4455+
4456+ /*
4457+ * PaX: fill DTLB with user rights and retry
4458+ */
4459+ __asm__ __volatile__ (
4460+ "movw %w4,%%ds\n"
4461+ "orb %2,%%ss:(%1)\n"
4462+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
4463+/*
4464+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
4465+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
4466+ * page fault when examined during a TLB load attempt. this is true not only
4467+ * for PTEs holding a non-present entry but also present entries that will
4468+ * raise a page fault (such as those set up by PaX, or the copy-on-write
4469+ * mechanism). in effect it means that we do *not* need to flush the TLBs
4470+ * for our target pages since their PTEs are simply not in the TLBs at all.
4471+
4472+ * the best thing in omitting it is that we gain around 15-20% speed in the
4473+ * fast path of the page fault handler and can get rid of tracing since we
4474+ * can no longer flush unintended entries.
4475+ */
4476+ "invlpg (%0)\n"
4477+#endif
4478+ "testb $0,(%0)\n"
4479+ "xorb %3,%%ss:(%1)\n"
4480+ "pushl %%ss\n"
4481+ "popl %%ds\n"
4482+ :
4483+ : "q" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER), "r" (__USER_DS)
4484+ : "memory", "cc");
4485+ pte_unmap_unlock(pte, ptl);
4486+ up_read(&mm->mmap_sem);
4487+ return;
4488+
4489+not_pax_fault:
4490+#endif
4491+
4492 vma = find_vma(mm, address);
4493 if (!vma)
4494 goto bad_area;
4495@@ -493,6 +619,37 @@ bad_area:
4496 up_read(&mm->mmap_sem);
4497
4498 bad_area_nosemaphore:
4499+
4500+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
4501+ if (mm && (error_code & 4) && !(regs->eflags & X86_EFLAGS_VM)) {
4502+
4503+#ifdef CONFIG_PAX_PAGEEXEC
4504+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(error_code & 3) && (regs->eip == address)) {
4505+ pax_report_fault(regs, (void*)regs->eip, (void*)regs->esp);
4506+ do_exit(SIGKILL);
4507+ }
4508+#endif
4509+
4510+#ifdef CONFIG_PAX_SEGMEXEC
4511+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & 3) && (regs->eip + SEGMEXEC_TASK_SIZE == address)) {
4512+
4513+ switch (pax_handle_fetch_fault(regs)) {
4514+
4515+#ifdef CONFIG_PAX_EMUTRAMP
4516+ case 2:
4517+ return;
4518+#endif
4519+
4520+ }
4521+ pax_report_fault(regs, (void*)regs->eip, (void*)regs->esp);
4522+ do_exit(SIGKILL);
4523+ }
4524+#endif
4525+
4526+ }
4527+#endif
4528+
4529+bad_area_nopax:
4530 /* User mode accesses just cause a SIGSEGV */
4531 if (error_code & 4) {
4532 /*
4533@@ -560,6 +717,21 @@ no_context:
4534 if (address < PAGE_SIZE)
4535 printk(KERN_ALERT "BUG: unable to handle kernel NULL "
4536 "pointer dereference");
4537+
4538+#ifdef CONFIG_PAX_KERNEXEC
4539+#ifdef CONFIG_MODULES
4540+ else if (init_mm.start_code <= address && address < (unsigned long)MODULES_END)
4541+#else
4542+ else if (init_mm.start_code <= address && address < init_mm.end_code)
4543+#endif
4544+ if (tsk->signal->curr_ip)
4545+ printk(KERN_ERR "PAX: From %u.%u.%u.%u: %s:%d, uid/euid: %u/%u, attempted to modify kernel code",
4546+ NIPQUAD(tsk->signal->curr_ip), tsk->comm, tsk->pid, tsk->uid, tsk->euid);
4547+ else
4548+ printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code",
4549+ tsk->comm, tsk->pid, tsk->uid, tsk->euid);
4550+#endif
4551+
4552 else
4553 printk(KERN_ALERT "BUG: unable to handle kernel paging"
4554 " request");
4555@@ -567,24 +739,34 @@ no_context:
4556 printk(KERN_ALERT " printing eip:\n");
4557 printk("%08lx\n", regs->eip);
4558 }
4559- page = read_cr3();
4560- page = ((unsigned long *) __va(page))[address >> 22];
4561- if (oops_may_print())
4562- printk(KERN_ALERT "*pde = %08lx\n", page);
4563- /*
4564- * We must not directly access the pte in the highpte
4565- * case, the page table might be allocated in highmem.
4566- * And lets rather not kmap-atomic the pte, just in case
4567- * it's allocated already.
4568- */
4569+
4570+ if (oops_may_print()) {
4571+ unsigned long index = pgd_index(address);
4572+ pgd_t *pgd;
4573+ pud_t *pud;
4574+ pmd_t *pmd;
4575+ pte_t *pte;
4576+
4577+ pgd = index + (pgd_t *)__va(read_cr3());
4578+ printk(KERN_ALERT "*pgd = %*llx\n", sizeof(*pgd), (unsigned long long)pgd_val(*pgd));
4579+ if (pgd_present(*pgd)) {
4580+ pud = pud_offset(pgd, address);
4581+ pmd = pmd_offset(pud, address);
4582+ printk(KERN_ALERT "*pmd = %*llx\n", sizeof(*pmd), (unsigned long long)pmd_val(*pmd));
4583+ /*
4584+ * We must not directly access the pte in the highpte
4585+ * case, the page table might be allocated in highmem.
4586+ * And lets rather not kmap-atomic the pte, just in case
4587+ * it's allocated already.
4588+ */
4589 #ifndef CONFIG_HIGHPTE
4590- if ((page & 1) && oops_may_print()) {
4591- page &= PAGE_MASK;
4592- address &= 0x003ff000;
4593- page = ((unsigned long *) __va(page))[address >> PAGE_SHIFT];
4594- printk(KERN_ALERT "*pte = %08lx\n", page);
4595- }
4596+ if (pmd_present(*pmd) && !pmd_large(*pmd)) {
4597+ pte = pte_offset_kernel(pmd, address);
4598+ printk(KERN_ALERT "*pte = %*llx\n", sizeof(*pte), (unsigned long long)pte_val(*pte));
4599+ }
4600 #endif
4601+ }
4602+ }
4603 tsk->thread.cr2 = address;
4604 tsk->thread.trap_no = 14;
4605 tsk->thread.error_code = error_code;
4606@@ -661,3 +843,105 @@ void vmalloc_sync_all(void)
4607 }
4608 }
4609 #endif
4610+
4611+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
4612+/*
4613+ * PaX: decide what to do with offenders (regs->eip = fault address)
4614+ *
4615+ * returns 1 when task should be killed
4616+ * 2 when gcc trampoline was detected
4617+ */
4618+static int pax_handle_fetch_fault(struct pt_regs *regs)
4619+{
4620+
4621+#ifdef CONFIG_PAX_EMUTRAMP
4622+ static const unsigned char trans[8] = {6, 1, 2, 0, 13, 5, 3, 4};
4623+ int err;
4624+#endif
4625+
4626+ if (regs->eflags & X86_EFLAGS_VM)
4627+ return 1;
4628+
4629+#ifdef CONFIG_PAX_EMUTRAMP
4630+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
4631+ return 1;
4632+
4633+ do { /* PaX: gcc trampoline emulation #1 */
4634+ unsigned char mov1, mov2;
4635+ unsigned short jmp;
4636+ unsigned long addr1, addr2;
4637+
4638+ err = get_user(mov1, (unsigned char __user *)regs->eip);
4639+ err |= get_user(addr1, (unsigned long __user *)(regs->eip + 1));
4640+ err |= get_user(mov2, (unsigned char __user *)(regs->eip + 5));
4641+ err |= get_user(addr2, (unsigned long __user *)(regs->eip + 6));
4642+ err |= get_user(jmp, (unsigned short __user *)(regs->eip + 10));
4643+
4644+ if (err)
4645+ break;
4646+
4647+ if ((mov1 & 0xF8) == 0xB8 &&
4648+ (mov2 & 0xF8) == 0xB8 &&
4649+ (mov1 & 0x07) != (mov2 & 0x07) &&
4650+ (jmp & 0xF8FF) == 0xE0FF &&
4651+ (mov2 & 0x07) == ((jmp>>8) & 0x07))
4652+ {
4653+ ((unsigned long *)regs)[trans[mov1 & 0x07]] = addr1;
4654+ ((unsigned long *)regs)[trans[mov2 & 0x07]] = addr2;
4655+ regs->eip = addr2;
4656+ return 2;
4657+ }
4658+ } while (0);
4659+
4660+ do { /* PaX: gcc trampoline emulation #2 */
4661+ unsigned char mov, jmp;
4662+ unsigned long addr1, addr2;
4663+
4664+ err = get_user(mov, (unsigned char __user *)regs->eip);
4665+ err |= get_user(addr1, (unsigned long __user *)(regs->eip + 1));
4666+ err |= get_user(jmp, (unsigned char __user *)(regs->eip + 5));
4667+ err |= get_user(addr2, (unsigned long __user *)(regs->eip + 6));
4668+
4669+ if (err)
4670+ break;
4671+
4672+ if ((mov & 0xF8) == 0xB8 &&
4673+ jmp == 0xE9)
4674+ {
4675+ ((unsigned long *)regs)[trans[mov & 0x07]] = addr1;
4676+ regs->eip += addr2 + 10;
4677+ return 2;
4678+ }
4679+ } while (0);
4680+#endif
4681+
4682+ return 1; /* PaX in action */
4683+}
4684+#endif
4685+
4686+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
4687+void pax_report_insns(void *pc, void *sp)
4688+{
4689+ long i;
4690+
4691+ printk(KERN_ERR "PAX: bytes at PC: ");
4692+ for (i = 0; i < 20; i++) {
4693+ unsigned char c;
4694+ if (get_user(c, (unsigned char __user *)pc+i))
4695+ printk("?? ");
4696+ else
4697+ printk("%02x ", c);
4698+ }
4699+ printk("\n");
4700+
4701+ printk(KERN_ERR "PAX: bytes at SP-4: ");
4702+ for (i = -1; i < 20; i++) {
4703+ unsigned long c;
4704+ if (get_user(c, (unsigned long __user *)sp+i))
4705+ printk("???????? ");
4706+ else
4707+ printk("%08lx ", c);
4708+ }
4709+ printk("\n");
4710+}
4711+#endif
4712diff -urNp linux-2.6.18/arch/i386/mm/hugetlbpage.c linux-2.6.18/arch/i386/mm/hugetlbpage.c
4713--- linux-2.6.18/arch/i386/mm/hugetlbpage.c 2006-09-19 23:42:06.000000000 -0400
4714+++ linux-2.6.18/arch/i386/mm/hugetlbpage.c 2006-09-22 20:45:03.000000000 -0400
4715@@ -120,7 +120,12 @@ static unsigned long hugetlb_get_unmappe
4716 {
4717 struct mm_struct *mm = current->mm;
4718 struct vm_area_struct *vma;
4719- unsigned long start_addr;
4720+ unsigned long start_addr, task_size = TASK_SIZE;
4721+
4722+#ifdef CONFIG_PAX_SEGMEXEC
4723+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
4724+ task_size = SEGMEXEC_TASK_SIZE;
4725+#endif
4726
4727 if (len > mm->cached_hole_size) {
4728 start_addr = mm->free_area_cache;
4729@@ -134,7 +139,7 @@ full_search:
4730
4731 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
4732 /* At this point: (!vma || addr < vma->vm_end). */
4733- if (TASK_SIZE - len < addr) {
4734+ if (task_size - len < addr) {
4735 /*
4736 * Start a new search - just in case we missed
4737 * some holes.
4738@@ -162,9 +167,8 @@ static unsigned long hugetlb_get_unmappe
4739 {
4740 struct mm_struct *mm = current->mm;
4741 struct vm_area_struct *vma, *prev_vma;
4742- unsigned long base = mm->mmap_base, addr = addr0;
4743+ unsigned long base = mm->mmap_base, addr;
4744 unsigned long largest_hole = mm->cached_hole_size;
4745- int first_time = 1;
4746
4747 /* don't allow allocations above current base */
4748 if (mm->free_area_cache > base)
4749@@ -174,7 +178,7 @@ static unsigned long hugetlb_get_unmappe
4750 largest_hole = 0;
4751 mm->free_area_cache = base;
4752 }
4753-try_again:
4754+
4755 /* make sure it can fit in the remaining address space */
4756 if (mm->free_area_cache < len)
4757 goto fail;
4758@@ -216,16 +220,6 @@ try_again:
4759
4760 fail:
4761 /*
4762- * if hint left us with no space for the requested
4763- * mapping then try again:
4764- */
4765- if (first_time) {
4766- mm->free_area_cache = base;
4767- largest_hole = 0;
4768- first_time = 0;
4769- goto try_again;
4770- }
4771- /*
4772 * A failed mmap() very likely causes application failure,
4773 * so fall back to the bottom-up function here. This scenario
4774 * can happen with large stack limits and large mmap()
4775@@ -251,16 +245,23 @@ hugetlb_get_unmapped_area(struct file *f
4776 {
4777 struct mm_struct *mm = current->mm;
4778 struct vm_area_struct *vma;
4779+ unsigned long task_size = TASK_SIZE;
4780
4781 if (len & ~HPAGE_MASK)
4782 return -EINVAL;
4783- if (len > TASK_SIZE)
4784+
4785+#ifdef CONFIG_PAX_SEGMEXEC
4786+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
4787+ task_size = SEGMEXEC_TASK_SIZE;
4788+#endif
4789+
4790+ if (len > task_size || addr > task_size - len)
4791 return -ENOMEM;
4792
4793 if (addr) {
4794 addr = ALIGN(addr, HPAGE_SIZE);
4795 vma = find_vma(mm, addr);
4796- if (TASK_SIZE - len >= addr &&
4797+ if (task_size - len >= addr &&
4798 (!vma || addr + len <= vma->vm_start))
4799 return addr;
4800 }
4801diff -urNp linux-2.6.18/arch/i386/mm/init.c linux-2.6.18/arch/i386/mm/init.c
4802--- linux-2.6.18/arch/i386/mm/init.c 2006-09-19 23:42:06.000000000 -0400
4803+++ linux-2.6.18/arch/i386/mm/init.c 2006-09-22 20:45:03.000000000 -0400
4804@@ -42,6 +42,7 @@
4805 #include <asm/tlb.h>
4806 #include <asm/tlbflush.h>
4807 #include <asm/sections.h>
4808+#include <asm/desc.h>
4809
4810 unsigned int __VMALLOC_RESERVE = 128 << 20;
4811
4812@@ -51,30 +52,6 @@ unsigned long highstart_pfn, highend_pfn
4813 static int noinline do_test_wp_bit(void);
4814
4815 /*
4816- * Creates a middle page table and puts a pointer to it in the
4817- * given global directory entry. This only returns the gd entry
4818- * in non-PAE compilation mode, since the middle layer is folded.
4819- */
4820-static pmd_t * __init one_md_table_init(pgd_t *pgd)
4821-{
4822- pud_t *pud;
4823- pmd_t *pmd_table;
4824-
4825-#ifdef CONFIG_X86_PAE
4826- pmd_table = (pmd_t *) alloc_bootmem_low_pages(PAGE_SIZE);
4827- set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
4828- pud = pud_offset(pgd, 0);
4829- if (pmd_table != pmd_offset(pud, 0))
4830- BUG();
4831-#else
4832- pud = pud_offset(pgd, 0);
4833- pmd_table = pmd_offset(pud, 0);
4834-#endif
4835-
4836- return pmd_table;
4837-}
4838-
4839-/*
4840 * Create a page table and place a pointer to it in a middle page
4841 * directory entry.
4842 */
4843@@ -82,7 +59,11 @@ static pte_t * __init one_page_table_ini
4844 {
4845 if (pmd_none(*pmd)) {
4846 pte_t *page_table = (pte_t *) alloc_bootmem_low_pages(PAGE_SIZE);
4847+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
4848+ set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
4849+#else
4850 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
4851+#endif
4852 if (page_table != pte_offset_kernel(pmd, 0))
4853 BUG();
4854
4855@@ -117,8 +98,6 @@ static void __init page_table_range_init
4856 pgd = pgd_base + pgd_idx;
4857
4858 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
4859- if (pgd_none(*pgd))
4860- one_md_table_init(pgd);
4861 pud = pud_offset(pgd, vaddr);
4862 pmd = pmd_offset(pud, vaddr);
4863 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end); pmd++, pmd_idx++) {
4864@@ -131,11 +110,22 @@ static void __init page_table_range_init
4865 }
4866 }
4867
4868-static inline int is_kernel_text(unsigned long addr)
4869+static inline int is_kernel_text(unsigned long start, unsigned long end)
4870 {
4871- if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
4872- return 1;
4873- return 0;
4874+ unsigned long etext;
4875+
4876+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
4877+ etext = (unsigned long)&MODULES_END - __KERNEL_TEXT_OFFSET;
4878+#else
4879+ etext = (unsigned long)&_etext;
4880+#endif
4881+
4882+ if ((start > etext + __KERNEL_TEXT_OFFSET ||
4883+ end <= (unsigned long)_stext + __KERNEL_TEXT_OFFSET) &&
4884+ (start > (unsigned long)_einittext + __KERNEL_TEXT_OFFSET ||
4885+ end <= (unsigned long)_sinittext + __KERNEL_TEXT_OFFSET))
4886+ return 0;
4887+ return 1;
4888 }
4889
4890 /*
4891@@ -147,26 +137,24 @@ static void __init kernel_physical_mappi
4892 {
4893 unsigned long pfn;
4894 pgd_t *pgd;
4895+ pud_t *pud;
4896 pmd_t *pmd;
4897 pte_t *pte;
4898- int pgd_idx, pmd_idx, pte_ofs;
4899+ unsigned int pgd_idx, pmd_idx, pte_ofs;
4900
4901 pgd_idx = pgd_index(PAGE_OFFSET);
4902 pgd = pgd_base + pgd_idx;
4903 pfn = 0;
4904
4905- for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
4906- pmd = one_md_table_init(pgd);
4907- if (pfn >= max_low_pfn)
4908- continue;
4909+ for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
4910+ pud = pud_offset(pgd, 0);
4911+ pmd = pmd_offset(pud, 0);
4912 for (pmd_idx = 0; pmd_idx < PTRS_PER_PMD && pfn < max_low_pfn; pmd++, pmd_idx++) {
4913- unsigned int address = pfn * PAGE_SIZE + PAGE_OFFSET;
4914+ unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
4915
4916 /* Map with big pages if possible, otherwise create normal page tables. */
4917 if (cpu_has_pse) {
4918- unsigned int address2 = (pfn + PTRS_PER_PTE - 1) * PAGE_SIZE + PAGE_OFFSET + PAGE_SIZE-1;
4919-
4920- if (is_kernel_text(address) || is_kernel_text(address2))
4921+ if (is_kernel_text(address, address + PMD_SIZE))
4922 set_pmd(pmd, pfn_pmd(pfn, PAGE_KERNEL_LARGE_EXEC));
4923 else
4924 set_pmd(pmd, pfn_pmd(pfn, PAGE_KERNEL_LARGE));
4925@@ -175,7 +163,7 @@ static void __init kernel_physical_mappi
4926 pte = one_page_table_init(pmd);
4927
4928 for (pte_ofs = 0; pte_ofs < PTRS_PER_PTE && pfn < max_low_pfn; pte++, pfn++, pte_ofs++) {
4929- if (is_kernel_text(address))
4930+ if (is_kernel_text(address, address + PAGE_SIZE))
4931 set_pte(pte, pfn_pte(pfn, PAGE_KERNEL_EXEC));
4932 else
4933 set_pte(pte, pfn_pte(pfn, PAGE_KERNEL));
4934@@ -342,13 +330,6 @@ static void __init pagetable_init (void)
4935 unsigned long vaddr;
4936 pgd_t *pgd_base = swapper_pg_dir;
4937
4938-#ifdef CONFIG_X86_PAE
4939- int i;
4940- /* Init entries of the first-level page table to the zero page */
4941- for (i = 0; i < PTRS_PER_PGD; i++)
4942- set_pgd(pgd_base + i, __pgd(__pa(empty_zero_page) | _PAGE_PRESENT));
4943-#endif
4944-
4945 /* Enable PSE if available */
4946 if (cpu_has_pse) {
4947 set_in_cr4(X86_CR4_PSE);
4948@@ -372,17 +353,6 @@ static void __init pagetable_init (void)
4949 page_table_range_init(vaddr, 0, pgd_base);
4950
4951 permanent_kmaps_init(pgd_base);
4952-
4953-#ifdef CONFIG_X86_PAE
4954- /*
4955- * Add low memory identity-mappings - SMP needs it when
4956- * starting up on an AP from real-mode. In the non-PAE
4957- * case we already have these mappings through head.S.
4958- * All user-space mappings are explicitly cleared after
4959- * SMP startup.
4960- */
4961- set_pgd(&pgd_base[0], pgd_base[USER_PTRS_PER_PGD]);
4962-#endif
4963 }
4964
4965 #if defined(CONFIG_SOFTWARE_SUSPEND) || defined(CONFIG_ACPI_SLEEP)
4966@@ -424,7 +394,6 @@ void zap_low_mappings (void)
4967 flush_tlb_all();
4968 }
4969
4970-static int disable_nx __initdata = 0;
4971 u64 __supported_pte_mask __read_mostly = ~_PAGE_NX;
4972
4973 /*
4974@@ -438,11 +407,9 @@ u64 __supported_pte_mask __read_mostly =
4975 void __init noexec_setup(const char *str)
4976 {
4977 if (!strncmp(str, "on",2) && cpu_has_nx) {
4978- __supported_pte_mask |= _PAGE_NX;
4979- disable_nx = 0;
4980+ nx_enabled = 1;
4981 } else if (!strncmp(str,"off",3)) {
4982- disable_nx = 1;
4983- __supported_pte_mask &= ~_PAGE_NX;
4984+ nx_enabled = 0;
4985 }
4986 }
4987
4988@@ -451,17 +418,13 @@ int nx_enabled = 0;
4989
4990 static void __init set_nx(void)
4991 {
4992- unsigned int v[4], l, h;
4993+ if (!nx_enabled && cpu_has_nx) {
4994+ unsigned l, h;
4995
4996- if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
4997- cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
4998- if ((v[3] & (1 << 20)) && !disable_nx) {
4999- rdmsr(MSR_EFER, l, h);
5000- l |= EFER_NX;
5001- wrmsr(MSR_EFER, l, h);
5002- nx_enabled = 1;
5003- __supported_pte_mask |= _PAGE_NX;
5004- }
5005+ __supported_pte_mask &= ~_PAGE_NX;
5006+ rdmsr(MSR_EFER, l, h);
5007+ l &= ~EFER_NX;
5008+ wrmsr(MSR_EFER, l, h);
5009 }
5010 }
5011
5012@@ -513,14 +476,6 @@ void __init paging_init(void)
5013
5014 load_cr3(swapper_pg_dir);
5015
5016-#ifdef CONFIG_X86_PAE
5017- /*
5018- * We will bail out later - printk doesn't work right now so
5019- * the user would just see a hanging kernel.
5020- */
5021- if (cpu_has_pae)
5022- set_in_cr4(X86_CR4_PAE);
5023-#endif
5024 __flush_tlb_all();
5025
5026 kmap_init();
5027@@ -612,7 +567,7 @@ void __init mem_init(void)
5028 set_highmem_pages_init(bad_ppro);
5029
5030 codesize = (unsigned long) &_etext - (unsigned long) &_text;
5031- datasize = (unsigned long) &_edata - (unsigned long) &_etext;
5032+ datasize = (unsigned long) &_edata - (unsigned long) &_data;
5033 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
5034
5035 kclist_add(&kcore_mem, __va(0), max_low_pfn << PAGE_SHIFT);
5036@@ -629,10 +584,6 @@ void __init mem_init(void)
5037 (unsigned long) (totalhigh_pages << (PAGE_SHIFT-10))
5038 );
5039
5040-#ifdef CONFIG_X86_PAE
5041- if (!cpu_has_pae)
5042- panic("cannot execute a PAE-enabled kernel on a PAE-less CPU!");
5043-#endif
5044 if (boot_cpu_data.wp_works_ok < 0)
5045 test_wp_bit();
5046
5047@@ -761,6 +712,37 @@ void free_init_pages(char *what, unsigne
5048
5049 void free_initmem(void)
5050 {
5051+
5052+#ifdef CONFIG_PAX_KERNEXEC
5053+ /* PaX: limit KERNEL_CS to actual size */
5054+ unsigned long addr, limit;
5055+ int cpu;
5056+ pgd_t *pgd;
5057+ pud_t *pud;
5058+ pmd_t *pmd;
5059+
5060+#ifdef CONFIG_MODULES
5061+ limit = (unsigned long)&MODULES_END - __KERNEL_TEXT_OFFSET;
5062+#else
5063+ limit = (unsigned long)&_etext;
5064+#endif
5065+ limit = (limit - 1UL) >> PAGE_SHIFT;
5066+
5067+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
5068+ get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS].a = (get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS].a & 0xFFFF0000UL) | (limit & 0x0FFFFUL);
5069+ get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS].b = (get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS].b & 0xFFF0FFFFUL) | (limit & 0xF0000UL);
5070+ }
5071+
5072+ /* PaX: make KERNEL_CS read-only */
5073+ for (addr = __KERNEL_TEXT_OFFSET; addr < (unsigned long)&_data; addr += PMD_SIZE) {
5074+ pgd = pgd_offset_k(addr);
5075+ pud = pud_offset(pgd, addr);
5076+ pmd = pmd_offset(pud, addr);
5077+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
5078+ }
5079+ flush_tlb_all();
5080+#endif
5081+
5082 free_init_pages("unused kernel memory",
5083 (unsigned long)(&__init_begin),
5084 (unsigned long)(&__init_end));
5085diff -urNp linux-2.6.18/arch/i386/mm/mmap.c linux-2.6.18/arch/i386/mm/mmap.c
5086--- linux-2.6.18/arch/i386/mm/mmap.c 2006-09-19 23:42:06.000000000 -0400
5087+++ linux-2.6.18/arch/i386/mm/mmap.c 2006-09-22 20:45:03.000000000 -0400
5088@@ -34,12 +34,18 @@
5089 * Leave an at least ~128 MB hole.
5090 */
5091 #define MIN_GAP (128*1024*1024)
5092-#define MAX_GAP (TASK_SIZE/6*5)
5093+#define MAX_GAP (task_size/6*5)
5094
5095 static inline unsigned long mmap_base(struct mm_struct *mm)
5096 {
5097 unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
5098 unsigned long random_factor = 0;
5099+ unsigned long task_size = TASK_SIZE;
5100+
5101+#ifdef CONFIG_PAX_SEGMEXEC
5102+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
5103+ task_size = SEGMEXEC_TASK_SIZE;
5104+#endif
5105
5106 if (current->flags & PF_RANDOMIZE)
5107 random_factor = get_random_int() % (1024*1024);
5108@@ -49,7 +55,7 @@ static inline unsigned long mmap_base(st
5109 else if (gap > MAX_GAP)
5110 gap = MAX_GAP;
5111
5112- return PAGE_ALIGN(TASK_SIZE - gap - random_factor);
5113+ return PAGE_ALIGN(task_size - gap - random_factor);
5114 }
5115
5116 /*
5117@@ -66,10 +72,22 @@ void arch_pick_mmap_layout(struct mm_str
5118 (current->personality & ADDR_COMPAT_LAYOUT) ||
5119 current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY) {
5120 mm->mmap_base = TASK_UNMAPPED_BASE;
5121+
5122+#ifdef CONFIG_PAX_RANDMMAP
5123+ if (mm->pax_flags & MF_PAX_RANDMMAP)
5124+ mm->mmap_base += mm->delta_mmap;
5125+#endif
5126+
5127 mm->get_unmapped_area = arch_get_unmapped_area;
5128 mm->unmap_area = arch_unmap_area;
5129 } else {
5130 mm->mmap_base = mmap_base(mm);
5131+
5132+#ifdef CONFIG_PAX_RANDMMAP
5133+ if (mm->pax_flags & MF_PAX_RANDMMAP)
5134+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
5135+#endif
5136+
5137 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
5138 mm->unmap_area = arch_unmap_area_topdown;
5139 }
5140diff -urNp linux-2.6.18/arch/i386/mm/pageattr.c linux-2.6.18/arch/i386/mm/pageattr.c
5141--- linux-2.6.18/arch/i386/mm/pageattr.c 2006-09-19 23:42:06.000000000 -0400
5142+++ linux-2.6.18/arch/i386/mm/pageattr.c 2006-09-22 20:45:03.000000000 -0400
5143@@ -13,6 +13,7 @@
5144 #include <asm/tlbflush.h>
5145 #include <asm/pgalloc.h>
5146 #include <asm/sections.h>
5147+#include <asm/desc.h>
5148
5149 static DEFINE_SPINLOCK(cpa_lock);
5150 static struct list_head df_list = LIST_HEAD_INIT(df_list);
5151@@ -83,7 +84,18 @@ static void set_pmd_pte(pte_t *kpte, uns
5152 struct page *page;
5153 unsigned long flags;
5154
5155+#ifdef CONFIG_PAX_KERNEXEC
5156+ unsigned long cr0;
5157+
5158+ pax_open_kernel(cr0);
5159+#endif
5160+
5161 set_pte_atomic(kpte, pte); /* change init_mm */
5162+
5163+#ifdef CONFIG_PAX_KERNEXEC
5164+ pax_close_kernel(cr0);
5165+#endif
5166+
5167 if (PTRS_PER_PMD > 1)
5168 return;
5169
5170@@ -110,7 +122,7 @@ static inline void revert_page(struct pa
5171 pte_t *linear;
5172
5173 ref_prot =
5174- ((address & LARGE_PAGE_MASK) < (unsigned long)&_etext)
5175+ ((address & LARGE_PAGE_MASK) < (unsigned long)&_etext + __KERNEL_TEXT_OFFSET)
5176 ? PAGE_KERNEL_LARGE_EXEC : PAGE_KERNEL_LARGE;
5177
5178 linear = (pte_t *)
5179@@ -142,7 +154,7 @@ __change_page_attr(struct page *page, pg
5180 struct page *split;
5181
5182 ref_prot =
5183- ((address & LARGE_PAGE_MASK) < (unsigned long)&_etext)
5184+ ((address & LARGE_PAGE_MASK) < (unsigned long)&_etext + __KERNEL_TEXT_OFFSET)
5185 ? PAGE_KERNEL_EXEC : PAGE_KERNEL;
5186 split = split_large_page(address, prot, ref_prot);
5187 if (!split)
5188diff -urNp linux-2.6.18/arch/i386/oprofile/backtrace.c linux-2.6.18/arch/i386/oprofile/backtrace.c
5189--- linux-2.6.18/arch/i386/oprofile/backtrace.c 2006-09-19 23:42:06.000000000 -0400
5190+++ linux-2.6.18/arch/i386/oprofile/backtrace.c 2006-09-22 20:45:03.000000000 -0400
5191@@ -116,7 +116,7 @@ x86_backtrace(struct pt_regs * const reg
5192 head = (struct frame_head *)regs->ebp;
5193 #endif
5194
5195- if (!user_mode_vm(regs)) {
5196+ if (!user_mode(regs)) {
5197 while (depth-- && valid_kernel_stack(head, regs))
5198 head = dump_kernel_backtrace(head);
5199 return;
5200diff -urNp linux-2.6.18/arch/i386/oprofile/op_model_p4.c linux-2.6.18/arch/i386/oprofile/op_model_p4.c
5201--- linux-2.6.18/arch/i386/oprofile/op_model_p4.c 2006-09-19 23:42:06.000000000 -0400
5202+++ linux-2.6.18/arch/i386/oprofile/op_model_p4.c 2006-09-22 20:45:03.000000000 -0400
5203@@ -45,7 +45,7 @@ static inline void setup_num_counters(vo
5204 #endif
5205 }
5206
5207-static int inline addr_increment(void)
5208+static inline int addr_increment(void)
5209 {
5210 #ifdef CONFIG_SMP
5211 return smp_num_siblings == 2 ? 2 : 1;
5212diff -urNp linux-2.6.18/arch/i386/power/cpu.c linux-2.6.18/arch/i386/power/cpu.c
5213--- linux-2.6.18/arch/i386/power/cpu.c 2006-09-19 23:42:06.000000000 -0400
5214+++ linux-2.6.18/arch/i386/power/cpu.c 2006-09-22 20:45:03.000000000 -0400
5215@@ -63,7 +63,7 @@ static void do_fpu_end(void)
5216 static void fix_processor_context(void)
5217 {
5218 int cpu = smp_processor_id();
5219- struct tss_struct * t = &per_cpu(init_tss, cpu);
5220+ struct tss_struct * t = init_tss + cpu;
5221
5222 set_tss_desc(cpu,t); /* This just modifies memory; should not be necessary. But... This is necessary, because 386 hardware has concept of busy TSS or some similar stupidity. */
5223
5224diff -urNp linux-2.6.18/arch/ia64/ia32/binfmt_elf32.c linux-2.6.18/arch/ia64/ia32/binfmt_elf32.c
5225--- linux-2.6.18/arch/ia64/ia32/binfmt_elf32.c 2006-09-19 23:42:06.000000000 -0400
5226+++ linux-2.6.18/arch/ia64/ia32/binfmt_elf32.c 2006-09-22 20:45:03.000000000 -0400
5227@@ -45,6 +45,17 @@ randomize_stack_top(unsigned long stack_
5228
5229 #define elf_read_implies_exec(ex, have_pt_gnu_stack) (!(have_pt_gnu_stack))
5230
5231+#ifdef CONFIG_PAX_ASLR
5232+#define PAX_ELF_ET_DYN_BASE(tsk) ((tsk)->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
5233+
5234+#define PAX_DELTA_MMAP_LSB(tsk) IA32_PAGE_SHIFT
5235+#define PAX_DELTA_MMAP_LEN(tsk) ((tsk)->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - IA32_PAGE_SHIFT)
5236+#define PAX_DELTA_EXEC_LSB(tsk) IA32_PAGE_SHIFT
5237+#define PAX_DELTA_EXEC_LEN(tsk) ((tsk)->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - IA32_PAGE_SHIFT)
5238+#define PAX_DELTA_STACK_LSB(tsk) IA32_PAGE_SHIFT
5239+#define PAX_DELTA_STACK_LEN(tsk) ((tsk)->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - IA32_PAGE_SHIFT)
5240+#endif
5241+
5242 /* Ugly but avoids duplication */
5243 #include "../../../fs/binfmt_elf.c"
5244
5245diff -urNp linux-2.6.18/arch/ia64/ia32/ia32priv.h linux-2.6.18/arch/ia64/ia32/ia32priv.h
5246--- linux-2.6.18/arch/ia64/ia32/ia32priv.h 2006-09-19 23:42:06.000000000 -0400
5247+++ linux-2.6.18/arch/ia64/ia32/ia32priv.h 2006-09-22 20:45:03.000000000 -0400
5248@@ -304,7 +304,14 @@ struct old_linux32_dirent {
5249 #define ELF_DATA ELFDATA2LSB
5250 #define ELF_ARCH EM_386
5251
5252-#define IA32_STACK_TOP IA32_PAGE_OFFSET
5253+#ifdef CONFIG_PAX_RANDUSTACK
5254+#define __IA32_DELTA_STACK (current->mm->delta_stack)
5255+#else
5256+#define __IA32_DELTA_STACK 0UL
5257+#endif
5258+
5259+#define IA32_STACK_TOP (IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
5260+
5261 #define IA32_GATE_OFFSET IA32_PAGE_OFFSET
5262 #define IA32_GATE_END IA32_PAGE_OFFSET + PAGE_SIZE
5263
5264diff -urNp linux-2.6.18/arch/ia64/kernel/module.c linux-2.6.18/arch/ia64/kernel/module.c
5265--- linux-2.6.18/arch/ia64/kernel/module.c 2006-09-19 23:42:06.000000000 -0400
5266+++ linux-2.6.18/arch/ia64/kernel/module.c 2006-09-22 20:45:03.000000000 -0400
5267@@ -321,7 +321,7 @@ module_alloc (unsigned long size)
5268 void
5269 module_free (struct module *mod, void *module_region)
5270 {
5271- if (mod->arch.init_unw_table && module_region == mod->module_init) {
5272+ if (mod->arch.init_unw_table && module_region == mod->module_init_rx) {
5273 unw_remove_unwind_table(mod->arch.init_unw_table);
5274 mod->arch.init_unw_table = NULL;
5275 }
5276@@ -499,15 +499,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
5277 }
5278
5279 static inline int
5280+in_init_rx (const struct module *mod, uint64_t addr)
5281+{
5282+ return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
5283+}
5284+
5285+static inline int
5286+in_init_rw (const struct module *mod, uint64_t addr)
5287+{
5288+ return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
5289+}
5290+
5291+static inline int
5292 in_init (const struct module *mod, uint64_t addr)
5293 {
5294- return addr - (uint64_t) mod->module_init < mod->init_size;
5295+ return in_init_rx(mod, value) || in_init_rw(mod, value);
5296+}
5297+
5298+static inline int
5299+in_core_rx (const struct module *mod, uint64_t addr)
5300+{
5301+ return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
5302+}
5303+
5304+static inline int
5305+in_core_rw (const struct module *mod, uint64_t addr)
5306+{
5307+ return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
5308 }
5309
5310 static inline int
5311 in_core (const struct module *mod, uint64_t addr)
5312 {
5313- return addr - (uint64_t) mod->module_core < mod->core_size;
5314+ return in_core_rx(mod, value) || in_core_rw(mod, value);
5315 }
5316
5317 static inline int
5318@@ -691,7 +715,14 @@ do_reloc (struct module *mod, uint8_t r_
5319 break;
5320
5321 case RV_BDREL:
5322- val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
5323+ if (in_init_rx(mod, val))
5324+ val -= (uint64_t) mod->module_init_rx;
5325+ else if (in_init_rw(mod, val))
5326+ val -= (uint64_t) mod->module_init_rw;
5327+ else if (in_core_rx(mod, val))
5328+ val -= (uint64_t) mod->module_core_rx;
5329+ else if (in_core_rw(mod, val))
5330+ val -= (uint64_t) mod->module_core_rw;
5331 break;
5332
5333 case RV_LTV:
5334@@ -825,15 +856,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
5335 * addresses have been selected...
5336 */
5337 uint64_t gp;
5338- if (mod->core_size > MAX_LTOFF)
5339+ if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
5340 /*
5341 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
5342 * at the end of the module.
5343 */
5344- gp = mod->core_size - MAX_LTOFF / 2;
5345+ gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
5346 else
5347- gp = mod->core_size / 2;
5348- gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
5349+ gp = (mod->core_size_rx + mod->core_size_rw) / 2;
5350+ gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
5351 mod->arch.gp = gp;
5352 DEBUGP("%s: placing gp at 0x%lx\n", __FUNCTION__, gp);
5353 }
5354diff -urNp linux-2.6.18/arch/ia64/kernel/ptrace.c linux-2.6.18/arch/ia64/kernel/ptrace.c
5355--- linux-2.6.18/arch/ia64/kernel/ptrace.c 2006-09-19 23:42:06.000000000 -0400
5356+++ linux-2.6.18/arch/ia64/kernel/ptrace.c 2006-09-22 20:04:35.000000000 -0400
5357@@ -17,6 +17,7 @@
5358 #include <linux/security.h>
5359 #include <linux/audit.h>
5360 #include <linux/signal.h>
5361+#include <linux/grsecurity.h>
5362
5363 #include <asm/pgtable.h>
5364 #include <asm/processor.h>
5365@@ -1446,6 +1447,9 @@ sys_ptrace (long request, pid_t pid, uns
5366 if (pid == 1) /* no messing around with init! */
5367 goto out_tsk;
5368
5369+ if (gr_handle_ptrace(child, request))
5370+ goto out_tsk;
5371+
5372 if (request == PTRACE_ATTACH) {
5373 ret = ptrace_attach(child);
5374 goto out_tsk;
5375diff -urNp linux-2.6.18/arch/ia64/kernel/sys_ia64.c linux-2.6.18/arch/ia64/kernel/sys_ia64.c
5376--- linux-2.6.18/arch/ia64/kernel/sys_ia64.c 2006-09-19 23:42:06.000000000 -0400
5377+++ linux-2.6.18/arch/ia64/kernel/sys_ia64.c 2006-09-22 20:45:03.000000000 -0400
5378@@ -37,6 +37,13 @@ arch_get_unmapped_area (struct file *fil
5379 if (REGION_NUMBER(addr) == RGN_HPAGE)
5380 addr = 0;
5381 #endif
5382+
5383+#ifdef CONFIG_PAX_RANDMMAP
5384+ if ((mm->pax_flags & MF_PAX_RANDMMAP) && addr && filp)
5385+ addr = mm->free_area_cache;
5386+ else
5387+#endif
5388+
5389 if (!addr)
5390 addr = mm->free_area_cache;
5391
5392@@ -55,9 +62,9 @@ arch_get_unmapped_area (struct file *fil
5393 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
5394 /* At this point: (!vma || addr < vma->vm_end). */
5395 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
5396- if (start_addr != TASK_UNMAPPED_BASE) {
5397+ if (start_addr != mm->mmap_base) {
5398 /* Start a new search --- just in case we missed some holes. */
5399- addr = TASK_UNMAPPED_BASE;
5400+ addr = mm->mmap_base;
5401 goto full_search;
5402 }
5403 return -ENOMEM;
5404diff -urNp linux-2.6.18/arch/ia64/mm/fault.c linux-2.6.18/arch/ia64/mm/fault.c
5405--- linux-2.6.18/arch/ia64/mm/fault.c 2006-09-19 23:42:06.000000000 -0400
5406+++ linux-2.6.18/arch/ia64/mm/fault.c 2006-09-22 20:45:03.000000000 -0400
5407@@ -10,6 +10,7 @@
5408 #include <linux/smp_lock.h>
5409 #include <linux/interrupt.h>
5410 #include <linux/kprobes.h>
5411+#include <linux/binfmts.h>
5412
5413 #include <asm/pgtable.h>
5414 #include <asm/processor.h>
5415@@ -85,6 +86,23 @@ mapped_kernel_page_is_present (unsigned
5416 return pte_present(pte);
5417 }
5418
5419+#ifdef CONFIG_PAX_PAGEEXEC
5420+void pax_report_insns(void *pc, void *sp)
5421+{
5422+ unsigned long i;
5423+
5424+ printk(KERN_ERR "PAX: bytes at PC: ");
5425+ for (i = 0; i < 8; i++) {
5426+ unsigned int c;
5427+ if (get_user(c, (unsigned int*)pc+i))
5428+ printk("???????? ");
5429+ else
5430+ printk("%08x ", c);
5431+ }
5432+ printk("\n");
5433+}
5434+#endif
5435+
5436 void __kprobes
5437 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
5438 {
5439@@ -150,9 +168,23 @@ ia64_do_page_fault (unsigned long addres
5440 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT)
5441 | (((isr >> IA64_ISR_R_BIT) & 1UL) << VM_READ_BIT));
5442
5443- if ((vma->vm_flags & mask) != mask)
5444+ if ((vma->vm_flags & mask) != mask) {
5445+
5446+#ifdef CONFIG_PAX_PAGEEXEC
5447+ if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
5448+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
5449+ goto bad_area;
5450+
5451+ up_read(&mm->mmap_sem);
5452+ pax_report_fault(regs, (void*)regs->cr_iip, (void*)regs->r12);
5453+ do_exit(SIGKILL);
5454+ }
5455+#endif
5456+
5457 goto bad_area;
5458
5459+ }
5460+
5461 survive:
5462 /*
5463 * If for any reason at all we couldn't handle the fault, make
5464diff -urNp linux-2.6.18/arch/ia64/mm/init.c linux-2.6.18/arch/ia64/mm/init.c
5465--- linux-2.6.18/arch/ia64/mm/init.c 2006-09-19 23:42:06.000000000 -0400
5466+++ linux-2.6.18/arch/ia64/mm/init.c 2006-09-22 20:45:03.000000000 -0400
5467@@ -19,8 +19,8 @@
5468 #include <linux/swap.h>
5469 #include <linux/proc_fs.h>
5470 #include <linux/bitops.h>
5471+#include <linux/a.out.h>
5472
5473-#include <asm/a.out.h>
5474 #include <asm/dma.h>
5475 #include <asm/ia32.h>
5476 #include <asm/io.h>
5477diff -urNp linux-2.6.18/arch/mips/kernel/binfmt_elfn32.c linux-2.6.18/arch/mips/kernel/binfmt_elfn32.c
5478--- linux-2.6.18/arch/mips/kernel/binfmt_elfn32.c 2006-09-19 23:42:06.000000000 -0400
5479+++ linux-2.6.18/arch/mips/kernel/binfmt_elfn32.c 2006-09-22 20:45:03.000000000 -0400
5480@@ -50,6 +50,17 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
5481 #undef ELF_ET_DYN_BASE
5482 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
5483
5484+#ifdef CONFIG_PAX_ASLR
5485+#define PAX_ELF_ET_DYN_BASE(tsk) (((tsk)->thread.mflags & MF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
5486+
5487+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
5488+#define PAX_DELTA_MMAP_LEN(tsk) (((tsk)->thread.mflags & MF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
5489+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
5490+#define PAX_DELTA_EXEC_LEN(tsk) (((tsk)->thread.mflags & MF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
5491+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
5492+#define PAX_DELTA_STACK_LEN(tsk) (((tsk)->thread.mflags & MF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
5493+#endif
5494+
5495 #include <asm/processor.h>
5496 #include <linux/module.h>
5497 #include <linux/elfcore.h>
5498diff -urNp linux-2.6.18/arch/mips/kernel/binfmt_elfo32.c linux-2.6.18/arch/mips/kernel/binfmt_elfo32.c
5499--- linux-2.6.18/arch/mips/kernel/binfmt_elfo32.c 2006-09-19 23:42:06.000000000 -0400
5500+++ linux-2.6.18/arch/mips/kernel/binfmt_elfo32.c 2006-09-22 20:45:03.000000000 -0400
5501@@ -52,6 +52,17 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
5502 #undef ELF_ET_DYN_BASE
5503 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
5504
5505+#ifdef CONFIG_PAX_ASLR
5506+#define PAX_ELF_ET_DYN_BASE(tsk) (((tsk)->thread.mflags & MF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
5507+
5508+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
5509+#define PAX_DELTA_MMAP_LEN(tsk) (((tsk)->thread.mflags & MF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
5510+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
5511+#define PAX_DELTA_EXEC_LEN(tsk) (((tsk)->thread.mflags & MF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
5512+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
5513+#define PAX_DELTA_STACK_LEN(tsk) (((tsk)->thread.mflags & MF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
5514+#endif
5515+
5516 #include <asm/processor.h>
5517 #include <linux/module.h>
5518 #include <linux/elfcore.h>
5519diff -urNp linux-2.6.18/arch/mips/kernel/syscall.c linux-2.6.18/arch/mips/kernel/syscall.c
5520--- linux-2.6.18/arch/mips/kernel/syscall.c 2006-09-19 23:42:06.000000000 -0400
5521+++ linux-2.6.18/arch/mips/kernel/syscall.c 2006-09-22 20:45:03.000000000 -0400
5522@@ -88,6 +88,11 @@ unsigned long arch_get_unmapped_area(str
5523 do_color_align = 0;
5524 if (filp || (flags & MAP_SHARED))
5525 do_color_align = 1;
5526+
5527+#ifdef CONFIG_PAX_RANDMMAP
5528+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP) || !filp)
5529+#endif
5530+
5531 if (addr) {
5532 if (do_color_align)
5533 addr = COLOUR_ALIGN(addr, pgoff);
5534@@ -98,7 +103,7 @@ unsigned long arch_get_unmapped_area(str
5535 (!vmm || addr + len <= vmm->vm_start))
5536 return addr;
5537 }
5538- addr = TASK_UNMAPPED_BASE;
5539+ addr = current->mm->mmap_base;
5540 if (do_color_align)
5541 addr = COLOUR_ALIGN(addr, pgoff);
5542 else
5543diff -urNp linux-2.6.18/arch/mips/mm/fault.c linux-2.6.18/arch/mips/mm/fault.c
5544--- linux-2.6.18/arch/mips/mm/fault.c 2006-09-19 23:42:06.000000000 -0400
5545+++ linux-2.6.18/arch/mips/mm/fault.c 2006-09-22 20:45:03.000000000 -0400
5546@@ -27,6 +27,23 @@
5547 #include <asm/ptrace.h>
5548 #include <asm/highmem.h> /* For VMALLOC_END */
5549
5550+#ifdef CONFIG_PAX_PAGEEXEC
5551+void pax_report_insns(void *pc)
5552+{
5553+ unsigned long i;
5554+
5555+ printk(KERN_ERR "PAX: bytes at PC: ");
5556+ for (i = 0; i < 5; i++) {
5557+ unsigned int c;
5558+ if (get_user(c, (unsigned int*)pc+i))
5559+ printk("???????? ");
5560+ else
5561+ printk("%08x ", c);
5562+ }
5563+ printk("\n");
5564+}
5565+#endif
5566+
5567 /*
5568 * This routine handles page faults. It determines the address,
5569 * and the problem, and then passes it off to one of the appropriate
5570diff -urNp linux-2.6.18/arch/parisc/kernel/module.c linux-2.6.18/arch/parisc/kernel/module.c
5571--- linux-2.6.18/arch/parisc/kernel/module.c 2006-09-19 23:42:06.000000000 -0400
5572+++ linux-2.6.18/arch/parisc/kernel/module.c 2006-09-22 20:45:03.000000000 -0400
5573@@ -72,16 +72,38 @@
5574
5575 /* three functions to determine where in the module core
5576 * or init pieces the location is */
5577+static inline int is_init_rx(struct module *me, void *loc)
5578+{
5579+ return (loc >= me->module_init_rx &&
5580+ loc < (me->module_init_rx + me->init_size_rx));
5581+}
5582+
5583+static inline int is_init_rw(struct module *me, void *loc)
5584+{
5585+ return (loc >= me->module_init_rw &&
5586+ loc < (me->module_init_rw + me->init_size_rw));
5587+}
5588+
5589 static inline int is_init(struct module *me, void *loc)
5590 {
5591- return (loc >= me->module_init &&
5592- loc <= (me->module_init + me->init_size));
5593+ return is_init_rx(me, loc) || is_init_rw(me, loc);
5594+}
5595+
5596+static inline int is_core_rx(struct module *me, void *loc)
5597+{
5598+ return (loc >= me->module_core_rx &&
5599+ loc < (me->module_core_rx + me->core_size_rx));
5600+}
5601+
5602+static inline int is_core_rw(struct module *me, void *loc)
5603+{
5604+ return (loc >= me->module_core_rw &&
5605+ loc < (me->module_core_rw + me->core_size_rw));
5606 }
5607
5608 static inline int is_core(struct module *me, void *loc)
5609 {
5610- return (loc >= me->module_core &&
5611- loc <= (me->module_core + me->core_size));
5612+ return is_core_rx(me, loc) || is_core_rw(me, loc);
5613 }
5614
5615 static inline int is_local(struct module *me, void *loc)
5616@@ -295,21 +317,21 @@ int module_frob_arch_sections(CONST Elf_
5617 }
5618
5619 /* align things a bit */
5620- me->core_size = ALIGN(me->core_size, 16);
5621- me->arch.got_offset = me->core_size;
5622- me->core_size += gots * sizeof(struct got_entry);
5623-
5624- me->core_size = ALIGN(me->core_size, 16);
5625- me->arch.fdesc_offset = me->core_size;
5626- me->core_size += fdescs * sizeof(Elf_Fdesc);
5627-
5628- me->core_size = ALIGN(me->core_size, 16);
5629- me->arch.stub_offset = me->core_size;
5630- me->core_size += stubs * sizeof(struct stub_entry);
5631-
5632- me->init_size = ALIGN(me->init_size, 16);
5633- me->arch.init_stub_offset = me->init_size;
5634- me->init_size += init_stubs * sizeof(struct stub_entry);
5635+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
5636+ me->arch.got_offset = me->core_size_rw;
5637+ me->core_size_rw += gots * sizeof(struct got_entry);
5638+
5639+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
5640+ me->arch.fdesc_offset = me->core_size_rw;
5641+ me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
5642+
5643+ me->core_size_rx = ALIGN(me->core_size_rx, 16);
5644+ me->arch.stub_offset = me->core_size_rx;
5645+ me->core_size_rx += stubs * sizeof(struct stub_entry);
5646+
5647+ me->init_size_rx = ALIGN(me->init_size_rx, 16);
5648+ me->arch.init_stub_offset = me->init_size_rx;
5649+ me->init_size_rx += init_stubs * sizeof(struct stub_entry);
5650
5651 me->arch.got_max = gots;
5652 me->arch.fdesc_max = fdescs;
5653@@ -329,7 +351,7 @@ static Elf64_Word get_got(struct module
5654
5655 BUG_ON(value == 0);
5656
5657- got = me->module_core + me->arch.got_offset;
5658+ got = me->module_core_rw + me->arch.got_offset;
5659 for (i = 0; got[i].addr; i++)
5660 if (got[i].addr == value)
5661 goto out;
5662@@ -347,7 +369,7 @@ static Elf64_Word get_got(struct module
5663 #ifdef __LP64__
5664 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
5665 {
5666- Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
5667+ Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
5668
5669 if (!value) {
5670 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
5671@@ -365,7 +387,7 @@ static Elf_Addr get_fdesc(struct module
5672
5673 /* Create new one */
5674 fdesc->addr = value;
5675- fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
5676+ fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
5677 return (Elf_Addr)fdesc;
5678 }
5679 #endif /* __LP64__ */
5680@@ -385,12 +407,12 @@ static Elf_Addr get_stub(struct module *
5681 if(init_section) {
5682 i = me->arch.init_stub_count++;
5683 BUG_ON(me->arch.init_stub_count > me->arch.init_stub_max);
5684- stub = me->module_init + me->arch.init_stub_offset +
5685+ stub = me->module_init_rx + me->arch.init_stub_offset +
5686 i * sizeof(struct stub_entry);
5687 } else {
5688 i = me->arch.stub_count++;
5689 BUG_ON(me->arch.stub_count > me->arch.stub_max);
5690- stub = me->module_core + me->arch.stub_offset +
5691+ stub = me->module_core_rx + me->arch.stub_offset +
5692 i * sizeof(struct stub_entry);
5693 }
5694
5695@@ -758,7 +780,7 @@ register_unwind_table(struct module *me,
5696
5697 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
5698 end = table + sechdrs[me->arch.unwind_section].sh_size;
5699- gp = (Elf_Addr)me->module_core + me->arch.got_offset;
5700+ gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
5701
5702 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
5703 me->arch.unwind_section, table, end, gp);
5704diff -urNp linux-2.6.18/arch/parisc/kernel/ptrace.c linux-2.6.18/arch/parisc/kernel/ptrace.c
5705--- linux-2.6.18/arch/parisc/kernel/ptrace.c 2006-09-19 23:42:06.000000000 -0400
5706+++ linux-2.6.18/arch/parisc/kernel/ptrace.c 2006-09-22 20:04:35.000000000 -0400
5707@@ -18,6 +18,7 @@
5708 #include <linux/security.h>
5709 #include <linux/compat.h>
5710 #include <linux/signal.h>
5711+#include <linux/grsecurity.h>
5712
5713 #include <asm/uaccess.h>
5714 #include <asm/pgtable.h>
5715diff -urNp linux-2.6.18/arch/parisc/kernel/sys_parisc.c linux-2.6.18/arch/parisc/kernel/sys_parisc.c
5716--- linux-2.6.18/arch/parisc/kernel/sys_parisc.c 2006-09-19 23:42:06.000000000 -0400
5717+++ linux-2.6.18/arch/parisc/kernel/sys_parisc.c 2006-09-22 20:45:03.000000000 -0400
5718@@ -105,7 +105,7 @@ unsigned long arch_get_unmapped_area(str
5719 if (len > TASK_SIZE)
5720 return -ENOMEM;
5721 if (!addr)
5722- addr = TASK_UNMAPPED_BASE;
5723+ addr = current->mm->mmap_base;
5724
5725 if (filp) {
5726 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
5727diff -urNp linux-2.6.18/arch/parisc/kernel/traps.c linux-2.6.18/arch/parisc/kernel/traps.c
5728--- linux-2.6.18/arch/parisc/kernel/traps.c 2006-09-19 23:42:06.000000000 -0400
5729+++ linux-2.6.18/arch/parisc/kernel/traps.c 2006-09-22 20:45:03.000000000 -0400
5730@@ -706,9 +706,7 @@ void handle_interruption(int code, struc
5731
5732 down_read(&current->mm->mmap_sem);
5733 vma = find_vma(current->mm,regs->iaoq[0]);
5734- if (vma && (regs->iaoq[0] >= vma->vm_start)
5735- && (vma->vm_flags & VM_EXEC)) {
5736-
5737+ if (vma && (regs->iaoq[0] >= vma->vm_start)) {
5738 fault_address = regs->iaoq[0];
5739 fault_space = regs->iasq[0];
5740
5741diff -urNp linux-2.6.18/arch/parisc/mm/fault.c linux-2.6.18/arch/parisc/mm/fault.c
5742--- linux-2.6.18/arch/parisc/mm/fault.c 2006-09-19 23:42:06.000000000 -0400
5743+++ linux-2.6.18/arch/parisc/mm/fault.c 2006-09-22 20:45:03.000000000 -0400
5744@@ -16,6 +16,8 @@
5745 #include <linux/sched.h>
5746 #include <linux/interrupt.h>
5747 #include <linux/module.h>
5748+#include <linux/unistd.h>
5749+#include <linux/binfmts.h>
5750
5751 #include <asm/uaccess.h>
5752 #include <asm/traps.h>
5753@@ -57,7 +59,7 @@ DEFINE_PER_CPU(struct exception_data, ex
5754 static unsigned long
5755 parisc_acctyp(unsigned long code, unsigned int inst)
5756 {
5757- if (code == 6 || code == 16)
5758+ if (code == 6 || code == 7 || code == 16)
5759 return VM_EXEC;
5760
5761 switch (inst & 0xf0000000) {
5762@@ -143,6 +145,116 @@ parisc_acctyp(unsigned long code, unsign
5763 }
5764 #endif
5765
5766+#ifdef CONFIG_PAX_PAGEEXEC
5767+/*
5768+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
5769+ *
5770+ * returns 1 when task should be killed
5771+ * 2 when rt_sigreturn trampoline was detected
5772+ * 3 when unpatched PLT trampoline was detected
5773+ */
5774+static int pax_handle_fetch_fault(struct pt_regs *regs)
5775+{
5776+
5777+#ifdef CONFIG_PAX_EMUPLT
5778+ int err;
5779+
5780+ do { /* PaX: unpatched PLT emulation */
5781+ unsigned int bl, depwi;
5782+
5783+ err = get_user(bl, (unsigned int*)instruction_pointer(regs));
5784+ err |= get_user(depwi, (unsigned int*)(instruction_pointer(regs)+4));
5785+
5786+ if (err)
5787+ break;
5788+
5789+ if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
5790+ unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
5791+
5792+ err = get_user(ldw, (unsigned int*)addr);
5793+ err |= get_user(bv, (unsigned int*)(addr+4));
5794+ err |= get_user(ldw2, (unsigned int*)(addr+8));
5795+
5796+ if (err)
5797+ break;
5798+
5799+ if (ldw == 0x0E801096U &&
5800+ bv == 0xEAC0C000U &&
5801+ ldw2 == 0x0E881095U)
5802+ {
5803+ unsigned int resolver, map;
5804+
5805+ err = get_user(resolver, (unsigned int*)(instruction_pointer(regs)+8));
5806+ err |= get_user(map, (unsigned int*)(instruction_pointer(regs)+12));
5807+ if (err)
5808+ break;
5809+
5810+ regs->gr[20] = instruction_pointer(regs)+8;
5811+ regs->gr[21] = map;
5812+ regs->gr[22] = resolver;
5813+ regs->iaoq[0] = resolver | 3UL;
5814+ regs->iaoq[1] = regs->iaoq[0] + 4;
5815+ return 3;
5816+ }
5817+ }
5818+ } while (0);
5819+#endif
5820+
5821+#ifdef CONFIG_PAX_EMUTRAMP
5822+
5823+#ifndef CONFIG_PAX_EMUSIGRT
5824+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
5825+ return 1;
5826+#endif
5827+
5828+ do { /* PaX: rt_sigreturn emulation */
5829+ unsigned int ldi1, ldi2, bel, nop;
5830+
5831+ err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
5832+ err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
5833+ err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
5834+ err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
5835+
5836+ if (err)
5837+ break;
5838+
5839+ if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
5840+ ldi2 == 0x3414015AU &&
5841+ bel == 0xE4008200U &&
5842+ nop == 0x08000240U)
5843+ {
5844+ regs->gr[25] = (ldi1 & 2) >> 1;
5845+ regs->gr[20] = __NR_rt_sigreturn;
5846+ regs->gr[31] = regs->iaoq[1] + 16;
5847+ regs->sr[0] = regs->iasq[1];
5848+ regs->iaoq[0] = 0x100UL;
5849+ regs->iaoq[1] = regs->iaoq[0] + 4;
5850+ regs->iasq[0] = regs->sr[2];
5851+ regs->iasq[1] = regs->sr[2];
5852+ return 2;
5853+ }
5854+ } while (0);
5855+#endif
5856+
5857+ return 1;
5858+}
5859+
5860+void pax_report_insns(void *pc, void *sp)
5861+{
5862+ unsigned long i;
5863+
5864+ printk(KERN_ERR "PAX: bytes at PC: ");
5865+ for (i = 0; i < 5; i++) {
5866+ unsigned int c;
5867+ if (get_user(c, (unsigned int*)pc+i))
5868+ printk("???????? ");
5869+ else
5870+ printk("%08x ", c);
5871+ }
5872+ printk("\n");
5873+}
5874+#endif
5875+
5876 void do_page_fault(struct pt_regs *regs, unsigned long code,
5877 unsigned long address)
5878 {
5879@@ -168,8 +280,33 @@ good_area:
5880
5881 acc_type = parisc_acctyp(code,regs->iir);
5882
5883- if ((vma->vm_flags & acc_type) != acc_type)
5884+ if ((vma->vm_flags & acc_type) != acc_type) {
5885+
5886+#ifdef CONFIG_PAX_PAGEEXEC
5887+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
5888+ (address & ~3UL) == instruction_pointer(regs))
5889+ {
5890+ up_read(&mm->mmap_sem);
5891+ switch(pax_handle_fetch_fault(regs)) {
5892+
5893+#ifdef CONFIG_PAX_EMUPLT
5894+ case 3:
5895+ return;
5896+#endif
5897+
5898+#ifdef CONFIG_PAX_EMUTRAMP
5899+ case 2:
5900+ return;
5901+#endif
5902+
5903+ }
5904+ pax_report_fault(regs, (void*)instruction_pointer(regs), (void*)regs->gr[30]);
5905+ do_exit(SIGKILL);
5906+ }
5907+#endif
5908+
5909 goto bad_area;
5910+ }
5911
5912 /*
5913 * If for any reason at all we couldn't handle the fault, make
5914diff -urNp linux-2.6.18/arch/powerpc/kernel/module_32.c linux-2.6.18/arch/powerpc/kernel/module_32.c
5915--- linux-2.6.18/arch/powerpc/kernel/module_32.c 2006-09-19 23:42:06.000000000 -0400
5916+++ linux-2.6.18/arch/powerpc/kernel/module_32.c 2006-09-22 20:45:03.000000000 -0400
5917@@ -123,7 +123,7 @@ int module_frob_arch_sections(Elf32_Ehdr
5918 me->arch.core_plt_section = i;
5919 }
5920 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
5921- printk("Module doesn't contain .plt or .init.plt sections.\n");
5922+ printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
5923 return -ENOEXEC;
5924 }
5925
5926@@ -164,11 +164,16 @@ static uint32_t do_plt_call(void *locati
5927
5928 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
5929 /* Init, or core PLT? */
5930- if (location >= mod->module_core
5931- && location < mod->module_core + mod->core_size)
5932+ if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
5933+ (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
5934 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
5935- else
5936+ else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
5937+ (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
5938 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
5939+ else {
5940+ printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
5941+ return ~0UL;
5942+ }
5943
5944 /* Find this entry, or if that fails, the next avail. entry */
5945 while (entry->jump[0]) {
5946diff -urNp linux-2.6.18/arch/powerpc/kernel/vdso.c linux-2.6.18/arch/powerpc/kernel/vdso.c
5947--- linux-2.6.18/arch/powerpc/kernel/vdso.c 2006-09-19 23:42:06.000000000 -0400
5948+++ linux-2.6.18/arch/powerpc/kernel/vdso.c 2006-09-22 20:45:03.000000000 -0400
5949@@ -254,7 +254,7 @@ int arch_setup_additional_pages(struct l
5950 */
5951 down_write(&mm->mmap_sem);
5952 vdso_base = get_unmapped_area(NULL, vdso_base,
5953- vdso_pages << PAGE_SHIFT, 0, 0);
5954+ vdso_pages << PAGE_SHIFT, 0, MAP_PRIVATE | MAP_EXECUTABLE);
5955 if (IS_ERR_VALUE(vdso_base)) {
5956 rc = vdso_base;
5957 goto fail_mmapsem;
5958diff -urNp linux-2.6.18/arch/powerpc/mm/fault.c linux-2.6.18/arch/powerpc/mm/fault.c
5959--- linux-2.6.18/arch/powerpc/mm/fault.c 2006-09-19 23:42:06.000000000 -0400
5960+++ linux-2.6.18/arch/powerpc/mm/fault.c 2006-09-22 20:45:03.000000000 -0400
5961@@ -28,6 +28,12 @@
5962 #include <linux/highmem.h>
5963 #include <linux/module.h>
5964 #include <linux/kprobes.h>
5965+#include <linux/binfmts.h>
5966+#include <linux/slab.h>
5967+#include <linux/pagemap.h>
5968+#include <linux/compiler.h>
5969+#include <linux/binfmts.h>
5970+#include <linux/unistd.h>
5971
5972 #include <asm/page.h>
5973 #include <asm/pgtable.h>
5974@@ -73,6 +79,364 @@ static inline int notify_page_fault(enum
5975 }
5976 #endif
5977
5978+#ifdef CONFIG_PAX_EMUSIGRT
5979+void pax_syscall_close(struct vm_area_struct * vma)
5980+{
5981+ vma->vm_mm->call_syscall = 0UL;
5982+}
5983+
5984+static struct page* pax_syscall_nopage(struct vm_area_struct *vma, unsigned long address, int *type)
5985+{
5986+ struct page* page;
5987+ unsigned int *kaddr;
5988+
5989+ page = alloc_page(GFP_HIGHUSER);
5990+ if (!page)
5991+ return NOPAGE_OOM;
5992+
5993+ kaddr = kmap(page);
5994+ memset(kaddr, 0, PAGE_SIZE);
5995+ kaddr[0] = 0x44000002U; /* sc */
5996+ __flush_dcache_icache(kaddr);
5997+ kunmap(page);
5998+ if (type)
5999+ *type = VM_FAULT_MAJOR;
6000+ return page;
6001+}
6002+
6003+static struct vm_operations_struct pax_vm_ops = {
6004+ .close = pax_syscall_close,
6005+ .nopage = pax_syscall_nopage,
6006+};
6007+
6008+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6009+{
6010+ int ret;
6011+
6012+ memset(vma, 0, sizeof(*vma));
6013+ vma->vm_mm = current->mm;
6014+ vma->vm_start = addr;
6015+ vma->vm_end = addr + PAGE_SIZE;
6016+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6017+ vma->vm_page_prot = protection_map[vma->vm_flags & 0x0f];
6018+ vma->vm_ops = &pax_vm_ops;
6019+
6020+ ret = insert_vm_struct(current->mm, vma);
6021+ if (ret)
6022+ return ret;
6023+
6024+ ++current->mm->total_vm;
6025+ return 0;
6026+}
6027+#endif
6028+
6029+#ifdef CONFIG_PAX_PAGEEXEC
6030+/*
6031+ * PaX: decide what to do with offenders (regs->nip = fault address)
6032+ *
6033+ * returns 1 when task should be killed
6034+ * 2 when patched GOT trampoline was detected
6035+ * 3 when patched PLT trampoline was detected
6036+ * 4 when unpatched PLT trampoline was detected
6037+ * 5 when sigreturn trampoline was detected
6038+ * 7 when rt_sigreturn trampoline was detected
6039+ */
6040+static int pax_handle_fetch_fault(struct pt_regs *regs)
6041+{
6042+
6043+#if defined(CONFIG_PAX_EMUPLT) || defined(CONFIG_PAX_EMUSIGRT)
6044+ int err;
6045+#endif
6046+
6047+#ifdef CONFIG_PAX_EMUPLT
6048+ do { /* PaX: patched GOT emulation */
6049+ unsigned int blrl;
6050+
6051+ err = get_user(blrl, (unsigned int*)regs->nip);
6052+
6053+ if (!err && blrl == 0x4E800021U) {
6054+ unsigned long temp = regs->nip;
6055+
6056+ regs->nip = regs->link & 0xFFFFFFFCUL;
6057+ regs->link = temp + 4UL;
6058+ return 2;
6059+ }
6060+ } while (0);
6061+
6062+ do { /* PaX: patched PLT emulation #1 */
6063+ unsigned int b;
6064+
6065+ err = get_user(b, (unsigned int *)regs->nip);
6066+
6067+ if (!err && (b & 0xFC000003U) == 0x48000000U) {
6068+ regs->nip += (((b | 0xFC000000UL) ^ 0x02000000UL) + 0x02000000UL);
6069+ return 3;
6070+ }
6071+ } while (0);
6072+
6073+ do { /* PaX: unpatched PLT emulation #1 */
6074+ unsigned int li, b;
6075+
6076+ err = get_user(li, (unsigned int *)regs->nip);
6077+ err |= get_user(b, (unsigned int *)(regs->nip+4));
6078+
6079+ if (!err && (li & 0xFFFF0000U) == 0x39600000U && (b & 0xFC000003U) == 0x48000000U) {
6080+ unsigned int rlwinm, add, li2, addis2, mtctr, li3, addis3, bctr;
6081+ unsigned long addr = b | 0xFC000000UL;
6082+
6083+ addr = regs->nip + 4 + ((addr ^ 0x02000000UL) + 0x02000000UL);
6084+ err = get_user(rlwinm, (unsigned int*)addr);
6085+ err |= get_user(add, (unsigned int*)(addr+4));
6086+ err |= get_user(li2, (unsigned int*)(addr+8));
6087+ err |= get_user(addis2, (unsigned int*)(addr+12));
6088+ err |= get_user(mtctr, (unsigned int*)(addr+16));
6089+ err |= get_user(li3, (unsigned int*)(addr+20));
6090+ err |= get_user(addis3, (unsigned int*)(addr+24));
6091+ err |= get_user(bctr, (unsigned int*)(addr+28));
6092+
6093+ if (err)
6094+ break;
6095+
6096+ if (rlwinm == 0x556C083CU &&
6097+ add == 0x7D6C5A14U &&
6098+ (li2 & 0xFFFF0000U) == 0x39800000U &&
6099+ (addis2 & 0xFFFF0000U) == 0x3D8C0000U &&
6100+ mtctr == 0x7D8903A6U &&
6101+ (li3 & 0xFFFF0000U) == 0x39800000U &&
6102+ (addis3 & 0xFFFF0000U) == 0x3D8C0000U &&
6103+ bctr == 0x4E800420U)
6104+ {
6105+ regs->gpr[PT_R11] = 3 * (((li | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6106+ regs->gpr[PT_R12] = (((li3 | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6107+ regs->gpr[PT_R12] += (addis3 & 0xFFFFU) << 16;
6108+ regs->ctr = (((li2 | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6109+ regs->ctr += (addis2 & 0xFFFFU) << 16;
6110+ regs->nip = regs->ctr;
6111+ return 4;
6112+ }
6113+ }
6114+ } while (0);
6115+
6116+#if 0
6117+ do { /* PaX: unpatched PLT emulation #2 */
6118+ unsigned int lis, lwzu, b, bctr;
6119+
6120+ err = get_user(lis, (unsigned int *)regs->nip);
6121+ err |= get_user(lwzu, (unsigned int *)(regs->nip+4));
6122+ err |= get_user(b, (unsigned int *)(regs->nip+8));
6123+ err |= get_user(bctr, (unsigned int *)(regs->nip+12));
6124+
6125+ if (err)
6126+ break;
6127+
6128+ if ((lis & 0xFFFF0000U) == 0x39600000U &&
6129+ (lwzu & 0xU) == 0xU &&
6130+ (b & 0xFC000003U) == 0x48000000U &&
6131+ bctr == 0x4E800420U)
6132+ {
6133+ unsigned int addis, addi, rlwinm, add, li2, addis2, mtctr, li3, addis3, bctr;
6134+ unsigned long addr = b | 0xFC000000UL;
6135+
6136+ addr = regs->nip + 12 + ((addr ^ 0x02000000UL) + 0x02000000UL);
6137+ err = get_user(addis, (unsigned int*)addr);
6138+ err |= get_user(addi, (unsigned int*)(addr+4));
6139+ err |= get_user(rlwinm, (unsigned int*)(addr+8));
6140+ err |= get_user(add, (unsigned int*)(addr+12));
6141+ err |= get_user(li2, (unsigned int*)(addr+16));
6142+ err |= get_user(addis2, (unsigned int*)(addr+20));
6143+ err |= get_user(mtctr, (unsigned int*)(addr+24));
6144+ err |= get_user(li3, (unsigned int*)(addr+28));
6145+ err |= get_user(addis3, (unsigned int*)(addr+32));
6146+ err |= get_user(bctr, (unsigned int*)(addr+36));
6147+
6148+ if (err)
6149+ break;
6150+
6151+ if ((addis & 0xFFFF0000U) == 0x3D6B0000U &&
6152+ (addi & 0xFFFF0000U) == 0x396B0000U &&
6153+ rlwinm == 0x556C083CU &&
6154+ add == 0x7D6C5A14U &&
6155+ (li2 & 0xFFFF0000U) == 0x39800000U &&
6156+ (addis2 & 0xFFFF0000U) == 0x3D8C0000U &&
6157+ mtctr == 0x7D8903A6U &&
6158+ (li3 & 0xFFFF0000U) == 0x39800000U &&
6159+ (addis3 & 0xFFFF0000U) == 0x3D8C0000U &&
6160+ bctr == 0x4E800420U)
6161+ {
6162+ regs->gpr[PT_R11] =
6163+ regs->gpr[PT_R11] = 3 * (((li | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6164+ regs->gpr[PT_R12] = (((li3 | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6165+ regs->gpr[PT_R12] += (addis3 & 0xFFFFU) << 16;
6166+ regs->ctr = (((li2 | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6167+ regs->ctr += (addis2 & 0xFFFFU) << 16;
6168+ regs->nip = regs->ctr;
6169+ return 4;
6170+ }
6171+ }
6172+ } while (0);
6173+#endif
6174+
6175+ do { /* PaX: unpatched PLT emulation #3 */
6176+ unsigned int li, b;
6177+
6178+ err = get_user(li, (unsigned int *)regs->nip);
6179+ err |= get_user(b, (unsigned int *)(regs->nip+4));
6180+
6181+ if (!err && (li & 0xFFFF0000U) == 0x39600000U && (b & 0xFC000003U) == 0x48000000U) {
6182+ unsigned int addis, lwz, mtctr, bctr;
6183+ unsigned long addr = b | 0xFC000000UL;
6184+
6185+ addr = regs->nip + 4 + ((addr ^ 0x02000000UL) + 0x02000000UL);
6186+ err = get_user(addis, (unsigned int*)addr);
6187+ err |= get_user(lwz, (unsigned int*)(addr+4));
6188+ err |= get_user(mtctr, (unsigned int*)(addr+8));
6189+ err |= get_user(bctr, (unsigned int*)(addr+12));
6190+
6191+ if (err)
6192+ break;
6193+
6194+ if ((addis & 0xFFFF0000U) == 0x3D6B0000U &&
6195+ (lwz & 0xFFFF0000U) == 0x816B0000U &&
6196+ mtctr == 0x7D6903A6U &&
6197+ bctr == 0x4E800420U)
6198+ {
6199+ unsigned int r11;
6200+
6201+ addr = (addis << 16) + (((li | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6202+ addr += (((lwz | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6203+
6204+ err = get_user(r11, (unsigned int*)addr);
6205+ if (err)
6206+ break;
6207+
6208+ regs->gpr[PT_R11] = r11;
6209+ regs->ctr = r11;
6210+ regs->nip = r11;
6211+ return 4;
6212+ }
6213+ }
6214+ } while (0);
6215+#endif
6216+
6217+#ifdef CONFIG_PAX_EMUSIGRT
6218+ do { /* PaX: sigreturn emulation */
6219+ unsigned int li, sc;
6220+
6221+ err = get_user(li, (unsigned int *)regs->nip);
6222+ err |= get_user(sc, (unsigned int *)(regs->nip+4));
6223+
6224+ if (!err && li == 0x38000000U + __NR_sigreturn && sc == 0x44000002U) {
6225+ struct vm_area_struct *vma;
6226+ unsigned long call_syscall;
6227+
6228+ down_read(&current->mm->mmap_sem);
6229+ call_syscall = current->mm->call_syscall;
6230+ up_read(&current->mm->mmap_sem);
6231+ if (likely(call_syscall))
6232+ goto emulate;
6233+
6234+ vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
6235+
6236+ down_write(&current->mm->mmap_sem);
6237+ if (current->mm->call_syscall) {
6238+ call_syscall = current->mm->call_syscall;
6239+ up_write(&current->mm->mmap_sem);
6240+ if (vma) kmem_cache_free(vm_area_cachep, vma);
6241+ goto emulate;
6242+ }
6243+
6244+ call_syscall = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
6245+ if (!vma || (call_syscall & ~PAGE_MASK)) {
6246+ up_write(&current->mm->mmap_sem);
6247+ if (vma) kmem_cache_free(vm_area_cachep, vma);
6248+ return 1;
6249+ }
6250+
6251+ if (pax_insert_vma(vma, call_syscall)) {
6252+ up_write(&current->mm->mmap_sem);
6253+ kmem_cache_free(vm_area_cachep, vma);
6254+ return 1;
6255+ }
6256+
6257+ current->mm->call_syscall = call_syscall;
6258+ up_write(&current->mm->mmap_sem);
6259+
6260+emulate:
6261+ regs->gpr[PT_R0] = __NR_sigreturn;
6262+ regs->nip = call_syscall;
6263+ return 5;
6264+ }
6265+ } while (0);
6266+
6267+ do { /* PaX: rt_sigreturn emulation */
6268+ unsigned int li, sc;
6269+
6270+ err = get_user(li, (unsigned int *)regs->nip);
6271+ err |= get_user(sc, (unsigned int *)(regs->nip+4));
6272+
6273+ if (!err && li == 0x38000000U + __NR_rt_sigreturn && sc == 0x44000002U) {
6274+ struct vm_area_struct *vma;
6275+ unsigned int call_syscall;
6276+
6277+ down_read(&current->mm->mmap_sem);
6278+ call_syscall = current->mm->call_syscall;
6279+ up_read(&current->mm->mmap_sem);
6280+ if (likely(call_syscall))
6281+ goto rt_emulate;
6282+
6283+ vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
6284+
6285+ down_write(&current->mm->mmap_sem);
6286+ if (current->mm->call_syscall) {
6287+ call_syscall = current->mm->call_syscall;
6288+ up_write(&current->mm->mmap_sem);
6289+ if (vma) kmem_cache_free(vm_area_cachep, vma);
6290+ goto rt_emulate;
6291+ }
6292+
6293+ call_syscall = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
6294+ if (!vma || (call_syscall & ~PAGE_MASK)) {
6295+ up_write(&current->mm->mmap_sem);
6296+ if (vma) kmem_cache_free(vm_area_cachep, vma);
6297+ return 1;
6298+ }
6299+
6300+ if (pax_insert_vma(vma, call_syscall)) {
6301+ up_write(&current->mm->mmap_sem);
6302+ kmem_cache_free(vm_area_cachep, vma);
6303+ return 1;
6304+ }
6305+
6306+ current->mm->call_syscall = call_syscall;
6307+ up_write(&current->mm->mmap_sem);
6308+
6309+rt_emulate:
6310+ regs->gpr[PT_R0] = __NR_rt_sigreturn;
6311+ regs->nip = call_syscall;
6312+ return 6;
6313+ }
6314+ } while (0);
6315+#endif
6316+
6317+ return 1;
6318+}
6319+
6320+void pax_report_insns(void *pc, void *sp)
6321+{
6322+ unsigned long i;
6323+
6324+ printk(KERN_ERR "PAX: bytes at PC: ");
6325+ for (i = 0; i < 5; i++) {
6326+ unsigned int c;
6327+ if (get_user(c, (unsigned int*)pc+i))
6328+ printk("???????? ");
6329+ else
6330+ printk("%08x ", c);
6331+ }
6332+ printk("\n");
6333+}
6334+#endif
6335+
6336 /*
6337 * Check whether the instruction at regs->nip is a store using
6338 * an update addressing form which will update r1.
6339@@ -168,7 +532,7 @@ int __kprobes do_page_fault(struct pt_re
6340 * indicate errors in DSISR but can validly be set in SRR1.
6341 */
6342 if (trap == 0x400)
6343- error_code &= 0x48200000;
6344+ error_code &= 0x58200000;
6345 else
6346 is_write = error_code & DSISR_ISSTORE;
6347 #else
6348@@ -295,9 +659,9 @@ good_area:
6349 /* protection fault */
6350 if (error_code & DSISR_PROTFAULT)
6351 goto bad_area;
6352+#endif
6353 if (!(vma->vm_flags & VM_EXEC))
6354 goto bad_area;
6355-#endif
6356 #if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
6357 pte_t *ptep;
6358 pmd_t *pmdp;
6359@@ -368,6 +732,37 @@ bad_area:
6360 bad_area_nosemaphore:
6361 /* User mode accesses cause a SIGSEGV */
6362 if (user_mode(regs)) {
6363+
6364+#ifdef CONFIG_PAX_PAGEEXEC
6365+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
6366+#ifdef CONFIG_PPC64
6367+ if (is_exec && (error_code & DSISR_PROTFAULT)) {
6368+#else
6369+ if (is_exec && regs->nip == address) {
6370+#endif
6371+ switch (pax_handle_fetch_fault(regs)) {
6372+
6373+#ifdef CONFIG_PAX_EMUPLT
6374+ case 2:
6375+ case 3:
6376+ case 4:
6377+ return 0;
6378+#endif
6379+
6380+#ifdef CONFIG_PAX_EMUSIGRT
6381+ case 5:
6382+ case 6:
6383+ return 0;
6384+#endif
6385+
6386+ }
6387+
6388+ pax_report_fault(regs, (void*)regs->nip, (void*)regs->gpr[1]);
6389+ do_exit(SIGKILL);
6390+ }
6391+ }
6392+#endif
6393+
6394 _exception(SIGSEGV, regs, code, address);
6395 return 0;
6396 }
6397diff -urNp linux-2.6.18/arch/powerpc/mm/hugetlbpage.c linux-2.6.18/arch/powerpc/mm/hugetlbpage.c
6398--- linux-2.6.18/arch/powerpc/mm/hugetlbpage.c 2006-09-19 23:42:06.000000000 -0400
6399+++ linux-2.6.18/arch/powerpc/mm/hugetlbpage.c 2006-09-22 20:45:03.000000000 -0400
6400@@ -562,6 +562,10 @@ unsigned long arch_get_unmapped_area(str
6401 if (len > TASK_SIZE)
6402 return -ENOMEM;
6403
6404+#ifdef CONFIG_PAX_RANDMMAP
6405+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
6406+#endif
6407+
6408 if (addr) {
6409 addr = PAGE_ALIGN(addr);
6410 vma = find_vma(mm, addr);
6411@@ -573,7 +577,7 @@ unsigned long arch_get_unmapped_area(str
6412 if (len > mm->cached_hole_size) {
6413 start_addr = addr = mm->free_area_cache;
6414 } else {
6415- start_addr = addr = TASK_UNMAPPED_BASE;
6416+ start_addr = addr = mm->mmap_base;
6417 mm->cached_hole_size = 0;
6418 }
6419
6420@@ -606,8 +610,8 @@ full_search:
6421 }
6422
6423 /* Make sure we didn't miss any holes */
6424- if (start_addr != TASK_UNMAPPED_BASE) {
6425- start_addr = addr = TASK_UNMAPPED_BASE;
6426+ if (start_addr != mm->mmap_base) {
6427+ start_addr = addr = mm->mmap_base;
6428 mm->cached_hole_size = 0;
6429 goto full_search;
6430 }
6431@@ -642,6 +646,11 @@ arch_get_unmapped_area_topdown(struct fi
6432 mm->free_area_cache = base;
6433
6434 /* requesting a specific address */
6435+
6436+#ifdef CONFIG_PAX_RANDMMAP
6437+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
6438+#endif
6439+
6440 if (addr) {
6441 addr = PAGE_ALIGN(addr);
6442 vma = find_vma(mm, addr);
6443@@ -721,12 +730,20 @@ fail:
6444 * can happen with large stack limits and large mmap()
6445 * allocations.
6446 */
6447- mm->free_area_cache = TASK_UNMAPPED_BASE;
6448+ mm->mmap_base = TASK_UNMAPPED_BASE;
6449+
6450+#ifdef CONFIG_PAX_RANDMMAP
6451+ if (mm->pax_flags & MF_PAX_RANDMMAP)
6452+ mm->mmap_base += mm->delta_mmap;
6453+#endif
6454+
6455+ mm->free_area_cache = mm->mmap_base;
6456 mm->cached_hole_size = ~0UL;
6457 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
6458 /*
6459 * Restore the topdown base:
6460 */
6461+ mm->mmap_base = base;
6462 mm->free_area_cache = base;
6463 mm->cached_hole_size = ~0UL;
6464
6465diff -urNp linux-2.6.18/arch/powerpc/mm/mmap.c linux-2.6.18/arch/powerpc/mm/mmap.c
6466--- linux-2.6.18/arch/powerpc/mm/mmap.c 2006-09-19 23:42:06.000000000 -0400
6467+++ linux-2.6.18/arch/powerpc/mm/mmap.c 2006-09-22 20:45:03.000000000 -0400
6468@@ -74,10 +74,22 @@ void arch_pick_mmap_layout(struct mm_str
6469 */
6470 if (mmap_is_legacy()) {
6471 mm->mmap_base = TASK_UNMAPPED_BASE;
6472+
6473+#ifdef CONFIG_PAX_RANDMMAP
6474+ if (mm->pax_flags & MF_PAX_RANDMMAP)
6475+ mm->mmap_base += mm->delta_mmap;
6476+#endif
6477+
6478 mm->get_unmapped_area = arch_get_unmapped_area;
6479 mm->unmap_area = arch_unmap_area;
6480 } else {
6481 mm->mmap_base = mmap_base();
6482+
6483+#ifdef CONFIG_PAX_RANDMMAP
6484+ if (mm->pax_flags & MF_PAX_RANDMMAP)
6485+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
6486+#endif
6487+
6488 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
6489 mm->unmap_area = arch_unmap_area_topdown;
6490 }
6491diff -urNp linux-2.6.18/arch/ppc/mm/fault.c linux-2.6.18/arch/ppc/mm/fault.c
6492--- linux-2.6.18/arch/ppc/mm/fault.c 2006-09-19 23:42:06.000000000 -0400
6493+++ linux-2.6.18/arch/ppc/mm/fault.c 2006-09-22 20:45:03.000000000 -0400
6494@@ -25,6 +25,11 @@
6495 #include <linux/interrupt.h>
6496 #include <linux/highmem.h>
6497 #include <linux/module.h>
6498+#include <linux/slab.h>
6499+#include <linux/pagemap.h>
6500+#include <linux/compiler.h>
6501+#include <linux/binfmts.h>
6502+#include <linux/unistd.h>
6503
6504 #include <asm/page.h>
6505 #include <asm/pgtable.h>
6506@@ -48,6 +53,379 @@ unsigned long pte_misses; /* updated by
6507 unsigned long pte_errors; /* updated by do_page_fault() */
6508 unsigned int probingmem;
6509
6510+#ifdef CONFIG_PAX_EMUSIGRT
6511+void pax_syscall_close(struct vm_area_struct * vma)
6512+{
6513+ vma->vm_mm->call_syscall = 0UL;
6514+}
6515+
6516+static struct page* pax_syscall_nopage(struct vm_area_struct *vma, unsigned long address, int *type)
6517+{
6518+ struct page* page;
6519+ unsigned int *kaddr;
6520+
6521+ page = alloc_page(GFP_HIGHUSER);
6522+ if (!page)
6523+ return NOPAGE_OOM;
6524+
6525+ kaddr = kmap(page);
6526+ memset(kaddr, 0, PAGE_SIZE);
6527+ kaddr[0] = 0x44000002U; /* sc */
6528+ __flush_dcache_icache(kaddr);
6529+ kunmap(page);
6530+ if (type)
6531+ *type = VM_FAULT_MAJOR;
6532+ return page;
6533+}
6534+
6535+static struct vm_operations_struct pax_vm_ops = {
6536+ .close = pax_syscall_close,
6537+ .nopage = pax_syscall_nopage,
6538+};
6539+
6540+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6541+{
6542+ int ret;
6543+
6544+ memset(vma, 0, sizeof(*vma));
6545+ vma->vm_mm = current->mm;
6546+ vma->vm_start = addr;
6547+ vma->vm_end = addr + PAGE_SIZE;
6548+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6549+ vma->vm_page_prot = protection_map[vma->vm_flags & 0x0f];
6550+ vma->vm_ops = &pax_vm_ops;
6551+
6552+ ret = insert_vm_struct(current->mm, vma);
6553+ if (ret)
6554+ return ret;
6555+
6556+ ++current->mm->total_vm;
6557+ return 0;
6558+}
6559+#endif
6560+
6561+#ifdef CONFIG_PAX_PAGEEXEC
6562+/*
6563+ * PaX: decide what to do with offenders (regs->nip = fault address)
6564+ *
6565+ * returns 1 when task should be killed
6566+ * 2 when patched GOT trampoline was detected
6567+ * 3 when patched PLT trampoline was detected
6568+ * 4 when unpatched PLT trampoline was detected
6569+ * 5 when sigreturn trampoline was detected
6570+ * 7 when rt_sigreturn trampoline was detected
6571+ */
6572+static int pax_handle_fetch_fault(struct pt_regs *regs)
6573+{
6574+
6575+#if defined(CONFIG_PAX_EMUPLT) || defined(CONFIG_PAX_EMUSIGRT)
6576+ int err;
6577+#endif
6578+
6579+#ifdef CONFIG_PAX_EMUPLT
6580+ do { /* PaX: patched GOT emulation */
6581+ unsigned int blrl;
6582+
6583+ err = get_user(blrl, (unsigned int*)regs->nip);
6584+
6585+ if (!err && blrl == 0x4E800021U) {
6586+ unsigned long temp = regs->nip;
6587+
6588+ regs->nip = regs->link & 0xFFFFFFFCUL;
6589+ regs->link = temp + 4UL;
6590+ return 2;
6591+ }
6592+ } while (0);
6593+
6594+ do { /* PaX: patched PLT emulation #1 */
6595+ unsigned int b;
6596+
6597+ err = get_user(b, (unsigned int *)regs->nip);
6598+
6599+ if (!err && (b & 0xFC000003U) == 0x48000000U) {
6600+ regs->nip += (((b | 0xFC000000UL) ^ 0x02000000UL) + 0x02000000UL);
6601+ return 3;
6602+ }
6603+ } while (0);
6604+
6605+ do { /* PaX: unpatched PLT emulation #1 */
6606+ unsigned int li, b;
6607+
6608+ err = get_user(li, (unsigned int *)regs->nip);
6609+ err |= get_user(b, (unsigned int *)(regs->nip+4));
6610+
6611+ if (!err && (li & 0xFFFF0000U) == 0x39600000U && (b & 0xFC000003U) == 0x48000000U) {
6612+ unsigned int rlwinm, add, li2, addis2, mtctr, li3, addis3, bctr;
6613+ unsigned long addr = b | 0xFC000000UL;
6614+
6615+ addr = regs->nip + 4 + ((addr ^ 0x02000000UL) + 0x02000000UL);
6616+ err = get_user(rlwinm, (unsigned int*)addr);
6617+ err |= get_user(add, (unsigned int*)(addr+4));
6618+ err |= get_user(li2, (unsigned int*)(addr+8));
6619+ err |= get_user(addis2, (unsigned int*)(addr+12));
6620+ err |= get_user(mtctr, (unsigned int*)(addr+16));
6621+ err |= get_user(li3, (unsigned int*)(addr+20));
6622+ err |= get_user(addis3, (unsigned int*)(addr+24));
6623+ err |= get_user(bctr, (unsigned int*)(addr+28));
6624+
6625+ if (err)
6626+ break;
6627+
6628+ if (rlwinm == 0x556C083CU &&
6629+ add == 0x7D6C5A14U &&
6630+ (li2 & 0xFFFF0000U) == 0x39800000U &&
6631+ (addis2 & 0xFFFF0000U) == 0x3D8C0000U &&
6632+ mtctr == 0x7D8903A6U &&
6633+ (li3 & 0xFFFF0000U) == 0x39800000U &&
6634+ (addis3 & 0xFFFF0000U) == 0x3D8C0000U &&
6635+ bctr == 0x4E800420U)
6636+ {
6637+ regs->gpr[PT_R11] = 3 * (((li | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6638+ regs->gpr[PT_R12] = (((li3 | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6639+ regs->gpr[PT_R12] += (addis3 & 0xFFFFU) << 16;
6640+ regs->ctr = (((li2 | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6641+ regs->ctr += (addis2 & 0xFFFFU) << 16;
6642+ regs->nip = regs->ctr;
6643+ return 4;
6644+ }
6645+ }
6646+ } while (0);
6647+
6648+#if 0
6649+ do { /* PaX: unpatched PLT emulation #2 */
6650+ unsigned int lis, lwzu, b, bctr;
6651+
6652+ err = get_user(lis, (unsigned int *)regs->nip);
6653+ err |= get_user(lwzu, (unsigned int *)(regs->nip+4));
6654+ err |= get_user(b, (unsigned int *)(regs->nip+8));
6655+ err |= get_user(bctr, (unsigned int *)(regs->nip+12));
6656+
6657+ if (err)
6658+ break;
6659+
6660+ if ((lis & 0xFFFF0000U) == 0x39600000U &&
6661+ (lwzu & 0xU) == 0xU &&
6662+ (b & 0xFC000003U) == 0x48000000U &&
6663+ bctr == 0x4E800420U)
6664+ {
6665+ unsigned int addis, addi, rlwinm, add, li2, addis2, mtctr, li3, addis3, bctr;
6666+ unsigned long addr = b | 0xFC000000UL;
6667+
6668+ addr = regs->nip + 12 + ((addr ^ 0x02000000UL) + 0x02000000UL);
6669+ err = get_user(addis, (unsigned int*)addr);
6670+ err |= get_user(addi, (unsigned int*)(addr+4));
6671+ err |= get_user(rlwinm, (unsigned int*)(addr+8));
6672+ err |= get_user(add, (unsigned int*)(addr+12));
6673+ err |= get_user(li2, (unsigned int*)(addr+16));
6674+ err |= get_user(addis2, (unsigned int*)(addr+20));
6675+ err |= get_user(mtctr, (unsigned int*)(addr+24));
6676+ err |= get_user(li3, (unsigned int*)(addr+28));
6677+ err |= get_user(addis3, (unsigned int*)(addr+32));
6678+ err |= get_user(bctr, (unsigned int*)(addr+36));
6679+
6680+ if (err)
6681+ break;
6682+
6683+ if ((addis & 0xFFFF0000U) == 0x3D6B0000U &&
6684+ (addi & 0xFFFF0000U) == 0x396B0000U &&
6685+ rlwinm == 0x556C083CU &&
6686+ add == 0x7D6C5A14U &&
6687+ (li2 & 0xFFFF0000U) == 0x39800000U &&
6688+ (addis2 & 0xFFFF0000U) == 0x3D8C0000U &&
6689+ mtctr == 0x7D8903A6U &&
6690+ (li3 & 0xFFFF0000U) == 0x39800000U &&
6691+ (addis3 & 0xFFFF0000U) == 0x3D8C0000U &&
6692+ bctr == 0x4E800420U)
6693+ {
6694+ regs->gpr[PT_R11] =
6695+ regs->gpr[PT_R11] = 3 * (((li | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6696+ regs->gpr[PT_R12] = (((li3 | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6697+ regs->gpr[PT_R12] += (addis3 & 0xFFFFU) << 16;
6698+ regs->ctr = (((li2 | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6699+ regs->ctr += (addis2 & 0xFFFFU) << 16;
6700+ regs->nip = regs->ctr;
6701+ return 4;
6702+ }
6703+ }
6704+ } while (0);
6705+#endif
6706+
6707+ do { /* PaX: unpatched PLT emulation #3 */
6708+ unsigned int li, b;
6709+
6710+ err = get_user(li, (unsigned int *)regs->nip);
6711+ err |= get_user(b, (unsigned int *)(regs->nip+4));
6712+
6713+ if (!err && (li & 0xFFFF0000U) == 0x39600000U && (b & 0xFC000003U) == 0x48000000U) {
6714+ unsigned int addis, lwz, mtctr, bctr;
6715+ unsigned long addr = b | 0xFC000000UL;
6716+
6717+ addr = regs->nip + 4 + ((addr ^ 0x02000000UL) + 0x02000000UL);
6718+ err = get_user(addis, (unsigned int*)addr);
6719+ err |= get_user(lwz, (unsigned int*)(addr+4));
6720+ err |= get_user(mtctr, (unsigned int*)(addr+8));
6721+ err |= get_user(bctr, (unsigned int*)(addr+12));
6722+
6723+ if (err)
6724+ break;
6725+
6726+ if ((addis & 0xFFFF0000U) == 0x3D6B0000U &&
6727+ (lwz & 0xFFFF0000U) == 0x816B0000U &&
6728+ mtctr == 0x7D6903A6U &&
6729+ bctr == 0x4E800420U)
6730+ {
6731+ unsigned int r11;
6732+
6733+ addr = (addis << 16) + (((li | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6734+ addr += (((lwz | 0xFFFF0000UL) ^ 0x00008000UL) + 0x00008000UL);
6735+
6736+ err = get_user(r11, (unsigned int*)addr);
6737+ if (err)
6738+ break;
6739+
6740+ regs->gpr[PT_R11] = r11;
6741+ regs->ctr = r11;
6742+ regs->nip = r11;
6743+ return 4;
6744+ }
6745+ }
6746+ } while (0);
6747+#endif
6748+
6749+#ifdef CONFIG_PAX_EMUSIGRT
6750+ do { /* PaX: sigreturn emulation */
6751+ unsigned int li, sc;
6752+
6753+ err = get_user(li, (unsigned int *)regs->nip);
6754+ err |= get_user(sc, (unsigned int *)(regs->nip+4));
6755+
6756+ if (!err && li == 0x38000000U + __NR_sigreturn && sc == 0x44000002U) {
6757+ struct vm_area_struct *vma;
6758+ unsigned long call_syscall;
6759+
6760+ down_read(&current->mm->mmap_sem);
6761+ call_syscall = current->mm->call_syscall;
6762+ up_read(&current->mm->mmap_sem);
6763+ if (likely(call_syscall))
6764+ goto emulate;
6765+
6766+ vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
6767+
6768+ down_write(&current->mm->mmap_sem);
6769+ if (current->mm->call_syscall) {
6770+ call_syscall = current->mm->call_syscall;
6771+ up_write(&current->mm->mmap_sem);
6772+ if (vma) kmem_cache_free(vm_area_cachep, vma);
6773+ goto emulate;
6774+ }
6775+
6776+ call_syscall = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
6777+ if (!vma || (call_syscall & ~PAGE_MASK)) {
6778+ up_write(&current->mm->mmap_sem);
6779+ if (vma) kmem_cache_free(vm_area_cachep, vma);
6780+ return 1;
6781+ }
6782+
6783+ if (pax_insert_vma(vma, call_syscall)) {
6784+ up_write(&current->mm->mmap_sem);
6785+ kmem_cache_free(vm_area_cachep, vma);
6786+ return 1;
6787+ }
6788+
6789+ current->mm->call_syscall = call_syscall;
6790+ up_write(&current->mm->mmap_sem);
6791+
6792+emulate:
6793+ regs->gpr[PT_R0] = __NR_sigreturn;
6794+ regs->nip = call_syscall;
6795+ return 5;
6796+ }
6797+ } while (0);
6798+
6799+ do { /* PaX: rt_sigreturn emulation */
6800+ unsigned int li, sc;
6801+
6802+ err = get_user(li, (unsigned int *)regs->nip);
6803+ err |= get_user(sc, (unsigned int *)(regs->nip+4));
6804+
6805+ if (!err && li == 0x38000000U + __NR_rt_sigreturn && sc == 0x44000002U) {
6806+ struct vm_area_struct *vma;
6807+ unsigned int call_syscall;
6808+
6809+ down_read(&current->mm->mmap_sem);
6810+ call_syscall = current->mm->call_syscall;
6811+ up_read(&current->mm->mmap_sem);
6812+ if (likely(call_syscall))
6813+ goto rt_emulate;
6814+
6815+ vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
6816+
6817+ down_write(&current->mm->mmap_sem);
6818+ if (current->mm->call_syscall) {
6819+ call_syscall = current->mm->call_syscall;
6820+ up_write(&current->mm->mmap_sem);
6821+ if (vma) kmem_cache_free(vm_area_cachep, vma);
6822+ goto rt_emulate;
6823+ }
6824+
6825+ call_syscall = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
6826+ if (!vma || (call_syscall & ~PAGE_MASK)) {
6827+ up_write(&current->mm->mmap_sem);
6828+ if (vma) kmem_cache_free(vm_area_cachep, vma);
6829+ return 1;
6830+ }
6831+
6832+ if (pax_insert_vma(vma, call_syscall)) {
6833+ up_write(&current->mm->mmap_sem);
6834+ kmem_cache_free(vm_area_cachep, vma);
6835+ return 1;
6836+ }
6837+
6838+ current->mm->call_syscall = call_syscall;
6839+ up_write(&current->mm->mmap_sem);
6840+
6841+rt_emulate:
6842+ regs->gpr[PT_R0] = __NR_rt_sigreturn;
6843+ regs->nip = call_syscall;
6844+ return 6;
6845+ }
6846+ } while (0);
6847+#endif
6848+
6849+ return 1;
6850+}
6851+
6852+/*
6853+ * PaX: decide what to do with offenders (regs->nip = fault address)
6854+ *
6855+ * returns 1 when task should be killed
6856+ */
6857+static int pax_handle_fetch_fault(struct pt_regs *regs)
6858+{
6859+
6860+#if defined(CONFIG_PAX_EMUPLT) || defined(CONFIG_PAX_EMUSIGRT)
6861+ int err;
6862+#endif
6863+
6864+ return 1;
6865+}
6866+
6867+void pax_report_insns(void *pc, void *sp)
6868+{
6869+ unsigned long i;
6870+
6871+ printk(KERN_ERR "PAX: bytes at PC: ");
6872+ for (i = 0; i < 5; i++) {
6873+ unsigned int c;
6874+ if (get_user(c, (unsigned int*)pc+i))
6875+ printk("???????? ");
6876+ else
6877+ printk("%08x ", c);
6878+ }
6879+ printk("\n");
6880+}
6881+#endif
6882+
6883 /*
6884 * Check whether the instruction at regs->nip is a store using
6885 * an update addressing form which will update r1.
6886@@ -108,7 +486,7 @@ int do_page_fault(struct pt_regs *regs,
6887 * indicate errors in DSISR but can validly be set in SRR1.
6888 */
6889 if (TRAP(regs) == 0x400)
6890- error_code &= 0x48200000;
6891+ error_code &= 0x58200000;
6892 else
6893 is_write = error_code & 0x02000000;
6894 #endif /* CONFIG_4xx || CONFIG_BOOKE */
6895@@ -203,15 +581,14 @@ good_area:
6896 pte_t *ptep;
6897 pmd_t *pmdp;
6898
6899-#if 0
6900+#if 1
6901 /* It would be nice to actually enforce the VM execute
6902 permission on CPUs which can do so, but far too
6903 much stuff in userspace doesn't get the permissions
6904 right, so we let any page be executed for now. */
6905 if (! (vma->vm_flags & VM_EXEC))
6906 goto bad_area;
6907-#endif
6908-
6909+#else
6910 /* Since 4xx/Book-E supports per-page execute permission,
6911 * we lazily flush dcache to icache. */
6912 ptep = NULL;
6913@@ -234,6 +611,7 @@ good_area:
6914 pte_unmap_unlock(ptep, ptl);
6915 }
6916 #endif
6917+#endif
6918 /* a read */
6919 } else {
6920 /* protection fault */
6921@@ -279,6 +657,33 @@ bad_area:
6922
6923 /* User mode accesses cause a SIGSEGV */
6924 if (user_mode(regs)) {
6925+
6926+#ifdef CONFIG_PAX_PAGEEXEC
6927+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
6928+ if ((TRAP(regs) == 0x400) && (regs->nip == address)) {
6929+ switch (pax_handle_fetch_fault(regs)) {
6930+
6931+#ifdef CONFIG_PAX_EMUPLT
6932+ case 2:
6933+ case 3:
6934+ case 4:
6935+ return 0;
6936+#endif
6937+
6938+#ifdef CONFIG_PAX_EMUSIGRT
6939+ case 5:
6940+ case 6:
6941+ return 0;
6942+#endif
6943+
6944+ }
6945+
6946+ pax_report_fault(regs, (void*)regs->nip, (void*)regs->gpr[1]);
6947+ do_exit(SIGKILL);
6948+ }
6949+ }
6950+#endif
6951+
6952 _exception(SIGSEGV, regs, code, address);
6953 return 0;
6954 }
6955diff -urNp linux-2.6.18/arch/s390/kernel/module.c linux-2.6.18/arch/s390/kernel/module.c
6956--- linux-2.6.18/arch/s390/kernel/module.c 2006-09-19 23:42:06.000000000 -0400
6957+++ linux-2.6.18/arch/s390/kernel/module.c 2006-09-22 20:45:03.000000000 -0400
6958@@ -164,11 +164,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
6959
6960 /* Increase core size by size of got & plt and set start
6961 offsets for got and plt. */
6962- me->core_size = ALIGN(me->core_size, 4);
6963- me->arch.got_offset = me->core_size;
6964- me->core_size += me->arch.got_size;
6965- me->arch.plt_offset = me->core_size;
6966- me->core_size += me->arch.plt_size;
6967+ me->core_size_rw = ALIGN(me->core_size_rw, 4);
6968+ me->arch.got_offset = me->core_size_rw;
6969+ me->core_size_rw += me->arch.got_size;
6970+ me->arch.plt_offset = me->core_size_rx;
6971+ me->core_size_rx += me->arch.plt_size;
6972 return 0;
6973 }
6974
6975@@ -254,7 +254,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
6976 if (info->got_initialized == 0) {
6977 Elf_Addr *gotent;
6978
6979- gotent = me->module_core + me->arch.got_offset +
6980+ gotent = me->module_core_rw + me->arch.got_offset +
6981 info->got_offset;
6982 *gotent = val;
6983 info->got_initialized = 1;
6984@@ -278,7 +278,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
6985 else if (r_type == R_390_GOTENT ||
6986 r_type == R_390_GOTPLTENT)
6987 *(unsigned int *) loc =
6988- (val + (Elf_Addr) me->module_core - loc) >> 1;
6989+ (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
6990 else if (r_type == R_390_GOT64 ||
6991 r_type == R_390_GOTPLT64)
6992 *(unsigned long *) loc = val;
6993@@ -292,7 +292,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
6994 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
6995 if (info->plt_initialized == 0) {
6996 unsigned int *ip;
6997- ip = me->module_core + me->arch.plt_offset +
6998+ ip = me->module_core_rx + me->arch.plt_offset +
6999 info->plt_offset;
7000 #ifndef CONFIG_64BIT
7001 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
7002@@ -314,7 +314,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
7003 val = me->arch.plt_offset - me->arch.got_offset +
7004 info->plt_offset + rela->r_addend;
7005 else
7006- val = (Elf_Addr) me->module_core +
7007+ val = (Elf_Addr) me->module_core_rx +
7008 me->arch.plt_offset + info->plt_offset +
7009 rela->r_addend - loc;
7010 if (r_type == R_390_PLT16DBL)
7011@@ -334,7 +334,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
7012 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
7013 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
7014 val = val + rela->r_addend -
7015- ((Elf_Addr) me->module_core + me->arch.got_offset);
7016+ ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
7017 if (r_type == R_390_GOTOFF16)
7018 *(unsigned short *) loc = val;
7019 else if (r_type == R_390_GOTOFF32)
7020@@ -344,7 +344,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
7021 break;
7022 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
7023 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
7024- val = (Elf_Addr) me->module_core + me->arch.got_offset +
7025+ val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
7026 rela->r_addend - loc;
7027 if (r_type == R_390_GOTPC)
7028 *(unsigned int *) loc = val;
7029diff -urNp linux-2.6.18/arch/sparc/kernel/ptrace.c linux-2.6.18/arch/sparc/kernel/ptrace.c
7030--- linux-2.6.18/arch/sparc/kernel/ptrace.c 2006-09-19 23:42:06.000000000 -0400
7031+++ linux-2.6.18/arch/sparc/kernel/ptrace.c 2006-09-22 20:04:35.000000000 -0400
7032@@ -19,6 +19,7 @@
7033 #include <linux/smp_lock.h>
7034 #include <linux/security.h>
7035 #include <linux/signal.h>
7036+#include <linux/grsecurity.h>
7037
7038 #include <asm/pgtable.h>
7039 #include <asm/system.h>
7040@@ -300,6 +301,11 @@ asmlinkage void do_ptrace(struct pt_regs
7041 goto out;
7042 }
7043
7044+ if (gr_handle_ptrace(child, request)) {
7045+ pt_error_return(regs, EPERM);
7046+ goto out_tsk;
7047+ }
7048+
7049 if ((current->personality == PER_SUNOS && request == PTRACE_SUNATTACH)
7050 || (current->personality != PER_SUNOS && request == PTRACE_ATTACH)) {
7051 if (ptrace_attach(child)) {
7052diff -urNp linux-2.6.18/arch/sparc/kernel/sys_sparc.c linux-2.6.18/arch/sparc/kernel/sys_sparc.c
7053--- linux-2.6.18/arch/sparc/kernel/sys_sparc.c 2006-09-19 23:42:06.000000000 -0400
7054+++ linux-2.6.18/arch/sparc/kernel/sys_sparc.c 2006-09-22 20:45:03.000000000 -0400
7055@@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(str
7056 if (ARCH_SUN4C_SUN4 && len > 0x20000000)
7057 return -ENOMEM;
7058 if (!addr)
7059- addr = TASK_UNMAPPED_BASE;
7060+ addr = current->mm->mmap_base;
7061
7062 if (flags & MAP_SHARED)
7063 addr = COLOUR_ALIGN(addr);
7064diff -urNp linux-2.6.18/arch/sparc/Makefile linux-2.6.18/arch/sparc/Makefile
7065--- linux-2.6.18/arch/sparc/Makefile 2006-09-19 23:42:06.000000000 -0400
7066+++ linux-2.6.18/arch/sparc/Makefile 2006-09-22 20:04:35.000000000 -0400
7067@@ -34,7 +34,7 @@ libs-y += arch/sparc/prom/ arch/sparc/li
7068 # Renaming is done to avoid confusing pattern matching rules in 2.5.45 (multy-)
7069 INIT_Y := $(patsubst %/, %/built-in.o, $(init-y))
7070 CORE_Y := $(core-y)
7071-CORE_Y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
7072+CORE_Y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
7073 CORE_Y := $(patsubst %/, %/built-in.o, $(CORE_Y))
7074 DRIVERS_Y := $(patsubst %/, %/built-in.o, $(drivers-y))
7075 NET_Y := $(patsubst %/, %/built-in.o, $(net-y))
7076diff -urNp linux-2.6.18/arch/sparc/mm/fault.c linux-2.6.18/arch/sparc/mm/fault.c
7077--- linux-2.6.18/arch/sparc/mm/fault.c 2006-09-19 23:42:06.000000000 -0400
7078+++ linux-2.6.18/arch/sparc/mm/fault.c 2006-09-22 20:45:03.000000000 -0400
7079@@ -21,6 +21,10 @@
7080 #include <linux/smp_lock.h>
7081 #include <linux/interrupt.h>
7082 #include <linux/module.h>
7083+#include <linux/slab.h>
7084+#include <linux/pagemap.h>
7085+#include <linux/compiler.h>
7086+#include <linux/binfmts.h>
7087
7088 #include <asm/system.h>
7089 #include <asm/page.h>
7090@@ -217,6 +221,252 @@ static unsigned long compute_si_addr(str
7091 return safe_compute_effective_address(regs, insn);
7092 }
7093
7094+#ifdef CONFIG_PAX_PAGEEXEC
7095+void pax_emuplt_close(struct vm_area_struct * vma)
7096+{
7097+ vma->vm_mm->call_dl_resolve = 0UL;
7098+}
7099+
7100+static struct page* pax_emuplt_nopage(struct vm_area_struct *vma, unsigned long address, int *type)
7101+{
7102+ struct page* page;
7103+ unsigned int *kaddr;
7104+
7105+ page = alloc_page(GFP_HIGHUSER);
7106+ if (!page)
7107+ return NOPAGE_OOM;
7108+
7109+ kaddr = kmap(page);
7110+ memset(kaddr, 0, PAGE_SIZE);
7111+ kaddr[0] = 0x9DE3BFA8U; /* save */
7112+ flush_dcache_page(page);
7113+ kunmap(page);
7114+ if (type)
7115+ *type = VM_FAULT_MAJOR;
7116+
7117+ return page;
7118+}
7119+
7120+static struct vm_operations_struct pax_vm_ops = {
7121+ .close = pax_emuplt_close,
7122+ .nopage = pax_emuplt_nopage,
7123+};
7124+
7125+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
7126+{
7127+ int ret;
7128+
7129+ memset(vma, 0, sizeof(*vma));
7130+ vma->vm_mm = current->mm;
7131+ vma->vm_start = addr;
7132+ vma->vm_end = addr + PAGE_SIZE;
7133+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
7134+ vma->vm_page_prot = protection_map[vma->vm_flags & 0x0f];
7135+ vma->vm_ops = &pax_vm_ops;
7136+
7137+ ret = insert_vm_struct(current->mm, vma);
7138+ if (ret)
7139+ return ret;
7140+
7141+ ++current->mm->total_vm;
7142+ return 0;
7143+}
7144+
7145+/*
7146+ * PaX: decide what to do with offenders (regs->pc = fault address)
7147+ *
7148+ * returns 1 when task should be killed
7149+ * 2 when patched PLT trampoline was detected
7150+ * 3 when unpatched PLT trampoline was detected
7151+ */
7152+static int pax_handle_fetch_fault(struct pt_regs *regs)
7153+{
7154+
7155+#ifdef CONFIG_PAX_EMUPLT
7156+ int err;
7157+
7158+ do { /* PaX: patched PLT emulation #1 */
7159+ unsigned int sethi1, sethi2, jmpl;
7160+
7161+ err = get_user(sethi1, (unsigned int*)regs->pc);
7162+ err |= get_user(sethi2, (unsigned int*)(regs->pc+4));
7163+ err |= get_user(jmpl, (unsigned int*)(regs->pc+8));
7164+
7165+ if (err)
7166+ break;
7167+
7168+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
7169+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
7170+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
7171+ {
7172+ unsigned int addr;
7173+
7174+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
7175+ addr = regs->u_regs[UREG_G1];
7176+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
7177+ regs->pc = addr;
7178+ regs->npc = addr+4;
7179+ return 2;
7180+ }
7181+ } while (0);
7182+
7183+ { /* PaX: patched PLT emulation #2 */
7184+ unsigned int ba;
7185+
7186+ err = get_user(ba, (unsigned int*)regs->pc);
7187+
7188+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
7189+ unsigned int addr;
7190+
7191+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
7192+ regs->pc = addr;
7193+ regs->npc = addr+4;
7194+ return 2;
7195+ }
7196+ }
7197+
7198+ do { /* PaX: patched PLT emulation #3 */
7199+ unsigned int sethi, jmpl, nop;
7200+
7201+ err = get_user(sethi, (unsigned int*)regs->pc);
7202+ err |= get_user(jmpl, (unsigned int*)(regs->pc+4));
7203+ err |= get_user(nop, (unsigned int*)(regs->pc+8));
7204+
7205+ if (err)
7206+ break;
7207+
7208+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7209+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
7210+ nop == 0x01000000U)
7211+ {
7212+ unsigned int addr;
7213+
7214+ addr = (sethi & 0x003FFFFFU) << 10;
7215+ regs->u_regs[UREG_G1] = addr;
7216+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
7217+ regs->pc = addr;
7218+ regs->npc = addr+4;
7219+ return 2;
7220+ }
7221+ } while (0);
7222+
7223+ do { /* PaX: unpatched PLT emulation step 1 */
7224+ unsigned int sethi, ba, nop;
7225+
7226+ err = get_user(sethi, (unsigned int*)regs->pc);
7227+ err |= get_user(ba, (unsigned int*)(regs->pc+4));
7228+ err |= get_user(nop, (unsigned int*)(regs->pc+8));
7229+
7230+ if (err)
7231+ break;
7232+
7233+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7234+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
7235+ nop == 0x01000000U)
7236+ {
7237+ unsigned int addr, save, call;
7238+
7239+ if ((ba & 0xFFC00000U) == 0x30800000U)
7240+ addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
7241+ else
7242+ addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
7243+
7244+ err = get_user(save, (unsigned int*)addr);
7245+ err |= get_user(call, (unsigned int*)(addr+4));
7246+ err |= get_user(nop, (unsigned int*)(addr+8));
7247+ if (err)
7248+ break;
7249+
7250+ if (save == 0x9DE3BFA8U &&
7251+ (call & 0xC0000000U) == 0x40000000U &&
7252+ nop == 0x01000000U)
7253+ {
7254+ struct vm_area_struct *vma;
7255+ unsigned long call_dl_resolve;
7256+
7257+ down_read(&current->mm->mmap_sem);
7258+ call_dl_resolve = current->mm->call_dl_resolve;
7259+ up_read(&current->mm->mmap_sem);
7260+ if (likely(call_dl_resolve))
7261+ goto emulate;
7262+
7263+ vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
7264+
7265+ down_write(&current->mm->mmap_sem);
7266+ if (current->mm->call_dl_resolve) {
7267+ call_dl_resolve = current->mm->call_dl_resolve;
7268+ up_write(&current->mm->mmap_sem);
7269+ if (vma) kmem_cache_free(vm_area_cachep, vma);
7270+ goto emulate;
7271+ }
7272+
7273+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
7274+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
7275+ up_write(&current->mm->mmap_sem);
7276+ if (vma) kmem_cache_free(vm_area_cachep, vma);
7277+ return 1;
7278+ }
7279+
7280+ if (pax_insert_vma(vma, call_dl_resolve)) {
7281+ up_write(&current->mm->mmap_sem);
7282+ kmem_cache_free(vm_area_cachep, vma);
7283+ return 1;
7284+ }
7285+
7286+ current->mm->call_dl_resolve = call_dl_resolve;
7287+ up_write(&current->mm->mmap_sem);
7288+
7289+emulate:
7290+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7291+ regs->pc = call_dl_resolve;
7292+ regs->npc = addr+4;
7293+ return 3;
7294+ }
7295+ }
7296+ } while (0);
7297+
7298+ do { /* PaX: unpatched PLT emulation step 2 */
7299+ unsigned int save, call, nop;
7300+
7301+ err = get_user(save, (unsigned int*)(regs->pc-4));
7302+ err |= get_user(call, (unsigned int*)regs->pc);
7303+ err |= get_user(nop, (unsigned int*)(regs->pc+4));
7304+ if (err)
7305+ break;
7306+
7307+ if (save == 0x9DE3BFA8U &&
7308+ (call & 0xC0000000U) == 0x40000000U &&
7309+ nop == 0x01000000U)
7310+ {
7311+ unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
7312+
7313+ regs->u_regs[UREG_RETPC] = regs->pc;
7314+ regs->pc = dl_resolve;
7315+ regs->npc = dl_resolve+4;
7316+ return 3;
7317+ }
7318+ } while (0);
7319+#endif
7320+
7321+ return 1;
7322+}
7323+
7324+void pax_report_insns(void *pc, void *sp)
7325+{
7326+ unsigned long i;
7327+
7328+ printk(KERN_ERR "PAX: bytes at PC: ");
7329+ for (i = 0; i < 5; i++) {
7330+ unsigned int c;
7331+ if (get_user(c, (unsigned int*)pc+i))
7332+ printk("???????? ");
7333+ else
7334+ printk("%08x ", c);
7335+ }
7336+ printk("\n");
7337+}
7338+#endif
7339+
7340 asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
7341 unsigned long address)
7342 {
7343@@ -280,6 +530,24 @@ good_area:
7344 if(!(vma->vm_flags & VM_WRITE))
7345 goto bad_area;
7346 } else {
7347+
7348+#ifdef CONFIG_PAX_PAGEEXEC
7349+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
7350+ up_read(&mm->mmap_sem);
7351+ switch (pax_handle_fetch_fault(regs)) {
7352+
7353+#ifdef CONFIG_PAX_EMUPLT
7354+ case 2:
7355+ case 3:
7356+ return;
7357+#endif
7358+
7359+ }
7360+ pax_report_fault(regs, (void*)regs->pc, (void*)regs->u_regs[UREG_FP]);
7361+ do_exit(SIGKILL);
7362+ }
7363+#endif
7364+
7365 /* Allow reads even for write-only mappings */
7366 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
7367 goto bad_area;
7368diff -urNp linux-2.6.18/arch/sparc/mm/init.c linux-2.6.18/arch/sparc/mm/init.c
7369--- linux-2.6.18/arch/sparc/mm/init.c 2006-09-19 23:42:06.000000000 -0400
7370+++ linux-2.6.18/arch/sparc/mm/init.c 2006-09-22 20:45:03.000000000 -0400
7371@@ -333,17 +333,17 @@ void __init paging_init(void)
7372
7373 /* Initialize the protection map with non-constant, MMU dependent values. */
7374 protection_map[0] = PAGE_NONE;
7375- protection_map[1] = PAGE_READONLY;
7376- protection_map[2] = PAGE_COPY;
7377- protection_map[3] = PAGE_COPY;
7378+ protection_map[1] = PAGE_READONLY_NOEXEC;
7379+ protection_map[2] = PAGE_COPY_NOEXEC;
7380+ protection_map[3] = PAGE_COPY_NOEXEC;
7381 protection_map[4] = PAGE_READONLY;
7382 protection_map[5] = PAGE_READONLY;
7383 protection_map[6] = PAGE_COPY;
7384 protection_map[7] = PAGE_COPY;
7385 protection_map[8] = PAGE_NONE;
7386- protection_map[9] = PAGE_READONLY;
7387- protection_map[10] = PAGE_SHARED;
7388- protection_map[11] = PAGE_SHARED;
7389+ protection_map[9] = PAGE_READONLY_NOEXEC;
7390+ protection_map[10] = PAGE_SHARED_NOEXEC;
7391+ protection_map[11] = PAGE_SHARED_NOEXEC;
7392 protection_map[12] = PAGE_READONLY;
7393 protection_map[13] = PAGE_READONLY;
7394 protection_map[14] = PAGE_SHARED;
7395diff -urNp linux-2.6.18/arch/sparc/mm/srmmu.c linux-2.6.18/arch/sparc/mm/srmmu.c
7396--- linux-2.6.18/arch/sparc/mm/srmmu.c 2006-09-19 23:42:06.000000000 -0400
7397+++ linux-2.6.18/arch/sparc/mm/srmmu.c 2006-09-22 20:45:03.000000000 -0400
7398@@ -2160,6 +2160,13 @@ void __init ld_mmu_srmmu(void)
7399 BTFIXUPSET_INT(page_shared, pgprot_val(SRMMU_PAGE_SHARED));
7400 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
7401 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
7402+
7403+#ifdef CONFIG_PAX_PAGEEXEC
7404+ BTFIXUPSET_INT(page_shared_noexec, pgprot_val(SRMMU_PAGE_SHARED_NOEXEC));
7405+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
7406+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
7407+#endif
7408+
7409 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
7410 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
7411
7412diff -urNp linux-2.6.18/arch/sparc64/kernel/ptrace.c linux-2.6.18/arch/sparc64/kernel/ptrace.c
7413--- linux-2.6.18/arch/sparc64/kernel/ptrace.c 2006-09-19 23:42:06.000000000 -0400
7414+++ linux-2.6.18/arch/sparc64/kernel/ptrace.c 2006-09-22 20:04:35.000000000 -0400
7415@@ -22,6 +22,7 @@
7416 #include <linux/seccomp.h>
7417 #include <linux/audit.h>
7418 #include <linux/signal.h>
7419+#include <linux/grsecurity.h>
7420
7421 #include <asm/asi.h>
7422 #include <asm/pgtable.h>
7423@@ -213,6 +214,11 @@ asmlinkage void do_ptrace(struct pt_regs
7424 goto out;
7425 }
7426
7427+ if (gr_handle_ptrace(child, (long)request)) {
7428+ pt_error_return(regs, EPERM);
7429+ goto out_tsk;
7430+ }
7431+
7432 if ((current->personality == PER_SUNOS && request == PTRACE_SUNATTACH)
7433 || (current->personality != PER_SUNOS && request == PTRACE_ATTACH)) {
7434 if (ptrace_attach(child)) {
7435diff -urNp linux-2.6.18/arch/sparc64/kernel/sys_sparc.c linux-2.6.18/arch/sparc64/kernel/sys_sparc.c
7436--- linux-2.6.18/arch/sparc64/kernel/sys_sparc.c 2006-09-19 23:42:06.000000000 -0400
7437+++ linux-2.6.18/arch/sparc64/kernel/sys_sparc.c 2006-09-22 20:45:03.000000000 -0400
7438@@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(str
7439 if (filp || (flags & MAP_SHARED))
7440 do_color_align = 1;
7441
7442+#ifdef CONFIG_PAX_RANDMMAP
7443+ if (!(mm->pax_flags & MF_PAX_RANDMMAP) || !filp)
7444+#endif
7445+
7446 if (addr) {
7447 if (do_color_align)
7448 addr = COLOUR_ALIGN(addr, pgoff);
7449@@ -152,9 +156,9 @@ unsigned long arch_get_unmapped_area(str
7450 }
7451
7452 if (len > mm->cached_hole_size) {
7453- start_addr = addr = mm->free_area_cache;
7454+ start_addr = addr = mm->free_area_cache;
7455 } else {
7456- start_addr = addr = TASK_UNMAPPED_BASE;
7457+ start_addr = addr = mm->mmap_base;
7458 mm->cached_hole_size = 0;
7459 }
7460
7461@@ -174,8 +178,8 @@ full_search:
7462 vma = find_vma(mm, VA_EXCLUDE_END);
7463 }
7464 if (unlikely(task_size < addr)) {
7465- if (start_addr != TASK_UNMAPPED_BASE) {
7466- start_addr = addr = TASK_UNMAPPED_BASE;
7467+ if (start_addr != mm->mmap_base) {
7468+ start_addr = addr = mm->mmap_base;
7469 mm->cached_hole_size = 0;
7470 goto full_search;
7471 }
7472@@ -378,6 +382,12 @@ void arch_pick_mmap_layout(struct mm_str
7473 current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
7474 sysctl_legacy_va_layout) {
7475 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
7476+
7477+#ifdef CONFIG_PAX_RANDMMAP
7478+ if (mm->pax_flags & MF_PAX_RANDMMAP)
7479+ mm->mmap_base += mm->delta_mmap;
7480+#endif
7481+
7482 mm->get_unmapped_area = arch_get_unmapped_area;
7483 mm->unmap_area = arch_unmap_area;
7484 } else {
7485@@ -392,6 +402,12 @@ void arch_pick_mmap_layout(struct mm_str
7486 gap = (task_size / 6 * 5);
7487
7488 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
7489+
7490+#ifdef CONFIG_PAX_RANDMMAP
7491+ if (mm->pax_flags & MF_PAX_RANDMMAP)
7492+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
7493+#endif
7494+
7495 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
7496 mm->unmap_area = arch_unmap_area_topdown;
7497 }
7498diff -urNp linux-2.6.18/arch/sparc64/mm/fault.c linux-2.6.18/arch/sparc64/mm/fault.c
7499--- linux-2.6.18/arch/sparc64/mm/fault.c 2006-09-19 23:42:06.000000000 -0400
7500+++ linux-2.6.18/arch/sparc64/mm/fault.c 2006-09-22 20:45:03.000000000 -0400
7501@@ -20,6 +20,10 @@
7502 #include <linux/interrupt.h>
7503 #include <linux/kprobes.h>
7504 #include <linux/kallsyms.h>
7505+#include <linux/slab.h>
7506+#include <linux/pagemap.h>
7507+#include <linux/compiler.h>
7508+#include <linux/binfmts.h>
7509
7510 #include <asm/page.h>
7511 #include <asm/pgtable.h>
7512@@ -290,6 +294,369 @@ cannot_handle:
7513 unhandled_fault (address, current, regs);
7514 }
7515
7516+#ifdef CONFIG_PAX_PAGEEXEC
7517+#ifdef CONFIG_PAX_EMUPLT
7518+static void pax_emuplt_close(struct vm_area_struct * vma)
7519+{
7520+ vma->vm_mm->call_dl_resolve = 0UL;
7521+}
7522+
7523+static struct page* pax_emuplt_nopage(struct vm_area_struct *vma, unsigned long address, int *type)
7524+{
7525+ struct page* page;
7526+ unsigned int *kaddr;
7527+
7528+ page = alloc_page(GFP_HIGHUSER);
7529+ if (!page)
7530+ return NOPAGE_OOM;
7531+
7532+ kaddr = kmap(page);
7533+ memset(kaddr, 0, PAGE_SIZE);
7534+ kaddr[0] = 0x9DE3BFA8U; /* save */
7535+ flush_dcache_page(page);
7536+ kunmap(page);
7537+ if (type)
7538+ *type = VM_FAULT_MAJOR;
7539+ return page;
7540+}
7541+
7542+static struct vm_operations_struct pax_vm_ops = {
7543+ .close = pax_emuplt_close,
7544+ .nopage = pax_emuplt_nopage,
7545+};
7546+
7547+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
7548+{
7549+ int ret;
7550+
7551+ memset(vma, 0, sizeof(*vma));
7552+ vma->vm_mm = current->mm;
7553+ vma->vm_start = addr;
7554+ vma->vm_end = addr + PAGE_SIZE;
7555+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
7556+ vma->vm_page_prot = protection_map[vma->vm_flags & 0x0f];
7557+ vma->vm_ops = &pax_vm_ops;
7558+
7559+ ret = insert_vm_struct(current->mm, vma);
7560+ if (ret)
7561+ return ret;
7562+
7563+ ++current->mm->total_vm;
7564+ return 0;
7565+}
7566+#endif
7567+
7568+/*
7569+ * PaX: decide what to do with offenders (regs->tpc = fault address)
7570+ *
7571+ * returns 1 when task should be killed
7572+ * 2 when patched PLT trampoline was detected
7573+ * 3 when unpatched PLT trampoline was detected
7574+ */
7575+static int pax_handle_fetch_fault(struct pt_regs *regs)
7576+{
7577+
7578+#ifdef CONFIG_PAX_EMUPLT
7579+ int err;
7580+
7581+ do { /* PaX: patched PLT emulation #1 */
7582+ unsigned int sethi1, sethi2, jmpl;
7583+
7584+ err = get_user(sethi1, (unsigned int*)regs->tpc);
7585+ err |= get_user(sethi2, (unsigned int*)(regs->tpc+4));
7586+ err |= get_user(jmpl, (unsigned int*)(regs->tpc+8));
7587+
7588+ if (err)
7589+ break;
7590+
7591+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
7592+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
7593+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
7594+ {
7595+ unsigned long addr;
7596+
7597+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
7598+ addr = regs->u_regs[UREG_G1];
7599+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
7600+ regs->tpc = addr;
7601+ regs->tnpc = addr+4;
7602+ return 2;
7603+ }
7604+ } while (0);
7605+
7606+ { /* PaX: patched PLT emulation #2 */
7607+ unsigned int ba;
7608+
7609+ err = get_user(ba, (unsigned int*)regs->tpc);
7610+
7611+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
7612+ unsigned long addr;
7613+
7614+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
7615+ regs->tpc = addr;
7616+ regs->tnpc = addr+4;
7617+ return 2;
7618+ }
7619+ }
7620+
7621+ do { /* PaX: patched PLT emulation #3 */
7622+ unsigned int sethi, jmpl, nop;
7623+
7624+ err = get_user(sethi, (unsigned int*)regs->tpc);
7625+ err |= get_user(jmpl, (unsigned int*)(regs->tpc+4));
7626+ err |= get_user(nop, (unsigned int*)(regs->tpc+8));
7627+
7628+ if (err)
7629+ break;
7630+
7631+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7632+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
7633+ nop == 0x01000000U)
7634+ {
7635+ unsigned long addr;
7636+
7637+ addr = (sethi & 0x003FFFFFU) << 10;
7638+ regs->u_regs[UREG_G1] = addr;
7639+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
7640+ regs->tpc = addr;
7641+ regs->tnpc = addr+4;
7642+ return 2;
7643+ }
7644+ } while (0);
7645+
7646+ do { /* PaX: patched PLT emulation #4 */
7647+ unsigned int mov1, call, mov2;
7648+
7649+ err = get_user(mov1, (unsigned int*)regs->tpc);
7650+ err |= get_user(call, (unsigned int*)(regs->tpc+4));
7651+ err |= get_user(mov2, (unsigned int*)(regs->tpc+8));
7652+
7653+ if (err)
7654+ break;
7655+
7656+ if (mov1 == 0x8210000FU &&
7657+ (call & 0xC0000000U) == 0x40000000U &&
7658+ mov2 == 0x9E100001U)
7659+ {
7660+ unsigned long addr;
7661+
7662+ regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
7663+ addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
7664+ regs->tpc = addr;
7665+ regs->tnpc = addr+4;
7666+ return 2;
7667+ }
7668+ } while (0);
7669+
7670+ do { /* PaX: patched PLT emulation #5 */
7671+ unsigned int sethi1, sethi2, or1, or2, sllx, jmpl, nop;
7672+
7673+ err = get_user(sethi1, (unsigned int*)regs->tpc);
7674+ err |= get_user(sethi2, (unsigned int*)(regs->tpc+4));
7675+ err |= get_user(or1, (unsigned int*)(regs->tpc+8));
7676+ err |= get_user(or2, (unsigned int*)(regs->tpc+12));
7677+ err |= get_user(sllx, (unsigned int*)(regs->tpc+16));
7678+ err |= get_user(jmpl, (unsigned int*)(regs->tpc+20));
7679+ err |= get_user(nop, (unsigned int*)(regs->tpc+24));
7680+
7681+ if (err)
7682+ break;
7683+
7684+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
7685+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7686+ (or1 & 0xFFFFE000U) == 0x82106000U &&
7687+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
7688+ sllx == 0x83287020 &&
7689+ jmpl == 0x81C04005U &&
7690+ nop == 0x01000000U)
7691+ {
7692+ unsigned long addr;
7693+
7694+ regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
7695+ regs->u_regs[UREG_G1] <<= 32;
7696+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
7697+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
7698+ regs->tpc = addr;
7699+ regs->tnpc = addr+4;
7700+ return 2;
7701+ }
7702+ } while (0);
7703+
7704+ do { /* PaX: patched PLT emulation #6 */
7705+ unsigned int sethi1, sethi2, sllx, or, jmpl, nop;
7706+
7707+ err = get_user(sethi1, (unsigned int*)regs->tpc);
7708+ err |= get_user(sethi2, (unsigned int*)(regs->tpc+4));
7709+ err |= get_user(sllx, (unsigned int*)(regs->tpc+8));
7710+ err |= get_user(or, (unsigned int*)(regs->tpc+12));
7711+ err |= get_user(jmpl, (unsigned int*)(regs->tpc+16));
7712+ err |= get_user(nop, (unsigned int*)(regs->tpc+20));
7713+
7714+ if (err)
7715+ break;
7716+
7717+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
7718+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7719+ sllx == 0x83287020 &&
7720+ (or & 0xFFFFE000U) == 0x8A116000U &&
7721+ jmpl == 0x81C04005U &&
7722+ nop == 0x01000000U)
7723+ {
7724+ unsigned long addr;
7725+
7726+ regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
7727+ regs->u_regs[UREG_G1] <<= 32;
7728+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
7729+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
7730+ regs->tpc = addr;
7731+ regs->tnpc = addr+4;
7732+ return 2;
7733+ }
7734+ } while (0);
7735+
7736+ do { /* PaX: patched PLT emulation #7 */
7737+ unsigned int sethi, ba, nop;
7738+
7739+ err = get_user(sethi, (unsigned int*)regs->tpc);
7740+ err |= get_user(ba, (unsigned int*)(regs->tpc+4));
7741+ err |= get_user(nop, (unsigned int*)(regs->tpc+8));
7742+
7743+ if (err)
7744+ break;
7745+
7746+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7747+ (ba & 0xFFF00000U) == 0x30600000U &&
7748+ nop == 0x01000000U)
7749+ {
7750+ unsigned long addr;
7751+
7752+ addr = (sethi & 0x003FFFFFU) << 10;
7753+ regs->u_regs[UREG_G1] = addr;
7754+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
7755+ regs->tpc = addr;
7756+ regs->tnpc = addr+4;
7757+ return 2;
7758+ }
7759+ } while (0);
7760+
7761+ do { /* PaX: unpatched PLT emulation step 1 */
7762+ unsigned int sethi, ba, nop;
7763+
7764+ err = get_user(sethi, (unsigned int*)regs->tpc);
7765+ err |= get_user(ba, (unsigned int*)(regs->tpc+4));
7766+ err |= get_user(nop, (unsigned int*)(regs->tpc+8));
7767+
7768+ if (err)
7769+ break;
7770+
7771+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7772+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
7773+ nop == 0x01000000U)
7774+ {
7775+ unsigned long addr;
7776+ unsigned int save, call;
7777+
7778+ if ((ba & 0xFFC00000U) == 0x30800000U)
7779+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
7780+ else
7781+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
7782+
7783+ err = get_user(save, (unsigned int*)addr);
7784+ err |= get_user(call, (unsigned int*)(addr+4));
7785+ err |= get_user(nop, (unsigned int*)(addr+8));
7786+ if (err)
7787+ break;
7788+
7789+ if (save == 0x9DE3BFA8U &&
7790+ (call & 0xC0000000U) == 0x40000000U &&
7791+ nop == 0x01000000U)
7792+ {
7793+ struct vm_area_struct *vma;
7794+ unsigned long call_dl_resolve;
7795+
7796+ down_read(&current->mm->mmap_sem);
7797+ call_dl_resolve = current->mm->call_dl_resolve;
7798+ up_read(&current->mm->mmap_sem);
7799+ if (likely(call_dl_resolve))
7800+ goto emulate;
7801+
7802+ vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
7803+
7804+ down_write(&current->mm->mmap_sem);
7805+ if (current->mm->call_dl_resolve) {
7806+ call_dl_resolve = current->mm->call_dl_resolve;
7807+ up_write(&current->mm->mmap_sem);
7808+ if (vma) kmem_cache_free(vm_area_cachep, vma);
7809+ goto emulate;
7810+ }
7811+
7812+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
7813+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
7814+ up_write(&current->mm->mmap_sem);
7815+ if (vma) kmem_cache_free(vm_area_cachep, vma);
7816+ return 1;
7817+ }
7818+
7819+ if (pax_insert_vma(vma, call_dl_resolve)) {
7820+ up_write(&current->mm->mmap_sem);
7821+ kmem_cache_free(vm_area_cachep, vma);
7822+ return 1;
7823+ }
7824+
7825+ current->mm->call_dl_resolve = call_dl_resolve;
7826+ up_write(&current->mm->mmap_sem);
7827+
7828+emulate:
7829+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7830+ regs->tpc = call_dl_resolve;
7831+ regs->tnpc = addr+4;
7832+ return 3;
7833+ }
7834+ }
7835+ } while (0);
7836+
7837+ do { /* PaX: unpatched PLT emulation step 2 */
7838+ unsigned int save, call, nop;
7839+
7840+ err = get_user(save, (unsigned int*)(regs->tpc-4));
7841+ err |= get_user(call, (unsigned int*)regs->tpc);
7842+ err |= get_user(nop, (unsigned int*)(regs->tpc+4));
7843+ if (err)
7844+ break;
7845+
7846+ if (save == 0x9DE3BFA8U &&
7847+ (call & 0xC0000000U) == 0x40000000U &&
7848+ nop == 0x01000000U)
7849+ {
7850+ unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
7851+
7852+ regs->u_regs[UREG_RETPC] = regs->tpc;
7853+ regs->tpc = dl_resolve;
7854+ regs->tnpc = dl_resolve+4;
7855+ return 3;
7856+ }
7857+ } while (0);
7858+#endif
7859+
7860+ return 1;
7861+}
7862+
7863+void pax_report_insns(void *pc, void *sp)
7864+{
7865+ unsigned long i;
7866+
7867+ printk(KERN_ERR "PAX: bytes at PC: ");
7868+ for (i = 0; i < 5; i++) {
7869+ unsigned int c;
7870+ if (get_user(c, (unsigned int*)pc+i))
7871+ printk("???????? ");
7872+ else
7873+ printk("%08x ", c);
7874+ }
7875+ printk("\n");
7876+}
7877+#endif
7878+
7879 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
7880 {
7881 struct mm_struct *mm = current->mm;
7882@@ -332,8 +699,10 @@ asmlinkage void __kprobes do_sparc64_fau
7883 goto intr_or_no_mm;
7884
7885 if (test_thread_flag(TIF_32BIT)) {
7886- if (!(regs->tstate & TSTATE_PRIV))
7887+ if (!(regs->tstate & TSTATE_PRIV)) {
7888 regs->tpc &= 0xffffffff;
7889+ regs->tnpc &= 0xffffffff;
7890+ }
7891 address &= 0xffffffff;
7892 }
7893
7894@@ -350,6 +719,29 @@ asmlinkage void __kprobes do_sparc64_fau
7895 if (!vma)
7896 goto bad_area;
7897
7898+#ifdef CONFIG_PAX_PAGEEXEC
7899+ /* PaX: detect ITLB misses on non-exec pages */
7900+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
7901+ !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
7902+ {
7903+ if (address != regs->tpc)
7904+ goto good_area;
7905+
7906+ up_read(&mm->mmap_sem);
7907+ switch (pax_handle_fetch_fault(regs)) {
7908+
7909+#ifdef CONFIG_PAX_EMUPLT
7910+ case 2:
7911+ case 3:
7912+ return;
7913+#endif
7914+
7915+ }
7916+ pax_report_fault(regs, (void*)regs->tpc, (void*)(regs->u_regs[UREG_FP] + STACK_BIAS));
7917+ do_exit(SIGKILL);
7918+ }
7919+#endif
7920+
7921 /* Pure DTLB misses do not tell us whether the fault causing
7922 * load/store/atomic was a write or not, it only says that there
7923 * was no match. So in such a case we (carefully) read the
7924diff -urNp linux-2.6.18/arch/v850/kernel/module.c linux-2.6.18/arch/v850/kernel/module.c
7925--- linux-2.6.18/arch/v850/kernel/module.c 2006-09-19 23:42:06.000000000 -0400
7926+++ linux-2.6.18/arch/v850/kernel/module.c 2006-09-22 20:45:03.000000000 -0400
7927@@ -150,8 +150,8 @@ static uint32_t do_plt_call (void *locat
7928 tramp[1] = ((val >> 16) & 0xffff) + 0x610000; /* ...; jmp r1 */
7929
7930 /* Init, or core PLT? */
7931- if (location >= mod->module_core
7932- && location < mod->module_core + mod->core_size)
7933+ if (location >= mod->module_core_rx
7934+ && location < mod->module_core_rx + mod->core_size_rx)
7935 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
7936 else
7937 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
7938diff -urNp linux-2.6.18/arch/x86_64/boot/compressed/head.S linux-2.6.18/arch/x86_64/boot/compressed/head.S
7939--- linux-2.6.18/arch/x86_64/boot/compressed/head.S 2006-09-19 23:42:06.000000000 -0400
7940+++ linux-2.6.18/arch/x86_64/boot/compressed/head.S 2006-09-22 20:45:04.000000000 -0400
7941@@ -41,11 +41,13 @@ startup_32:
7942 movl %eax,%gs
7943
7944 lss stack_start,%esp
7945+ movl 0x000000,%ecx
7946 xorl %eax,%eax
7947 1: incl %eax # check that A20 really IS enabled
7948 movl %eax,0x000000 # loop forever if it isn't
7949 cmpl %eax,0x100000
7950 je 1b
7951+ movl %ecx,0x000000
7952
7953 /*
7954 * Initialize eflags. Some BIOS's leave bits like NT set. This would
7955diff -urNp linux-2.6.18/arch/x86_64/ia32/ia32_binfmt.c linux-2.6.18/arch/x86_64/ia32/ia32_binfmt.c
7956--- linux-2.6.18/arch/x86_64/ia32/ia32_binfmt.c 2006-09-19 23:42:06.000000000 -0400
7957+++ linux-2.6.18/arch/x86_64/ia32/ia32_binfmt.c 2006-09-22 20:45:04.000000000 -0400
7958@@ -191,6 +191,17 @@ struct elf_prpsinfo
7959 //#include <asm/ia32.h>
7960 #include <linux/elf.h>
7961
7962+#ifdef CONFIG_PAX_ASLR
7963+#define PAX_ELF_ET_DYN_BASE(tsk) 0x08048000UL
7964+
7965+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
7966+#define PAX_DELTA_MMAP_LEN(tsk) 16
7967+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
7968+#define PAX_DELTA_EXEC_LEN(tsk) 16
7969+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
7970+#define PAX_DELTA_STACK_LEN(tsk) 16
7971+#endif
7972+
7973 typedef struct user_i387_ia32_struct elf_fpregset_t;
7974 typedef struct user32_fxsr_struct elf_fpxregset_t;
7975
7976diff -urNp linux-2.6.18/arch/x86_64/ia32/mmap32.c linux-2.6.18/arch/x86_64/ia32/mmap32.c
7977--- linux-2.6.18/arch/x86_64/ia32/mmap32.c 2006-09-19 23:42:06.000000000 -0400
7978+++ linux-2.6.18/arch/x86_64/ia32/mmap32.c 2006-09-22 20:45:04.000000000 -0400
7979@@ -68,10 +68,22 @@ void ia32_pick_mmap_layout(struct mm_str
7980 (current->personality & ADDR_COMPAT_LAYOUT) ||
7981 current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY) {
7982 mm->mmap_base = TASK_UNMAPPED_BASE;
7983+
7984+#ifdef CONFIG_PAX_RANDMMAP
7985+ if (mm->pax_flags & MF_PAX_RANDMMAP)
7986+ mm->mmap_base += mm->delta_mmap;
7987+#endif
7988+
7989 mm->get_unmapped_area = arch_get_unmapped_area;
7990 mm->unmap_area = arch_unmap_area;
7991 } else {
7992 mm->mmap_base = mmap_base(mm);
7993+
7994+#ifdef CONFIG_PAX_RANDMMAP
7995+ if (mm->pax_flags & MF_PAX_RANDMMAP)
7996+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
7997+#endif
7998+
7999 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
8000 mm->unmap_area = arch_unmap_area_topdown;
8001 }
8002diff -urNp linux-2.6.18/arch/x86_64/ia32/syscall32.c linux-2.6.18/arch/x86_64/ia32/syscall32.c
8003--- linux-2.6.18/arch/x86_64/ia32/syscall32.c 2006-09-19 23:42:06.000000000 -0400
8004+++ linux-2.6.18/arch/x86_64/ia32/syscall32.c 2006-09-22 20:45:04.000000000 -0400
8005@@ -49,11 +49,10 @@ int syscall32_setup_pages(struct linux_b
8006 struct mm_struct *mm = current->mm;
8007 int ret;
8008
8009- vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
8010+ vma = kmem_cache_zalloc(vm_area_cachep, SLAB_KERNEL);
8011 if (!vma)
8012 return -ENOMEM;
8013
8014- memset(vma, 0, sizeof(struct vm_area_struct));
8015 /* Could randomize here */
8016 vma->vm_start = VSYSCALL32_BASE;
8017 vma->vm_end = VSYSCALL32_END;
8018diff -urNp linux-2.6.18/arch/x86_64/kernel/process.c linux-2.6.18/arch/x86_64/kernel/process.c
8019--- linux-2.6.18/arch/x86_64/kernel/process.c 2006-09-19 23:42:06.000000000 -0400
8020+++ linux-2.6.18/arch/x86_64/kernel/process.c 2006-09-22 20:45:04.000000000 -0400
8021@@ -832,9 +832,3 @@ int dump_task_regs(struct task_struct *t
8022 return 1;
8023 }
8024
8025-unsigned long arch_align_stack(unsigned long sp)
8026-{
8027- if (randomize_va_space)
8028- sp -= get_random_int() % 8192;
8029- return sp & ~0xf;
8030-}
8031diff -urNp linux-2.6.18/arch/x86_64/kernel/ptrace.c linux-2.6.18/arch/x86_64/kernel/ptrace.c
8032--- linux-2.6.18/arch/x86_64/kernel/ptrace.c 2006-09-19 23:42:06.000000000 -0400
8033+++ linux-2.6.18/arch/x86_64/kernel/ptrace.c 2006-09-22 20:04:35.000000000 -0400
8034@@ -19,6 +19,7 @@
8035 #include <linux/audit.h>
8036 #include <linux/seccomp.h>
8037 #include <linux/signal.h>
8038+#include <linux/grsecurity.h>
8039
8040 #include <asm/uaccess.h>
8041 #include <asm/pgtable.h>
8042diff -urNp linux-2.6.18/arch/x86_64/kernel/setup64.c linux-2.6.18/arch/x86_64/kernel/setup64.c
8043--- linux-2.6.18/arch/x86_64/kernel/setup64.c 2006-09-19 23:42:06.000000000 -0400
8044+++ linux-2.6.18/arch/x86_64/kernel/setup64.c 2006-09-22 20:45:04.000000000 -0400
8045@@ -38,7 +38,6 @@ char boot_cpu_stack[IRQSTACKSIZE] __attr
8046
8047 unsigned long __supported_pte_mask __read_mostly = ~0UL;
8048 EXPORT_SYMBOL(__supported_pte_mask);
8049-static int do_not_nx __cpuinitdata = 0;
8050
8051 /* noexec=on|off
8052 Control non executable mappings for 64bit processes.
8053@@ -50,16 +49,14 @@ int __init nonx_setup(char *str)
8054 {
8055 if (!strncmp(str, "on", 2)) {
8056 __supported_pte_mask |= _PAGE_NX;
8057- do_not_nx = 0;
8058 } else if (!strncmp(str, "off", 3)) {
8059- do_not_nx = 1;
8060 __supported_pte_mask &= ~_PAGE_NX;
8061 }
8062 return 1;
8063 }
8064 __setup("noexec=", nonx_setup); /* parsed early actually */
8065
8066-int force_personality32 = 0;
8067+int force_personality32;
8068
8069 /* noexec32=on|off
8070 Control non executable heap for 32bit processes.
8071@@ -173,7 +170,7 @@ void __cpuinit check_efer(void)
8072 unsigned long efer;
8073
8074 rdmsrl(MSR_EFER, efer);
8075- if (!(efer & EFER_NX) || do_not_nx) {
8076+ if (!(efer & EFER_NX)) {
8077 __supported_pte_mask &= ~_PAGE_NX;
8078 }
8079 }
8080diff -urNp linux-2.6.18/arch/x86_64/kernel/sys_x86_64.c linux-2.6.18/arch/x86_64/kernel/sys_x86_64.c
8081--- linux-2.6.18/arch/x86_64/kernel/sys_x86_64.c 2006-09-19 23:42:06.000000000 -0400
8082+++ linux-2.6.18/arch/x86_64/kernel/sys_x86_64.c 2006-09-22 20:45:04.000000000 -0400
8083@@ -65,8 +65,8 @@ out:
8084 return error;
8085 }
8086
8087-static void find_start_end(unsigned long flags, unsigned long *begin,
8088- unsigned long *end)
8089+static void find_start_end(struct mm_struct *mm, unsigned long flags,
8090+ unsigned long *begin, unsigned long *end)
8091 {
8092 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
8093 /* This is usually used needed to map code in small
8094@@ -79,7 +79,7 @@ static void find_start_end(unsigned long
8095 *begin = 0x40000000;
8096 *end = 0x80000000;
8097 } else {
8098- *begin = TASK_UNMAPPED_BASE;
8099+ *begin = mm->mmap_base;
8100 *end = TASK_SIZE;
8101 }
8102 }
8103@@ -93,11 +93,15 @@ arch_get_unmapped_area(struct file *filp
8104 unsigned long start_addr;
8105 unsigned long begin, end;
8106
8107- find_start_end(flags, &begin, &end);
8108+ find_start_end(mm, flags, &begin, &end);
8109
8110 if (len > end)
8111 return -ENOMEM;
8112
8113+#ifdef CONFIG_PAX_RANDMMAP
8114+ if (!(mm->pax_flags & MF_PAX_RANDMMAP) || !filp)
8115+#endif
8116+
8117 if (addr) {
8118 addr = PAGE_ALIGN(addr);
8119 vma = find_vma(mm, addr);
8120diff -urNp linux-2.6.18/arch/x86_64/mm/fault.c linux-2.6.18/arch/x86_64/mm/fault.c
8121--- linux-2.6.18/arch/x86_64/mm/fault.c 2006-09-19 23:42:06.000000000 -0400
8122+++ linux-2.6.18/arch/x86_64/mm/fault.c 2006-09-22 20:45:04.000000000 -0400
8123@@ -23,6 +23,7 @@
8124 #include <linux/compiler.h>
8125 #include <linux/module.h>
8126 #include <linux/kprobes.h>
8127+#include <linux/binfmts.h>
8128
8129 #include <asm/system.h>
8130 #include <asm/uaccess.h>
8131@@ -328,6 +329,33 @@ static int vmalloc_fault(unsigned long a
8132 return 0;
8133 }
8134
8135+#ifdef CONFIG_PAX_PAGEEXEC
8136+void pax_report_insns(void *pc, void *sp)
8137+{
8138+ long i;
8139+
8140+ printk(KERN_ERR "PAX: bytes at PC: ");
8141+ for (i = 0; i < 20; i++) {
8142+ unsigned char c;
8143+ if (get_user(c, (unsigned char __user *)pc+i))
8144+ printk("?? ");
8145+ else
8146+ printk("%02x ", c);
8147+ }
8148+ printk("\n");
8149+
8150+ printk(KERN_ERR "PAX: bytes at SP-8: ");
8151+ for (i = -1; i < 10; i++) {
8152+ unsigned long c;
8153+ if (get_user(c, (unsigned long __user *)sp+i))
8154+ printk("???????????????? ");
8155+ else
8156+ printk("%016lx ", c);
8157+ }
8158+ printk("\n");
8159+}
8160+#endif
8161+
8162 int page_fault_trace = 0;
8163 int exception_trace = 1;
8164
8165@@ -459,6 +487,8 @@ asmlinkage void __kprobes do_page_fault(
8166 good_area:
8167 info.si_code = SEGV_ACCERR;
8168 write = 0;
8169+ if ((error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
8170+ goto bad_area;
8171 switch (error_code & (PF_PROT|PF_WRITE)) {
8172 default: /* 3: write, present */
8173 /* fall through */
8174@@ -525,7 +555,14 @@ bad_area_nosemaphore:
8175 tsk->comm, tsk->pid, address, regs->rip,
8176 regs->rsp, error_code);
8177 }
8178-
8179+
8180+#ifdef CONFIG_PAX_PAGEEXEC
8181+ if (mm && (mm->pax_flags & MF_PAX_PAGEEXEC) && (error_code & 16)) {
8182+ pax_report_fault(regs, (void*)regs->rip, (void*)regs->rsp);
8183+ do_exit(SIGKILL);
8184+ }
8185+#endif
8186+
8187 tsk->thread.cr2 = address;
8188 /* Kernel addresses are always protection faults */
8189 tsk->thread.error_code = error_code | (address >= TASK_SIZE);
8190diff -urNp linux-2.6.18/arch/x86_64/mm/mmap.c linux-2.6.18/arch/x86_64/mm/mmap.c
8191--- linux-2.6.18/arch/x86_64/mm/mmap.c 2006-09-19 23:42:06.000000000 -0400
8192+++ linux-2.6.18/arch/x86_64/mm/mmap.c 2006-09-22 20:45:04.000000000 -0400
8193@@ -23,6 +23,12 @@ void arch_pick_mmap_layout(struct mm_str
8194 unsigned rnd = get_random_int() & 0xfffffff;
8195 mm->mmap_base += ((unsigned long)rnd) << PAGE_SHIFT;
8196 }
8197+
8198+#ifdef CONFIG_PAX_RANDMMAP
8199+ if (mm->pax_flags & MF_PAX_RANDMMAP)
8200+ mm->mmap_base += mm->delta_mmap;
8201+#endif
8202+
8203 mm->get_unmapped_area = arch_get_unmapped_area;
8204 mm->unmap_area = arch_unmap_area;
8205 }
8206diff -urNp linux-2.6.18/Documentation/dontdiff linux-2.6.18/Documentation/dontdiff
8207--- linux-2.6.18/Documentation/dontdiff 2006-09-19 23:42:06.000000000 -0400
8208+++ linux-2.6.18/Documentation/dontdiff 2006-09-22 20:45:03.000000000 -0400
8209@@ -55,7 +55,7 @@ aic7*seq.h*
8210 aicasm
8211 aicdb.h*
8212 asm
8213-asm-offsets.*
8214+asm-offsets.h
8215 asm_offsets.*
8216 autoconf.h*
8217 bbootsect
8218@@ -115,6 +115,7 @@ mkdep
8219 mktables
8220 modpost
8221 modversions.h*
8222+netfilter*
8223 offset.h
8224 offsets.h
8225 oui.c*
8226@@ -142,4 +143,5 @@ vmlinux.lds
8227 vsyscall.lds
8228 wanxlfw.inc
8229 uImage
8230+utsrelease.h
8231 zImage
8232diff -urNp linux-2.6.18/drivers/acpi/glue.c linux-2.6.18/drivers/acpi/glue.c
8233--- linux-2.6.18/drivers/acpi/glue.c 2006-09-19 23:42:06.000000000 -0400
8234+++ linux-2.6.18/drivers/acpi/glue.c 2006-09-22 20:45:04.000000000 -0400
8235@@ -16,7 +16,7 @@
8236 #if ACPI_GLUE_DEBUG
8237 #define DBG(x...) printk(PREFIX x)
8238 #else
8239-#define DBG(x...)
8240+#define DBG(x...) do {} while (0)
8241 #endif
8242 static LIST_HEAD(bus_type_list);
8243 static DECLARE_RWSEM(bus_type_sem);
8244diff -urNp linux-2.6.18/drivers/acpi/processor_core.c linux-2.6.18/drivers/acpi/processor_core.c
8245--- linux-2.6.18/drivers/acpi/processor_core.c 2006-09-19 23:42:06.000000000 -0400
8246+++ linux-2.6.18/drivers/acpi/processor_core.c 2006-09-22 20:45:04.000000000 -0400
8247@@ -534,7 +534,7 @@ static int acpi_processor_start(struct a
8248 return 0;
8249 }
8250
8251- BUG_ON((pr->id >= NR_CPUS) || (pr->id < 0));
8252+ BUG_ON(pr->id >= NR_CPUS);
8253
8254 /*
8255 * Buggy BIOS check
8256diff -urNp linux-2.6.18/drivers/char/agp/frontend.c linux-2.6.18/drivers/char/agp/frontend.c
8257--- linux-2.6.18/drivers/char/agp/frontend.c 2006-09-19 23:42:06.000000000 -0400
8258+++ linux-2.6.18/drivers/char/agp/frontend.c 2006-09-22 20:45:04.000000000 -0400
8259@@ -841,7 +841,7 @@ static int agpioc_reserve_wrap(struct ag
8260 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
8261 return -EFAULT;
8262
8263- if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
8264+ if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
8265 return -EFAULT;
8266
8267 client = agp_find_client_by_pid(reserve.pid);
8268diff -urNp linux-2.6.18/drivers/char/keyboard.c linux-2.6.18/drivers/char/keyboard.c
8269--- linux-2.6.18/drivers/char/keyboard.c 2006-09-19 23:42:06.000000000 -0400
8270+++ linux-2.6.18/drivers/char/keyboard.c 2006-09-22 20:45:04.000000000 -0400
8271@@ -198,7 +198,7 @@ int setkeycode(unsigned int scancode, un
8272
8273 if (scancode >= dev->keycodemax)
8274 return -EINVAL;
8275- if (keycode < 0 || keycode > KEY_MAX)
8276+ if (keycode > KEY_MAX)
8277 return -EINVAL;
8278 if (dev->keycodesize < sizeof(keycode) && (keycode >> (dev->keycodesize * 8)))
8279 return -EINVAL;
8280@@ -618,6 +618,16 @@ static void k_spec(struct vc_data *vc, u
8281 kbd->kbdmode == VC_MEDIUMRAW) &&
8282 value != KVAL(K_SAK))
8283 return; /* SAK is allowed even in raw mode */
8284+
8285+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
8286+ {
8287+ void *func = fn_handler[value];
8288+ if (func == fn_show_state || func == fn_show_ptregs ||
8289+ func == fn_show_mem)
8290+ return;
8291+ }
8292+#endif
8293+
8294 fn_handler[value](vc, regs);
8295 }
8296
8297diff -urNp linux-2.6.18/drivers/char/mem.c linux-2.6.18/drivers/char/mem.c
8298--- linux-2.6.18/drivers/char/mem.c 2006-09-19 23:42:06.000000000 -0400
8299+++ linux-2.6.18/drivers/char/mem.c 2006-09-22 20:45:04.000000000 -0400
8300@@ -26,6 +26,7 @@
8301 #include <linux/backing-dev.h>
8302 #include <linux/bootmem.h>
8303 #include <linux/pipe_fs_i.h>
8304+#include <linux/grsecurity.h>
8305
8306 #include <asm/uaccess.h>
8307 #include <asm/io.h>
8308@@ -34,6 +35,10 @@
8309 # include <linux/efi.h>
8310 #endif
8311
8312+#ifdef CONFIG_GRKERNSEC
8313+extern struct file_operations grsec_fops;
8314+#endif
8315+
8316 /*
8317 * Architectures vary in how they handle caching for addresses
8318 * outside of main memory.
8319@@ -173,6 +178,11 @@ static ssize_t write_mem(struct file * f
8320 if (!valid_phys_addr_range(p, count))
8321 return -EFAULT;
8322
8323+#ifdef CONFIG_GRKERNSEC_KMEM
8324+ gr_handle_mem_write();
8325+ return -EPERM;
8326+#endif
8327+
8328 written = 0;
8329
8330 #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
8331@@ -249,6 +259,11 @@ static int mmap_mem(struct file * file,
8332 size,
8333 vma->vm_page_prot);
8334
8335+#ifdef CONFIG_GRKERNSEC_KMEM
8336+ if (gr_handle_mem_mmap(vma->vm_pgoff << PAGE_SHIFT, vma))
8337+ return -EPERM;
8338+#endif
8339+
8340 /* Remap-pfn-range will mark the range VM_IO and VM_RESERVED */
8341 if (remap_pfn_range(vma,
8342 vma->vm_start,
8343@@ -476,6 +491,11 @@ static ssize_t write_kmem(struct file *
8344 ssize_t written;
8345 char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
8346
8347+#ifdef CONFIG_GRKERNSEC_KMEM
8348+ gr_handle_kmem_write();
8349+ return -EPERM;
8350+#endif
8351+
8352 if (p < (unsigned long) high_memory) {
8353
8354 wrote = count;
8355@@ -616,7 +636,23 @@ static inline size_t read_zero_pagealign
8356 count = size;
8357
8358 zap_page_range(vma, addr, count, NULL);
8359- zeromap_page_range(vma, addr, count, PAGE_COPY);
8360+ zeromap_page_range(vma, addr, count, vma->vm_page_prot);
8361+
8362+#ifdef CONFIG_PAX_SEGMEXEC
8363+ if (vma->vm_flags & VM_MIRROR) {
8364+ unsigned long addr_m;
8365+ struct vm_area_struct * vma_m;
8366+
8367+ addr_m = vma->vm_start + vma->vm_mirror;
8368+ vma_m = find_vma(mm, addr_m);
8369+ if (vma_m && vma_m->vm_start == addr_m && (vma_m->vm_flags & VM_MIRROR)) {
8370+ addr_m = addr + vma->vm_mirror;
8371+ zap_page_range(vma_m, addr_m, count, NULL);
8372+ } else
8373+ printk(KERN_ERR "PAX: VMMIRROR: read_zero bug, %08lx, %08lx\n",
8374+ addr, vma->vm_start);
8375+ }
8376+#endif
8377
8378 size -= count;
8379 buf += count;
8380@@ -765,6 +801,16 @@ static loff_t memory_lseek(struct file *
8381
8382 static int open_port(struct inode * inode, struct file * filp)
8383 {
8384+#ifdef CONFIG_GRKERNSEC_KMEM
8385+ gr_handle_open_port();
8386+ return -EPERM;
8387+#endif
8388+
8389+ return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
8390+}
8391+
8392+static int open_mem(struct inode * inode, struct file * filp)
8393+{
8394 return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
8395 }
8396
8397@@ -772,7 +818,6 @@ static int open_port(struct inode * inod
8398 #define full_lseek null_lseek
8399 #define write_zero write_null
8400 #define read_full read_zero
8401-#define open_mem open_port
8402 #define open_kmem open_mem
8403 #define open_oldmem open_mem
8404
8405@@ -895,6 +940,11 @@ static int memory_open(struct inode * in
8406 filp->f_op = &oldmem_fops;
8407 break;
8408 #endif
8409+#ifdef CONFIG_GRKERNSEC
8410+ case 13:
8411+ filp->f_op = &grsec_fops;
8412+ break;
8413+#endif
8414 default:
8415 return -ENXIO;
8416 }
8417@@ -927,6 +977,9 @@ static const struct {
8418 #ifdef CONFIG_CRASH_DUMP
8419 {12,"oldmem", S_IRUSR | S_IWUSR | S_IRGRP, &oldmem_fops},
8420 #endif
8421+#ifdef CONFIG_GRKERNSEC
8422+ {13,"grsec", S_IRUSR | S_IWUGO, &grsec_fops},
8423+#endif
8424 };
8425
8426 static struct class *mem_class;
8427diff -urNp linux-2.6.18/drivers/char/random.c linux-2.6.18/drivers/char/random.c
8428--- linux-2.6.18/drivers/char/random.c 2006-09-19 23:42:06.000000000 -0400
8429+++ linux-2.6.18/drivers/char/random.c 2006-09-22 20:45:04.000000000 -0400
8430@@ -248,8 +248,13 @@
8431 /*
8432 * Configuration information
8433 */
8434+#ifdef CONFIG_GRKERNSEC_RANDNET
8435+#define INPUT_POOL_WORDS 512
8436+#define OUTPUT_POOL_WORDS 128
8437+#else
8438 #define INPUT_POOL_WORDS 128
8439 #define OUTPUT_POOL_WORDS 32
8440+#endif
8441 #define SEC_XFER_SIZE 512
8442
8443 /*
8444@@ -286,10 +291,17 @@ static struct poolinfo {
8445 int poolwords;
8446 int tap1, tap2, tap3, tap4, tap5;
8447 } poolinfo_table[] = {
8448+#ifdef CONFIG_GRKERNSEC_RANDNET
8449+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
8450+ { 512, 411, 308, 208, 104, 1 },
8451+ /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
8452+ { 128, 103, 76, 51, 25, 1 },
8453+#else
8454 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
8455 { 128, 103, 76, 51, 25, 1 },
8456 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
8457 { 32, 26, 20, 14, 7, 1 },
8458+#endif
8459 #if 0
8460 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
8461 { 2048, 1638, 1231, 819, 411, 1 },
8462@@ -1657,3 +1669,25 @@ randomize_range(unsigned long start, uns
8463 return 0;
8464 return PAGE_ALIGN(get_random_int() % range + start);
8465 }
8466+
8467+#if defined(CONFIG_PAX_ASLR) || defined(CONFIG_GRKERNSEC)
8468+unsigned long pax_get_random_long(void)
8469+{
8470+ static time_t rekey_time;
8471+ static __u32 secret[12];
8472+ time_t t;
8473+
8474+ /*
8475+ * Pick a random secret every REKEY_INTERVAL seconds.
8476+ */
8477+ t = get_seconds();
8478+ if (!rekey_time || (t - rekey_time) > REKEY_INTERVAL) {
8479+ rekey_time = t;
8480+ get_random_bytes(secret, sizeof(secret));
8481+ }
8482+
8483+ secret[1] = half_md4_transform(secret+8, secret);
8484+ secret[0] = half_md4_transform(secret+8, secret);
8485+ return *(unsigned long *)secret;
8486+}
8487+#endif
8488diff -urNp linux-2.6.18/drivers/char/vt_ioctl.c linux-2.6.18/drivers/char/vt_ioctl.c
8489--- linux-2.6.18/drivers/char/vt_ioctl.c 2006-09-19 23:42:06.000000000 -0400
8490+++ linux-2.6.18/drivers/char/vt_ioctl.c 2006-09-22 20:04:35.000000000 -0400
8491@@ -95,6 +95,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __
8492 case KDSKBENT:
8493 if (!perm)
8494 return -EPERM;
8495+
8496+#ifdef CONFIG_GRKERNSEC
8497+ if (!capable(CAP_SYS_TTY_CONFIG))
8498+ return -EPERM;
8499+#endif
8500+
8501 if (!i && v == K_NOSUCHMAP) {
8502 /* disallocate map */
8503 key_map = key_maps[s];
8504@@ -235,6 +241,13 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
8505 goto reterr;
8506 }
8507
8508+#ifdef CONFIG_GRKERNSEC
8509+ if (!capable(CAP_SYS_TTY_CONFIG)) {
8510+ ret = -EPERM;
8511+ goto reterr;
8512+ }
8513+#endif
8514+
8515 q = func_table[i];
8516 first_free = funcbufptr + (funcbufsize - funcbufleft);
8517 for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++)
8518diff -urNp linux-2.6.18/drivers/edac/edac_mc.h linux-2.6.18/drivers/edac/edac_mc.h
8519--- linux-2.6.18/drivers/edac/edac_mc.h 2006-09-19 23:42:06.000000000 -0400
8520+++ linux-2.6.18/drivers/edac/edac_mc.h 2006-09-22 20:45:04.000000000 -0400
8521@@ -71,11 +71,11 @@ extern int edac_debug_level;
8522
8523 #else /* !CONFIG_EDAC_DEBUG */
8524
8525-#define debugf0( ... )
8526-#define debugf1( ... )
8527-#define debugf2( ... )
8528-#define debugf3( ... )
8529-#define debugf4( ... )
8530+#define debugf0( ... ) do {} while (0)
8531+#define debugf1( ... ) do {} while (0)
8532+#define debugf2( ... ) do {} while (0)
8533+#define debugf3( ... ) do {} while (0)
8534+#define debugf4( ... ) do {} while (0)
8535
8536 #endif /* !CONFIG_EDAC_DEBUG */
8537
8538diff -urNp linux-2.6.18/drivers/hwmon/fscpos.c linux-2.6.18/drivers/hwmon/fscpos.c
8539--- linux-2.6.18/drivers/hwmon/fscpos.c 2006-09-19 23:42:06.000000000 -0400
8540+++ linux-2.6.18/drivers/hwmon/fscpos.c 2006-09-22 20:45:04.000000000 -0400
8541@@ -230,7 +230,6 @@ static ssize_t set_pwm(struct i2c_client
8542 unsigned long v = simple_strtoul(buf, NULL, 10);
8543
8544 /* Range: 0..255 */
8545- if (v < 0) v = 0;
8546 if (v > 255) v = 255;
8547
8548 mutex_lock(&data->update_lock);
8549diff -urNp linux-2.6.18/drivers/hwmon/w83791d.c linux-2.6.18/drivers/hwmon/w83791d.c
8550--- linux-2.6.18/drivers/hwmon/w83791d.c 2006-09-19 23:42:06.000000000 -0400
8551+++ linux-2.6.18/drivers/hwmon/w83791d.c 2006-09-22 20:45:04.000000000 -0400
8552@@ -290,8 +290,8 @@ static int w83791d_attach_adapter(struct
8553 static int w83791d_detect(struct i2c_adapter *adapter, int address, int kind);
8554 static int w83791d_detach_client(struct i2c_client *client);
8555
8556-static int w83791d_read(struct i2c_client *client, u8 register);
8557-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
8558+static int w83791d_read(struct i2c_client *client, u8 reg);
8559+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
8560 static struct w83791d_data *w83791d_update_device(struct device *dev);
8561
8562 #ifdef DEBUG
8563diff -urNp linux-2.6.18/drivers/ide/ide-cd.c linux-2.6.18/drivers/ide/ide-cd.c
8564--- linux-2.6.18/drivers/ide/ide-cd.c 2006-09-19 23:42:06.000000000 -0400
8565+++ linux-2.6.18/drivers/ide/ide-cd.c 2006-09-22 20:45:04.000000000 -0400
8566@@ -457,8 +457,6 @@ void cdrom_analyze_sense_data(ide_drive_
8567 sector &= ~(bio_sectors -1);
8568 valid = (sector - failed_command->sector) << 9;
8569
8570- if (valid < 0)
8571- valid = 0;
8572 if (sector < get_capacity(info->disk) &&
8573 drive->probed_capacity - sector < 4 * 75) {
8574 set_capacity(info->disk, sector);
8575diff -urNp linux-2.6.18/drivers/ieee1394/dv1394.c linux-2.6.18/drivers/ieee1394/dv1394.c
8576--- linux-2.6.18/drivers/ieee1394/dv1394.c 2006-09-19 23:42:06.000000000 -0400
8577+++ linux-2.6.18/drivers/ieee1394/dv1394.c 2006-09-22 20:45:04.000000000 -0400
8578@@ -142,7 +142,7 @@
8579 #if DV1394_DEBUG_LEVEL >= 1
8580 #define debug_printk( args... ) printk( args)
8581 #else
8582-#define debug_printk( args... )
8583+#define debug_printk( args... ) do {} while (0)
8584 #endif
8585
8586 /* issue a dummy PCI read to force the preceding write
8587@@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
8588 based upon DIF section and sequence
8589 */
8590
8591-static void inline
8592+static inline void
8593 frame_put_packet (struct frame *f, struct packet *p)
8594 {
8595 int section_type = p->data[0] >> 5; /* section type is in bits 5 - 7 */
8596@@ -918,7 +918,7 @@ static int do_dv1394_init(struct video_c
8597 /* default SYT offset is 3 cycles */
8598 init->syt_offset = 3;
8599
8600- if ( (init->channel > 63) || (init->channel < 0) )
8601+ if (init->channel > 63)
8602 init->channel = 63;
8603
8604 chan_mask = (u64)1 << init->channel;
8605diff -urNp linux-2.6.18/drivers/ieee1394/hosts.c linux-2.6.18/drivers/ieee1394/hosts.c
8606--- linux-2.6.18/drivers/ieee1394/hosts.c 2006-09-19 23:42:06.000000000 -0400
8607+++ linux-2.6.18/drivers/ieee1394/hosts.c 2006-09-22 20:45:04.000000000 -0400
8608@@ -75,6 +75,7 @@ static int dummy_isoctl(struct hpsb_iso
8609 }
8610
8611 static struct hpsb_host_driver dummy_driver = {
8612+ .name = "dummy",
8613 .transmit_packet = dummy_transmit_packet,
8614 .devctl = dummy_devctl,
8615 .isoctl = dummy_isoctl
8616diff -urNp linux-2.6.18/drivers/ieee1394/ohci1394.c linux-2.6.18/drivers/ieee1394/ohci1394.c
8617--- linux-2.6.18/drivers/ieee1394/ohci1394.c 2006-09-19 23:42:06.000000000 -0400
8618+++ linux-2.6.18/drivers/ieee1394/ohci1394.c 2006-09-22 20:45:04.000000000 -0400
8619@@ -136,7 +136,7 @@
8620 #define DBGMSG(fmt, args...) \
8621 printk(KERN_INFO "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
8622 #else
8623-#define DBGMSG(fmt, args...)
8624+#define DBGMSG(fmt, args...) do {} while (0)
8625 #endif
8626
8627 #ifdef CONFIG_IEEE1394_OHCI_DMA_DEBUG
8628@@ -161,9 +161,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
8629 printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
8630
8631 /* Module Parameters */
8632-static int phys_dma = 1;
8633+static int phys_dma = 0;
8634 module_param(phys_dma, int, 0444);
8635-MODULE_PARM_DESC(phys_dma, "Enable physical dma (default = 1).");
8636+MODULE_PARM_DESC(phys_dma, "Enable physical dma (default = 0).");
8637
8638 static void dma_trm_tasklet(unsigned long data);
8639 static void dma_trm_reset(struct dma_trm_ctx *d);
8640diff -urNp linux-2.6.18/drivers/ieee1394/video1394.c linux-2.6.18/drivers/ieee1394/video1394.c
8641--- linux-2.6.18/drivers/ieee1394/video1394.c 2006-09-19 23:42:06.000000000 -0400
8642+++ linux-2.6.18/drivers/ieee1394/video1394.c 2006-09-22 20:45:04.000000000 -0400
8643@@ -890,7 +890,7 @@ static int __video1394_ioctl(struct file
8644 d = find_ctx(&ctx->context_list, OHCI_ISO_RECEIVE, v.channel);
8645 if (d == NULL) return -EFAULT;
8646
8647- if ((v.buffer<0) || (v.buffer>=d->num_desc - 1)) {
8648+ if (v.buffer>=d->num_desc - 1) {
8649 PRINT(KERN_ERR, ohci->host->id,
8650 "Buffer %d out of range",v.buffer);
8651 return -EINVAL;
8652@@ -955,7 +955,7 @@ static int __video1394_ioctl(struct file
8653 d = find_ctx(&ctx->context_list, OHCI_ISO_RECEIVE, v.channel);
8654 if (d == NULL) return -EFAULT;
8655
8656- if ((v.buffer<0) || (v.buffer>d->num_desc - 1)) {
8657+ if (v.buffer>d->num_desc - 1) {
8658 PRINT(KERN_ERR, ohci->host->id,
8659 "Buffer %d out of range",v.buffer);
8660 return -EINVAL;
8661@@ -1026,7 +1026,7 @@ static int __video1394_ioctl(struct file
8662 d = find_ctx(&ctx->context_list, OHCI_ISO_TRANSMIT, v.channel);
8663 if (d == NULL) return -EFAULT;
8664
8665- if ((v.buffer<0) || (v.buffer>=d->num_desc - 1)) {
8666+ if (v.buffer>=d->num_desc - 1) {
8667 PRINT(KERN_ERR, ohci->host->id,
8668 "Buffer %d out of range",v.buffer);
8669 return -EINVAL;
8670@@ -1128,7 +1128,7 @@ static int __video1394_ioctl(struct file
8671 d = find_ctx(&ctx->context_list, OHCI_ISO_TRANSMIT, v.channel);
8672 if (d == NULL) return -EFAULT;
8673
8674- if ((v.buffer<0) || (v.buffer>=d->num_desc-1)) {
8675+ if (v.buffer>=d->num_desc-1) {
8676 PRINT(KERN_ERR, ohci->host->id,
8677 "Buffer %d out of range",v.buffer);
8678 return -EINVAL;
8679diff -urNp linux-2.6.18/drivers/md/bitmap.c linux-2.6.18/drivers/md/bitmap.c
8680--- linux-2.6.18/drivers/md/bitmap.c 2006-09-19 23:42:06.000000000 -0400
8681+++ linux-2.6.18/drivers/md/bitmap.c 2006-09-22 20:45:04.000000000 -0400
8682@@ -57,7 +57,7 @@
8683 # if DEBUG > 0
8684 # define PRINTK(x...) printk(KERN_DEBUG x)
8685 # else
8686-# define PRINTK(x...)
8687+# define PRINTK(x...) do {} while (0)
8688 # endif
8689 #endif
8690
8691diff -urNp linux-2.6.18/drivers/mtd/devices/doc2001.c linux-2.6.18/drivers/mtd/devices/doc2001.c
8692--- linux-2.6.18/drivers/mtd/devices/doc2001.c 2006-09-19 23:42:06.000000000 -0400
8693+++ linux-2.6.18/drivers/mtd/devices/doc2001.c 2006-09-22 20:04:35.000000000 -0400
8694@@ -401,6 +401,8 @@ static int doc_read (struct mtd_info *mt
8695 /* Don't allow read past end of device */
8696 if (from >= this->totlen)
8697 return -EINVAL;
8698+ if (!len)
8699+ return -EINVAL;
8700
8701 /* Don't allow a single read to cross a 512-byte block boundary */
8702 if (from + len > ((from | 0x1ff) + 1))
8703diff -urNp linux-2.6.18/drivers/net/eepro100.c linux-2.6.18/drivers/net/eepro100.c
8704--- linux-2.6.18/drivers/net/eepro100.c 2006-09-19 23:42:06.000000000 -0400
8705+++ linux-2.6.18/drivers/net/eepro100.c 2006-09-22 20:45:04.000000000 -0400
8706@@ -47,7 +47,7 @@ static int rxdmacount /* = 0 */;
8707 # define rx_align(skb) skb_reserve((skb), 2)
8708 # define RxFD_ALIGNMENT __attribute__ ((aligned (2), packed))
8709 #else
8710-# define rx_align(skb)
8711+# define rx_align(skb) do {} while (0)
8712 # define RxFD_ALIGNMENT
8713 #endif
8714
8715diff -urNp linux-2.6.18/drivers/net/pcnet32.c linux-2.6.18/drivers/net/pcnet32.c
8716--- linux-2.6.18/drivers/net/pcnet32.c 2006-09-19 23:42:06.000000000 -0400
8717+++ linux-2.6.18/drivers/net/pcnet32.c 2006-09-22 20:45:04.000000000 -0400
8718@@ -78,7 +78,7 @@ static int cards_found;
8719 /*
8720 * VLB I/O addresses
8721 */
8722-static unsigned int pcnet32_portlist[] __initdata =
8723+static unsigned int pcnet32_portlist[] __devinitdata =
8724 { 0x300, 0x320, 0x340, 0x360, 0 };
8725
8726 static int pcnet32_debug = 0;
8727diff -urNp linux-2.6.18/drivers/pci/proc.c linux-2.6.18/drivers/pci/proc.c
8728--- linux-2.6.18/drivers/pci/proc.c 2006-09-19 23:42:06.000000000 -0400
8729+++ linux-2.6.18/drivers/pci/proc.c 2006-09-22 20:04:35.000000000 -0400
8730@@ -467,7 +467,15 @@ static int __init pci_proc_init(void)
8731 {
8732 struct proc_dir_entry *entry;
8733 struct pci_dev *dev = NULL;
8734+#ifdef CONFIG_GRKERNSEC_PROC_ADD
8735+#ifdef CONFIG_GRKERNSEC_PROC_USER
8736+ proc_bus_pci_dir = proc_mkdir_mode("pci", S_IRUSR | S_IXUSR, proc_bus);
8737+#elif CONFIG_GRKERNSEC_PROC_USERGROUP
8738+ proc_bus_pci_dir = proc_mkdir_mode("pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, proc_bus);
8739+#endif
8740+#else
8741 proc_bus_pci_dir = proc_mkdir("pci", proc_bus);
8742+#endif
8743 entry = create_proc_entry("devices", 0, proc_bus_pci_dir);
8744 if (entry)
8745 entry->proc_fops = &proc_bus_pci_dev_operations;
8746diff -urNp linux-2.6.18/drivers/pnp/pnpbios/bioscalls.c linux-2.6.18/drivers/pnp/pnpbios/bioscalls.c
8747--- linux-2.6.18/drivers/pnp/pnpbios/bioscalls.c 2006-09-19 23:42:06.000000000 -0400
8748+++ linux-2.6.18/drivers/pnp/pnpbios/bioscalls.c 2006-09-22 20:45:04.000000000 -0400
8749@@ -65,7 +65,7 @@ set_base(gdt[(selname) >> 3], (u32)(addr
8750 set_limit(gdt[(selname) >> 3], size); \
8751 } while(0)
8752
8753-static struct desc_struct bad_bios_desc = { 0, 0x00409200 };
8754+static struct desc_struct bad_bios_desc = { 0, 0x00409300 };
8755
8756 /*
8757 * At some point we want to use this stack frame pointer to unwind
8758@@ -93,6 +93,10 @@ static inline u16 call_pnp_bios(u16 func
8759 struct desc_struct save_desc_40;
8760 int cpu;
8761
8762+#ifdef CONFIG_PAX_KERNEXEC
8763+ unsigned long cr0;
8764+#endif
8765+
8766 /*
8767 * PnP BIOSes are generally not terribly re-entrant.
8768 * Also, don't rely on them to save everything correctly.
8769@@ -107,6 +111,10 @@ static inline u16 call_pnp_bios(u16 func
8770 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
8771 spin_lock_irqsave(&pnp_bios_lock, flags);
8772
8773+#ifdef CONFIG_PAX_KERNEXEC
8774+ pax_open_kernel(cr0);
8775+#endif
8776+
8777 /* The lock prevents us bouncing CPU here */
8778 if (ts1_size)
8779 Q2_SET_SEL(smp_processor_id(), PNP_TS1, ts1_base, ts1_size);
8780@@ -142,9 +150,14 @@ static inline u16 call_pnp_bios(u16 func
8781 "i" (0)
8782 : "memory"
8783 );
8784- spin_unlock_irqrestore(&pnp_bios_lock, flags);
8785
8786 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
8787+
8788+#ifdef CONFIG_PAX_KERNEXEC
8789+ pax_close_kernel(cr0);
8790+#endif
8791+
8792+ spin_unlock_irqrestore(&pnp_bios_lock, flags);
8793 put_cpu();
8794
8795 /* If we get here and this is set then the PnP BIOS faulted on us. */
8796diff -urNp linux-2.6.18/drivers/pnp/resource.c linux-2.6.18/drivers/pnp/resource.c
8797--- linux-2.6.18/drivers/pnp/resource.c 2006-09-19 23:42:06.000000000 -0400
8798+++ linux-2.6.18/drivers/pnp/resource.c 2006-09-22 20:45:04.000000000 -0400
8799@@ -364,7 +364,7 @@ int pnp_check_irq(struct pnp_dev * dev,
8800 return 1;
8801
8802 /* check if the resource is valid */
8803- if (*irq < 0 || *irq > 15)
8804+ if (*irq > 15)
8805 return 0;
8806
8807 /* check if the resource is reserved */
8808@@ -430,7 +430,7 @@ int pnp_check_dma(struct pnp_dev * dev,
8809 return 1;
8810
8811 /* check if the resource is valid */
8812- if (*dma < 0 || *dma == 4 || *dma > 7)
8813+ if (*dma == 4 || *dma > 7)
8814 return 0;
8815
8816 /* check if the resource is reserved */
8817diff -urNp linux-2.6.18/drivers/rtc/rtc-v3020.c linux-2.6.18/drivers/rtc/rtc-v3020.c
8818--- linux-2.6.18/drivers/rtc/rtc-v3020.c 2006-09-19 23:42:06.000000000 -0400
8819+++ linux-2.6.18/drivers/rtc/rtc-v3020.c 2006-09-22 20:45:04.000000000 -0400
8820@@ -198,9 +198,9 @@ static int rtc_probe(struct platform_dev
8821 * are all disabled */
8822 v3020_set_reg(chip, V3020_STATUS_0, 0x0);
8823
8824- dev_info(&pdev->dev, "Chip available at physical address 0x%p,"
8825+ dev_info(&pdev->dev, "Chip available at physical address 0x%Lx,"
8826 "data connected to D%d\n",
8827- (void*)pdev->resource[0].start,
8828+ pdev->resource[0].start,
8829 chip->leftshift);
8830
8831 platform_set_drvdata(pdev, chip);
8832diff -urNp linux-2.6.18/drivers/scsi/scsi_logging.h linux-2.6.18/drivers/scsi/scsi_logging.h
8833--- linux-2.6.18/drivers/scsi/scsi_logging.h 2006-09-19 23:42:06.000000000 -0400
8834+++ linux-2.6.18/drivers/scsi/scsi_logging.h 2006-09-22 20:45:04.000000000 -0400
8835@@ -51,7 +51,7 @@ do { \
8836 } while (0); \
8837 } while (0)
8838 #else
8839-#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD)
8840+#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD) do {} while (0)
8841 #endif /* CONFIG_SCSI_LOGGING */
8842
8843 /*
8844diff -urNp linux-2.6.18/drivers/usb/storage/debug.h linux-2.6.18/drivers/usb/storage/debug.h
8845--- linux-2.6.18/drivers/usb/storage/debug.h 2006-09-19 23:42:06.000000000 -0400
8846+++ linux-2.6.18/drivers/usb/storage/debug.h 2006-09-22 20:45:04.000000000 -0400
8847@@ -56,9 +56,9 @@ void usb_stor_show_sense( unsigned char
8848 #define US_DEBUGPX(x...) printk( x )
8849 #define US_DEBUG(x) x
8850 #else
8851-#define US_DEBUGP(x...)
8852-#define US_DEBUGPX(x...)
8853-#define US_DEBUG(x)
8854+#define US_DEBUGP(x...) do {} while (0)
8855+#define US_DEBUGPX(x...) do {} while (0)
8856+#define US_DEBUG(x) do {} while (0)
8857 #endif
8858
8859 #endif
8860diff -urNp linux-2.6.18/drivers/video/fbcmap.c linux-2.6.18/drivers/video/fbcmap.c
8861--- linux-2.6.18/drivers/video/fbcmap.c 2006-09-19 23:42:06.000000000 -0400
8862+++ linux-2.6.18/drivers/video/fbcmap.c 2006-09-22 20:45:04.000000000 -0400
8863@@ -250,8 +250,7 @@ int fb_set_user_cmap(struct fb_cmap_user
8864 int rc, size = cmap->len * sizeof(u16);
8865 struct fb_cmap umap;
8866
8867- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
8868- !info->fbops->fb_setcmap))
8869+ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap)
8870 return -EINVAL;
8871
8872 memset(&umap, 0, sizeof(struct fb_cmap));
8873diff -urNp linux-2.6.18/drivers/video/fbmem.c linux-2.6.18/drivers/video/fbmem.c
8874--- linux-2.6.18/drivers/video/fbmem.c 2006-09-19 23:42:06.000000000 -0400
8875+++ linux-2.6.18/drivers/video/fbmem.c 2006-09-22 20:45:04.000000000 -0400
8876@@ -935,9 +935,9 @@ fb_ioctl(struct inode *inode, struct fil
8877 case FBIOPUT_CON2FBMAP:
8878 if (copy_from_user(&con2fb, argp, sizeof(con2fb)))
8879 return - EFAULT;
8880- if (con2fb.console < 0 || con2fb.console > MAX_NR_CONSOLES)
8881+ if (con2fb.console > MAX_NR_CONSOLES)
8882 return -EINVAL;
8883- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
8884+ if (con2fb.framebuffer >= FB_MAX)
8885 return -EINVAL;
8886 #ifdef CONFIG_KMOD
8887 if (!registered_fb[con2fb.framebuffer])
8888diff -urNp linux-2.6.18/drivers/video/fbmon.c linux-2.6.18/drivers/video/fbmon.c
8889--- linux-2.6.18/drivers/video/fbmon.c 2006-09-19 23:42:06.000000000 -0400
8890+++ linux-2.6.18/drivers/video/fbmon.c 2006-09-22 20:45:04.000000000 -0400
8891@@ -45,7 +45,7 @@
8892 #ifdef DEBUG
8893 #define DPRINTK(fmt, args...) printk(fmt,## args)
8894 #else
8895-#define DPRINTK(fmt, args...)
8896+#define DPRINTK(fmt, args...) do {} while (0)
8897 #endif
8898
8899 #define FBMON_FIX_HEADER 1
8900diff -urNp linux-2.6.18/drivers/video/i810/i810_main.c linux-2.6.18/drivers/video/i810/i810_main.c
8901--- linux-2.6.18/drivers/video/i810/i810_main.c 2006-09-19 23:42:06.000000000 -0400
8902+++ linux-2.6.18/drivers/video/i810/i810_main.c 2006-09-22 20:04:35.000000000 -0400
8903@@ -1506,7 +1506,7 @@ static int i810fb_cursor(struct fb_info
8904 int size = ((cursor->image.width + 7) >> 3) *
8905 cursor->image.height;
8906 int i;
8907- u8 *data = kmalloc(64 * 8, GFP_ATOMIC);
8908+ u8 *data = kmalloc(64 * 8, GFP_KERNEL);
8909
8910 if (data == NULL)
8911 return -ENOMEM;
8912diff -urNp linux-2.6.18/drivers/video/vesafb.c linux-2.6.18/drivers/video/vesafb.c
8913--- linux-2.6.18/drivers/video/vesafb.c 2006-09-19 23:42:06.000000000 -0400
8914+++ linux-2.6.18/drivers/video/vesafb.c 2006-09-22 20:45:04.000000000 -0400
8915@@ -267,7 +267,7 @@ static int __init vesafb_probe(struct pl
8916 size_remap = size_total;
8917 vesafb_fix.smem_len = size_remap;
8918
8919-#ifndef __i386__
8920+#if !defined(__i386__) || defined(CONFIG_PAX_KERNEXEC)
8921 screen_info.vesapm_seg = 0;
8922 #endif
8923
8924diff -urNp linux-2.6.18/fs/binfmt_aout.c linux-2.6.18/fs/binfmt_aout.c
8925--- linux-2.6.18/fs/binfmt_aout.c 2006-09-19 23:42:06.000000000 -0400
8926+++ linux-2.6.18/fs/binfmt_aout.c 2006-09-22 20:45:04.000000000 -0400
8927@@ -24,6 +24,7 @@
8928 #include <linux/binfmts.h>
8929 #include <linux/personality.h>
8930 #include <linux/init.h>
8931+#include <linux/grsecurity.h>
8932
8933 #include <asm/system.h>
8934 #include <asm/uaccess.h>
8935@@ -123,10 +124,12 @@ static int aout_core_dump(long signr, st
8936 /* If the size of the dump file exceeds the rlimit, then see what would happen
8937 if we wrote the stack, but not the data area. */
8938 #ifdef __sparc__
8939+ gr_learn_resource(current, RLIMIT_CORE, dump.u_dsize+dump.u_ssize, 1);
8940 if ((dump.u_dsize+dump.u_ssize) >
8941 current->signal->rlim[RLIMIT_CORE].rlim_cur)
8942 dump.u_dsize = 0;
8943 #else
8944+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize+dump.u_ssize+1) * PAGE_SIZE, 1);
8945 if ((dump.u_dsize+dump.u_ssize+1) * PAGE_SIZE >
8946 current->signal->rlim[RLIMIT_CORE].rlim_cur)
8947 dump.u_dsize = 0;
8948@@ -134,10 +137,12 @@ static int aout_core_dump(long signr, st
8949
8950 /* Make sure we have enough room to write the stack and data areas. */
8951 #ifdef __sparc__
8952+ gr_learn_resource(current, RLIMIT_CORE, dump.u_ssize, 1);
8953 if ((dump.u_ssize) >
8954 current->signal->rlim[RLIMIT_CORE].rlim_cur)
8955 dump.u_ssize = 0;
8956 #else
8957+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize+1) * PAGE_SIZE, 1);
8958 if ((dump.u_ssize+1) * PAGE_SIZE >
8959 current->signal->rlim[RLIMIT_CORE].rlim_cur)
8960 dump.u_ssize = 0;
8961@@ -287,6 +292,8 @@ static int load_aout_binary(struct linux
8962 rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
8963 if (rlim >= RLIM_INFINITY)
8964 rlim = ~0;
8965+
8966+ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
8967 if (ex.a_data + ex.a_bss > rlim)
8968 return -ENOMEM;
8969
8970@@ -319,6 +326,28 @@ static int load_aout_binary(struct linux
8971 current->mm->mmap = NULL;
8972 compute_creds(bprm);
8973 current->flags &= ~PF_FORKNOEXEC;
8974+
8975+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
8976+ current->mm->pax_flags = 0UL;
8977+#endif
8978+
8979+#ifdef CONFIG_PAX_PAGEEXEC
8980+ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
8981+ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
8982+
8983+#ifdef CONFIG_PAX_EMUTRAMP
8984+ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
8985+ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
8986+#endif
8987+
8988+#ifdef CONFIG_PAX_MPROTECT
8989+ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
8990+ current->mm->pax_flags |= MF_PAX_MPROTECT;
8991+#endif
8992+
8993+ }
8994+#endif
8995+
8996 #ifdef __sparc__
8997 if (N_MAGIC(ex) == NMAGIC) {
8998 loff_t pos = fd_offset;
8999@@ -414,7 +443,7 @@ static int load_aout_binary(struct linux
9000
9001 down_write(&current->mm->mmap_sem);
9002 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
9003- PROT_READ | PROT_WRITE | PROT_EXEC,
9004+ PROT_READ | PROT_WRITE,
9005 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
9006 fd_offset + ex.a_text);
9007 up_write(&current->mm->mmap_sem);
9008diff -urNp linux-2.6.18/fs/binfmt_elf.c linux-2.6.18/fs/binfmt_elf.c
9009--- linux-2.6.18/fs/binfmt_elf.c 2006-09-19 23:42:06.000000000 -0400
9010+++ linux-2.6.18/fs/binfmt_elf.c 2006-09-22 20:45:04.000000000 -0400
9011@@ -39,10 +39,16 @@
9012 #include <linux/syscalls.h>
9013 #include <linux/random.h>
9014 #include <linux/elf.h>
9015+#include <linux/grsecurity.h>
9016+
9017 #include <asm/uaccess.h>
9018 #include <asm/param.h>
9019 #include <asm/page.h>
9020
9021+#ifdef CONFIG_PAX_SEGMEXEC
9022+#include <asm/desc.h>
9023+#endif
9024+
9025 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs);
9026 static int load_elf_library(struct file *);
9027 static unsigned long elf_map (struct file *, unsigned long, struct elf_phdr *, int, int);
9028@@ -88,6 +94,8 @@ static struct linux_binfmt elf_format =
9029
9030 static int set_brk(unsigned long start, unsigned long end)
9031 {
9032+ unsigned long e = end;
9033+
9034 start = ELF_PAGEALIGN(start);
9035 end = ELF_PAGEALIGN(end);
9036 if (end > start) {
9037@@ -98,7 +106,7 @@ static int set_brk(unsigned long start,
9038 if (BAD_ADDR(addr))
9039 return addr;
9040 }
9041- current->mm->start_brk = current->mm->brk = end;
9042+ current->mm->start_brk = current->mm->brk = e;
9043 return 0;
9044 }
9045
9046@@ -316,10 +324,9 @@ static unsigned long load_elf_interp(str
9047 {
9048 struct elf_phdr *elf_phdata;
9049 struct elf_phdr *eppnt;
9050- unsigned long load_addr = 0;
9051- int load_addr_set = 0;
9052+ unsigned long load_addr = 0, min_addr, max_addr, task_size = TASK_SIZE;
9053 unsigned long last_bss = 0, elf_bss = 0;
9054- unsigned long error = ~0UL;
9055+ unsigned long error = -EINVAL;
9056 int retval, i, size;
9057
9058 /* First of all, some simple consistency checks */
9059@@ -358,66 +365,86 @@ static unsigned long load_elf_interp(str
9060 goto out_close;
9061 }
9062
9063+#ifdef CONFIG_PAX_SEGMEXEC
9064+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
9065+ task_size = SEGMEXEC_TASK_SIZE;
9066+#endif
9067+
9068 eppnt = elf_phdata;
9069+ min_addr = task_size;
9070+ max_addr = 0;
9071+ error = -ENOMEM;
9072+
9073 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
9074- if (eppnt->p_type == PT_LOAD) {
9075- int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
9076- int elf_prot = 0;
9077- unsigned long vaddr = 0;
9078- unsigned long k, map_addr;
9079-
9080- if (eppnt->p_flags & PF_R)
9081- elf_prot = PROT_READ;
9082- if (eppnt->p_flags & PF_W)
9083- elf_prot |= PROT_WRITE;
9084- if (eppnt->p_flags & PF_X)
9085- elf_prot |= PROT_EXEC;
9086- vaddr = eppnt->p_vaddr;
9087- if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
9088- elf_type |= MAP_FIXED;
9089-
9090- map_addr = elf_map(interpreter, load_addr + vaddr,
9091- eppnt, elf_prot, elf_type);
9092- error = map_addr;
9093- if (BAD_ADDR(map_addr))
9094- goto out_close;
9095-
9096- if (!load_addr_set &&
9097- interp_elf_ex->e_type == ET_DYN) {
9098- load_addr = map_addr - ELF_PAGESTART(vaddr);
9099- load_addr_set = 1;
9100- }
9101+ if (eppnt->p_type != PT_LOAD)
9102+ continue;
9103
9104- /*
9105- * Check to see if the section's size will overflow the
9106- * allowed task size. Note that p_filesz must always be
9107- * <= p_memsize so it's only necessary to check p_memsz.
9108- */
9109- k = load_addr + eppnt->p_vaddr;
9110- if (BAD_ADDR(k) ||
9111- eppnt->p_filesz > eppnt->p_memsz ||
9112- eppnt->p_memsz > TASK_SIZE ||
9113- TASK_SIZE - eppnt->p_memsz < k) {
9114- error = -ENOMEM;
9115- goto out_close;
9116- }
9117+ /*
9118+ * Check to see if the section's size will overflow the
9119+ * allowed task size. Note that p_filesz must always be
9120+ * <= p_memsize so it is only necessary to check p_memsz.
9121+ */
9122+ if (eppnt->p_filesz > eppnt->p_memsz || eppnt->p_vaddr >= eppnt->p_vaddr + eppnt->p_memsz)
9123+ goto out_close;
9124
9125- /*
9126- * Find the end of the file mapping for this phdr, and
9127- * keep track of the largest address we see for this.
9128- */
9129- k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
9130- if (k > elf_bss)
9131- elf_bss = k;
9132+ if (min_addr > ELF_PAGESTART(eppnt->p_vaddr))
9133+ min_addr = ELF_PAGESTART(eppnt->p_vaddr);
9134+ if (max_addr < ELF_PAGEALIGN(eppnt->p_vaddr + eppnt->p_memsz))
9135+ max_addr = ELF_PAGEALIGN(eppnt->p_vaddr + eppnt->p_memsz);
9136+ }
9137+ if (min_addr >= max_addr || max_addr > task_size)
9138+ goto out_close;
9139
9140- /*
9141- * Do the same thing for the memory mapping - between
9142- * elf_bss and last_bss is the bss section.
9143- */
9144- k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
9145- if (k > last_bss)
9146- last_bss = k;
9147- }
9148+ if (interp_elf_ex->e_type == ET_DYN) {
9149+ load_addr = get_unmapped_area(interpreter, 0, max_addr - min_addr, 0, MAP_PRIVATE | MAP_EXECUTABLE);
9150+
9151+ if (load_addr >= task_size)
9152+ goto out_close;
9153+
9154+ load_addr -= min_addr;
9155+ }
9156+
9157+ eppnt = elf_phdata;
9158+ for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
9159+ int elf_type = MAP_PRIVATE | MAP_DENYWRITE | MAP_FIXED;
9160+ int elf_prot = 0;
9161+ unsigned long vaddr = 0;
9162+ unsigned long k, map_addr;
9163+
9164+ if (eppnt->p_type != PT_LOAD)
9165+ continue;
9166+
9167+ if (eppnt->p_flags & PF_R)
9168+ elf_prot = PROT_READ;
9169+ if (eppnt->p_flags & PF_W)
9170+ elf_prot |= PROT_WRITE;
9171+ if (eppnt->p_flags & PF_X)
9172+ elf_prot |= PROT_EXEC;
9173+ vaddr = eppnt->p_vaddr;
9174+
9175+ map_addr = elf_map(interpreter, load_addr + vaddr,
9176+ eppnt, elf_prot, elf_type);
9177+ error = map_addr;
9178+ if (BAD_ADDR(map_addr))
9179+ goto out_close;
9180+
9181+ k = load_addr + eppnt->p_vaddr;
9182+
9183+ /*
9184+ * Find the end of the file mapping for this phdr, and
9185+ * keep track of the largest address we see for this.
9186+ */
9187+ k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
9188+ if (k > elf_bss)
9189+ elf_bss = k;
9190+
9191+ /*
9192+ * Do the same thing for the memory mapping - between
9193+ * elf_bss and last_bss is the bss section.
9194+ */
9195+ k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
9196+ if (k > last_bss)
9197+ last_bss = k;
9198 }
9199
9200 /*
9201@@ -445,6 +472,8 @@ static unsigned long load_elf_interp(str
9202
9203 *interp_load_addr = load_addr;
9204 error = ((unsigned long)interp_elf_ex->e_entry) + load_addr;
9205+ if (BAD_ADDR(error))
9206+ error = -EFAULT;
9207
9208 out_close:
9209 kfree(elf_phdata);
9210@@ -455,7 +484,7 @@ out:
9211 static unsigned long load_aout_interp(struct exec *interp_ex,
9212 struct file *interpreter)
9213 {
9214- unsigned long text_data, elf_entry = ~0UL;
9215+ unsigned long text_data, elf_entry = -EINVAL;
9216 char __user * addr;
9217 loff_t offset;
9218
9219@@ -498,6 +527,180 @@ out:
9220 return elf_entry;
9221 }
9222
9223+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
9224+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
9225+{
9226+ unsigned long pax_flags = 0UL;
9227+
9228+#ifdef CONFIG_PAX_PAGEEXEC
9229+ if (elf_phdata->p_flags & PF_PAGEEXEC)
9230+ pax_flags |= MF_PAX_PAGEEXEC;
9231+#endif
9232+
9233+#ifdef CONFIG_PAX_SEGMEXEC
9234+ if (elf_phdata->p_flags & PF_SEGMEXEC)
9235+ pax_flags |= MF_PAX_SEGMEXEC;
9236+#endif
9237+
9238+#ifdef CONFIG_PAX_DEFAULT_PAGEEXEC
9239+ if (pax_flags & MF_PAX_PAGEEXEC)
9240+ pax_flags &= ~MF_PAX_SEGMEXEC;
9241+#endif
9242+
9243+#ifdef CONFIG_PAX_DEFAULT_SEGMEXEC
9244+ if (pax_flags & MF_PAX_SEGMEXEC)
9245+ pax_flags &= ~MF_PAX_PAGEEXEC;
9246+#endif
9247+
9248+#ifdef CONFIG_PAX_EMUTRAMP
9249+ if (elf_phdata->p_flags & PF_EMUTRAMP)
9250+ pax_flags |= MF_PAX_EMUTRAMP;
9251+#endif
9252+
9253+#ifdef CONFIG_PAX_MPROTECT
9254+ if (elf_phdata->p_flags & PF_MPROTECT)
9255+ pax_flags |= MF_PAX_MPROTECT;
9256+#endif
9257+
9258+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
9259+ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
9260+ pax_flags |= MF_PAX_RANDMMAP;
9261+#endif
9262+
9263+ return pax_flags;
9264+}
9265+#endif
9266+
9267+#ifdef CONFIG_PAX_PT_PAX_FLAGS
9268+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
9269+{
9270+ unsigned long pax_flags = 0UL;
9271+
9272+#ifdef CONFIG_PAX_PAGEEXEC
9273+ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
9274+ pax_flags |= MF_PAX_PAGEEXEC;
9275+#endif
9276+
9277+#ifdef CONFIG_PAX_SEGMEXEC
9278+ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
9279+ pax_flags |= MF_PAX_SEGMEXEC;
9280+#endif
9281+
9282+#ifdef CONFIG_PAX_DEFAULT_PAGEEXEC
9283+ if (pax_flags & MF_PAX_PAGEEXEC)
9284+ pax_flags &= ~MF_PAX_SEGMEXEC;
9285+#endif
9286+
9287+#ifdef CONFIG_PAX_DEFAULT_SEGMEXEC
9288+ if (pax_flags & MF_PAX_SEGMEXEC)
9289+ pax_flags &= ~MF_PAX_PAGEEXEC;
9290+#endif
9291+
9292+#ifdef CONFIG_PAX_EMUTRAMP
9293+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
9294+ pax_flags |= MF_PAX_EMUTRAMP;
9295+#endif
9296+
9297+#ifdef CONFIG_PAX_MPROTECT
9298+ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
9299+ pax_flags |= MF_PAX_MPROTECT;
9300+#endif
9301+
9302+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
9303+ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
9304+ pax_flags |= MF_PAX_RANDMMAP;
9305+#endif
9306+
9307+ return pax_flags;
9308+}
9309+#endif
9310+
9311+#ifdef CONFIG_PAX_EI_PAX
9312+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
9313+{
9314+ unsigned long pax_flags = 0UL;
9315+
9316+#ifdef CONFIG_PAX_PAGEEXEC
9317+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
9318+ pax_flags |= MF_PAX_PAGEEXEC;
9319+#endif
9320+
9321+#ifdef CONFIG_PAX_SEGMEXEC
9322+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
9323+ pax_flags |= MF_PAX_SEGMEXEC;
9324+#endif
9325+
9326+#ifdef CONFIG_PAX_DEFAULT_PAGEEXEC
9327+ if (pax_flags & MF_PAX_PAGEEXEC)
9328+ pax_flags &= ~MF_PAX_SEGMEXEC;
9329+#endif
9330+
9331+#ifdef CONFIG_PAX_DEFAULT_SEGMEXEC
9332+ if (pax_flags & MF_PAX_SEGMEXEC)
9333+ pax_flags &= ~MF_PAX_PAGEEXEC;
9334+#endif
9335+
9336+#ifdef CONFIG_PAX_EMUTRAMP
9337+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
9338+ pax_flags |= MF_PAX_EMUTRAMP;
9339+#endif
9340+
9341+#ifdef CONFIG_PAX_MPROTECT
9342+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
9343+ pax_flags |= MF_PAX_MPROTECT;
9344+#endif
9345+
9346+#ifdef CONFIG_PAX_ASLR
9347+ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
9348+ pax_flags |= MF_PAX_RANDMMAP;
9349+#endif
9350+
9351+ return pax_flags;
9352+}
9353+#endif
9354+
9355+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
9356+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
9357+{
9358+ unsigned long pax_flags = 0UL;
9359+
9360+#ifdef CONFIG_PAX_PT_PAX_FLAGS
9361+ unsigned long i;
9362+#endif
9363+
9364+#ifdef CONFIG_PAX_EI_PAX
9365+ pax_flags = pax_parse_ei_pax(elf_ex);
9366+#endif
9367+
9368+#ifdef CONFIG_PAX_PT_PAX_FLAGS
9369+ for (i = 0UL; i < elf_ex->e_phnum; i++)
9370+ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
9371+ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
9372+ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
9373+ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
9374+ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
9375+ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
9376+ return -EINVAL;
9377+
9378+#ifdef CONFIG_PAX_SOFTMODE
9379+ if (pax_softmode)
9380+ pax_flags = pax_parse_softmode(&elf_phdata[i]);
9381+ else
9382+#endif
9383+
9384+ pax_flags = pax_parse_hardmode(&elf_phdata[i]);
9385+ break;
9386+ }
9387+#endif
9388+
9389+ if (0 > pax_check_flags(&pax_flags))
9390+ return -EINVAL;
9391+
9392+ current->mm->pax_flags = pax_flags;
9393+ return 0;
9394+}
9395+#endif
9396+
9397 /*
9398 * These are the functions used to load ELF style executables and shared
9399 * libraries. There is no binary dependent code anywhere else.
9400@@ -534,7 +737,7 @@ static int load_elf_binary(struct linux_
9401 char * elf_interpreter = NULL;
9402 unsigned int interpreter_type = INTERPRETER_NONE;
9403 unsigned char ibcs2_interpreter = 0;
9404- unsigned long error;
9405+ unsigned long error = 0;
9406 struct elf_phdr *elf_ppnt, *elf_phdata;
9407 unsigned long elf_bss, elf_brk;
9408 int elf_exec_fileno;
9409@@ -552,6 +755,7 @@ static int load_elf_binary(struct linux_
9410 struct elfhdr interp_elf_ex;
9411 struct exec interp_ex;
9412 } *loc;
9413+ unsigned long task_size = TASK_SIZE;
9414
9415 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
9416 if (!loc) {
9417@@ -774,14 +978,88 @@ static int load_elf_binary(struct linux_
9418 current->mm->end_code = 0;
9419 current->mm->mmap = NULL;
9420 current->flags &= ~PF_FORKNOEXEC;
9421+
9422+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
9423+ current->mm->pax_flags = 0UL;
9424+#endif
9425+
9426+#ifdef CONFIG_PAX_DLRESOLVE
9427+ current->mm->call_dl_resolve = 0UL;
9428+#endif
9429+
9430+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
9431+ current->mm->call_syscall = 0UL;
9432+#endif
9433+
9434+#ifdef CONFIG_PAX_ASLR
9435+ current->mm->delta_mmap = 0UL;
9436+ current->mm->delta_exec = 0UL;
9437+ current->mm->delta_stack = 0UL;
9438+#endif
9439+
9440 current->mm->def_flags = def_flags;
9441
9442+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
9443+ if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
9444+ send_sig(SIGKILL, current, 0);
9445+ goto out_free_dentry;
9446+ }
9447+#endif
9448+
9449+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
9450+ pax_set_initial_flags(bprm);
9451+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
9452+ if (pax_set_initial_flags_func)
9453+ (pax_set_initial_flags_func)(bprm);
9454+#endif
9455+
9456+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
9457+ if (current->mm->pax_flags & MF_PAX_PAGEEXEC)
9458+ current->mm->context.user_cs_limit = PAGE_SIZE;
9459+#endif
9460+
9461+#ifdef CONFIG_PAX_SEGMEXEC
9462+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
9463+ int cpu = get_cpu();
9464+
9465+ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
9466+ current->mm->context.user_cs_limit = -SEGMEXEC_TASK_SIZE;
9467+ set_user_cs(current->mm, cpu);
9468+ put_cpu();
9469+ task_size = SEGMEXEC_TASK_SIZE;
9470+ }
9471+#endif
9472+
9473+#ifdef CONFIG_PAX_ASLR
9474+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
9475+#define pax_delta_mask(delta, lsb, len) (((delta) & ((1UL << (len)) - 1)) << (lsb))
9476+
9477+ current->mm->delta_mmap = pax_delta_mask(pax_get_random_long(), PAX_DELTA_MMAP_LSB(current), PAX_DELTA_MMAP_LEN(current));
9478+ current->mm->delta_exec = pax_delta_mask(pax_get_random_long(), PAX_DELTA_EXEC_LSB(current), PAX_DELTA_EXEC_LEN(current));
9479+ current->mm->delta_stack = pax_delta_mask(pax_get_random_long(), PAX_DELTA_STACK_LSB(current), PAX_DELTA_STACK_LEN(current));
9480+ }
9481+#endif
9482+
9483+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
9484+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
9485+ executable_stack = EXSTACK_DEFAULT;
9486+#endif
9487+
9488 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
9489 may depend on the personality. */
9490 SET_PERSONALITY(loc->elf_ex, ibcs2_interpreter);
9491+
9492+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
9493+ if (!(current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)))
9494+#endif
9495+
9496 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
9497 current->personality |= READ_IMPLIES_EXEC;
9498
9499+#ifdef CONFIG_PAX_ASLR
9500+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
9501+#endif
9502+
9503 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
9504 current->flags |= PF_RANDOMIZE;
9505 arch_pick_mmap_layout(current->mm);
9506@@ -857,6 +1135,15 @@ static int load_elf_binary(struct linux_
9507 * might try to exec. This is because the brk will
9508 * follow the loader, and is not movable. */
9509 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
9510+
9511+#ifdef CONFIG_PAX_RANDMMAP
9512+ /* PaX: randomize base address at the default exe base if requested */
9513+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
9514+ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE(current) - vaddr + current->mm->delta_exec);
9515+ elf_flags |= MAP_FIXED;
9516+ }
9517+#endif
9518+
9519 }
9520
9521 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
9522@@ -887,9 +1174,9 @@ static int load_elf_binary(struct linux_
9523 * allowed task size. Note that p_filesz must always be
9524 * <= p_memsz so it is only necessary to check p_memsz.
9525 */
9526- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
9527- elf_ppnt->p_memsz > TASK_SIZE ||
9528- TASK_SIZE - elf_ppnt->p_memsz < k) {
9529+ if (k >= task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
9530+ elf_ppnt->p_memsz > task_size ||
9531+ task_size - elf_ppnt->p_memsz < k) {
9532 /* set_brk can never work. Avoid overflows. */
9533 send_sig(SIGKILL, current, 0);
9534 goto out_free_dentry;
9535@@ -916,6 +1203,12 @@ static int load_elf_binary(struct linux_
9536 start_data += load_bias;
9537 end_data += load_bias;
9538
9539+#ifdef CONFIG_PAX_RANDMMAP
9540+ if (current->mm->pax_flags & MF_PAX_RANDMMAP)
9541+ elf_brk += PAGE_SIZE + pax_delta_mask(pax_get_random_long(), 4, PAGE_SHIFT);
9542+#undef pax_delta_mask
9543+#endif
9544+
9545 /* Calling set_brk effectively mmaps the pages that we need
9546 * for the bss and break sections. We must do this before
9547 * mapping in the interpreter, to make sure it doesn't wind
9548@@ -1168,7 +1461,7 @@ static int dump_seek(struct file *file,
9549 *
9550 * I think we should skip something. But I am not sure how. H.J.
9551 */
9552-static int maydump(struct vm_area_struct *vma)
9553+static int maydump(struct vm_area_struct *vma, long signr)
9554 {
9555 /* Do not dump I/O mapped devices or special mappings */
9556 if (vma->vm_flags & (VM_IO | VM_RESERVED))
9557@@ -1179,7 +1472,7 @@ static int maydump(struct vm_area_struct
9558 return vma->vm_file->f_dentry->d_inode->i_nlink == 0;
9559
9560 /* If it hasn't been written to, don't write it out */
9561- if (!vma->anon_vma)
9562+ if (signr != SIGKILL && !vma->anon_vma)
9563 return 0;
9564
9565 return 1;
9566@@ -1231,8 +1524,11 @@ static int writenote(struct memelfnote *
9567 #undef DUMP_SEEK
9568
9569 #define DUMP_WRITE(addr, nr) \
9570+ do { \
9571+ gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
9572 if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
9573- goto end_coredump;
9574+ goto end_coredump; \
9575+ } while (0);
9576 #define DUMP_SEEK(off) \
9577 if (!dump_seek(file, (off))) \
9578 goto end_coredump;
9579@@ -1586,7 +1882,7 @@ static int elf_core_dump(long signr, str
9580 phdr.p_offset = offset;
9581 phdr.p_vaddr = vma->vm_start;
9582 phdr.p_paddr = 0;
9583- phdr.p_filesz = maydump(vma) ? sz : 0;
9584+ phdr.p_filesz = maydump(vma, signr) ? sz : 0;
9585 phdr.p_memsz = sz;
9586 offset += phdr.p_filesz;
9587 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
9588@@ -1623,7 +1919,7 @@ static int elf_core_dump(long signr, str
9589 for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
9590 unsigned long addr;
9591
9592- if (!maydump(vma))
9593+ if (!maydump(vma, signr))
9594 continue;
9595
9596 for (addr = vma->vm_start;
9597@@ -1643,6 +1939,7 @@ static int elf_core_dump(long signr, str
9598 flush_cache_page(vma, addr,
9599 page_to_pfn(page));
9600 kaddr = kmap(page);
9601+ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
9602 if ((size += PAGE_SIZE) > limit ||
9603 !dump_write(file, kaddr,
9604 PAGE_SIZE)) {
9605diff -urNp linux-2.6.18/fs/binfmt_flat.c linux-2.6.18/fs/binfmt_flat.c
9606--- linux-2.6.18/fs/binfmt_flat.c 2006-09-19 23:42:06.000000000 -0400
9607+++ linux-2.6.18/fs/binfmt_flat.c 2006-09-22 20:45:04.000000000 -0400
9608@@ -551,7 +551,9 @@ static int load_flat_file(struct linux_b
9609 realdatastart = (unsigned long) -ENOMEM;
9610 printk("Unable to allocate RAM for process data, errno %d\n",
9611 (int)-datapos);
9612+ down_write(&current->mm->mmap_sem);
9613 do_munmap(current->mm, textpos, text_len);
9614+ up_write(&current->mm->mmap_sem);
9615 ret = realdatastart;
9616 goto err;
9617 }
9618@@ -573,8 +575,10 @@ static int load_flat_file(struct linux_b
9619 }
9620 if (result >= (unsigned long)-4096) {
9621 printk("Unable to read data+bss, errno %d\n", (int)-result);
9622+ down_write(&current->mm->mmap_sem);
9623 do_munmap(current->mm, textpos, text_len);
9624 do_munmap(current->mm, realdatastart, data_len + extra);
9625+ up_write(&current->mm->mmap_sem);
9626 ret = result;
9627 goto err;
9628 }
9629@@ -638,8 +642,10 @@ static int load_flat_file(struct linux_b
9630 }
9631 if (result >= (unsigned long)-4096) {
9632 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
9633+ down_write(&current->mm->mmap_sem);
9634 do_munmap(current->mm, textpos, text_len + data_len + extra +
9635 MAX_SHARED_LIBS * sizeof(unsigned long));
9636+ up_write(&current->mm->mmap_sem);
9637 ret = result;
9638 goto err;
9639 }
9640diff -urNp linux-2.6.18/fs/binfmt_misc.c linux-2.6.18/fs/binfmt_misc.c
9641--- linux-2.6.18/fs/binfmt_misc.c 2006-09-19 23:42:06.000000000 -0400
9642+++ linux-2.6.18/fs/binfmt_misc.c 2006-09-22 20:45:04.000000000 -0400
9643@@ -113,9 +113,11 @@ static int load_misc_binary(struct linux
9644 struct files_struct *files = NULL;
9645
9646 retval = -ENOEXEC;
9647- if (!enabled)
9648+ if (!enabled || bprm->misc)
9649 goto _ret;
9650
9651+ bprm->misc++;
9652+
9653 /* to keep locking time low, we copy the interpreter string */
9654 read_lock(&entries_lock);
9655 fmt = check_file(bprm);
9656diff -urNp linux-2.6.18/fs/buffer.c linux-2.6.18/fs/buffer.c
9657--- linux-2.6.18/fs/buffer.c 2006-09-19 23:42:06.000000000 -0400
9658+++ linux-2.6.18/fs/buffer.c 2006-09-22 20:04:35.000000000 -0400
9659@@ -41,6 +41,7 @@
9660 #include <linux/bitops.h>
9661 #include <linux/mpage.h>
9662 #include <linux/bit_spinlock.h>
9663+#include <linux/grsecurity.h>
9664
9665 static int fsync_buffers_list(spinlock_t *lock, struct list_head *list);
9666 static void invalidate_bh_lrus(void);
9667@@ -2164,6 +2165,7 @@ static int __generic_cont_expand(struct
9668
9669 err = -EFBIG;
9670 limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
9671+ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long) size, 1);
9672 if (limit != RLIM_INFINITY && size > (loff_t)limit) {
9673 send_sig(SIGXFSZ, current, 0);
9674 goto out;
9675diff -urNp linux-2.6.18/fs/cifs/smbdes.c linux-2.6.18/fs/cifs/smbdes.c
9676--- linux-2.6.18/fs/cifs/smbdes.c 2006-09-19 23:42:06.000000000 -0400
9677+++ linux-2.6.18/fs/cifs/smbdes.c 2006-09-22 20:45:04.000000000 -0400
9678@@ -196,15 +196,18 @@ dohash(char *out, char *in, char *key, i
9679 char c[28];
9680 char d[28];
9681 char *cd;
9682- char ki[16][48];
9683+ char *ki;
9684 char *pd1;
9685 char l[32], r[32];
9686 char *rl;
9687+ char *er; /* er[48] */
9688
9689 /* Have to reduce stack usage */
9690- pk1 = kmalloc(56+56+64+64,GFP_KERNEL);
9691- if(pk1 == NULL)
9692- return;
9693+ pk1 = kmalloc(56+56+64+64, GFP_KERNEL);
9694+ ki = kmalloc(16*48, GFP_KERNEL);
9695+ er = kmalloc(48+48+32+32+32, GFP_KERNEL);
9696+ if (!pk1 || !ki || !er)
9697+ goto free;
9698
9699 cd = pk1 + 56;
9700 pd1= cd + 56;
9701@@ -222,7 +225,7 @@ dohash(char *out, char *in, char *key, i
9702 lshift(d, sc[i], 28);
9703
9704 concat(cd, c, d, 28, 28);
9705- permute(ki[i], cd, perm2, 48);
9706+ permute(ki+48*i, cd, perm2, 48);
9707 }
9708
9709 permute(pd1, in, perm3, 64);
9710@@ -233,18 +236,12 @@ dohash(char *out, char *in, char *key, i
9711 }
9712
9713 for (i = 0; i < 16; i++) {
9714- char *er; /* er[48] */
9715 char *erk; /* erk[48] */
9716 char b[8][6];
9717 char *cb; /* cb[32] */
9718 char *pcb; /* pcb[32] */
9719 char *r2; /* r2[32] */
9720
9721- er = kmalloc(48+48+32+32+32, GFP_KERNEL);
9722- if(er == NULL) {
9723- kfree(pk1);
9724- return;
9725- }
9726 erk = er+48;
9727 cb = erk+48;
9728 pcb = cb+32;
9729@@ -252,7 +249,7 @@ dohash(char *out, char *in, char *key, i
9730
9731 permute(er, r, perm4, 48);
9732
9733- xor(erk, er, ki[forw ? i : 15 - i], 48);
9734+ xor(erk, er, ki+48*(forw ? i : 15 - i), 48);
9735
9736 for (j = 0; j < 8; j++)
9737 for (k = 0; k < 6; k++)
9738@@ -282,13 +279,15 @@ dohash(char *out, char *in, char *key, i
9739
9740 for (j = 0; j < 32; j++)
9741 r[j] = r2[j];
9742-
9743- kfree(er);
9744 }
9745
9746 concat(rl, r, l, 32, 32);
9747
9748 permute(out, rl, perm6, 64);
9749+
9750+free:
9751+ kfree(er);
9752+ kfree(ki);
9753 kfree(pk1);
9754 }
9755
9756diff -urNp linux-2.6.18/fs/compat.c linux-2.6.18/fs/compat.c
9757--- linux-2.6.18/fs/compat.c 2006-09-19 23:42:06.000000000 -0400
9758+++ linux-2.6.18/fs/compat.c 2006-09-22 20:04:35.000000000 -0400
9759@@ -46,6 +46,7 @@
9760 #include <linux/rwsem.h>
9761 #include <linux/acct.h>
9762 #include <linux/mm.h>
9763+#include <linux/grsecurity.h>
9764
9765 #include <net/sock.h> /* siocdevprivate_ioctl */
9766
9767@@ -1512,6 +1513,11 @@ int compat_do_execve(char * filename,
9768 struct file *file;
9769 int retval;
9770 int i;
9771+#ifdef CONFIG_GRKERNSEC
9772+ struct file *old_exec_file;
9773+ struct acl_subject_label *old_acl;
9774+ struct rlimit old_rlim[RLIM_NLIMITS];
9775+#endif
9776
9777 retval = -ENOMEM;
9778 bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
9779@@ -1529,6 +1535,15 @@ int compat_do_execve(char * filename,
9780 bprm->file = file;
9781 bprm->filename = filename;
9782 bprm->interp = filename;
9783+
9784+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->user->processes), 1);
9785+ retval = -EAGAIN;
9786+ if (gr_handle_nproc())
9787+ goto out_file;
9788+ retval = -EACCES;
9789+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
9790+ goto out_file;
9791+
9792 bprm->mm = mm_alloc();
9793 retval = -ENOMEM;
9794 if (!bprm->mm)
9795@@ -1567,10 +1582,39 @@ int compat_do_execve(char * filename,
9796 if (retval < 0)
9797 goto out;
9798
9799+ if (!gr_tpe_allow(file)) {
9800+ retval = -EACCES;
9801+ goto out;
9802+ }
9803+
9804+ if (gr_check_crash_exec(file)) {
9805+ retval = -EACCES;
9806+ goto out;
9807+ }
9808+
9809+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
9810+
9811+ gr_handle_exec_args(bprm, (char __user * __user *)argv);
9812+
9813+#ifdef CONFIG_GRKERNSEC
9814+ old_acl = current->acl;
9815+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
9816+ old_exec_file = current->exec_file;
9817+ get_file(file);
9818+ current->exec_file = file;
9819+#endif
9820+
9821+ gr_set_proc_label(file->f_dentry, file->f_vfsmnt);
9822+
9823 retval = search_binary_handler(bprm, regs);
9824 if (retval >= 0) {
9825 free_arg_pages(bprm);
9826
9827+#ifdef CONFIG_GRKERNSEC
9828+ if (old_exec_file)
9829+ fput(old_exec_file);
9830+#endif
9831+
9832 /* execve success */
9833 security_bprm_free(bprm);
9834 acct_update_integrals(current);
9835@@ -1578,6 +1622,13 @@ int compat_do_execve(char * filename,
9836 return retval;
9837 }
9838
9839+#ifdef CONFIG_GRKERNSEC
9840+ current->acl = old_acl;
9841+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
9842+ fput(current->exec_file);
9843+ current->exec_file = old_exec_file;
9844+#endif
9845+
9846 out:
9847 /* Something went wrong, return the inode and free the argument pages*/
9848 for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
9849diff -urNp linux-2.6.18/fs/dcache.c linux-2.6.18/fs/dcache.c
9850--- linux-2.6.18/fs/dcache.c 2006-09-19 23:42:06.000000000 -0400
9851+++ linux-2.6.18/fs/dcache.c 2006-09-22 20:04:35.000000000 -0400
9852@@ -1402,7 +1402,7 @@ already_unhashed:
9853 *
9854 * "buflen" should be positive. Caller holds the dcache_lock.
9855 */
9856-static char * __d_path( struct dentry *dentry, struct vfsmount *vfsmnt,
9857+char * __d_path( struct dentry *dentry, struct vfsmount *vfsmnt,
9858 struct dentry *root, struct vfsmount *rootmnt,
9859 char *buffer, int buflen)
9860 {
9861diff -urNp linux-2.6.18/fs/exec.c linux-2.6.18/fs/exec.c
9862--- linux-2.6.18/fs/exec.c 2006-09-19 23:42:06.000000000 -0400
9863+++ linux-2.6.18/fs/exec.c 2006-09-22 22:13:47.000000000 -0400
9864@@ -49,6 +49,8 @@
9865 #include <linux/acct.h>
9866 #include <linux/cn_proc.h>
9867 #include <linux/audit.h>
9868+#include <linux/random.h>
9869+#include <linux/grsecurity.h>
9870
9871 #include <asm/uaccess.h>
9872 #include <asm/mmu_context.h>
9873@@ -67,6 +69,15 @@ EXPORT_SYMBOL(suid_dumpable);
9874 static struct linux_binfmt *formats;
9875 static DEFINE_RWLOCK(binfmt_lock);
9876
9877+#ifdef CONFIG_PAX_SOFTMODE
9878+unsigned int pax_softmode;
9879+#endif
9880+
9881+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
9882+void (*pax_set_initial_flags_func)(struct linux_binprm * bprm);
9883+EXPORT_SYMBOL(pax_set_initial_flags_func);
9884+#endif
9885+
9886 int register_binfmt(struct linux_binfmt * fmt)
9887 {
9888 struct linux_binfmt ** tmp = &formats;
9889@@ -312,6 +323,10 @@ void install_arg_page(struct vm_area_str
9890 if (unlikely(anon_vma_prepare(vma)))
9891 goto out;
9892
9893+#ifdef CONFIG_PAX_SEGMEXEC
9894+ if (page_count(page) == 1)
9895+#endif
9896+
9897 flush_dcache_page(page);
9898 pte = get_locked_pte(mm, address, &ptl);
9899 if (!pte)
9900@@ -321,9 +336,21 @@ void install_arg_page(struct vm_area_str
9901 goto out;
9902 }
9903 inc_mm_counter(mm, anon_rss);
9904+
9905+#ifdef CONFIG_PAX_SEGMEXEC
9906+ if (page_count(page) == 1)
9907+#endif
9908+
9909 lru_cache_add_active(page);
9910 set_pte_at(mm, address, pte, pte_mkdirty(pte_mkwrite(mk_pte(
9911 page, vma->vm_page_prot))));
9912+
9913+#ifdef CONFIG_PAX_SEGMEXEC
9914+ if (page_count(page) != 1)
9915+ page_add_anon_rmap(page, vma, address);
9916+ else
9917+#endif
9918+
9919 page_add_new_anon_rmap(page, vma, address);
9920 pte_unmap_unlock(pte, ptl);
9921
9922@@ -346,6 +373,10 @@ int setup_arg_pages(struct linux_binprm
9923 int i, ret;
9924 long arg_size;
9925
9926+#ifdef CONFIG_PAX_SEGMEXEC
9927+ struct vm_area_struct *mpnt_m = NULL;
9928+#endif
9929+
9930 #ifdef CONFIG_STACK_GROWSUP
9931 /* Move the argument and environment strings to the bottom of the
9932 * stack space.
9933@@ -404,11 +435,19 @@ int setup_arg_pages(struct linux_binprm
9934 bprm->loader += stack_base;
9935 bprm->exec += stack_base;
9936
9937- mpnt = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
9938+ mpnt = kmem_cache_zalloc(vm_area_cachep, SLAB_KERNEL);
9939 if (!mpnt)
9940 return -ENOMEM;
9941
9942- memset(mpnt, 0, sizeof(*mpnt));
9943+#ifdef CONFIG_PAX_SEGMEXEC
9944+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (VM_STACK_FLAGS & VM_MAYEXEC)) {
9945+ mpnt_m = kmem_cache_zalloc(vm_area_cachep, SLAB_KERNEL);
9946+ if (!mpnt_m) {
9947+ kmem_cache_free(vm_area_cachep, mpnt);
9948+ return -ENOMEM;
9949+ }
9950+ }
9951+#endif
9952
9953 down_write(&mm->mmap_sem);
9954 {
9955@@ -430,13 +469,50 @@ int setup_arg_pages(struct linux_binprm
9956 else
9957 mpnt->vm_flags = VM_STACK_FLAGS;
9958 mpnt->vm_flags |= mm->def_flags;
9959- mpnt->vm_page_prot = protection_map[mpnt->vm_flags & 0x7];
9960+
9961+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
9962+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC))
9963+ mpnt->vm_page_prot = protection_map[(mpnt->vm_flags | VM_EXEC) & (VM_READ|VM_WRITE|VM_EXEC)];
9964+ else
9965+#endif
9966+
9967+ mpnt->vm_page_prot = protection_map[mpnt->vm_flags & (VM_READ|VM_WRITE|VM_EXEC)];
9968 if ((ret = insert_vm_struct(mm, mpnt))) {
9969 up_write(&mm->mmap_sem);
9970 kmem_cache_free(vm_area_cachep, mpnt);
9971+
9972+#ifdef CONFIG_PAX_SEGMEXEC
9973+ if (mpnt_m)
9974+ kmem_cache_free(vm_area_cachep, mpnt_m);
9975+#endif
9976+
9977 return ret;
9978 }
9979 mm->stack_vm = mm->total_vm = vma_pages(mpnt);
9980+
9981+#ifdef CONFIG_PAX_SEGMEXEC
9982+ if (mpnt_m) {
9983+ *mpnt_m = *mpnt;
9984+ if (!(mpnt->vm_flags & VM_EXEC)) {
9985+ mpnt_m->vm_flags &= ~(VM_READ | VM_WRITE | VM_EXEC);
9986+ mpnt_m->vm_page_prot = PAGE_NONE;
9987+ }
9988+ mpnt_m->vm_start += SEGMEXEC_TASK_SIZE;
9989+ mpnt_m->vm_end += SEGMEXEC_TASK_SIZE;
9990+ if ((ret = insert_vm_struct(mm, mpnt_m))) {
9991+ up_write(&mm->mmap_sem);
9992+ kmem_cache_free(vm_area_cachep, mpnt_m);
9993+ return ret;
9994+ }
9995+ mpnt_m->vm_flags |= VM_MIRROR;
9996+ mpnt->vm_flags |= VM_MIRROR;
9997+ mpnt_m->vm_mirror = mpnt->vm_start - mpnt_m->vm_start;
9998+ mpnt->vm_mirror = mpnt_m->vm_start - mpnt->vm_start;
9999+ mpnt_m->vm_pgoff = mpnt->vm_pgoff;
10000+ mm->total_vm += vma_pages(mpnt_m);
10001+ }
10002+#endif
10003+
10004 }
10005
10006 for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
10007@@ -444,6 +520,14 @@ int setup_arg_pages(struct linux_binprm
10008 if (page) {
10009 bprm->page[i] = NULL;
10010 install_arg_page(mpnt, page, stack_base);
10011+
10012+#ifdef CONFIG_PAX_SEGMEXEC
10013+ if (mpnt_m) {
10014+ page_cache_get(page);
10015+ install_arg_page(mpnt_m, page, stack_base + SEGMEXEC_TASK_SIZE);
10016+ }
10017+#endif
10018+
10019 }
10020 stack_base += PAGE_SIZE;
10021 }
10022@@ -1132,6 +1216,11 @@ int do_execve(char * filename,
10023 struct file *file;
10024 int retval;
10025 int i;
10026+#ifdef CONFIG_GRKERNSEC
10027+ struct file *old_exec_file;
10028+ struct acl_subject_label *old_acl;
10029+ struct rlimit old_rlim[RLIM_NLIMITS];
10030+#endif
10031
10032 retval = -ENOMEM;
10033 bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
10034@@ -1143,10 +1232,29 @@ int do_execve(char * filename,
10035 if (IS_ERR(file))
10036 goto out_kfree;
10037
10038+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->user->processes), 1);
10039+
10040+ if (gr_handle_nproc()) {
10041+ allow_write_access(file);
10042+ fput(file);
10043+ return -EAGAIN;
10044+ }
10045+
10046+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
10047+ allow_write_access(file);
10048+ fput(file);
10049+ return -EACCES;
10050+ }
10051+
10052 sched_exec();
10053
10054 bprm->p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
10055
10056+#ifdef CONFIG_PAX_RANDUSTACK
10057+ if (randomize_va_space)
10058+ bprm->p -= (pax_get_random_long() & ~(sizeof(void *)-1)) & ~PAGE_MASK;
10059+#endif
10060+
10061 bprm->file = file;
10062 bprm->filename = filename;
10063 bprm->interp = filename;
10064@@ -1188,8 +1296,38 @@ int do_execve(char * filename,
10065 if (retval < 0)
10066 goto out;
10067
10068+ if (!gr_tpe_allow(file)) {
10069+ retval = -EACCES;
10070+ goto out;
10071+ }
10072+
10073+ if (gr_check_crash_exec(file)) {
10074+ retval = -EACCES;
10075+ goto out;
10076+ }
10077+
10078+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
10079+
10080+ gr_handle_exec_args(bprm, argv);
10081+
10082+#ifdef CONFIG_GRKERNSEC
10083+ old_acl = current->acl;
10084+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
10085+ old_exec_file = current->exec_file;
10086+ get_file(file);
10087+ current->exec_file = file;
10088+#endif
10089+
10090+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt);
10091+ if (retval < 0)
10092+ goto out_fail;
10093+
10094 retval = search_binary_handler(bprm,regs);
10095 if (retval >= 0) {
10096+#ifdef CONFIG_GRKERNSEC
10097+ if (old_exec_file)
10098+ fput(old_exec_file);
10099+#endif
10100 free_arg_pages(bprm);
10101
10102 /* execve success */
10103@@ -1199,6 +1337,14 @@ int do_execve(char * filename,
10104 return retval;
10105 }
10106
10107+out_fail:
10108+#ifdef CONFIG_GRKERNSEC
10109+ current->acl = old_acl;
10110+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
10111+ fput(current->exec_file);
10112+ current->exec_file = old_exec_file;
10113+#endif
10114+
10115 out:
10116 /* Something went wrong, return the inode and free the argument pages*/
10117 for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
10118@@ -1359,6 +1505,114 @@ static void format_corename(char *corena
10119 *out_ptr = 0;
10120 }
10121
10122+int pax_check_flags(unsigned long * flags)
10123+{
10124+ int retval = 0;
10125+
10126+#if !defined(__i386__) || !defined(CONFIG_PAX_SEGMEXEC)
10127+ if (*flags & MF_PAX_SEGMEXEC)
10128+ {
10129+ *flags &= ~MF_PAX_SEGMEXEC;
10130+ retval = -EINVAL;
10131+ }
10132+#endif
10133+
10134+ if ((*flags & MF_PAX_PAGEEXEC)
10135+
10136+#ifdef CONFIG_PAX_PAGEEXEC
10137+ && (*flags & MF_PAX_SEGMEXEC)
10138+#endif
10139+
10140+ )
10141+ {
10142+ *flags &= ~MF_PAX_PAGEEXEC;
10143+ retval = -EINVAL;
10144+ }
10145+
10146+ if ((*flags & MF_PAX_MPROTECT)
10147+
10148+#ifdef CONFIG_PAX_MPROTECT
10149+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
10150+#endif
10151+
10152+ )
10153+ {
10154+ *flags &= ~MF_PAX_MPROTECT;
10155+ retval = -EINVAL;
10156+ }
10157+
10158+ if ((*flags & MF_PAX_EMUTRAMP)
10159+
10160+#ifdef CONFIG_PAX_EMUTRAMP
10161+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
10162+#endif
10163+
10164+ )
10165+ {
10166+ *flags &= ~MF_PAX_EMUTRAMP;
10167+ retval = -EINVAL;
10168+ }
10169+
10170+ return retval;
10171+}
10172+
10173+EXPORT_SYMBOL(pax_check_flags);
10174+
10175+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
10176+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
10177+{
10178+ struct task_struct *tsk = current;
10179+ struct mm_struct *mm = current->mm;
10180+ char* buffer_exec = (char*)__get_free_page(GFP_ATOMIC);
10181+ char* buffer_fault = (char*)__get_free_page(GFP_ATOMIC);
10182+ char* path_exec=NULL;
10183+ char* path_fault=NULL;
10184+ unsigned long start=0UL, end=0UL, offset=0UL;
10185+
10186+ if (buffer_exec && buffer_fault) {
10187+ struct vm_area_struct* vma, * vma_exec=NULL, * vma_fault=NULL;
10188+
10189+ down_read(&mm->mmap_sem);
10190+ vma = mm->mmap;
10191+ while (vma && (!vma_exec || !vma_fault)) {
10192+ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
10193+ vma_exec = vma;
10194+ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
10195+ vma_fault = vma;
10196+ vma = vma->vm_next;
10197+ }
10198+ if (vma_exec) {
10199+ path_exec = d_path(vma_exec->vm_file->f_dentry, vma_exec->vm_file->f_vfsmnt, buffer_exec, PAGE_SIZE);
10200+ if (IS_ERR(path_exec))
10201+ path_exec = "<path too long>";
10202+ }
10203+ if (vma_fault) {
10204+ start = vma_fault->vm_start;
10205+ end = vma_fault->vm_end;
10206+ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
10207+ if (vma_fault->vm_file) {
10208+ path_fault = d_path(vma_fault->vm_file->f_dentry, vma_fault->vm_file->f_vfsmnt, buffer_fault, PAGE_SIZE);
10209+ if (IS_ERR(path_fault))
10210+ path_fault = "<path too long>";
10211+ } else
10212+ path_fault = "<anonymous mapping>";
10213+ }
10214+ up_read(&mm->mmap_sem);
10215+ }
10216+ if (tsk->signal->curr_ip)
10217+ printk(KERN_ERR "PAX: From %u.%u.%u.%u: execution attempt in: %s, %08lx-%08lx %08lx\n", NIPQUAD(tsk->signal->curr_ip), path_fault, start, end, offset);
10218+ else
10219+ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
10220+ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
10221+ "PC: %p, SP: %p\n", path_exec, tsk->comm, tsk->pid,
10222+ tsk->uid, tsk->euid, pc, sp);
10223+ free_page((unsigned long)buffer_exec);
10224+ free_page((unsigned long)buffer_fault);
10225+ pax_report_insns(pc, sp);
10226+ do_coredump(SIGKILL, SIGKILL, regs);
10227+}
10228+#endif
10229+
10230 static void zap_process(struct task_struct *start)
10231 {
10232 struct task_struct *t;
10233@@ -1498,6 +1752,10 @@ int do_coredump(long signr, int exit_cod
10234 */
10235 clear_thread_flag(TIF_SIGPENDING);
10236
10237+ if (signr == SIGKILL || signr == SIGILL)
10238+ gr_handle_brute_attach(current);
10239+
10240+ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
10241 if (current->signal->rlim[RLIMIT_CORE].rlim_cur < binfmt->min_coredump)
10242 goto fail_unlock;
10243
10244diff -urNp linux-2.6.18/fs/ext3/xattr.c linux-2.6.18/fs/ext3/xattr.c
10245--- linux-2.6.18/fs/ext3/xattr.c 2006-09-19 23:42:06.000000000 -0400
10246+++ linux-2.6.18/fs/ext3/xattr.c 2006-09-22 20:45:04.000000000 -0400
10247@@ -89,8 +89,8 @@
10248 printk("\n"); \
10249 } while (0)
10250 #else
10251-# define ea_idebug(f...)
10252-# define ea_bdebug(f...)
10253+# define ea_idebug(f...) do {} while (0)
10254+# define ea_bdebug(f...) do {} while (0)
10255 #endif
10256
10257 static void ext3_xattr_cache_insert(struct buffer_head *);
10258diff -urNp linux-2.6.18/fs/fcntl.c linux-2.6.18/fs/fcntl.c
10259--- linux-2.6.18/fs/fcntl.c 2006-09-19 23:42:06.000000000 -0400
10260+++ linux-2.6.18/fs/fcntl.c 2006-09-22 20:04:35.000000000 -0400
10261@@ -18,6 +18,7 @@
10262 #include <linux/ptrace.h>
10263 #include <linux/signal.h>
10264 #include <linux/rcupdate.h>
10265+#include <linux/grsecurity.h>
10266
10267 #include <asm/poll.h>
10268 #include <asm/siginfo.h>
10269@@ -63,6 +64,7 @@ static int locate_fd(struct files_struct
10270 struct fdtable *fdt;
10271
10272 error = -EINVAL;
10273+ gr_learn_resource(current, RLIMIT_NOFILE, orig_start, 0);
10274 if (orig_start >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
10275 goto out;
10276
10277@@ -83,6 +85,7 @@ repeat:
10278 }
10279
10280 error = -EMFILE;
10281+ gr_learn_resource(current, RLIMIT_NOFILE, newfd, 0);
10282 if (newfd >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
10283 goto out;
10284
10285@@ -141,6 +144,8 @@ asmlinkage long sys_dup2(unsigned int ol
10286 struct files_struct * files = current->files;
10287 struct fdtable *fdt;
10288
10289+ gr_learn_resource(current, RLIMIT_NOFILE, newfd, 0);
10290+
10291 spin_lock(&files->file_lock);
10292 if (!(file = fcheck(oldfd)))
10293 goto out_unlock;
10294@@ -427,7 +432,8 @@ static inline int sigio_perm(struct task
10295 return (((fown->euid == 0) ||
10296 (fown->euid == p->suid) || (fown->euid == p->uid) ||
10297 (fown->uid == p->suid) || (fown->uid == p->uid)) &&
10298- !security_file_send_sigiotask(p, fown, sig));
10299+ !security_file_send_sigiotask(p, fown, sig) &&
10300+ !gr_check_protected_task(p) && !gr_pid_is_chrooted(p));
10301 }
10302
10303 static void send_sigio_to_task(struct task_struct *p,
10304diff -urNp linux-2.6.18/fs/Kconfig linux-2.6.18/fs/Kconfig
10305--- linux-2.6.18/fs/Kconfig 2006-09-19 23:42:06.000000000 -0400
10306+++ linux-2.6.18/fs/Kconfig 2006-09-22 20:04:35.000000000 -0400
10307@@ -817,7 +817,7 @@ config PROC_FS
10308
10309 config PROC_KCORE
10310 bool "/proc/kcore support" if !ARM
10311- depends on PROC_FS && MMU
10312+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
10313
10314 config PROC_VMCORE
10315 bool "/proc/vmcore support (EXPERIMENTAL)"
10316diff -urNp linux-2.6.18/fs/namei.c linux-2.6.18/fs/namei.c
10317--- linux-2.6.18/fs/namei.c 2006-09-19 23:42:06.000000000 -0400
10318+++ linux-2.6.18/fs/namei.c 2006-09-22 20:04:35.000000000 -0400
10319@@ -32,6 +32,7 @@
10320 #include <linux/file.h>
10321 #include <linux/fcntl.h>
10322 #include <linux/namei.h>
10323+#include <linux/grsecurity.h>
10324 #include <asm/namei.h>
10325 #include <asm/uaccess.h>
10326
10327@@ -618,6 +619,13 @@ static inline int do_follow_link(struct
10328 err = security_inode_follow_link(path->dentry, nd);
10329 if (err)
10330 goto loop;
10331+
10332+ if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
10333+ path->dentry->d_inode, path->dentry, nd->mnt)) {
10334+ err = -EACCES;
10335+ goto loop;
10336+ }
10337+
10338 current->link_count++;
10339 current->total_link_count++;
10340 nd->depth++;
10341@@ -961,11 +969,18 @@ return_reval:
10342 break;
10343 }
10344 return_base:
10345+ if (!gr_acl_handle_hidden_file(nd->dentry, nd->mnt)) {
10346+ path_release(nd);
10347+ return -ENOENT;
10348+ }
10349 return 0;
10350 out_dput:
10351 dput_path(&next, nd);
10352 break;
10353 }
10354+ if (!gr_acl_handle_hidden_file(nd->dentry, nd->mnt))
10355+ err = -ENOENT;
10356+
10357 path_release(nd);
10358 return_err:
10359 return err;
10360@@ -1608,6 +1623,17 @@ int open_namei(int dfd, const char *path
10361 nd, flag);
10362 if (error)
10363 return error;
10364+
10365+ if (gr_handle_rawio(nd->dentry->d_inode)) {
10366+ error = -EPERM;
10367+ goto exit;
10368+ }
10369+
10370+ if (!gr_acl_handle_open(nd->dentry, nd->mnt, flag)) {
10371+ error = -EACCES;
10372+ goto exit;
10373+ }
10374+
10375 goto ok;
10376 }
10377
10378@@ -1648,9 +1674,16 @@ do_last:
10379
10380 /* Negative dentry, just create the file */
10381 if (!path.dentry->d_inode) {
10382+ if (!gr_acl_handle_creat(path.dentry, nd->dentry, nd->mnt, flag, mode)) {
10383+ error = -EACCES;
10384+ mutex_unlock(&dir->d_inode->i_mutex);
10385+ goto exit_dput;
10386+ }
10387 if (!IS_POSIXACL(dir->d_inode))
10388 mode &= ~current->fs->umask;
10389 error = vfs_create(dir->d_inode, path.dentry, mode, nd);
10390+ if (!error)
10391+ gr_handle_create(path.dentry, nd->mnt);
10392 mutex_unlock(&dir->d_inode->i_mutex);
10393 dput(nd->dentry);
10394 nd->dentry = path.dentry;
10395@@ -1665,6 +1698,23 @@ do_last:
10396 /*
10397 * It already exists.
10398 */
10399+
10400+ if (gr_handle_rawio(path.dentry->d_inode)) {
10401+ mutex_unlock(&dir->d_inode->i_mutex);
10402+ error = -EPERM;
10403+ goto exit_dput;
10404+ }
10405+ if (!gr_acl_handle_open(path.dentry, nd->mnt, flag)) {
10406+ mutex_unlock(&dir->d_inode->i_mutex);
10407+ error = -EACCES;
10408+ goto exit_dput;
10409+ }
10410+ if (gr_handle_fifo(path.dentry, nd->mnt, dir, flag, acc_mode)) {
10411+ mutex_unlock(&dir->d_inode->i_mutex);
10412+ error = -EACCES;
10413+ goto exit_dput;
10414+ }
10415+
10416 mutex_unlock(&dir->d_inode->i_mutex);
10417 audit_inode_update(path.dentry->d_inode);
10418
10419@@ -1720,6 +1770,13 @@ do_link:
10420 error = security_inode_follow_link(path.dentry, nd);
10421 if (error)
10422 goto exit_dput;
10423+
10424+ if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
10425+ path.dentry, nd->mnt)) {
10426+ error = -EACCES;
10427+ goto exit_dput;
10428+ }
10429+
10430 error = __do_follow_link(&path, nd);
10431 if (error) {
10432 /* Does someone understand code flow here? Or it is only
10433@@ -1848,6 +1905,22 @@ asmlinkage long sys_mknodat(int dfd, con
10434 if (!IS_POSIXACL(nd.dentry->d_inode))
10435 mode &= ~current->fs->umask;
10436 if (!IS_ERR(dentry)) {
10437+ if (gr_handle_chroot_mknod(dentry, nd.mnt, mode)) {
10438+ error = -EPERM;
10439+ dput(dentry);
10440+ mutex_unlock(&nd.dentry->d_inode->i_mutex);
10441+ path_release(&nd);
10442+ goto out;
10443+ }
10444+
10445+ if (!gr_acl_handle_mknod(dentry, nd.dentry, nd.mnt, mode)) {
10446+ error = -EACCES;
10447+ dput(dentry);
10448+ mutex_unlock(&nd.dentry->d_inode->i_mutex);
10449+ path_release(&nd);
10450+ goto out;
10451+ }
10452+
10453 switch (mode & S_IFMT) {
10454 case 0: case S_IFREG:
10455 error = vfs_create(nd.dentry->d_inode,dentry,mode,&nd);
10456@@ -1865,6 +1938,10 @@ asmlinkage long sys_mknodat(int dfd, con
10457 default:
10458 error = -EINVAL;
10459 }
10460+
10461+ if (!error)
10462+ gr_handle_create(dentry, nd.mnt);
10463+
10464 dput(dentry);
10465 }
10466 mutex_unlock(&nd.dentry->d_inode->i_mutex);
10467@@ -1919,9 +1996,19 @@ asmlinkage long sys_mkdirat(int dfd, con
10468 dentry = lookup_create(&nd, 1);
10469 error = PTR_ERR(dentry);
10470 if (!IS_ERR(dentry)) {
10471+ error = 0;
10472 if (!IS_POSIXACL(nd.dentry->d_inode))
10473 mode &= ~current->fs->umask;
10474- error = vfs_mkdir(nd.dentry->d_inode, dentry, mode);
10475+
10476+ if (!gr_acl_handle_mkdir(dentry, nd.dentry, nd.mnt))
10477+ error = -EACCES;
10478+
10479+ if (!error)
10480+ error = vfs_mkdir(nd.dentry->d_inode, dentry, mode);
10481+
10482+ if (!error)
10483+ gr_handle_create(dentry, nd.mnt);
10484+
10485 dput(dentry);
10486 }
10487 mutex_unlock(&nd.dentry->d_inode->i_mutex);
10488@@ -2005,6 +2092,8 @@ static long do_rmdir(int dfd, const char
10489 char * name;
10490 struct dentry *dentry;
10491 struct nameidata nd;
10492+ ino_t saved_ino = 0;
10493+ dev_t saved_dev = 0;
10494
10495 name = getname(pathname);
10496 if(IS_ERR(name))
10497@@ -2029,7 +2118,21 @@ static long do_rmdir(int dfd, const char
10498 dentry = lookup_hash(&nd);
10499 error = PTR_ERR(dentry);
10500 if (!IS_ERR(dentry)) {
10501- error = vfs_rmdir(nd.dentry->d_inode, dentry);
10502+ error = 0;
10503+ if (dentry->d_inode) {
10504+ if (dentry->d_inode->i_nlink <= 1) {
10505+ saved_ino = dentry->d_inode->i_ino;
10506+ saved_dev = dentry->d_inode->i_sb->s_dev;
10507+ }
10508+
10509+ if (!gr_acl_handle_rmdir(dentry, nd.mnt))
10510+ error = -EACCES;
10511+ }
10512+
10513+ if (!error)
10514+ error = vfs_rmdir(nd.dentry->d_inode, dentry);
10515+ if (!error && (saved_dev || saved_ino))
10516+ gr_handle_delete(saved_ino, saved_dev);
10517 dput(dentry);
10518 }
10519 mutex_unlock(&nd.dentry->d_inode->i_mutex);
10520@@ -2088,6 +2191,8 @@ static long do_unlinkat(int dfd, const c
10521 struct dentry *dentry;
10522 struct nameidata nd;
10523 struct inode *inode = NULL;
10524+ ino_t saved_ino = 0;
10525+ dev_t saved_dev = 0;
10526
10527 name = getname(pathname);
10528 if(IS_ERR(name))
10529@@ -2103,13 +2208,26 @@ static long do_unlinkat(int dfd, const c
10530 dentry = lookup_hash(&nd);
10531 error = PTR_ERR(dentry);
10532 if (!IS_ERR(dentry)) {
10533+ error = 0;
10534 /* Why not before? Because we want correct error value */
10535 if (nd.last.name[nd.last.len])
10536 goto slashes;
10537 inode = dentry->d_inode;
10538- if (inode)
10539+ if (inode) {
10540+ if (inode->i_nlink <= 1) {
10541+ saved_ino = inode->i_ino;
10542+ saved_dev = inode->i_sb->s_dev;
10543+ }
10544+
10545+ if (!gr_acl_handle_unlink(dentry, nd.mnt))
10546+ error = -EACCES;
10547+
10548 atomic_inc(&inode->i_count);
10549- error = vfs_unlink(nd.dentry->d_inode, dentry);
10550+ }
10551+ if (!error)
10552+ error = vfs_unlink(nd.dentry->d_inode, dentry);
10553+ if (!error && (saved_ino || saved_dev))
10554+ gr_handle_delete(saved_ino, saved_dev);
10555 exit2:
10556 dput(dentry);
10557 }
10558@@ -2187,7 +2305,15 @@ asmlinkage long sys_symlinkat(const char
10559 dentry = lookup_create(&nd, 0);
10560 error = PTR_ERR(dentry);
10561 if (!IS_ERR(dentry)) {
10562- error = vfs_symlink(nd.dentry->d_inode, dentry, from, S_IALLUGO);
10563+ error = 0;
10564+ if (!gr_acl_handle_symlink(dentry, nd.dentry, nd.mnt, from))
10565+ error = -EACCES;
10566+
10567+ if (!error)
10568+ error = vfs_symlink(nd.dentry->d_inode, dentry, from, S_IALLUGO);
10569+
10570+ if (!error)
10571+ gr_handle_create(dentry, nd.mnt);
10572 dput(dentry);
10573 }
10574 mutex_unlock(&nd.dentry->d_inode->i_mutex);
10575@@ -2281,7 +2407,20 @@ asmlinkage long sys_linkat(int olddfd, c
10576 new_dentry = lookup_create(&nd, 0);
10577 error = PTR_ERR(new_dentry);
10578 if (!IS_ERR(new_dentry)) {
10579- error = vfs_link(old_nd.dentry, nd.dentry->d_inode, new_dentry);
10580+ error = 0;
10581+ if (gr_handle_hardlink(old_nd.dentry, old_nd.mnt,
10582+ old_nd.dentry->d_inode,
10583+ old_nd.dentry->d_inode->i_mode, to))
10584+ error = -EPERM;
10585+ if (!gr_acl_handle_link(new_dentry, nd.dentry, nd.mnt,
10586+ old_nd.dentry, old_nd.mnt, to))
10587+ error = -EACCES;
10588+ if (!error)
10589+ error = vfs_link(old_nd.dentry, nd.dentry->d_inode, new_dentry);
10590+
10591+ if (!error)
10592+ gr_handle_create(new_dentry, nd.mnt);
10593+
10594 dput(new_dentry);
10595 }
10596 mutex_unlock(&nd.dentry->d_inode->i_mutex);
10597@@ -2507,8 +2646,16 @@ static int do_rename(int olddfd, const c
10598 if (new_dentry == trap)
10599 goto exit5;
10600
10601- error = vfs_rename(old_dir->d_inode, old_dentry,
10602+ error = gr_acl_handle_rename(new_dentry, newnd.dentry, newnd.mnt,
10603+ old_dentry, old_dir->d_inode, oldnd.mnt,
10604+ newname);
10605+
10606+ if (!error)
10607+ error = vfs_rename(old_dir->d_inode, old_dentry,
10608 new_dir->d_inode, new_dentry);
10609+ if (!error)
10610+ gr_handle_rename(old_dir->d_inode, newnd.dentry->d_inode, old_dentry,
10611+ new_dentry, oldnd.mnt, new_dentry->d_inode ? 1 : 0);
10612 exit5:
10613 dput(new_dentry);
10614 exit4:
10615diff -urNp linux-2.6.18/fs/namespace.c linux-2.6.18/fs/namespace.c
10616--- linux-2.6.18/fs/namespace.c 2006-09-19 23:42:06.000000000 -0400
10617+++ linux-2.6.18/fs/namespace.c 2006-09-22 20:04:35.000000000 -0400
10618@@ -22,6 +22,8 @@
10619 #include <linux/namei.h>
10620 #include <linux/security.h>
10621 #include <linux/mount.h>
10622+#include <linux/sched.h>
10623+#include <linux/grsecurity.h>
10624 #include <asm/uaccess.h>
10625 #include <asm/unistd.h>
10626 #include "pnode.h"
10627@@ -606,6 +608,8 @@ static int do_umount(struct vfsmount *mn
10628 DQUOT_OFF(sb);
10629 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
10630 unlock_kernel();
10631+
10632+ gr_log_remount(mnt->mnt_devname, retval);
10633 }
10634 up_write(&sb->s_umount);
10635 return retval;
10636@@ -626,6 +630,9 @@ static int do_umount(struct vfsmount *mn
10637 security_sb_umount_busy(mnt);
10638 up_write(&namespace_sem);
10639 release_mounts(&umount_list);
10640+
10641+ gr_log_unmount(mnt->mnt_devname, retval);
10642+
10643 return retval;
10644 }
10645
10646@@ -1426,6 +1433,11 @@ long do_mount(char *dev_name, char *dir_
10647 if (retval)
10648 goto dput_out;
10649
10650+ if (gr_handle_chroot_mount(nd.dentry, nd.mnt, dev_name)) {
10651+ retval = -EPERM;
10652+ goto dput_out;
10653+ }
10654+
10655 if (flags & MS_REMOUNT)
10656 retval = do_remount(&nd, flags & ~MS_REMOUNT, mnt_flags,
10657 data_page);
10658@@ -1440,6 +1452,9 @@ long do_mount(char *dev_name, char *dir_
10659 dev_name, data_page);
10660 dput_out:
10661 path_release(&nd);
10662+
10663+ gr_log_mount(dev_name, dir_name, retval);
10664+
10665 return retval;
10666 }
10667
10668@@ -1692,6 +1707,9 @@ asmlinkage long sys_pivot_root(const cha
10669 if (!capable(CAP_SYS_ADMIN))
10670 return -EPERM;
10671
10672+ if (gr_handle_chroot_pivot())
10673+ return -EPERM;
10674+
10675 lock_kernel();
10676
10677 error = __user_walk(new_root, LOOKUP_FOLLOW | LOOKUP_DIRECTORY,
10678diff -urNp linux-2.6.18/fs/open.c linux-2.6.18/fs/open.c
10679--- linux-2.6.18/fs/open.c 2006-09-19 23:42:06.000000000 -0400
10680+++ linux-2.6.18/fs/open.c 2006-09-22 20:15:13.000000000 -0400
10681@@ -28,6 +28,7 @@
10682 #include <linux/syscalls.h>
10683 #include <linux/rcupdate.h>
10684 #include <linux/audit.h>
10685+#include <linux/grsecurity.h>
10686
10687 #include <asm/unistd.h>
10688
10689@@ -207,6 +208,9 @@ int do_truncate(struct dentry *dentry, l
10690 if (length < 0)
10691 return -EINVAL;
10692
10693+ if (filp && !gr_acl_handle_truncate(dentry, filp->f_vfsmnt))
10694+ return -EACCES;
10695+
10696 newattrs.ia_size = length;
10697 newattrs.ia_valid = ATTR_SIZE | time_attrs;
10698 if (filp) {
10699@@ -407,6 +411,12 @@ asmlinkage long sys_utime(char __user *
10700 (error = vfs_permission(&nd, MAY_WRITE)) != 0)
10701 goto dput_and_out;
10702 }
10703+
10704+ if (!gr_acl_handle_utime(nd.dentry, nd.mnt)) {
10705+ error = -EACCES;
10706+ goto dput_and_out;
10707+ }
10708+
10709 mutex_lock(&inode->i_mutex);
10710 error = notify_change(nd.dentry, &newattrs);
10711 mutex_unlock(&inode->i_mutex);
10712@@ -460,6 +470,12 @@ long do_utimes(int dfd, char __user *fil
10713 (error = vfs_permission(&nd, MAY_WRITE)) != 0)
10714 goto dput_and_out;
10715 }
10716+
10717+ if (!gr_acl_handle_utime(nd.dentry, nd.mnt)) {
10718+ error = -EACCES;
10719+ goto dput_and_out;
10720+ }
10721+
10722 mutex_lock(&inode->i_mutex);
10723 error = notify_change(nd.dentry, &newattrs);
10724 mutex_unlock(&inode->i_mutex);
10725@@ -526,6 +542,10 @@ asmlinkage long sys_faccessat(int dfd, c
10726 if(!res && (mode & S_IWOTH) && IS_RDONLY(nd.dentry->d_inode)
10727 && !special_file(nd.dentry->d_inode->i_mode))
10728 res = -EROFS;
10729+
10730+ if (!res && !gr_acl_handle_access(nd.dentry, nd.mnt, mode))
10731+ res = -EACCES;
10732+
10733 path_release(&nd);
10734 }
10735
10736@@ -554,6 +574,8 @@ asmlinkage long sys_chdir(const char __u
10737 if (error)
10738 goto dput_and_out;
10739
10740+ gr_log_chdir(nd.dentry, nd.mnt);
10741+
10742 set_fs_pwd(current->fs, nd.mnt, nd.dentry);
10743
10744 dput_and_out:
10745@@ -584,6 +606,13 @@ asmlinkage long sys_fchdir(unsigned int
10746 goto out_putf;
10747
10748 error = file_permission(file, MAY_EXEC);
10749+
10750+ if (!error && !gr_chroot_fchdir(dentry, mnt))
10751+ error = -EPERM;
10752+
10753+ if (!error)
10754+ gr_log_chdir(dentry, mnt);
10755+
10756 if (!error)
10757 set_fs_pwd(current->fs, mnt, dentry);
10758 out_putf:
10759@@ -609,8 +638,16 @@ asmlinkage long sys_chroot(const char __
10760 if (!capable(CAP_SYS_CHROOT))
10761 goto dput_and_out;
10762
10763+ if (gr_handle_chroot_chroot(nd.dentry, nd.mnt))
10764+ goto dput_and_out;
10765+
10766 set_fs_root(current->fs, nd.mnt, nd.dentry);
10767 set_fs_altroot();
10768+
10769+ gr_handle_chroot_caps(current);
10770+
10771+ gr_handle_chroot_chdir(nd.dentry, nd.mnt);
10772+
10773 error = 0;
10774 dput_and_out:
10775 path_release(&nd);
10776@@ -641,9 +678,22 @@ asmlinkage long sys_fchmod(unsigned int
10777 err = -EPERM;
10778 if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
10779 goto out_putf;
10780+
10781+ if (!gr_acl_handle_fchmod(dentry, file->f_vfsmnt, mode)) {
10782+ err = -EACCES;
10783+ goto out_putf;
10784+ }
10785+
10786 mutex_lock(&inode->i_mutex);
10787 if (mode == (mode_t) -1)
10788 mode = inode->i_mode;
10789+
10790+ if (gr_handle_chroot_chmod(dentry, file->f_vfsmnt, mode)) {
10791+ err = -EPERM;
10792+ mutex_unlock(&inode->i_mutex);
10793+ goto out_putf;
10794+ }
10795+
10796 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
10797 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
10798 err = notify_change(dentry, &newattrs);
10799@@ -676,9 +726,21 @@ asmlinkage long sys_fchmodat(int dfd, co
10800 if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
10801 goto dput_and_out;
10802
10803+ if (!gr_acl_handle_chmod(nd.dentry, nd.mnt, mode)) {
10804+ error = -EACCES;
10805+ goto dput_and_out;
10806+ };
10807+
10808 mutex_lock(&inode->i_mutex);
10809 if (mode == (mode_t) -1)
10810 mode = inode->i_mode;
10811+
10812+ if (gr_handle_chroot_chmod(nd.dentry, nd.mnt, mode)) {
10813+ error = -EACCES;
10814+ mutex_unlock(&inode->i_mutex);
10815+ goto dput_and_out;
10816+ }
10817+
10818 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
10819 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
10820 error = notify_change(nd.dentry, &newattrs);
10821@@ -695,7 +757,7 @@ asmlinkage long sys_chmod(const char __u
10822 return sys_fchmodat(AT_FDCWD, filename, mode);
10823 }
10824
10825-static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
10826+static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
10827 {
10828 struct inode * inode;
10829 int error;
10830@@ -712,6 +774,12 @@ static int chown_common(struct dentry *
10831 error = -EPERM;
10832 if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
10833 goto out;
10834+
10835+ if (!gr_acl_handle_chown(dentry, mnt)) {
10836+ error = -EACCES;
10837+ goto out;
10838+ }
10839+
10840 newattrs.ia_valid = ATTR_CTIME;
10841 if (user != (uid_t) -1) {
10842 newattrs.ia_valid |= ATTR_UID;
10843@@ -737,7 +805,7 @@ asmlinkage long sys_chown(const char __u
10844
10845 error = user_path_walk(filename, &nd);
10846 if (!error) {
10847- error = chown_common(nd.dentry, user, group);
10848+ error = chown_common(nd.dentry, user, group, nd.mnt);
10849 path_release(&nd);
10850 }
10851 return error;
10852@@ -756,7 +824,7 @@ asmlinkage long sys_fchownat(int dfd, co
10853 follow = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW;
10854 error = __user_walk_fd(dfd, filename, follow, &nd);
10855 if (!error) {
10856- error = chown_common(nd.dentry, user, group);
10857+ error = chown_common(nd.dentry, user, group, nd.mnt);
10858 path_release(&nd);
10859 }
10860 out:
10861@@ -770,7 +838,7 @@ asmlinkage long sys_lchown(const char __
10862
10863 error = user_path_walk_link(filename, &nd);
10864 if (!error) {
10865- error = chown_common(nd.dentry, user, group);
10866+ error = chown_common(nd.dentry, user, group, nd.mnt);
10867 path_release(&nd);
10868 }
10869 return error;
10870@@ -787,7 +855,7 @@ asmlinkage long sys_fchown(unsigned int
10871 struct dentry * dentry;
10872 dentry = file->f_dentry;
10873 audit_inode(NULL, dentry->d_inode);
10874- error = chown_common(dentry, user, group);
10875+ error = chown_common(dentry, user, group, file->f_vfsmnt);
10876 fput(file);
10877 }
10878 return error;
10879@@ -995,6 +1063,7 @@ repeat:
10880 * N.B. For clone tasks sharing a files structure, this test
10881 * will limit the total number of files that can be opened.
10882 */
10883+ gr_learn_resource(current, RLIMIT_NOFILE, fd, 0);
10884 if (fd >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
10885 goto out;
10886
10887diff -urNp linux-2.6.18/fs/partitions/efi.c linux-2.6.18/fs/partitions/efi.c
10888--- linux-2.6.18/fs/partitions/efi.c 2006-09-19 23:42:06.000000000 -0400
10889+++ linux-2.6.18/fs/partitions/efi.c 2006-09-22 20:45:04.000000000 -0400
10890@@ -99,7 +99,7 @@
10891 #ifdef EFI_DEBUG
10892 #define Dprintk(x...) printk(KERN_DEBUG x)
10893 #else
10894-#define Dprintk(x...)
10895+#define Dprintk(x...) do {} while (0)
10896 #endif
10897
10898 /* This allows a kernel command line option 'gpt' to override
10899diff -urNp linux-2.6.18/fs/pipe.c linux-2.6.18/fs/pipe.c
10900--- linux-2.6.18/fs/pipe.c 2006-09-19 23:42:06.000000000 -0400
10901+++ linux-2.6.18/fs/pipe.c 2006-09-22 20:04:35.000000000 -0400
10902@@ -842,7 +842,7 @@ void free_pipe_info(struct inode *inode)
10903 inode->i_pipe = NULL;
10904 }
10905
10906-static struct vfsmount *pipe_mnt __read_mostly;
10907+struct vfsmount *pipe_mnt __read_mostly;
10908 static int pipefs_delete_dentry(struct dentry *dentry)
10909 {
10910 return 1;
10911diff -urNp linux-2.6.18/fs/proc/array.c linux-2.6.18/fs/proc/array.c
10912--- linux-2.6.18/fs/proc/array.c 2006-09-19 23:42:06.000000000 -0400
10913+++ linux-2.6.18/fs/proc/array.c 2006-09-22 20:45:04.000000000 -0400
10914@@ -293,6 +293,21 @@ static inline char *task_cap(struct task
10915 cap_t(p->cap_effective));
10916 }
10917
10918+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
10919+static inline char *task_pax(struct task_struct *p, char *buffer)
10920+{
10921+ if (p->mm)
10922+ return buffer + sprintf(buffer, "PaX:\t%c%c%c%c%c\n",
10923+ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
10924+ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
10925+ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
10926+ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
10927+ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
10928+ else
10929+ return buffer + sprintf(buffer, "PaX:\t-----\n");
10930+}
10931+#endif
10932+
10933 int proc_pid_status(struct task_struct *task, char * buffer)
10934 {
10935 char * orig = buffer;
10936@@ -311,9 +326,20 @@ int proc_pid_status(struct task_struct *
10937 #if defined(CONFIG_S390)
10938 buffer = task_show_regs(task, buffer);
10939 #endif
10940+
10941+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
10942+ buffer = task_pax(task, buffer);
10943+#endif
10944+
10945 return buffer - orig;
10946 }
10947
10948+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
10949+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
10950+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
10951+ _mm->pax_flags & MF_PAX_SEGMEXEC))
10952+#endif
10953+
10954 static int do_task_stat(struct task_struct *task, char * buffer, int whole)
10955 {
10956 unsigned long vsize, eip, esp, wchan = ~0UL;
10957@@ -398,6 +424,19 @@ static int do_task_stat(struct task_stru
10958 stime = task->stime;
10959 }
10960
10961+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
10962+ if (PAX_RAND_FLAGS(mm)) {
10963+ eip = 0;
10964+ esp = 0;
10965+ wchan = 0;
10966+ }
10967+#endif
10968+#ifdef CONFIG_GRKERNSEC_HIDESYM
10969+ wchan = 0;
10970+ eip =0;
10971+ esp =0;
10972+#endif
10973+
10974 /* scale priority and nice values from timeslices to -20..20 */
10975 /* to make it look like a "normal" Unix priority/nice value */
10976 priority = task_prio(task);
10977@@ -437,9 +476,15 @@ static int do_task_stat(struct task_stru
10978 vsize,
10979 mm ? get_mm_rss(mm) : 0,
10980 rsslim,
10981+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
10982+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->start_code : 0),
10983+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->end_code : 0),
10984+ PAX_RAND_FLAGS(mm) ? 0 : (mm ? mm->start_stack : 0),
10985+#else
10986 mm ? mm->start_code : 0,
10987 mm ? mm->end_code : 0,
10988 mm ? mm->start_stack : 0,
10989+#endif
10990 esp,
10991 eip,
10992 /* The signal information here is obsolete.
10993@@ -486,3 +531,14 @@ int proc_pid_statm(struct task_struct *t
10994 return sprintf(buffer,"%d %d %d %d %d %d %d\n",
10995 size, resident, shared, text, lib, data, 0);
10996 }
10997+
10998+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
10999+int proc_pid_ipaddr(struct task_struct *task, char * buffer)
11000+{
11001+ int len;
11002+
11003+ len = sprintf(buffer, "%u.%u.%u.%u\n", NIPQUAD(task->signal->curr_ip));
11004+ return len;
11005+}
11006+#endif
11007+
11008diff -urNp linux-2.6.18/fs/proc/base.c linux-2.6.18/fs/proc/base.c
11009--- linux-2.6.18/fs/proc/base.c 2006-09-19 23:42:06.000000000 -0400
11010+++ linux-2.6.18/fs/proc/base.c 2006-09-22 20:41:43.000000000 -0400
11011@@ -71,6 +71,7 @@
11012 #include <linux/cpuset.h>
11013 #include <linux/audit.h>
11014 #include <linux/poll.h>
11015+#include <linux/grsecurity.h>
11016 #include "internal.h"
11017
11018 /* NOTE:
11019@@ -136,6 +137,9 @@ enum pid_directory_inos {
11020 #ifdef CONFIG_AUDITSYSCALL
11021 PROC_TGID_LOGINUID,
11022 #endif
11023+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
11024+ PROC_TGID_IPADDR,
11025+#endif
11026 PROC_TGID_OOM_SCORE,
11027 PROC_TGID_OOM_ADJUST,
11028 PROC_TID_INO,
11029@@ -220,6 +224,9 @@ static struct pid_entry tgid_base_stuff[
11030 E(PROC_TGID_EXE, "exe", S_IFLNK|S_IRWXUGO),
11031 E(PROC_TGID_MOUNTS, "mounts", S_IFREG|S_IRUGO),
11032 E(PROC_TGID_MOUNTSTATS, "mountstats", S_IFREG|S_IRUSR),
11033+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
11034+ E(PROC_TGID_IPADDR, "ipaddr", S_IFREG|S_IRUSR),
11035+#endif
11036 #ifdef CONFIG_MMU
11037 E(PROC_TGID_SMAPS, "smaps", S_IFREG|S_IRUGO),
11038 #endif
11039@@ -410,7 +417,7 @@ static int proc_root_link(struct inode *
11040 (task->parent == current && \
11041 (task->ptrace & PT_PTRACED) && \
11042 (task->state == TASK_STOPPED || task->state == TASK_TRACED) && \
11043- security_ptrace(current,task) == 0))
11044+ security_ptrace(current,task) == 0 && !gr_handle_proc_ptrace(task)))
11045
11046 static int proc_pid_environ(struct task_struct *task, char * buffer)
11047 {
11048@@ -546,6 +553,8 @@ static int proc_fd_access_allowed(struct
11049 task = get_proc_task(inode);
11050 if (task) {
11051 allowed = ptrace_may_attach(task);
11052+ if (allowed != 0)
11053+ allowed = !gr_acl_handle_procpidmem(task);
11054 put_task_struct(task);
11055 }
11056 return allowed;
11057@@ -1322,6 +1331,9 @@ static struct inode *proc_pid_make_inode
11058 inode->i_uid = task->euid;
11059 inode->i_gid = task->egid;
11060 }
11061+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
11062+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
11063+#endif
11064 security_task_to_inode(task, inode);
11065
11066 out:
11067@@ -1357,7 +1369,9 @@ static int pid_revalidate(struct dentry
11068 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
11069 task_dumpable(task)) {
11070 inode->i_uid = task->euid;
11071+#ifndef CONFIG_GRKERNSEC_PROC_USERGROUP
11072 inode->i_gid = task->egid;
11073+#endif
11074 } else {
11075 inode->i_uid = 0;
11076 inode->i_gid = 0;
11077@@ -1721,6 +1735,12 @@ static struct dentry *proc_pident_lookup
11078 inode->i_fop = &proc_info_file_operations;
11079 ei->op.proc_read = proc_pid_status;
11080 break;
11081+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
11082+ case PROC_TGID_IPADDR:
11083+ inode->i_fop = &proc_info_file_operations;
11084+ ei->op.proc_read = proc_pid_ipaddr;
11085+ break;
11086+#endif
11087 case PROC_TID_STAT:
11088 inode->i_fop = &proc_info_file_operations;
11089 ei->op.proc_read = proc_tid_stat;
11090@@ -2057,6 +2077,22 @@ struct dentry *proc_pid_lookup(struct in
11091 if (!task)
11092 goto out;
11093
11094+ if (gr_check_hidden_task(task)) {
11095+ put_task_struct(task);
11096+ goto out;
11097+ }
11098+
11099+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
11100+ if (current->uid && (task->uid != current->uid)
11101+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
11102+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
11103+#endif
11104+ ) {
11105+ put_task_struct(task);
11106+ goto out;
11107+ }
11108+#endif
11109+
11110 inode = proc_pid_make_inode(dir->i_sb, task, PROC_TGID_INO);
11111 if (!inode)
11112 goto out_put_task;
11113diff -urNp linux-2.6.18/fs/proc/inode.c linux-2.6.18/fs/proc/inode.c
11114--- linux-2.6.18/fs/proc/inode.c 2006-09-19 23:42:06.000000000 -0400
11115+++ linux-2.6.18/fs/proc/inode.c 2006-09-22 20:04:35.000000000 -0400
11116@@ -166,7 +166,11 @@ struct inode *proc_get_inode(struct supe
11117 if (de->mode) {
11118 inode->i_mode = de->mode;
11119 inode->i_uid = de->uid;
11120+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
11121+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
11122+#else
11123 inode->i_gid = de->gid;
11124+#endif
11125 }
11126 if (de->size)
11127 inode->i_size = de->size;
11128diff -urNp linux-2.6.18/fs/proc/internal.h linux-2.6.18/fs/proc/internal.h
11129--- linux-2.6.18/fs/proc/internal.h 2006-09-19 23:42:06.000000000 -0400
11130+++ linux-2.6.18/fs/proc/internal.h 2006-09-22 20:04:35.000000000 -0400
11131@@ -36,6 +36,9 @@ extern int proc_tid_stat(struct task_str
11132 extern int proc_tgid_stat(struct task_struct *, char *);
11133 extern int proc_pid_status(struct task_struct *, char *);
11134 extern int proc_pid_statm(struct task_struct *, char *);
11135+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
11136+extern int proc_pid_ipaddr(struct task_struct*,char*);
11137+#endif
11138
11139 extern struct file_operations proc_maps_operations;
11140 extern struct file_operations proc_numa_maps_operations;
11141diff -urNp linux-2.6.18/fs/proc/proc_misc.c linux-2.6.18/fs/proc/proc_misc.c
11142--- linux-2.6.18/fs/proc/proc_misc.c 2006-09-19 23:42:06.000000000 -0400
11143+++ linux-2.6.18/fs/proc/proc_misc.c 2006-09-22 20:04:35.000000000 -0400
11144@@ -655,6 +655,8 @@ void create_seq_entry(char *name, mode_t
11145 void __init proc_misc_init(void)
11146 {
11147 struct proc_dir_entry *entry;
11148+ int gr_mode = 0;
11149+
11150 static struct {
11151 char *name;
11152 int (*read_proc)(char*,char**,off_t,int,int*,void*);
11153@@ -670,7 +672,9 @@ void __init proc_misc_init(void)
11154 {"stram", stram_read_proc},
11155 #endif
11156 {"filesystems", filesystems_read_proc},
11157+#ifndef CONFIG_GRKERNSEC_PROC_ADD
11158 {"cmdline", cmdline_read_proc},
11159+#endif
11160 {"locks", locks_read_proc},
11161 {"execdomains", execdomains_read_proc},
11162 {NULL,}
11163@@ -678,19 +682,36 @@ void __init proc_misc_init(void)
11164 for (p = simple_ones; p->name; p++)
11165 create_proc_read_entry(p->name, 0, NULL, p->read_proc, NULL);
11166
11167+#ifdef CONFIG_GRKERNSEC_PROC_USER
11168+ gr_mode = S_IRUSR;
11169+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
11170+ gr_mode = S_IRUSR | S_IRGRP;
11171+#endif
11172+#ifdef CONFIG_GRKERNSEC_PROC_ADD
11173+ create_proc_read_entry("cmdline", gr_mode, NULL, &cmdline_read_proc, NULL);
11174+#endif
11175+
11176 proc_symlink("mounts", NULL, "self/mounts");
11177
11178 /* And now for trickier ones */
11179 entry = create_proc_entry("kmsg", S_IRUSR, &proc_root);
11180 if (entry)
11181 entry->proc_fops = &proc_kmsg_operations;
11182+#ifdef CONFIG_GRKERNSEC_PROC_ADD
11183+ create_seq_entry("devices", gr_mode, &proc_devinfo_operations);
11184+#else
11185 create_seq_entry("devices", 0, &proc_devinfo_operations);
11186+#endif
11187 create_seq_entry("cpuinfo", 0, &proc_cpuinfo_operations);
11188 create_seq_entry("partitions", 0, &proc_partitions_operations);
11189 create_seq_entry("stat", 0, &proc_stat_operations);
11190 create_seq_entry("interrupts", 0, &proc_interrupts_operations);
11191 #ifdef CONFIG_SLAB
11192+#ifdef CONFIG_GRKERNSEC_PROC_ADD
11193+ create_seq_entry("slabinfo",S_IWUSR|gr_mode,&proc_slabinfo_operations);
11194+#else
11195 create_seq_entry("slabinfo",S_IWUSR|S_IRUGO,&proc_slabinfo_operations);
11196+#endif
11197 #ifdef CONFIG_DEBUG_SLAB_LEAK
11198 create_seq_entry("slab_allocators", 0 ,&proc_slabstats_operations);
11199 #endif
11200@@ -705,7 +726,7 @@ void __init proc_misc_init(void)
11201 #ifdef CONFIG_SCHEDSTATS
11202 create_seq_entry("schedstat", 0, &proc_schedstat_operations);
11203 #endif
11204-#ifdef CONFIG_PROC_KCORE
11205+#if defined(CONFIG_PROC_KCORE) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
11206 proc_root_kcore = create_proc_entry("kcore", S_IRUSR, NULL);
11207 if (proc_root_kcore) {
11208 proc_root_kcore->proc_fops = &proc_kcore_operations;
11209diff -urNp linux-2.6.18/fs/proc/root.c linux-2.6.18/fs/proc/root.c
11210--- linux-2.6.18/fs/proc/root.c 2006-09-19 23:42:06.000000000 -0400
11211+++ linux-2.6.18/fs/proc/root.c 2006-09-22 20:04:35.000000000 -0400
11212@@ -52,7 +52,13 @@ void __init proc_root_init(void)
11213 return;
11214 }
11215 proc_misc_init();
11216+#ifdef CONFIG_GRKERNSEC_PROC_USER
11217+ proc_net = proc_mkdir_mode("net", S_IRUSR | S_IXUSR, NULL);
11218+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
11219+ proc_net = proc_mkdir_mode("net", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
11220+#else
11221 proc_net = proc_mkdir("net", NULL);
11222+#endif
11223 proc_net_stat = proc_mkdir("net/stat", NULL);
11224
11225 #ifdef CONFIG_SYSVIPC
11226@@ -76,7 +82,15 @@ void __init proc_root_init(void)
11227 #ifdef CONFIG_PROC_DEVICETREE
11228 proc_device_tree_init();
11229 #endif
11230+#ifdef CONFIG_GRKERNSEC_PROC_ADD
11231+#ifdef CONFIG_GRKERNSEC_PROC_USER
11232+ proc_bus = proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
11233+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
11234+ proc_bus = proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
11235+#endif
11236+#else
11237 proc_bus = proc_mkdir("bus", NULL);
11238+#endif
11239 }
11240
11241 static int proc_root_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat
11242diff -urNp linux-2.6.18/fs/proc/task_mmu.c linux-2.6.18/fs/proc/task_mmu.c
11243--- linux-2.6.18/fs/proc/task_mmu.c 2006-09-19 23:42:06.000000000 -0400
11244+++ linux-2.6.18/fs/proc/task_mmu.c 2006-09-22 20:45:04.000000000 -0400
11245@@ -43,15 +43,27 @@ char *task_mem(struct mm_struct *mm, cha
11246 "VmStk:\t%8lu kB\n"
11247 "VmExe:\t%8lu kB\n"
11248 "VmLib:\t%8lu kB\n"
11249- "VmPTE:\t%8lu kB\n",
11250- hiwater_vm << (PAGE_SHIFT-10),
11251+ "VmPTE:\t%8lu kB\n"
11252+
11253+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
11254+ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
11255+#endif
11256+
11257+ ,hiwater_vm << (PAGE_SHIFT-10),
11258 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
11259 mm->locked_vm << (PAGE_SHIFT-10),
11260 hiwater_rss << (PAGE_SHIFT-10),
11261 total_rss << (PAGE_SHIFT-10),
11262 data << (PAGE_SHIFT-10),
11263 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
11264- (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
11265+ (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
11266+
11267+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
11268+ , mm->context.user_cs_base, mm->context.user_cs_limit
11269+#endif
11270+
11271+ );
11272+
11273 return buffer;
11274 }
11275
11276@@ -127,6 +139,12 @@ __attribute__((weak)) const char *arch_v
11277 return NULL;
11278 }
11279
11280+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
11281+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
11282+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
11283+ _mm->pax_flags & MF_PAX_SEGMEXEC))
11284+#endif
11285+
11286 static int show_map_internal(struct seq_file *m, void *v, struct mem_size_stats *mss)
11287 {
11288 struct proc_maps_private *priv = m->private;
11289@@ -146,13 +164,30 @@ static int show_map_internal(struct seq_
11290 }
11291
11292 seq_printf(m, "%08lx-%08lx %c%c%c%c %08lx %02x:%02x %lu %n",
11293+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
11294+ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
11295+ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
11296+#else
11297 vma->vm_start,
11298 vma->vm_end,
11299+#endif
11300+
11301+#if 0
11302+ flags & VM_MAYREAD ? flags & VM_READ ? 'R' : '+' : flags & VM_READ ? 'r' : '-',
11303+ flags & VM_MAYWRITE ? flags & VM_WRITE ? 'W' : '+' : flags & VM_WRITE ? 'w' : '-',
11304+ flags & VM_MAYEXEC ? flags & VM_EXEC ? 'X' : '+' : flags & VM_EXEC ? 'x' : '-',
11305+#else
11306 flags & VM_READ ? 'r' : '-',
11307 flags & VM_WRITE ? 'w' : '-',
11308 flags & VM_EXEC ? 'x' : '-',
11309+#endif
11310+
11311 flags & VM_MAYSHARE ? 's' : 'p',
11312+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
11313+ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_pgoff << PAGE_SHIFT,
11314+#else
11315 vma->vm_pgoff << PAGE_SHIFT,
11316+#endif
11317 MAJOR(dev), MINOR(dev), ino, &len);
11318
11319 /*
11320@@ -166,11 +201,11 @@ static int show_map_internal(struct seq_
11321 const char *name = arch_vma_name(vma);
11322 if (!name) {
11323 if (mm) {
11324- if (vma->vm_start <= mm->start_brk &&
11325- vma->vm_end >= mm->brk) {
11326+ if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
11327 name = "[heap]";
11328- } else if (vma->vm_start <= mm->start_stack &&
11329- vma->vm_end >= mm->start_stack) {
11330+ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
11331+ (vma->vm_start <= mm->start_stack &&
11332+ vma->vm_end >= mm->start_stack)) {
11333 name = "[stack]";
11334 }
11335 } else {
11336@@ -184,7 +219,25 @@ static int show_map_internal(struct seq_
11337 }
11338 seq_putc(m, '\n');
11339
11340- if (mss)
11341+
11342+ if (mss) {
11343+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
11344+ if (PAX_RAND_FLAGS(mm))
11345+ seq_printf(m,
11346+ "Size: %8lu kB\n"
11347+ "Rss: %8lu kB\n"
11348+ "Shared_Clean: %8lu kB\n"
11349+ "Shared_Dirty: %8lu kB\n"
11350+ "Private_Clean: %8lu kB\n"
11351+ "Private_Dirty: %8lu kB\n",
11352+ 0UL,
11353+ 0UL,
11354+ 0UL,
11355+ 0UL,
11356+ 0UL,
11357+ 0UL);
11358+ else
11359+#endif
11360 seq_printf(m,
11361 "Size: %8lu kB\n"
11362 "Rss: %8lu kB\n"
11363@@ -198,6 +251,7 @@ static int show_map_internal(struct seq_
11364 mss->shared_dirty >> 10,
11365 mss->private_clean >> 10,
11366 mss->private_dirty >> 10);
11367+ }
11368
11369 if (m->count < m->size) /* vma is copied successfully */
11370 m->version = (vma != get_gate_vma(task))? vma->vm_start: 0;
11371diff -urNp linux-2.6.18/fs/readdir.c linux-2.6.18/fs/readdir.c
11372--- linux-2.6.18/fs/readdir.c 2006-09-19 23:42:06.000000000 -0400
11373+++ linux-2.6.18/fs/readdir.c 2006-09-22 20:04:35.000000000 -0400
11374@@ -16,6 +16,8 @@
11375 #include <linux/security.h>
11376 #include <linux/syscalls.h>
11377 #include <linux/unistd.h>
11378+#include <linux/namei.h>
11379+#include <linux/grsecurity.h>
11380
11381 #include <asm/uaccess.h>
11382
11383@@ -65,6 +67,7 @@ struct old_linux_dirent {
11384
11385 struct readdir_callback {
11386 struct old_linux_dirent __user * dirent;
11387+ struct file * file;
11388 int result;
11389 };
11390
11391@@ -76,6 +79,10 @@ static int fillonedir(void * __buf, cons
11392
11393 if (buf->result)
11394 return -EINVAL;
11395+
11396+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
11397+ return 0;
11398+
11399 buf->result++;
11400 dirent = buf->dirent;
11401 if (!access_ok(VERIFY_WRITE, dirent,
11402@@ -107,6 +114,7 @@ asmlinkage long old_readdir(unsigned int
11403
11404 buf.result = 0;
11405 buf.dirent = dirent;
11406+ buf.file = file;
11407
11408 error = vfs_readdir(file, fillonedir, &buf);
11409 if (error >= 0)
11410@@ -133,6 +141,7 @@ struct linux_dirent {
11411 struct getdents_callback {
11412 struct linux_dirent __user * current_dir;
11413 struct linux_dirent __user * previous;
11414+ struct file * file;
11415 int count;
11416 int error;
11417 };
11418@@ -147,6 +156,10 @@ static int filldir(void * __buf, const c
11419 buf->error = -EINVAL; /* only used if we fail.. */
11420 if (reclen > buf->count)
11421 return -EINVAL;
11422+
11423+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
11424+ return 0;
11425+
11426 dirent = buf->previous;
11427 if (dirent) {
11428 if (__put_user(offset, &dirent->d_off))
11429@@ -191,6 +204,7 @@ asmlinkage long sys_getdents(unsigned in
11430
11431 buf.current_dir = dirent;
11432 buf.previous = NULL;
11433+ buf.file = file;
11434 buf.count = count;
11435 buf.error = 0;
11436
11437@@ -217,6 +231,7 @@ out:
11438 struct getdents_callback64 {
11439 struct linux_dirent64 __user * current_dir;
11440 struct linux_dirent64 __user * previous;
11441+ struct file * file;
11442 int count;
11443 int error;
11444 };
11445@@ -231,6 +246,10 @@ static int filldir64(void * __buf, const
11446 buf->error = -EINVAL; /* only used if we fail.. */
11447 if (reclen > buf->count)
11448 return -EINVAL;
11449+
11450+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
11451+ return 0;
11452+
11453 dirent = buf->previous;
11454 if (dirent) {
11455 if (__put_user(offset, &dirent->d_off))
11456@@ -277,6 +296,7 @@ asmlinkage long sys_getdents64(unsigned
11457
11458 buf.current_dir = dirent;
11459 buf.previous = NULL;
11460+ buf.file = file;
11461 buf.count = count;
11462 buf.error = 0;
11463
11464diff -urNp linux-2.6.18/fs/udf/balloc.c linux-2.6.18/fs/udf/balloc.c
11465--- linux-2.6.18/fs/udf/balloc.c 2006-09-19 23:42:06.000000000 -0400
11466+++ linux-2.6.18/fs/udf/balloc.c 2006-09-22 20:45:04.000000000 -0400
11467@@ -153,8 +153,7 @@ static void udf_bitmap_free_blocks(struc
11468 unsigned long overflow;
11469
11470 mutex_lock(&sbi->s_alloc_mutex);
11471- if (bloc.logicalBlockNum < 0 ||
11472- (bloc.logicalBlockNum + count) > UDF_SB_PARTLEN(sb, bloc.partitionReferenceNum))
11473+ if (bloc.logicalBlockNum + count > UDF_SB_PARTLEN(sb, bloc.partitionReferenceNum))
11474 {
11475 udf_debug("%d < %d || %d + %d > %d\n",
11476 bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
11477@@ -227,7 +226,7 @@ static int udf_bitmap_prealloc_blocks(st
11478 struct buffer_head *bh;
11479
11480 mutex_lock(&sbi->s_alloc_mutex);
11481- if (first_block < 0 || first_block >= UDF_SB_PARTLEN(sb, partition))
11482+ if (first_block >= UDF_SB_PARTLEN(sb, partition))
11483 goto out;
11484
11485 if (first_block + block_count > UDF_SB_PARTLEN(sb, partition))
11486@@ -294,7 +293,7 @@ static int udf_bitmap_new_block(struct s
11487 mutex_lock(&sbi->s_alloc_mutex);
11488
11489 repeat:
11490- if (goal < 0 || goal >= UDF_SB_PARTLEN(sb, partition))
11491+ if (goal >= UDF_SB_PARTLEN(sb, partition))
11492 goal = 0;
11493
11494 nr_groups = bitmap->s_nr_groups;
11495@@ -434,8 +433,7 @@ static void udf_table_free_blocks(struct
11496 int i;
11497
11498 mutex_lock(&sbi->s_alloc_mutex);
11499- if (bloc.logicalBlockNum < 0 ||
11500- (bloc.logicalBlockNum + count) > UDF_SB_PARTLEN(sb, bloc.partitionReferenceNum))
11501+ if (bloc.logicalBlockNum + count > UDF_SB_PARTLEN(sb, bloc.partitionReferenceNum))
11502 {
11503 udf_debug("%d < %d || %d + %d > %d\n",
11504 bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
11505@@ -682,7 +680,7 @@ static int udf_table_prealloc_blocks(str
11506 struct buffer_head *bh;
11507 int8_t etype = -1;
11508
11509- if (first_block < 0 || first_block >= UDF_SB_PARTLEN(sb, partition))
11510+ if (first_block >= UDF_SB_PARTLEN(sb, partition))
11511 return 0;
11512
11513 if (UDF_I_ALLOCTYPE(table) == ICBTAG_FLAG_AD_SHORT)
11514@@ -762,7 +760,7 @@ static int udf_table_new_block(struct su
11515 return newblock;
11516
11517 mutex_lock(&sbi->s_alloc_mutex);
11518- if (goal < 0 || goal >= UDF_SB_PARTLEN(sb, partition))
11519+ if (goal >= UDF_SB_PARTLEN(sb, partition))
11520 goal = 0;
11521
11522 /* We search for the closest matching block to goal. If we find a exact hit,
11523diff -urNp linux-2.6.18/fs/udf/inode.c linux-2.6.18/fs/udf/inode.c
11524--- linux-2.6.18/fs/udf/inode.c 2006-09-19 23:42:06.000000000 -0400
11525+++ linux-2.6.18/fs/udf/inode.c 2006-09-22 20:45:04.000000000 -0400
11526@@ -300,9 +300,6 @@ static int udf_get_block(struct inode *i
11527
11528 lock_kernel();
11529
11530- if (block < 0)
11531- goto abort_negative;
11532-
11533 if (block == UDF_I_NEXT_ALLOC_BLOCK(inode) + 1)
11534 {
11535 UDF_I_NEXT_ALLOC_BLOCK(inode) ++;
11536@@ -323,10 +320,6 @@ static int udf_get_block(struct inode *i
11537 abort:
11538 unlock_kernel();
11539 return err;
11540-
11541-abort_negative:
11542- udf_warning(inode->i_sb, "udf_get_block", "block < 0");
11543- goto abort;
11544 }
11545
11546 static struct buffer_head *
11547diff -urNp linux-2.6.18/fs/ufs/inode.c linux-2.6.18/fs/ufs/inode.c
11548--- linux-2.6.18/fs/ufs/inode.c 2006-09-19 23:42:06.000000000 -0400
11549+++ linux-2.6.18/fs/ufs/inode.c 2006-09-22 20:45:04.000000000 -0400
11550@@ -55,9 +55,7 @@ static int ufs_block_to_path(struct inod
11551
11552
11553 UFSD("ptrs=uspi->s_apb = %d,double_blocks=%ld \n",ptrs,double_blocks);
11554- if (i_block < 0) {
11555- ufs_warning(inode->i_sb, "ufs_block_to_path", "block < 0");
11556- } else if (i_block < direct_blocks) {
11557+ if (i_block < direct_blocks) {
11558 offsets[n++] = i_block;
11559 } else if ((i_block -= direct_blocks) < indirect_blocks) {
11560 offsets[n++] = UFS_IND_BLOCK;
11561@@ -454,8 +452,6 @@ int ufs_getfrag_block(struct inode *inod
11562 lock_kernel();
11563
11564 UFSD("ENTER, ino %lu, fragment %llu\n", inode->i_ino, (unsigned long long)fragment);
11565- if (fragment < 0)
11566- goto abort_negative;
11567 if (fragment >
11568 ((UFS_NDADDR + uspi->s_apb + uspi->s_2apb + uspi->s_3apb)
11569 << uspi->s_fpbshift))
11570@@ -516,10 +512,6 @@ abort:
11571 unlock_kernel();
11572 return err;
11573
11574-abort_negative:
11575- ufs_warning(sb, "ufs_get_block", "block < 0");
11576- goto abort;
11577-
11578 abort_too_big:
11579 ufs_warning(sb, "ufs_get_block", "block > big");
11580 goto abort;
11581diff -urNp linux-2.6.18/fs/xfs/linux-2.6/xfs_file.c linux-2.6.18/fs/xfs/linux-2.6/xfs_file.c
11582--- linux-2.6.18/fs/xfs/linux-2.6/xfs_file.c 2006-09-19 23:42:06.000000000 -0400
11583+++ linux-2.6.18/fs/xfs/linux-2.6/xfs_file.c 2006-09-22 20:45:04.000000000 -0400
11584@@ -432,6 +432,12 @@ xfs_file_mmap(
11585 struct file *filp,
11586 struct vm_area_struct *vma)
11587 {
11588+
11589+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
11590+ if ((vma->vm_mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_EXEC))
11591+ vma->vm_page_prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(vma->vm_page_prot)))));
11592+#endif
11593+
11594 vma->vm_ops = &xfs_file_vm_ops;
11595
11596 #ifdef CONFIG_XFS_DMAPI
11597diff -urNp linux-2.6.18/fs/xfs/xfs_bmap.c linux-2.6.18/fs/xfs/xfs_bmap.c
11598--- linux-2.6.18/fs/xfs/xfs_bmap.c 2006-09-19 23:42:06.000000000 -0400
11599+++ linux-2.6.18/fs/xfs/xfs_bmap.c 2006-09-22 20:45:04.000000000 -0400
11600@@ -376,7 +376,7 @@ xfs_bmap_validate_ret(
11601 int nmap,
11602 int ret_nmap);
11603 #else
11604-#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
11605+#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
11606 #endif /* DEBUG */
11607
11608 #if defined(XFS_RW_TRACE)
11609diff -urNp linux-2.6.18/grsecurity/gracl_alloc.c linux-2.6.18/grsecurity/gracl_alloc.c
11610--- linux-2.6.18/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
11611+++ linux-2.6.18/grsecurity/gracl_alloc.c 2006-09-22 20:04:35.000000000 -0400
11612@@ -0,0 +1,91 @@
11613+#include <linux/kernel.h>
11614+#include <linux/mm.h>
11615+#include <linux/slab.h>
11616+#include <linux/vmalloc.h>
11617+#include <linux/gracl.h>
11618+#include <linux/grsecurity.h>
11619+
11620+static unsigned long alloc_stack_next = 1;
11621+static unsigned long alloc_stack_size = 1;
11622+static void **alloc_stack;
11623+
11624+static __inline__ int
11625+alloc_pop(void)
11626+{
11627+ if (alloc_stack_next == 1)
11628+ return 0;
11629+
11630+ kfree(alloc_stack[alloc_stack_next - 2]);
11631+
11632+ alloc_stack_next--;
11633+
11634+ return 1;
11635+}
11636+
11637+static __inline__ void
11638+alloc_push(void *buf)
11639+{
11640+ if (alloc_stack_next >= alloc_stack_size)
11641+ BUG();
11642+
11643+ alloc_stack[alloc_stack_next - 1] = buf;
11644+
11645+ alloc_stack_next++;
11646+
11647+ return;
11648+}
11649+
11650+void *
11651+acl_alloc(unsigned long len)
11652+{
11653+ void *ret;
11654+
11655+ if (len > PAGE_SIZE)
11656+ BUG();
11657+
11658+ ret = kmalloc(len, GFP_KERNEL);
11659+
11660+ if (ret)
11661+ alloc_push(ret);
11662+
11663+ return ret;
11664+}
11665+
11666+void
11667+acl_free_all(void)
11668+{
11669+ if (gr_acl_is_enabled() || !alloc_stack)
11670+ return;
11671+
11672+ while (alloc_pop()) ;
11673+
11674+ if (alloc_stack) {
11675+ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
11676+ kfree(alloc_stack);
11677+ else
11678+ vfree(alloc_stack);
11679+ }
11680+
11681+ alloc_stack = NULL;
11682+ alloc_stack_size = 1;
11683+ alloc_stack_next = 1;
11684+
11685+ return;
11686+}
11687+
11688+int
11689+acl_alloc_stack_init(unsigned long size)
11690+{
11691+ if ((size * sizeof (void *)) <= PAGE_SIZE)
11692+ alloc_stack =
11693+ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
11694+ else
11695+ alloc_stack = (void **) vmalloc(size * sizeof (void *));
11696+
11697+ alloc_stack_size = size;
11698+
11699+ if (!alloc_stack)
11700+ return 0;
11701+ else
11702+ return 1;
11703+}
11704diff -urNp linux-2.6.18/grsecurity/gracl.c linux-2.6.18/grsecurity/gracl.c
11705--- linux-2.6.18/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
11706+++ linux-2.6.18/grsecurity/gracl.c 2006-09-22 20:04:35.000000000 -0400
11707@@ -0,0 +1,3547 @@
11708+#include <linux/kernel.h>
11709+#include <linux/module.h>
11710+#include <linux/sched.h>
11711+#include <linux/mm.h>
11712+#include <linux/file.h>
11713+#include <linux/fs.h>
11714+#include <linux/namei.h>
11715+#include <linux/mount.h>
11716+#include <linux/tty.h>
11717+#include <linux/proc_fs.h>
11718+#include <linux/smp_lock.h>
11719+#include <linux/slab.h>
11720+#include <linux/vmalloc.h>
11721+#include <linux/types.h>
11722+#include <linux/capability.h>
11723+#include <linux/sysctl.h>
11724+#include <linux/netdevice.h>
11725+#include <linux/ptrace.h>
11726+#include <linux/gracl.h>
11727+#include <linux/gralloc.h>
11728+#include <linux/grsecurity.h>
11729+#include <linux/grinternal.h>
11730+#include <linux/percpu.h>
11731+
11732+#include <asm/uaccess.h>
11733+#include <asm/errno.h>
11734+#include <asm/mman.h>
11735+
11736+static struct acl_role_db acl_role_set;
11737+static struct name_db name_set;
11738+static struct inodev_db inodev_set;
11739+
11740+/* for keeping track of userspace pointers used for subjects, so we
11741+ can share references in the kernel as well
11742+*/
11743+
11744+static struct dentry *real_root;
11745+static struct vfsmount *real_root_mnt;
11746+
11747+static struct acl_subj_map_db subj_map_set;
11748+
11749+static struct acl_role_label *default_role;
11750+
11751+static u16 acl_sp_role_value;
11752+
11753+extern char *gr_shared_page[4];
11754+static DECLARE_MUTEX(gr_dev_sem);
11755+rwlock_t gr_inode_lock = RW_LOCK_UNLOCKED;
11756+
11757+struct gr_arg *gr_usermode;
11758+
11759+static unsigned int gr_status = GR_STATUS_INIT;
11760+
11761+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
11762+extern void gr_clear_learn_entries(void);
11763+
11764+#ifdef CONFIG_GRKERNSEC_RESLOG
11765+extern void gr_log_resource(const struct task_struct *task,
11766+ const int res, const unsigned long wanted, const int gt);
11767+#endif
11768+
11769+extern char * __d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
11770+ struct dentry *root, struct vfsmount *rootmnt,
11771+ char *buffer, int buflen);
11772+
11773+unsigned char *gr_system_salt;
11774+unsigned char *gr_system_sum;
11775+
11776+static struct sprole_pw **acl_special_roles = NULL;
11777+static __u16 num_sprole_pws = 0;
11778+
11779+static struct acl_role_label *kernel_role = NULL;
11780+
11781+static unsigned int gr_auth_attempts = 0;
11782+static unsigned long gr_auth_expires = 0UL;
11783+
11784+extern struct vfsmount *sock_mnt;
11785+extern struct vfsmount *pipe_mnt;
11786+extern struct vfsmount *shm_mnt;
11787+static struct acl_object_label *fakefs_obj;
11788+
11789+extern int gr_init_uidset(void);
11790+extern void gr_free_uidset(void);
11791+extern void gr_remove_uid(uid_t uid);
11792+extern int gr_find_uid(uid_t uid);
11793+
11794+__inline__ int
11795+gr_acl_is_enabled(void)
11796+{
11797+ return (gr_status & GR_READY);
11798+}
11799+
11800+char gr_roletype_to_char(void)
11801+{
11802+ switch (current->role->roletype &
11803+ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
11804+ GR_ROLE_SPECIAL)) {
11805+ case GR_ROLE_DEFAULT:
11806+ return 'D';
11807+ case GR_ROLE_USER:
11808+ return 'U';
11809+ case GR_ROLE_GROUP:
11810+ return 'G';
11811+ case GR_ROLE_SPECIAL:
11812+ return 'S';
11813+ }
11814+
11815+ return 'X';
11816+}
11817+
11818+__inline__ int
11819+gr_acl_tpe_check(void)
11820+{
11821+ if (unlikely(!(gr_status & GR_READY)))
11822+ return 0;
11823+ if (current->role->roletype & GR_ROLE_TPE)
11824+ return 1;
11825+ else
11826+ return 0;
11827+}
11828+
11829+int
11830+gr_handle_rawio(const struct inode *inode)
11831+{
11832+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
11833+ if (inode && S_ISBLK(inode->i_mode) &&
11834+ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
11835+ !capable(CAP_SYS_RAWIO))
11836+ return 1;
11837+#endif
11838+ return 0;
11839+}
11840+
11841+static int
11842+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
11843+{
11844+ int i;
11845+ unsigned long *l1;
11846+ unsigned long *l2;
11847+ unsigned char *c1;
11848+ unsigned char *c2;
11849+ int num_longs;
11850+
11851+ if (likely(lena != lenb))
11852+ return 0;
11853+
11854+ l1 = (unsigned long *)a;
11855+ l2 = (unsigned long *)b;
11856+
11857+ num_longs = lena / sizeof(unsigned long);
11858+
11859+ for (i = num_longs; i--; l1++, l2++) {
11860+ if (unlikely(*l1 != *l2))
11861+ return 0;
11862+ }
11863+
11864+ c1 = (unsigned char *) l1;
11865+ c2 = (unsigned char *) l2;
11866+
11867+ i = lena - (num_longs * sizeof(unsigned long));
11868+
11869+ for (; i--; c1++, c2++) {
11870+ if (unlikely(*c1 != *c2))
11871+ return 0;
11872+ }
11873+
11874+ return 1;
11875+}
11876+
11877+static char *
11878+gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
11879+ struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
11880+{
11881+ char *end = buf + buflen;
11882+ char *retval;
11883+ int namelen = 0;
11884+
11885+ *--end = '\0';
11886+
11887+ retval = end - 1;
11888+ *retval = '/';
11889+
11890+ if (dentry == root && vfsmnt == rootmnt)
11891+ return retval;
11892+ if (dentry != vfsmnt->mnt_root && !IS_ROOT(dentry)) {
11893+ namelen = strlen(dentry->d_name.name);
11894+ buflen -= namelen;
11895+ if (buflen < 2)
11896+ goto err;
11897+ if (dentry->d_parent != root || vfsmnt != rootmnt)
11898+ buflen--;
11899+ }
11900+
11901+ retval = __d_path(dentry->d_parent, vfsmnt, root, rootmnt, buf, buflen);
11902+ if (unlikely(IS_ERR(retval)))
11903+err:
11904+ retval = strcpy(buf, "<path too long>");
11905+ else if (namelen != 0) {
11906+ end = buf + buflen - 1; // accounts for null termination
11907+ if (dentry->d_parent != root || vfsmnt != rootmnt)
11908+ *end++ = '/'; // accounted for above with buflen--
11909+ memcpy(end, dentry->d_name.name, namelen);
11910+ }
11911+
11912+ return retval;
11913+}
11914+
11915+static char *
11916+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
11917+ char *buf, int buflen)
11918+{
11919+ char *res;
11920+
11921+ /* we can use real_root, real_root_mnt, because this is only called
11922+ by the RBAC system */
11923+ res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
11924+
11925+ return res;
11926+}
11927+
11928+static char *
11929+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
11930+ char *buf, int buflen)
11931+{
11932+ char *res;
11933+ struct dentry *root;
11934+ struct vfsmount *rootmnt;
11935+
11936+ /* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
11937+ read_lock(&child_reaper->fs->lock);
11938+ root = dget(child_reaper->fs->root);
11939+ rootmnt = mntget(child_reaper->fs->rootmnt);
11940+ read_unlock(&child_reaper->fs->lock);
11941+
11942+ spin_lock(&dcache_lock);
11943+ res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
11944+ spin_unlock(&dcache_lock);
11945+
11946+ dput(root);
11947+ mntput(rootmnt);
11948+ return res;
11949+}
11950+
11951+static char *
11952+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
11953+{
11954+ char *ret;
11955+ spin_lock(&dcache_lock);
11956+ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
11957+ PAGE_SIZE);
11958+ spin_unlock(&dcache_lock);
11959+ return ret;
11960+}
11961+
11962+char *
11963+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
11964+{
11965+ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
11966+ PAGE_SIZE);
11967+}
11968+
11969+char *
11970+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
11971+{
11972+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
11973+ PAGE_SIZE);
11974+}
11975+
11976+char *
11977+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
11978+{
11979+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
11980+ PAGE_SIZE);
11981+}
11982+
11983+char *
11984+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
11985+{
11986+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
11987+ PAGE_SIZE);
11988+}
11989+
11990+char *
11991+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
11992+{
11993+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
11994+ PAGE_SIZE);
11995+}
11996+
11997+__inline__ __u32
11998+to_gr_audit(const __u32 reqmode)
11999+{
12000+ /* masks off auditable permission flags, then shifts them to create
12001+ auditing flags, and adds the special case of append auditing if
12002+ we're requesting write */
12003+ return (((reqmode & GR_AUDIT_READ) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
12004+}
12005+
12006+struct acl_subject_label *
12007+lookup_subject_map(const struct acl_subject_label *userp)
12008+{
12009+ unsigned int index = shash(userp, subj_map_set.s_size);
12010+ struct subject_map *match;
12011+
12012+ match = subj_map_set.s_hash[index];
12013+
12014+ while (match && match->user != userp)
12015+ match = match->next;
12016+
12017+ if (match != NULL)
12018+ return match->kernel;
12019+ else
12020+ return NULL;
12021+}
12022+
12023+static void
12024+insert_subj_map_entry(struct subject_map *subjmap)
12025+{
12026+ unsigned int index = shash(subjmap->user, subj_map_set.s_size);
12027+ struct subject_map **curr;
12028+
12029+ subjmap->prev = NULL;
12030+
12031+ curr = &subj_map_set.s_hash[index];
12032+ if (*curr != NULL)
12033+ (*curr)->prev = subjmap;
12034+
12035+ subjmap->next = *curr;
12036+ *curr = subjmap;
12037+
12038+ return;
12039+}
12040+
12041+static struct acl_role_label *
12042+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
12043+ const gid_t gid)
12044+{
12045+ unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
12046+ struct acl_role_label *match;
12047+ struct role_allowed_ip *ipp;
12048+ unsigned int x;
12049+
12050+ match = acl_role_set.r_hash[index];
12051+
12052+ while (match) {
12053+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
12054+ for (x = 0; x < match->domain_child_num; x++) {
12055+ if (match->domain_children[x] == uid)
12056+ goto found;
12057+ }
12058+ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
12059+ break;
12060+ match = match->next;
12061+ }
12062+found:
12063+ if (match == NULL) {
12064+ try_group:
12065+ index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
12066+ match = acl_role_set.r_hash[index];
12067+
12068+ while (match) {
12069+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
12070+ for (x = 0; x < match->domain_child_num; x++) {
12071+ if (match->domain_children[x] == gid)
12072+ goto found2;
12073+ }
12074+ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
12075+ break;
12076+ match = match->next;
12077+ }
12078+found2:
12079+ if (match == NULL)
12080+ match = default_role;
12081+ if (match->allowed_ips == NULL)
12082+ return match;
12083+ else {
12084+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
12085+ if (likely
12086+ ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
12087+ (ntohl(ipp->addr) & ipp->netmask)))
12088+ return match;
12089+ }
12090+ match = default_role;
12091+ }
12092+ } else if (match->allowed_ips == NULL) {
12093+ return match;
12094+ } else {
12095+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
12096+ if (likely
12097+ ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
12098+ (ntohl(ipp->addr) & ipp->netmask)))
12099+ return match;
12100+ }
12101+ goto try_group;
12102+ }
12103+
12104+ return match;
12105+}
12106+
12107+struct acl_subject_label *
12108+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
12109+ const struct acl_role_label *role)
12110+{
12111+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
12112+ struct acl_subject_label *match;
12113+
12114+ match = role->subj_hash[index];
12115+
12116+ while (match && (match->inode != ino || match->device != dev ||
12117+ (match->mode & GR_DELETED))) {
12118+ match = match->next;
12119+ }
12120+
12121+ if (match && !(match->mode & GR_DELETED))
12122+ return match;
12123+ else
12124+ return NULL;
12125+}
12126+
12127+static struct acl_object_label *
12128+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
12129+ const struct acl_subject_label *subj)
12130+{
12131+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
12132+ struct acl_object_label *match;
12133+
12134+ match = subj->obj_hash[index];
12135+
12136+ while (match && (match->inode != ino || match->device != dev ||
12137+ (match->mode & GR_DELETED))) {
12138+ match = match->next;
12139+ }
12140+
12141+ if (match && !(match->mode & GR_DELETED))
12142+ return match;
12143+ else
12144+ return NULL;
12145+}
12146+
12147+static struct acl_object_label *
12148+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
12149+ const struct acl_subject_label *subj)
12150+{
12151+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
12152+ struct acl_object_label *match;
12153+
12154+ match = subj->obj_hash[index];
12155+
12156+ while (match && (match->inode != ino || match->device != dev ||
12157+ !(match->mode & GR_DELETED))) {
12158+ match = match->next;
12159+ }
12160+
12161+ if (match && (match->mode & GR_DELETED))
12162+ return match;
12163+
12164+ match = subj->obj_hash[index];
12165+
12166+ while (match && (match->inode != ino || match->device != dev ||
12167+ (match->mode & GR_DELETED))) {
12168+ match = match->next;
12169+ }
12170+
12171+ if (match && !(match->mode & GR_DELETED))
12172+ return match;
12173+ else
12174+ return NULL;
12175+}
12176+
12177+static struct name_entry *
12178+lookup_name_entry(const char *name)
12179+{
12180+ unsigned int len = strlen(name);
12181+ unsigned int key = full_name_hash(name, len);
12182+ unsigned int index = key % name_set.n_size;
12183+ struct name_entry *match;
12184+
12185+ match = name_set.n_hash[index];
12186+
12187+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
12188+ match = match->next;
12189+
12190+ return match;
12191+}
12192+
12193+static struct inodev_entry *
12194+lookup_inodev_entry(const ino_t ino, const dev_t dev)
12195+{
12196+ unsigned int index = fhash(ino, dev, inodev_set.i_size);
12197+ struct inodev_entry *match;
12198+
12199+ match = inodev_set.i_hash[index];
12200+
12201+ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
12202+ match = match->next;
12203+
12204+ return match;
12205+}
12206+
12207+static void
12208+insert_inodev_entry(struct inodev_entry *entry)
12209+{
12210+ unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
12211+ inodev_set.i_size);
12212+ struct inodev_entry **curr;
12213+
12214+ entry->prev = NULL;
12215+
12216+ curr = &inodev_set.i_hash[index];
12217+ if (*curr != NULL)
12218+ (*curr)->prev = entry;
12219+
12220+ entry->next = *curr;
12221+ *curr = entry;
12222+
12223+ return;
12224+}
12225+
12226+static void
12227+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
12228+{
12229+ unsigned int index =
12230+ rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
12231+ struct acl_role_label **curr;
12232+
12233+ role->prev = NULL;
12234+
12235+ curr = &acl_role_set.r_hash[index];
12236+ if (*curr != NULL)
12237+ (*curr)->prev = role;
12238+
12239+ role->next = *curr;
12240+ *curr = role;
12241+
12242+ return;
12243+}
12244+
12245+static void
12246+insert_acl_role_label(struct acl_role_label *role)
12247+{
12248+ int i;
12249+
12250+ if (role->roletype & GR_ROLE_DOMAIN) {
12251+ for (i = 0; i < role->domain_child_num; i++)
12252+ __insert_acl_role_label(role, role->domain_children[i]);
12253+ } else
12254+ __insert_acl_role_label(role, role->uidgid);
12255+}
12256+
12257+static int
12258+insert_name_entry(char *name, const ino_t inode, const dev_t device)
12259+{
12260+ struct name_entry **curr, *nentry;
12261+ struct inodev_entry *ientry;
12262+ unsigned int len = strlen(name);
12263+ unsigned int key = full_name_hash(name, len);
12264+ unsigned int index = key % name_set.n_size;
12265+
12266+ curr = &name_set.n_hash[index];
12267+
12268+ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
12269+ curr = &((*curr)->next);
12270+
12271+ if (*curr != NULL)
12272+ return 1;
12273+
12274+ nentry = acl_alloc(sizeof (struct name_entry));
12275+ if (nentry == NULL)
12276+ return 0;
12277+ ientry = acl_alloc(sizeof (struct inodev_entry));
12278+ if (ientry == NULL)
12279+ return 0;
12280+ ientry->nentry = nentry;
12281+
12282+ nentry->key = key;
12283+ nentry->name = name;
12284+ nentry->inode = inode;
12285+ nentry->device = device;
12286+ nentry->len = len;
12287+
12288+ nentry->prev = NULL;
12289+ curr = &name_set.n_hash[index];
12290+ if (*curr != NULL)
12291+ (*curr)->prev = nentry;
12292+ nentry->next = *curr;
12293+ *curr = nentry;
12294+
12295+ /* insert us into the table searchable by inode/dev */
12296+ insert_inodev_entry(ientry);
12297+
12298+ return 1;
12299+}
12300+
12301+static void
12302+insert_acl_obj_label(struct acl_object_label *obj,
12303+ struct acl_subject_label *subj)
12304+{
12305+ unsigned int index =
12306+ fhash(obj->inode, obj->device, subj->obj_hash_size);
12307+ struct acl_object_label **curr;
12308+
12309+
12310+ obj->prev = NULL;
12311+
12312+ curr = &subj->obj_hash[index];
12313+ if (*curr != NULL)
12314+ (*curr)->prev = obj;
12315+
12316+ obj->next = *curr;
12317+ *curr = obj;
12318+
12319+ return;
12320+}
12321+
12322+static void
12323+insert_acl_subj_label(struct acl_subject_label *obj,
12324+ struct acl_role_label *role)
12325+{
12326+ unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
12327+ struct acl_subject_label **curr;
12328+
12329+ obj->prev = NULL;
12330+
12331+ curr = &role->subj_hash[index];
12332+ if (*curr != NULL)
12333+ (*curr)->prev = obj;
12334+
12335+ obj->next = *curr;
12336+ *curr = obj;
12337+
12338+ return;
12339+}
12340+
12341+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
12342+
12343+static void *
12344+create_table(__u32 * len, int elementsize)
12345+{
12346+ unsigned int table_sizes[] = {
12347+ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
12348+ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
12349+ 4194301, 8388593, 16777213, 33554393, 67108859, 134217689,
12350+ 268435399, 536870909, 1073741789, 2147483647
12351+ };
12352+ void *newtable = NULL;
12353+ unsigned int pwr = 0;
12354+
12355+ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
12356+ table_sizes[pwr] <= *len)
12357+ pwr++;
12358+
12359+ if (table_sizes[pwr] <= *len)
12360+ return newtable;
12361+
12362+ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
12363+ newtable =
12364+ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
12365+ else
12366+ newtable = vmalloc(table_sizes[pwr] * elementsize);
12367+
12368+ *len = table_sizes[pwr];
12369+
12370+ return newtable;
12371+}
12372+
12373+static int
12374+init_variables(const struct gr_arg *arg)
12375+{
12376+ unsigned int stacksize;
12377+
12378+ subj_map_set.s_size = arg->role_db.num_subjects;
12379+ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
12380+ name_set.n_size = arg->role_db.num_objects;
12381+ inodev_set.i_size = arg->role_db.num_objects;
12382+
12383+ if (!subj_map_set.s_size || !acl_role_set.r_size ||
12384+ !name_set.n_size || !inodev_set.i_size)
12385+ return 1;
12386+
12387+ if (!gr_init_uidset())
12388+ return 1;
12389+
12390+ /* set up the stack that holds allocation info */
12391+
12392+ stacksize = arg->role_db.num_pointers + 5;
12393+
12394+ if (!acl_alloc_stack_init(stacksize))
12395+ return 1;
12396+
12397+ /* grab reference for the real root dentry and vfsmount */
12398+ read_lock(&child_reaper->fs->lock);
12399+ real_root_mnt = mntget(child_reaper->fs->rootmnt);
12400+ real_root = dget(child_reaper->fs->root);
12401+ read_unlock(&child_reaper->fs->lock);
12402+
12403+ fakefs_obj = acl_alloc(sizeof(struct acl_object_label));
12404+ if (fakefs_obj == NULL)
12405+ return 1;
12406+ fakefs_obj->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
12407+
12408+ subj_map_set.s_hash =
12409+ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
12410+ acl_role_set.r_hash =
12411+ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
12412+ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
12413+ inodev_set.i_hash =
12414+ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
12415+
12416+ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
12417+ !name_set.n_hash || !inodev_set.i_hash)
12418+ return 1;
12419+
12420+ memset(subj_map_set.s_hash, 0,
12421+ sizeof(struct subject_map *) * subj_map_set.s_size);
12422+ memset(acl_role_set.r_hash, 0,
12423+ sizeof (struct acl_role_label *) * acl_role_set.r_size);
12424+ memset(name_set.n_hash, 0,
12425+ sizeof (struct name_entry *) * name_set.n_size);
12426+ memset(inodev_set.i_hash, 0,
12427+ sizeof (struct inodev_entry *) * inodev_set.i_size);
12428+
12429+ return 0;
12430+}
12431+
12432+/* free information not needed after startup
12433+ currently contains user->kernel pointer mappings for subjects
12434+*/
12435+
12436+static void
12437+free_init_variables(void)
12438+{
12439+ __u32 i;
12440+
12441+ if (subj_map_set.s_hash) {
12442+ for (i = 0; i < subj_map_set.s_size; i++) {
12443+ if (subj_map_set.s_hash[i]) {
12444+ kfree(subj_map_set.s_hash[i]);
12445+ subj_map_set.s_hash[i] = NULL;
12446+ }
12447+ }
12448+
12449+ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
12450+ PAGE_SIZE)
12451+ kfree(subj_map_set.s_hash);
12452+ else
12453+ vfree(subj_map_set.s_hash);
12454+ }
12455+
12456+ return;
12457+}
12458+
12459+static void
12460+free_variables(void)
12461+{
12462+ struct acl_subject_label *s;
12463+ struct acl_role_label *r;
12464+ struct task_struct *task, *task2;
12465+ unsigned int i, x;
12466+
12467+ gr_clear_learn_entries();
12468+
12469+ read_lock(&tasklist_lock);
12470+ do_each_thread(task2, task) {
12471+ task->acl_sp_role = 0;
12472+ task->acl_role_id = 0;
12473+ task->acl = NULL;
12474+ task->role = NULL;
12475+ } while_each_thread(task2, task);
12476+ read_unlock(&tasklist_lock);
12477+
12478+ /* release the reference to the real root dentry and vfsmount */
12479+ if (real_root)
12480+ dput(real_root);
12481+ real_root = NULL;
12482+ if (real_root_mnt)
12483+ mntput(real_root_mnt);
12484+ real_root_mnt = NULL;
12485+
12486+ /* free all object hash tables */
12487+
12488+ FOR_EACH_ROLE_START(r, i)
12489+ if (r->subj_hash == NULL)
12490+ break;
12491+ FOR_EACH_SUBJECT_START(r, s, x)
12492+ if (s->obj_hash == NULL)
12493+ break;
12494+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
12495+ kfree(s->obj_hash);
12496+ else
12497+ vfree(s->obj_hash);
12498+ FOR_EACH_SUBJECT_END(s, x)
12499+ FOR_EACH_NESTED_SUBJECT_START(r, s)
12500+ if (s->obj_hash == NULL)
12501+ break;
12502+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
12503+ kfree(s->obj_hash);
12504+ else
12505+ vfree(s->obj_hash);
12506+ FOR_EACH_NESTED_SUBJECT_END(s)
12507+ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
12508+ kfree(r->subj_hash);
12509+ else
12510+ vfree(r->subj_hash);
12511+ r->subj_hash = NULL;
12512+ FOR_EACH_ROLE_END(r,i)
12513+
12514+ acl_free_all();
12515+
12516+ if (acl_role_set.r_hash) {
12517+ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
12518+ PAGE_SIZE)
12519+ kfree(acl_role_set.r_hash);
12520+ else
12521+ vfree(acl_role_set.r_hash);
12522+ }
12523+ if (name_set.n_hash) {
12524+ if ((name_set.n_size * sizeof (struct name_entry *)) <=
12525+ PAGE_SIZE)
12526+ kfree(name_set.n_hash);
12527+ else
12528+ vfree(name_set.n_hash);
12529+ }
12530+
12531+ if (inodev_set.i_hash) {
12532+ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
12533+ PAGE_SIZE)
12534+ kfree(inodev_set.i_hash);
12535+ else
12536+ vfree(inodev_set.i_hash);
12537+ }
12538+
12539+ gr_free_uidset();
12540+
12541+ memset(&name_set, 0, sizeof (struct name_db));
12542+ memset(&inodev_set, 0, sizeof (struct inodev_db));
12543+ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
12544+ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
12545+
12546+ default_role = NULL;
12547+
12548+ return;
12549+}
12550+
12551+static __u32
12552+count_user_objs(struct acl_object_label *userp)
12553+{
12554+ struct acl_object_label o_tmp;
12555+ __u32 num = 0;
12556+
12557+ while (userp) {
12558+ if (copy_from_user(&o_tmp, userp,
12559+ sizeof (struct acl_object_label)))
12560+ break;
12561+
12562+ userp = o_tmp.prev;
12563+ num++;
12564+ }
12565+
12566+ return num;
12567+}
12568+
12569+static struct acl_subject_label *
12570+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
12571+
12572+static int
12573+copy_user_glob(struct acl_object_label *obj)
12574+{
12575+ struct acl_object_label *g_tmp, **guser;
12576+ unsigned int len;
12577+ char *tmp;
12578+
12579+ if (obj->globbed == NULL)
12580+ return 0;
12581+
12582+ guser = &obj->globbed;
12583+ while (*guser) {
12584+ g_tmp = (struct acl_object_label *)
12585+ acl_alloc(sizeof (struct acl_object_label));
12586+ if (g_tmp == NULL)
12587+ return -ENOMEM;
12588+
12589+ if (copy_from_user(g_tmp, *guser,
12590+ sizeof (struct acl_object_label)))
12591+ return -EFAULT;
12592+
12593+ len = strnlen_user(g_tmp->filename, PATH_MAX);
12594+
12595+ if (!len || len >= PATH_MAX)
12596+ return -EINVAL;
12597+
12598+ if ((tmp = (char *) acl_alloc(len)) == NULL)
12599+ return -ENOMEM;
12600+
12601+ if (copy_from_user(tmp, g_tmp->filename, len))
12602+ return -EFAULT;
12603+
12604+ g_tmp->filename = tmp;
12605+
12606+ *guser = g_tmp;
12607+ guser = &(g_tmp->next);
12608+ }
12609+
12610+ return 0;
12611+}
12612+
12613+static int
12614+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
12615+ struct acl_role_label *role)
12616+{
12617+ struct acl_object_label *o_tmp;
12618+ unsigned int len;
12619+ int ret;
12620+ char *tmp;
12621+
12622+ while (userp) {
12623+ if ((o_tmp = (struct acl_object_label *)
12624+ acl_alloc(sizeof (struct acl_object_label))) == NULL)
12625+ return -ENOMEM;
12626+
12627+ if (copy_from_user(o_tmp, userp,
12628+ sizeof (struct acl_object_label)))
12629+ return -EFAULT;
12630+
12631+ userp = o_tmp->prev;
12632+
12633+ len = strnlen_user(o_tmp->filename, PATH_MAX);
12634+
12635+ if (!len || len >= PATH_MAX)
12636+ return -EINVAL;
12637+
12638+ if ((tmp = (char *) acl_alloc(len)) == NULL)
12639+ return -ENOMEM;
12640+
12641+ if (copy_from_user(tmp, o_tmp->filename, len))
12642+ return -EFAULT;
12643+
12644+ o_tmp->filename = tmp;
12645+
12646+ insert_acl_obj_label(o_tmp, subj);
12647+ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
12648+ o_tmp->device))
12649+ return -ENOMEM;
12650+
12651+ ret = copy_user_glob(o_tmp);
12652+ if (ret)
12653+ return ret;
12654+
12655+ if (o_tmp->nested) {
12656+ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
12657+ if (IS_ERR(o_tmp->nested))
12658+ return PTR_ERR(o_tmp->nested);
12659+
12660+ /* insert into nested subject list */
12661+ o_tmp->nested->next = role->hash->first;
12662+ role->hash->first = o_tmp->nested;
12663+ }
12664+ }
12665+
12666+ return 0;
12667+}
12668+
12669+static __u32
12670+count_user_subjs(struct acl_subject_label *userp)
12671+{
12672+ struct acl_subject_label s_tmp;
12673+ __u32 num = 0;
12674+
12675+ while (userp) {
12676+ if (copy_from_user(&s_tmp, userp,
12677+ sizeof (struct acl_subject_label)))
12678+ break;
12679+
12680+ userp = s_tmp.prev;
12681+ /* do not count nested subjects against this count, since
12682+ they are not included in the hash table, but are
12683+ attached to objects. We have already counted
12684+ the subjects in userspace for the allocation
12685+ stack
12686+ */
12687+ if (!(s_tmp.mode & GR_NESTED))
12688+ num++;
12689+ }
12690+
12691+ return num;
12692+}
12693+
12694+static int
12695+copy_user_allowedips(struct acl_role_label *rolep)
12696+{
12697+ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
12698+
12699+ ruserip = rolep->allowed_ips;
12700+
12701+ while (ruserip) {
12702+ rlast = rtmp;
12703+
12704+ if ((rtmp = (struct role_allowed_ip *)
12705+ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
12706+ return -ENOMEM;
12707+
12708+ if (copy_from_user(rtmp, ruserip,
12709+ sizeof (struct role_allowed_ip)))
12710+ return -EFAULT;
12711+
12712+ ruserip = rtmp->prev;
12713+
12714+ if (!rlast) {
12715+ rtmp->prev = NULL;
12716+ rolep->allowed_ips = rtmp;
12717+ } else {
12718+ rlast->next = rtmp;
12719+ rtmp->prev = rlast;
12720+ }
12721+
12722+ if (!ruserip)
12723+ rtmp->next = NULL;
12724+ }
12725+
12726+ return 0;
12727+}
12728+
12729+static int
12730+copy_user_transitions(struct acl_role_label *rolep)
12731+{
12732+ struct role_transition *rusertp, *rtmp = NULL, *rlast;
12733+
12734+ unsigned int len;
12735+ char *tmp;
12736+
12737+ rusertp = rolep->transitions;
12738+
12739+ while (rusertp) {
12740+ rlast = rtmp;
12741+
12742+ if ((rtmp = (struct role_transition *)
12743+ acl_alloc(sizeof (struct role_transition))) == NULL)
12744+ return -ENOMEM;
12745+
12746+ if (copy_from_user(rtmp, rusertp,
12747+ sizeof (struct role_transition)))
12748+ return -EFAULT;
12749+
12750+ rusertp = rtmp->prev;
12751+
12752+ len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
12753+
12754+ if (!len || len >= GR_SPROLE_LEN)
12755+ return -EINVAL;
12756+
12757+ if ((tmp = (char *) acl_alloc(len)) == NULL)
12758+ return -ENOMEM;
12759+
12760+ if (copy_from_user(tmp, rtmp->rolename, len))
12761+ return -EFAULT;
12762+
12763+ rtmp->rolename = tmp;
12764+
12765+ if (!rlast) {
12766+ rtmp->prev = NULL;
12767+ rolep->transitions = rtmp;
12768+ } else {
12769+ rlast->next = rtmp;
12770+ rtmp->prev = rlast;
12771+ }
12772+
12773+ if (!rusertp)
12774+ rtmp->next = NULL;
12775+ }
12776+
12777+ return 0;
12778+}
12779+
12780+static struct acl_subject_label *
12781+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
12782+{
12783+ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
12784+ unsigned int len;
12785+ char *tmp;
12786+ __u32 num_objs;
12787+ struct acl_ip_label **i_tmp, *i_utmp2;
12788+ struct gr_hash_struct ghash;
12789+ struct subject_map *subjmap;
12790+ unsigned int i_num;
12791+ int err;
12792+
12793+ s_tmp = lookup_subject_map(userp);
12794+
12795+ /* we've already copied this subject into the kernel, just return
12796+ the reference to it, and don't copy it over again
12797+ */
12798+ if (s_tmp)
12799+ return(s_tmp);
12800+
12801+ if ((s_tmp = (struct acl_subject_label *)
12802+ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
12803+ return ERR_PTR(-ENOMEM);
12804+
12805+ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
12806+ if (subjmap == NULL)
12807+ return ERR_PTR(-ENOMEM);
12808+
12809+ subjmap->user = userp;
12810+ subjmap->kernel = s_tmp;
12811+ insert_subj_map_entry(subjmap);
12812+
12813+ if (copy_from_user(s_tmp, userp,
12814+ sizeof (struct acl_subject_label)))
12815+ return ERR_PTR(-EFAULT);
12816+
12817+ len = strnlen_user(s_tmp->filename, PATH_MAX);
12818+
12819+ if (!len || len >= PATH_MAX)
12820+ return ERR_PTR(-EINVAL);
12821+
12822+ if ((tmp = (char *) acl_alloc(len)) == NULL)
12823+ return ERR_PTR(-ENOMEM);
12824+
12825+ if (copy_from_user(tmp, s_tmp->filename, len))
12826+ return ERR_PTR(-EFAULT);
12827+
12828+ s_tmp->filename = tmp;
12829+
12830+ if (!strcmp(s_tmp->filename, "/"))
12831+ role->root_label = s_tmp;
12832+
12833+ if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
12834+ return ERR_PTR(-EFAULT);
12835+
12836+ /* copy user and group transition tables */
12837+
12838+ if (s_tmp->user_trans_num) {
12839+ uid_t *uidlist;
12840+
12841+ uidlist = (uid_t *)acl_alloc(s_tmp->user_trans_num * sizeof(uid_t));
12842+ if (uidlist == NULL)
12843+ return ERR_PTR(-ENOMEM);
12844+ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
12845+ return ERR_PTR(-EFAULT);
12846+
12847+ s_tmp->user_transitions = uidlist;
12848+ }
12849+
12850+ if (s_tmp->group_trans_num) {
12851+ gid_t *gidlist;
12852+
12853+ gidlist = (gid_t *)acl_alloc(s_tmp->group_trans_num * sizeof(gid_t));
12854+ if (gidlist == NULL)
12855+ return ERR_PTR(-ENOMEM);
12856+ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
12857+ return ERR_PTR(-EFAULT);
12858+
12859+ s_tmp->group_transitions = gidlist;
12860+ }
12861+
12862+ /* set up object hash table */
12863+ num_objs = count_user_objs(ghash.first);
12864+
12865+ s_tmp->obj_hash_size = num_objs;
12866+ s_tmp->obj_hash =
12867+ (struct acl_object_label **)
12868+ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
12869+
12870+ if (!s_tmp->obj_hash)
12871+ return ERR_PTR(-ENOMEM);
12872+
12873+ memset(s_tmp->obj_hash, 0,
12874+ s_tmp->obj_hash_size *
12875+ sizeof (struct acl_object_label *));
12876+
12877+ /* add in objects */
12878+ err = copy_user_objs(ghash.first, s_tmp, role);
12879+
12880+ if (err)
12881+ return ERR_PTR(err);
12882+
12883+ /* set pointer for parent subject */
12884+ if (s_tmp->parent_subject) {
12885+ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
12886+
12887+ if (IS_ERR(s_tmp2))
12888+ return s_tmp2;
12889+
12890+ s_tmp->parent_subject = s_tmp2;
12891+ }
12892+
12893+ /* add in ip acls */
12894+
12895+ if (!s_tmp->ip_num) {
12896+ s_tmp->ips = NULL;
12897+ goto insert;
12898+ }
12899+
12900+ i_tmp =
12901+ (struct acl_ip_label **) acl_alloc(s_tmp->ip_num *
12902+ sizeof (struct
12903+ acl_ip_label *));
12904+
12905+ if (!i_tmp)
12906+ return ERR_PTR(-ENOMEM);
12907+
12908+ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
12909+ *(i_tmp + i_num) =
12910+ (struct acl_ip_label *)
12911+ acl_alloc(sizeof (struct acl_ip_label));
12912+ if (!*(i_tmp + i_num))
12913+ return ERR_PTR(-ENOMEM);
12914+
12915+ if (copy_from_user
12916+ (&i_utmp2, s_tmp->ips + i_num,
12917+ sizeof (struct acl_ip_label *)))
12918+ return ERR_PTR(-EFAULT);
12919+
12920+ if (copy_from_user
12921+ (*(i_tmp + i_num), i_utmp2,
12922+ sizeof (struct acl_ip_label)))
12923+ return ERR_PTR(-EFAULT);
12924+
12925+ if ((*(i_tmp + i_num))->iface == NULL)
12926+ continue;
12927+
12928+ len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
12929+ if (!len || len >= IFNAMSIZ)
12930+ return ERR_PTR(-EINVAL);
12931+ tmp = acl_alloc(len);
12932+ if (tmp == NULL)
12933+ return ERR_PTR(-ENOMEM);
12934+ if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
12935+ return ERR_PTR(-EFAULT);
12936+ (*(i_tmp + i_num))->iface = tmp;
12937+ }
12938+
12939+ s_tmp->ips = i_tmp;
12940+
12941+insert:
12942+ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
12943+ s_tmp->device))
12944+ return ERR_PTR(-ENOMEM);
12945+
12946+ return s_tmp;
12947+}
12948+
12949+static int
12950+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
12951+{
12952+ struct acl_subject_label s_pre;
12953+ struct acl_subject_label * ret;
12954+ int err;
12955+
12956+ while (userp) {
12957+ if (copy_from_user(&s_pre, userp,
12958+ sizeof (struct acl_subject_label)))
12959+ return -EFAULT;
12960+
12961+ /* do not add nested subjects here, add
12962+ while parsing objects
12963+ */
12964+
12965+ if (s_pre.mode & GR_NESTED) {
12966+ userp = s_pre.prev;
12967+ continue;
12968+ }
12969+
12970+ ret = do_copy_user_subj(userp, role);
12971+
12972+ err = PTR_ERR(ret);
12973+ if (IS_ERR(ret))
12974+ return err;
12975+
12976+ insert_acl_subj_label(ret, role);
12977+
12978+ userp = s_pre.prev;
12979+ }
12980+
12981+ return 0;
12982+}
12983+
12984+static int
12985+copy_user_acl(struct gr_arg *arg)
12986+{
12987+ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
12988+ struct sprole_pw *sptmp;
12989+ struct gr_hash_struct *ghash;
12990+ uid_t *domainlist;
12991+ unsigned int r_num;
12992+ unsigned int len;
12993+ char *tmp;
12994+ int err = 0;
12995+ __u16 i;
12996+ __u32 num_subjs;
12997+
12998+ /* we need a default and kernel role */
12999+ if (arg->role_db.num_roles < 2)
13000+ return -EINVAL;
13001+
13002+ /* copy special role authentication info from userspace */
13003+
13004+ num_sprole_pws = arg->num_sprole_pws;
13005+ acl_special_roles = (struct sprole_pw **) acl_alloc(num_sprole_pws * sizeof(struct sprole_pw *));
13006+
13007+ if (!acl_special_roles) {
13008+ err = -ENOMEM;
13009+ goto cleanup;
13010+ }
13011+
13012+ for (i = 0; i < num_sprole_pws; i++) {
13013+ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
13014+ if (!sptmp) {
13015+ err = -ENOMEM;
13016+ goto cleanup;
13017+ }
13018+ if (copy_from_user(sptmp, arg->sprole_pws + i,
13019+ sizeof (struct sprole_pw))) {
13020+ err = -EFAULT;
13021+ goto cleanup;
13022+ }
13023+
13024+ len =
13025+ strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
13026+
13027+ if (!len || len >= GR_SPROLE_LEN) {
13028+ err = -EINVAL;
13029+ goto cleanup;
13030+ }
13031+
13032+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
13033+ err = -ENOMEM;
13034+ goto cleanup;
13035+ }
13036+
13037+ if (copy_from_user(tmp, sptmp->rolename, len)) {
13038+ err = -EFAULT;
13039+ goto cleanup;
13040+ }
13041+
13042+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
13043+ printk(KERN_ALERT "Copying special role %s\n", tmp);
13044+#endif
13045+ sptmp->rolename = tmp;
13046+ acl_special_roles[i] = sptmp;
13047+ }
13048+
13049+ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
13050+
13051+ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
13052+ r_tmp = acl_alloc(sizeof (struct acl_role_label));
13053+
13054+ if (!r_tmp) {
13055+ err = -ENOMEM;
13056+ goto cleanup;
13057+ }
13058+
13059+ if (copy_from_user(&r_utmp2, r_utmp + r_num,
13060+ sizeof (struct acl_role_label *))) {
13061+ err = -EFAULT;
13062+ goto cleanup;
13063+ }
13064+
13065+ if (copy_from_user(r_tmp, r_utmp2,
13066+ sizeof (struct acl_role_label))) {
13067+ err = -EFAULT;
13068+ goto cleanup;
13069+ }
13070+
13071+ len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
13072+
13073+ if (!len || len >= PATH_MAX) {
13074+ err = -EINVAL;
13075+ goto cleanup;
13076+ }
13077+
13078+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
13079+ err = -ENOMEM;
13080+ goto cleanup;
13081+ }
13082+ if (copy_from_user(tmp, r_tmp->rolename, len)) {
13083+ err = -EFAULT;
13084+ goto cleanup;
13085+ }
13086+ r_tmp->rolename = tmp;
13087+
13088+ if (!strcmp(r_tmp->rolename, "default")
13089+ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
13090+ default_role = r_tmp;
13091+ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
13092+ kernel_role = r_tmp;
13093+ }
13094+
13095+ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
13096+ err = -ENOMEM;
13097+ goto cleanup;
13098+ }
13099+ if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
13100+ err = -EFAULT;
13101+ goto cleanup;
13102+ }
13103+
13104+ r_tmp->hash = ghash;
13105+
13106+ num_subjs = count_user_subjs(r_tmp->hash->first);
13107+
13108+ r_tmp->subj_hash_size = num_subjs;
13109+ r_tmp->subj_hash =
13110+ (struct acl_subject_label **)
13111+ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
13112+
13113+ if (!r_tmp->subj_hash) {
13114+ err = -ENOMEM;
13115+ goto cleanup;
13116+ }
13117+
13118+ err = copy_user_allowedips(r_tmp);
13119+ if (err)
13120+ goto cleanup;
13121+
13122+ /* copy domain info */
13123+ if (r_tmp->domain_children != NULL) {
13124+ domainlist = acl_alloc(r_tmp->domain_child_num * sizeof(uid_t));
13125+ if (domainlist == NULL) {
13126+ err = -ENOMEM;
13127+ goto cleanup;
13128+ }
13129+ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
13130+ err = -EFAULT;
13131+ goto cleanup;
13132+ }
13133+ r_tmp->domain_children = domainlist;
13134+ }
13135+
13136+ err = copy_user_transitions(r_tmp);
13137+ if (err)
13138+ goto cleanup;
13139+
13140+ memset(r_tmp->subj_hash, 0,
13141+ r_tmp->subj_hash_size *
13142+ sizeof (struct acl_subject_label *));
13143+
13144+ err = copy_user_subjs(r_tmp->hash->first, r_tmp);
13145+
13146+ if (err)
13147+ goto cleanup;
13148+
13149+ /* set nested subject list to null */
13150+ r_tmp->hash->first = NULL;
13151+
13152+ insert_acl_role_label(r_tmp);
13153+ }
13154+
13155+ goto return_err;
13156+ cleanup:
13157+ free_variables();
13158+ return_err:
13159+ return err;
13160+
13161+}
13162+
13163+static int
13164+gracl_init(struct gr_arg *args)
13165+{
13166+ int error = 0;
13167+
13168+ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
13169+ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
13170+
13171+ if (init_variables(args)) {
13172+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
13173+ error = -ENOMEM;
13174+ free_variables();
13175+ goto out;
13176+ }
13177+
13178+ error = copy_user_acl(args);
13179+ free_init_variables();
13180+ if (error) {
13181+ free_variables();
13182+ goto out;
13183+ }
13184+
13185+ if ((error = gr_set_acls(0))) {
13186+ free_variables();
13187+ goto out;
13188+ }
13189+
13190+ gr_status |= GR_READY;
13191+ out:
13192+ return error;
13193+}
13194+
13195+/* derived from glibc fnmatch() 0: match, 1: no match*/
13196+
13197+static int
13198+glob_match(const char *p, const char *n)
13199+{
13200+ char c;
13201+
13202+ while ((c = *p++) != '\0') {
13203+ switch (c) {
13204+ case '?':
13205+ if (*n == '\0')
13206+ return 1;
13207+ else if (*n == '/')
13208+ return 1;
13209+ break;
13210+ case '\\':
13211+ if (*n != c)
13212+ return 1;
13213+ break;
13214+ case '*':
13215+ for (c = *p++; c == '?' || c == '*'; c = *p++) {
13216+ if (*n == '/')
13217+ return 1;
13218+ else if (c == '?') {
13219+ if (*n == '\0')
13220+ return 1;
13221+ else
13222+ ++n;
13223+ }
13224+ }
13225+ if (c == '\0') {
13226+ return 0;
13227+ } else {
13228+ const char *endp;
13229+
13230+ if ((endp = strchr(n, '/')) == NULL)
13231+ endp = n + strlen(n);
13232+
13233+ if (c == '[') {
13234+ for (--p; n < endp; ++n)
13235+ if (!glob_match(p, n))
13236+ return 0;
13237+ } else if (c == '/') {
13238+ while (*n != '\0' && *n != '/')
13239+ ++n;
13240+ if (*n == '/' && !glob_match(p, n + 1))
13241+ return 0;
13242+ } else {
13243+ for (--p; n < endp; ++n)
13244+ if (*n == c && !glob_match(p, n))
13245+ return 0;
13246+ }
13247+
13248+ return 1;
13249+ }
13250+ case '[':
13251+ {
13252+ int not;
13253+ char cold;
13254+
13255+ if (*n == '\0' || *n == '/')
13256+ return 1;
13257+
13258+ not = (*p == '!' || *p == '^');
13259+ if (not)
13260+ ++p;
13261+
13262+ c = *p++;
13263+ for (;;) {
13264+ unsigned char fn = (unsigned char)*n;
13265+
13266+ if (c == '\0')
13267+ return 1;
13268+ else {
13269+ if (c == fn)
13270+ goto matched;
13271+ cold = c;
13272+ c = *p++;
13273+
13274+ if (c == '-' && *p != ']') {
13275+ unsigned char cend = *p++;
13276+
13277+ if (cend == '\0')
13278+ return 1;
13279+
13280+ if (cold <= fn && fn <= cend)
13281+ goto matched;
13282+
13283+ c = *p++;
13284+ }
13285+ }
13286+
13287+ if (c == ']')
13288+ break;
13289+ }
13290+ if (!not)
13291+ return 1;
13292+ break;
13293+ matched:
13294+ while (c != ']') {
13295+ if (c == '\0')
13296+ return 1;
13297+
13298+ c = *p++;
13299+ }
13300+ if (not)
13301+ return 1;
13302+ }
13303+ break;
13304+ default:
13305+ if (c != *n)
13306+ return 1;
13307+ }
13308+
13309+ ++n;
13310+ }
13311+
13312+ if (*n == '\0')
13313+ return 0;
13314+
13315+ if (*n == '/')
13316+ return 0;
13317+
13318+ return 1;
13319+}
13320+
13321+static struct acl_object_label *
13322+chk_glob_label(struct acl_object_label *globbed,
13323+ struct dentry *dentry, struct vfsmount *mnt, char **path)
13324+{
13325+ struct acl_object_label *tmp;
13326+
13327+ if (*path == NULL)
13328+ *path = gr_to_filename_nolock(dentry, mnt);
13329+
13330+ tmp = globbed;
13331+
13332+ while (tmp) {
13333+ if (!glob_match(tmp->filename, *path))
13334+ return tmp;
13335+ tmp = tmp->next;
13336+ }
13337+
13338+ return NULL;
13339+}
13340+
13341+static struct acl_object_label *
13342+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
13343+ const ino_t curr_ino, const dev_t curr_dev,
13344+ const struct acl_subject_label *subj, char **path)
13345+{
13346+ struct acl_subject_label *tmpsubj;
13347+ struct acl_object_label *retval;
13348+ struct acl_object_label *retval2;
13349+
13350+ tmpsubj = (struct acl_subject_label *) subj;
13351+ read_lock(&gr_inode_lock);
13352+ do {
13353+ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
13354+ if (retval) {
13355+ if (retval->globbed) {
13356+ retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
13357+ (struct vfsmount *)orig_mnt, path);
13358+ if (retval2)
13359+ retval = retval2;
13360+ }
13361+ break;
13362+ }
13363+ } while ((tmpsubj = tmpsubj->parent_subject));
13364+ read_unlock(&gr_inode_lock);
13365+
13366+ return retval;
13367+}
13368+
13369+static __inline__ struct acl_object_label *
13370+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
13371+ const struct dentry *curr_dentry,
13372+ const struct acl_subject_label *subj, char **path)
13373+{
13374+ return __full_lookup(orig_dentry, orig_mnt,
13375+ curr_dentry->d_inode->i_ino,
13376+ curr_dentry->d_inode->i_sb->s_dev, subj, path);
13377+}
13378+
13379+static struct acl_object_label *
13380+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
13381+ const struct acl_subject_label *subj, char *path)
13382+{
13383+ struct dentry *dentry = (struct dentry *) l_dentry;
13384+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
13385+ struct acl_object_label *retval;
13386+
13387+ spin_lock(&dcache_lock);
13388+
13389+ if (unlikely(mnt == shm_mnt || mnt == pipe_mnt || mnt == sock_mnt)) {
13390+ retval = fakefs_obj;
13391+ goto out;
13392+ }
13393+
13394+ for (;;) {
13395+ if (dentry == real_root && mnt == real_root_mnt)
13396+ break;
13397+
13398+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
13399+ if (mnt->mnt_parent == mnt)
13400+ break;
13401+
13402+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path);
13403+ if (retval != NULL)
13404+ goto out;
13405+
13406+ dentry = mnt->mnt_mountpoint;
13407+ mnt = mnt->mnt_parent;
13408+ continue;
13409+ }
13410+
13411+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path);
13412+ if (retval != NULL)
13413+ goto out;
13414+
13415+ dentry = dentry->d_parent;
13416+ }
13417+
13418+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path);
13419+
13420+ if (retval == NULL)
13421+ retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path);
13422+out:
13423+ spin_unlock(&dcache_lock);
13424+ return retval;
13425+}
13426+
13427+static __inline__ struct acl_object_label *
13428+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
13429+ const struct acl_subject_label *subj)
13430+{
13431+ char *path = NULL;
13432+ return __chk_obj_label(l_dentry, l_mnt, subj, path);
13433+}
13434+
13435+static __inline__ struct acl_object_label *
13436+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
13437+ const struct acl_subject_label *subj, char *path)
13438+{
13439+ return __chk_obj_label(l_dentry, l_mnt, subj, path);
13440+}
13441+
13442+static struct acl_subject_label *
13443+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
13444+ const struct acl_role_label *role)
13445+{
13446+ struct dentry *dentry = (struct dentry *) l_dentry;
13447+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
13448+ struct acl_subject_label *retval;
13449+
13450+ spin_lock(&dcache_lock);
13451+
13452+ for (;;) {
13453+ if (dentry == real_root && mnt == real_root_mnt)
13454+ break;
13455+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
13456+ if (mnt->mnt_parent == mnt)
13457+ break;
13458+
13459+ read_lock(&gr_inode_lock);
13460+ retval =
13461+ lookup_acl_subj_label(dentry->d_inode->i_ino,
13462+ dentry->d_inode->i_sb->s_dev, role);
13463+ read_unlock(&gr_inode_lock);
13464+ if (retval != NULL)
13465+ goto out;
13466+
13467+ dentry = mnt->mnt_mountpoint;
13468+ mnt = mnt->mnt_parent;
13469+ continue;
13470+ }
13471+
13472+ read_lock(&gr_inode_lock);
13473+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
13474+ dentry->d_inode->i_sb->s_dev, role);
13475+ read_unlock(&gr_inode_lock);
13476+ if (retval != NULL)
13477+ goto out;
13478+
13479+ dentry = dentry->d_parent;
13480+ }
13481+
13482+ read_lock(&gr_inode_lock);
13483+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
13484+ dentry->d_inode->i_sb->s_dev, role);
13485+ read_unlock(&gr_inode_lock);
13486+
13487+ if (unlikely(retval == NULL)) {
13488+ read_lock(&gr_inode_lock);
13489+ retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
13490+ real_root->d_inode->i_sb->s_dev, role);
13491+ read_unlock(&gr_inode_lock);
13492+ }
13493+out:
13494+ spin_unlock(&dcache_lock);
13495+
13496+ return retval;
13497+}
13498+
13499+static void
13500+gr_log_learn(const struct task_struct *task, const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
13501+{
13502+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
13503+ task->uid, task->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_dentry,
13504+ task->exec_file->f_vfsmnt) : task->acl->filename, task->acl->filename,
13505+ 1, 1, gr_to_filename(dentry, mnt), (unsigned long) mode, NIPQUAD(task->signal->curr_ip));
13506+
13507+ return;
13508+}
13509+
13510+static void
13511+gr_log_learn_id_change(const struct task_struct *task, const char type, const unsigned int real,
13512+ const unsigned int effective, const unsigned int fs)
13513+{
13514+ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
13515+ task->uid, task->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_dentry,
13516+ task->exec_file->f_vfsmnt) : task->acl->filename, task->acl->filename,
13517+ type, real, effective, fs, NIPQUAD(task->signal->curr_ip));
13518+
13519+ return;
13520+}
13521+
13522+__u32
13523+gr_check_link(const struct dentry * new_dentry,
13524+ const struct dentry * parent_dentry,
13525+ const struct vfsmount * parent_mnt,
13526+ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
13527+{
13528+ struct acl_object_label *obj;
13529+ __u32 oldmode, newmode;
13530+ __u32 needmode;
13531+
13532+ if (unlikely(!(gr_status & GR_READY)))
13533+ return (GR_CREATE | GR_LINK);
13534+
13535+ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
13536+ oldmode = obj->mode;
13537+
13538+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
13539+ oldmode |= (GR_CREATE | GR_LINK);
13540+
13541+ needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
13542+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
13543+ needmode |= GR_SETID | GR_AUDIT_SETID;
13544+
13545+ newmode =
13546+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
13547+ oldmode | needmode);
13548+
13549+ needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
13550+ GR_SETID | GR_READ | GR_FIND | GR_DELETE |
13551+ GR_INHERIT | GR_AUDIT_INHERIT);
13552+
13553+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
13554+ goto bad;
13555+
13556+ if ((oldmode & needmode) != needmode)
13557+ goto bad;
13558+
13559+ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
13560+ if ((newmode & needmode) != needmode)
13561+ goto bad;
13562+
13563+ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
13564+ return newmode;
13565+bad:
13566+ needmode = oldmode;
13567+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
13568+ needmode |= GR_SETID;
13569+
13570+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
13571+ gr_log_learn(current, old_dentry, old_mnt, needmode);
13572+ return (GR_CREATE | GR_LINK);
13573+ } else if (newmode & GR_SUPPRESS)
13574+ return GR_SUPPRESS;
13575+ else
13576+ return 0;
13577+}
13578+
13579+__u32
13580+gr_search_file(const struct dentry * dentry, const __u32 mode,
13581+ const struct vfsmount * mnt)
13582+{
13583+ __u32 retval = mode;
13584+ struct acl_subject_label *curracl;
13585+ struct acl_object_label *currobj;
13586+
13587+ if (unlikely(!(gr_status & GR_READY)))
13588+ return (mode & ~GR_AUDITS);
13589+
13590+ curracl = current->acl;
13591+
13592+ currobj = chk_obj_label(dentry, mnt, curracl);
13593+ retval = currobj->mode & mode;
13594+
13595+ if (unlikely
13596+ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
13597+ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
13598+ __u32 new_mode = mode;
13599+
13600+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
13601+
13602+ retval = new_mode;
13603+
13604+ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
13605+ new_mode |= GR_INHERIT;
13606+
13607+ if (!(mode & GR_NOLEARN))
13608+ gr_log_learn(current, dentry, mnt, new_mode);
13609+ }
13610+
13611+ return retval;
13612+}
13613+
13614+__u32
13615+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
13616+ const struct vfsmount * mnt, const __u32 mode)
13617+{
13618+ struct name_entry *match;
13619+ struct acl_object_label *matchpo;
13620+ struct acl_subject_label *curracl;
13621+ char *path;
13622+ __u32 retval;
13623+
13624+ if (unlikely(!(gr_status & GR_READY)))
13625+ return (mode & ~GR_AUDITS);
13626+
13627+ preempt_disable();
13628+ path = gr_to_filename_rbac(new_dentry, mnt);
13629+ match = lookup_name_entry(path);
13630+
13631+ if (!match)
13632+ goto check_parent;
13633+
13634+ curracl = current->acl;
13635+
13636+ read_lock(&gr_inode_lock);
13637+ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
13638+ read_unlock(&gr_inode_lock);
13639+
13640+ if (matchpo) {
13641+ if ((matchpo->mode & mode) !=
13642+ (mode & ~(GR_AUDITS | GR_SUPPRESS))
13643+ && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
13644+ __u32 new_mode = mode;
13645+
13646+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
13647+
13648+ gr_log_learn(current, new_dentry, mnt, new_mode);
13649+
13650+ preempt_enable();
13651+ return new_mode;
13652+ }
13653+ preempt_enable();
13654+ return (matchpo->mode & mode);
13655+ }
13656+
13657+ check_parent:
13658+ curracl = current->acl;
13659+
13660+ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
13661+ retval = matchpo->mode & mode;
13662+
13663+ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
13664+ && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
13665+ __u32 new_mode = mode;
13666+
13667+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
13668+
13669+ gr_log_learn(current, new_dentry, mnt, new_mode);
13670+ preempt_enable();
13671+ return new_mode;
13672+ }
13673+
13674+ preempt_enable();
13675+ return retval;
13676+}
13677+
13678+int
13679+gr_check_hidden_task(const struct task_struct *task)
13680+{
13681+ if (unlikely(!(gr_status & GR_READY)))
13682+ return 0;
13683+
13684+ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
13685+ return 1;
13686+
13687+ return 0;
13688+}
13689+
13690+int
13691+gr_check_protected_task(const struct task_struct *task)
13692+{
13693+ if (unlikely(!(gr_status & GR_READY) || !task))
13694+ return 0;
13695+
13696+ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
13697+ task->acl != current->acl)
13698+ return 1;
13699+
13700+ return 0;
13701+}
13702+
13703+void
13704+gr_copy_label(struct task_struct *tsk)
13705+{
13706+ tsk->signal->used_accept = 0;
13707+ tsk->acl_sp_role = 0;
13708+ tsk->acl_role_id = current->acl_role_id;
13709+ tsk->acl = current->acl;
13710+ tsk->role = current->role;
13711+ tsk->signal->curr_ip = current->signal->curr_ip;
13712+ if (current->exec_file)
13713+ get_file(current->exec_file);
13714+ tsk->exec_file = current->exec_file;
13715+ tsk->is_writable = current->is_writable;
13716+ if (unlikely(current->signal->used_accept))
13717+ current->signal->curr_ip = 0;
13718+
13719+ return;
13720+}
13721+
13722+static void
13723+gr_set_proc_res(struct task_struct *task)
13724+{
13725+ struct acl_subject_label *proc;
13726+ unsigned short i;
13727+
13728+ proc = task->acl;
13729+
13730+ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
13731+ return;
13732+
13733+ for (i = 0; i < (GR_NLIMITS - 1); i++) {
13734+ if (!(proc->resmask & (1 << i)))
13735+ continue;
13736+
13737+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
13738+ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
13739+ }
13740+
13741+ return;
13742+}
13743+
13744+int
13745+gr_check_user_change(int real, int effective, int fs)
13746+{
13747+ unsigned int i;
13748+ __u16 num;
13749+ uid_t *uidlist;
13750+ int curuid;
13751+ int realok = 0;
13752+ int effectiveok = 0;
13753+ int fsok = 0;
13754+
13755+ if (unlikely(!(gr_status & GR_READY)))
13756+ return 0;
13757+
13758+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
13759+ gr_log_learn_id_change(current, 'u', real, effective, fs);
13760+
13761+ num = current->acl->user_trans_num;
13762+ uidlist = current->acl->user_transitions;
13763+
13764+ if (uidlist == NULL)
13765+ return 0;
13766+
13767+ if (real == -1)
13768+ realok = 1;
13769+ if (effective == -1)
13770+ effectiveok = 1;
13771+ if (fs == -1)
13772+ fsok = 1;
13773+
13774+ if (current->acl->user_trans_type & GR_ID_ALLOW) {
13775+ for (i = 0; i < num; i++) {
13776+ curuid = (int)uidlist[i];
13777+ if (real == curuid)
13778+ realok = 1;
13779+ if (effective == curuid)
13780+ effectiveok = 1;
13781+ if (fs == curuid)
13782+ fsok = 1;
13783+ }
13784+ } else if (current->acl->user_trans_type & GR_ID_DENY) {
13785+ for (i = 0; i < num; i++) {
13786+ curuid = (int)uidlist[i];
13787+ if (real == curuid)
13788+ break;
13789+ if (effective == curuid)
13790+ break;
13791+ if (fs == curuid)
13792+ break;
13793+ }
13794+ /* not in deny list */
13795+ if (i == num) {
13796+ realok = 1;
13797+ effectiveok = 1;
13798+ fsok = 1;
13799+ }
13800+ }
13801+
13802+ if (realok && effectiveok && fsok)
13803+ return 0;
13804+ else {
13805+ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
13806+ return 1;
13807+ }
13808+}
13809+
13810+int
13811+gr_check_group_change(int real, int effective, int fs)
13812+{
13813+ unsigned int i;
13814+ __u16 num;
13815+ gid_t *gidlist;
13816+ int curgid;
13817+ int realok = 0;
13818+ int effectiveok = 0;
13819+ int fsok = 0;
13820+
13821+ if (unlikely(!(gr_status & GR_READY)))
13822+ return 0;
13823+
13824+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
13825+ gr_log_learn_id_change(current, 'g', real, effective, fs);
13826+
13827+ num = current->acl->group_trans_num;
13828+ gidlist = current->acl->group_transitions;
13829+
13830+ if (gidlist == NULL)
13831+ return 0;
13832+
13833+ if (real == -1)
13834+ realok = 1;
13835+ if (effective == -1)
13836+ effectiveok = 1;
13837+ if (fs == -1)
13838+ fsok = 1;
13839+
13840+ if (current->acl->group_trans_type & GR_ID_ALLOW) {
13841+ for (i = 0; i < num; i++) {
13842+ curgid = (int)gidlist[i];
13843+ if (real == curgid)
13844+ realok = 1;
13845+ if (effective == curgid)
13846+ effectiveok = 1;
13847+ if (fs == curgid)
13848+ fsok = 1;
13849+ }
13850+ } else if (current->acl->group_trans_type & GR_ID_DENY) {
13851+ for (i = 0; i < num; i++) {
13852+ curgid = (int)gidlist[i];
13853+ if (real == curgid)
13854+ break;
13855+ if (effective == curgid)
13856+ break;
13857+ if (fs == curgid)
13858+ break;
13859+ }
13860+ /* not in deny list */
13861+ if (i == num) {
13862+ realok = 1;
13863+ effectiveok = 1;
13864+ fsok = 1;
13865+ }
13866+ }
13867+
13868+ if (realok && effectiveok && fsok)
13869+ return 0;
13870+ else {
13871+ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
13872+ return 1;
13873+ }
13874+}
13875+
13876+void
13877+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
13878+{
13879+ struct acl_role_label *role = task->role;
13880+ struct acl_subject_label *subj = NULL;
13881+ struct acl_object_label *obj;
13882+ struct file *filp;
13883+
13884+ if (unlikely(!(gr_status & GR_READY)))
13885+ return;
13886+
13887+ filp = task->exec_file;
13888+
13889+ /* kernel process, we'll give them the kernel role */
13890+ if (unlikely(!filp)) {
13891+ task->role = kernel_role;
13892+ task->acl = kernel_role->root_label;
13893+ return;
13894+ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
13895+ role = lookup_acl_role_label(task, uid, gid);
13896+
13897+ /* perform subject lookup in possibly new role
13898+ we can use this result below in the case where role == task->role
13899+ */
13900+ subj = chk_subj_label(filp->f_dentry, filp->f_vfsmnt, role);
13901+
13902+ /* if we changed uid/gid, but result in the same role
13903+ and are using inheritance, don't lose the inherited subject
13904+ if current subject is other than what normal lookup
13905+ would result in, we arrived via inheritance, don't
13906+ lose subject
13907+ */
13908+ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
13909+ (subj == task->acl)))
13910+ task->acl = subj;
13911+
13912+ task->role = role;
13913+
13914+ task->is_writable = 0;
13915+
13916+ /* ignore additional mmap checks for processes that are writable
13917+ by the default ACL */
13918+ obj = chk_obj_label(filp->f_dentry, filp->f_vfsmnt, default_role->root_label);
13919+ if (unlikely(obj->mode & GR_WRITE))
13920+ task->is_writable = 1;
13921+ obj = chk_obj_label(filp->f_dentry, filp->f_vfsmnt, task->role->root_label);
13922+ if (unlikely(obj->mode & GR_WRITE))
13923+ task->is_writable = 1;
13924+
13925+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
13926+ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
13927+#endif
13928+
13929+ gr_set_proc_res(task);
13930+
13931+ return;
13932+}
13933+
13934+int
13935+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt)
13936+{
13937+ struct task_struct *task = current;
13938+ struct acl_subject_label *newacl;
13939+ struct acl_object_label *obj;
13940+ __u32 retmode;
13941+
13942+ if (unlikely(!(gr_status & GR_READY)))
13943+ return 0;
13944+
13945+ newacl = chk_subj_label(dentry, mnt, task->role);
13946+
13947+ task_lock(task);
13948+ if (((task->ptrace & PT_PTRACED) && !(task->acl->mode &
13949+ GR_POVERRIDE) && (task->acl != newacl) &&
13950+ !(task->role->roletype & GR_ROLE_GOD) &&
13951+ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
13952+ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN))) ||
13953+ (atomic_read(&task->fs->count) > 1 ||
13954+ atomic_read(&task->files->count) > 1 ||
13955+ atomic_read(&task->sighand->count) > 1)) {
13956+ task_unlock(task);
13957+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
13958+ return -EACCES;
13959+ }
13960+ task_unlock(task);
13961+
13962+ obj = chk_obj_label(dentry, mnt, task->acl);
13963+ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
13964+
13965+ if (!(task->acl->mode & GR_INHERITLEARN) &&
13966+ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
13967+ if (obj->nested)
13968+ task->acl = obj->nested;
13969+ else
13970+ task->acl = newacl;
13971+ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
13972+ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
13973+
13974+ task->is_writable = 0;
13975+
13976+ /* ignore additional mmap checks for processes that are writable
13977+ by the default ACL */
13978+ obj = chk_obj_label(dentry, mnt, default_role->root_label);
13979+ if (unlikely(obj->mode & GR_WRITE))
13980+ task->is_writable = 1;
13981+ obj = chk_obj_label(dentry, mnt, task->role->root_label);
13982+ if (unlikely(obj->mode & GR_WRITE))
13983+ task->is_writable = 1;
13984+
13985+ gr_set_proc_res(task);
13986+
13987+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
13988+ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
13989+#endif
13990+ return 0;
13991+}
13992+
13993+static void
13994+do_handle_delete(const ino_t ino, const dev_t dev)
13995+{
13996+ struct acl_object_label *matchpo;
13997+ struct acl_subject_label *matchps;
13998+ struct acl_subject_label *subj;
13999+ struct acl_role_label *role;
14000+ unsigned int i, x;
14001+
14002+ FOR_EACH_ROLE_START(role, i)
14003+ FOR_EACH_SUBJECT_START(role, subj, x)
14004+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
14005+ matchpo->mode |= GR_DELETED;
14006+ FOR_EACH_SUBJECT_END(subj,x)
14007+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
14008+ if (subj->inode == ino && subj->device == dev)
14009+ subj->mode |= GR_DELETED;
14010+ FOR_EACH_NESTED_SUBJECT_END(subj)
14011+ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
14012+ matchps->mode |= GR_DELETED;
14013+ FOR_EACH_ROLE_END(role,i)
14014+
14015+ return;
14016+}
14017+
14018+void
14019+gr_handle_delete(const ino_t ino, const dev_t dev)
14020+{
14021+ if (unlikely(!(gr_status & GR_READY)))
14022+ return;
14023+
14024+ write_lock(&gr_inode_lock);
14025+ if (unlikely((unsigned long)lookup_inodev_entry(ino, dev)))
14026+ do_handle_delete(ino, dev);
14027+ write_unlock(&gr_inode_lock);
14028+
14029+ return;
14030+}
14031+
14032+static void
14033+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
14034+ const ino_t newinode, const dev_t newdevice,
14035+ struct acl_subject_label *subj)
14036+{
14037+ unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
14038+ struct acl_object_label *match;
14039+
14040+ match = subj->obj_hash[index];
14041+
14042+ while (match && (match->inode != oldinode ||
14043+ match->device != olddevice ||
14044+ !(match->mode & GR_DELETED)))
14045+ match = match->next;
14046+
14047+ if (match && (match->inode == oldinode)
14048+ && (match->device == olddevice)
14049+ && (match->mode & GR_DELETED)) {
14050+ if (match->prev == NULL) {
14051+ subj->obj_hash[index] = match->next;
14052+ if (match->next != NULL)
14053+ match->next->prev = NULL;
14054+ } else {
14055+ match->prev->next = match->next;
14056+ if (match->next != NULL)
14057+ match->next->prev = match->prev;
14058+ }
14059+ match->prev = NULL;
14060+ match->next = NULL;
14061+ match->inode = newinode;
14062+ match->device = newdevice;
14063+ match->mode &= ~GR_DELETED;
14064+
14065+ insert_acl_obj_label(match, subj);
14066+ }
14067+
14068+ return;
14069+}
14070+
14071+static void
14072+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
14073+ const ino_t newinode, const dev_t newdevice,
14074+ struct acl_role_label *role)
14075+{
14076+ unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
14077+ struct acl_subject_label *match;
14078+
14079+ match = role->subj_hash[index];
14080+
14081+ while (match && (match->inode != oldinode ||
14082+ match->device != olddevice ||
14083+ !(match->mode & GR_DELETED)))
14084+ match = match->next;
14085+
14086+ if (match && (match->inode == oldinode)
14087+ && (match->device == olddevice)
14088+ && (match->mode & GR_DELETED)) {
14089+ if (match->prev == NULL) {
14090+ role->subj_hash[index] = match->next;
14091+ if (match->next != NULL)
14092+ match->next->prev = NULL;
14093+ } else {
14094+ match->prev->next = match->next;
14095+ if (match->next != NULL)
14096+ match->next->prev = match->prev;
14097+ }
14098+ match->prev = NULL;
14099+ match->next = NULL;
14100+ match->inode = newinode;
14101+ match->device = newdevice;
14102+ match->mode &= ~GR_DELETED;
14103+
14104+ insert_acl_subj_label(match, role);
14105+ }
14106+
14107+ return;
14108+}
14109+
14110+static void
14111+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
14112+ const ino_t newinode, const dev_t newdevice)
14113+{
14114+ unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
14115+ struct inodev_entry *match;
14116+
14117+ match = inodev_set.i_hash[index];
14118+
14119+ while (match && (match->nentry->inode != oldinode ||
14120+ match->nentry->device != olddevice))
14121+ match = match->next;
14122+
14123+ if (match && (match->nentry->inode == oldinode)
14124+ && (match->nentry->device == olddevice)) {
14125+ if (match->prev == NULL) {
14126+ inodev_set.i_hash[index] = match->next;
14127+ if (match->next != NULL)
14128+ match->next->prev = NULL;
14129+ } else {
14130+ match->prev->next = match->next;
14131+ if (match->next != NULL)
14132+ match->next->prev = match->prev;
14133+ }
14134+ match->prev = NULL;
14135+ match->next = NULL;
14136+ match->nentry->inode = newinode;
14137+ match->nentry->device = newdevice;
14138+
14139+ insert_inodev_entry(match);
14140+ }
14141+
14142+ return;
14143+}
14144+
14145+static void
14146+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
14147+ const struct vfsmount *mnt)
14148+{
14149+ struct acl_subject_label *subj;
14150+ struct acl_role_label *role;
14151+ unsigned int i, x;
14152+
14153+ FOR_EACH_ROLE_START(role, i)
14154+ update_acl_subj_label(matchn->inode, matchn->device,
14155+ dentry->d_inode->i_ino,
14156+ dentry->d_inode->i_sb->s_dev, role);
14157+
14158+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
14159+ if ((subj->inode == dentry->d_inode->i_ino) &&
14160+ (subj->device == dentry->d_inode->i_sb->s_dev)) {
14161+ subj->inode = dentry->d_inode->i_ino;
14162+ subj->device = dentry->d_inode->i_sb->s_dev;
14163+ }
14164+ FOR_EACH_NESTED_SUBJECT_END(subj)
14165+ FOR_EACH_SUBJECT_START(role, subj, x)
14166+ update_acl_obj_label(matchn->inode, matchn->device,
14167+ dentry->d_inode->i_ino,
14168+ dentry->d_inode->i_sb->s_dev, subj);
14169+ FOR_EACH_SUBJECT_END(subj,x)
14170+ FOR_EACH_ROLE_END(role,i)
14171+
14172+ update_inodev_entry(matchn->inode, matchn->device,
14173+ dentry->d_inode->i_ino, dentry->d_inode->i_sb->s_dev);
14174+
14175+ return;
14176+}
14177+
14178+void
14179+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
14180+{
14181+ struct name_entry *matchn;
14182+
14183+ if (unlikely(!(gr_status & GR_READY)))
14184+ return;
14185+
14186+ preempt_disable();
14187+ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
14188+
14189+ if (unlikely((unsigned long)matchn)) {
14190+ write_lock(&gr_inode_lock);
14191+ do_handle_create(matchn, dentry, mnt);
14192+ write_unlock(&gr_inode_lock);
14193+ }
14194+ preempt_enable();
14195+
14196+ return;
14197+}
14198+
14199+void
14200+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
14201+ struct dentry *old_dentry,
14202+ struct dentry *new_dentry,
14203+ struct vfsmount *mnt, const __u8 replace)
14204+{
14205+ struct name_entry *matchn;
14206+
14207+ if (unlikely(!(gr_status & GR_READY)))
14208+ return;
14209+
14210+ preempt_disable();
14211+ matchn = lookup_name_entry(gr_to_filename_rbac(new_dentry, mnt));
14212+
14213+ /* we wouldn't have to check d_inode if it weren't for
14214+ NFS silly-renaming
14215+ */
14216+
14217+ write_lock(&gr_inode_lock);
14218+ if (unlikely(replace && new_dentry->d_inode)) {
14219+ if (unlikely(lookup_inodev_entry(new_dentry->d_inode->i_ino,
14220+ new_dentry->d_inode->i_sb->s_dev) &&
14221+ (old_dentry->d_inode->i_nlink <= 1)))
14222+ do_handle_delete(new_dentry->d_inode->i_ino,
14223+ new_dentry->d_inode->i_sb->s_dev);
14224+ }
14225+
14226+ if (unlikely(lookup_inodev_entry(old_dentry->d_inode->i_ino,
14227+ old_dentry->d_inode->i_sb->s_dev) &&
14228+ (old_dentry->d_inode->i_nlink <= 1)))
14229+ do_handle_delete(old_dentry->d_inode->i_ino,
14230+ old_dentry->d_inode->i_sb->s_dev);
14231+
14232+ if (unlikely((unsigned long)matchn))
14233+ do_handle_create(matchn, old_dentry, mnt);
14234+
14235+ write_unlock(&gr_inode_lock);
14236+ preempt_enable();
14237+
14238+ return;
14239+}
14240+
14241+static int
14242+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
14243+ unsigned char **sum)
14244+{
14245+ struct acl_role_label *r;
14246+ struct role_allowed_ip *ipp;
14247+ struct role_transition *trans;
14248+ unsigned int i;
14249+ int found = 0;
14250+
14251+ /* check transition table */
14252+
14253+ for (trans = current->role->transitions; trans; trans = trans->next) {
14254+ if (!strcmp(rolename, trans->rolename)) {
14255+ found = 1;
14256+ break;
14257+ }
14258+ }
14259+
14260+ if (!found)
14261+ return 0;
14262+
14263+ /* handle special roles that do not require authentication
14264+ and check ip */
14265+
14266+ FOR_EACH_ROLE_START(r, i)
14267+ if (!strcmp(rolename, r->rolename) &&
14268+ (r->roletype & GR_ROLE_SPECIAL)) {
14269+ found = 0;
14270+ if (r->allowed_ips != NULL) {
14271+ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
14272+ if ((ntohl(current->signal->curr_ip) & ipp->netmask) ==
14273+ (ntohl(ipp->addr) & ipp->netmask))
14274+ found = 1;
14275+ }
14276+ } else
14277+ found = 2;
14278+ if (!found)
14279+ return 0;
14280+
14281+ if (((mode == SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
14282+ ((mode == SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
14283+ *salt = NULL;
14284+ *sum = NULL;
14285+ return 1;
14286+ }
14287+ }
14288+ FOR_EACH_ROLE_END(r,i)
14289+
14290+ for (i = 0; i < num_sprole_pws; i++) {
14291+ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
14292+ *salt = acl_special_roles[i]->salt;
14293+ *sum = acl_special_roles[i]->sum;
14294+ return 1;
14295+ }
14296+ }
14297+
14298+ return 0;
14299+}
14300+
14301+static void
14302+assign_special_role(char *rolename)
14303+{
14304+ struct acl_object_label *obj;
14305+ struct acl_role_label *r;
14306+ struct acl_role_label *assigned = NULL;
14307+ struct task_struct *tsk;
14308+ struct file *filp;
14309+ unsigned int i;
14310+
14311+ FOR_EACH_ROLE_START(r, i)
14312+ if (!strcmp(rolename, r->rolename) &&
14313+ (r->roletype & GR_ROLE_SPECIAL))
14314+ assigned = r;
14315+ FOR_EACH_ROLE_END(r,i)
14316+
14317+ if (!assigned)
14318+ return;
14319+
14320+ read_lock(&tasklist_lock);
14321+ read_lock(&grsec_exec_file_lock);
14322+
14323+ tsk = current->parent;
14324+ if (tsk == NULL)
14325+ goto out_unlock;
14326+
14327+ filp = tsk->exec_file;
14328+ if (filp == NULL)
14329+ goto out_unlock;
14330+
14331+ tsk->is_writable = 0;
14332+
14333+ tsk->acl_sp_role = 1;
14334+ tsk->acl_role_id = ++acl_sp_role_value;
14335+ tsk->role = assigned;
14336+ tsk->acl = chk_subj_label(filp->f_dentry, filp->f_vfsmnt, tsk->role);
14337+
14338+ /* ignore additional mmap checks for processes that are writable
14339+ by the default ACL */
14340+ obj = chk_obj_label(filp->f_dentry, filp->f_vfsmnt, default_role->root_label);
14341+ if (unlikely(obj->mode & GR_WRITE))
14342+ tsk->is_writable = 1;
14343+ obj = chk_obj_label(filp->f_dentry, filp->f_vfsmnt, tsk->role->root_label);
14344+ if (unlikely(obj->mode & GR_WRITE))
14345+ tsk->is_writable = 1;
14346+
14347+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
14348+ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
14349+#endif
14350+
14351+out_unlock:
14352+ read_unlock(&grsec_exec_file_lock);
14353+ read_unlock(&tasklist_lock);
14354+ return;
14355+}
14356+
14357+int gr_check_secure_terminal(struct task_struct *task)
14358+{
14359+ struct task_struct *p, *p2, *p3;
14360+ struct files_struct *files;
14361+ struct fdtable *fdt;
14362+ struct file *our_file = NULL, *file;
14363+ int i;
14364+
14365+ if (task->signal->tty == NULL)
14366+ return 1;
14367+
14368+ files = get_files_struct(task);
14369+ if (files != NULL) {
14370+ rcu_read_lock();
14371+ fdt = files_fdtable(files);
14372+ for (i=0; i < fdt->max_fds; i++) {
14373+ file = fcheck_files(files, i);
14374+ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
14375+ get_file(file);
14376+ our_file = file;
14377+ }
14378+ }
14379+ rcu_read_unlock();
14380+ put_files_struct(files);
14381+ }
14382+
14383+ if (our_file == NULL)
14384+ return 1;
14385+
14386+ read_lock(&tasklist_lock);
14387+ do_each_thread(p2, p) {
14388+ files = get_files_struct(p);
14389+ if (files == NULL ||
14390+ (p->signal && p->signal->tty == task->signal->tty)) {
14391+ if (files != NULL)
14392+ put_files_struct(files);
14393+ continue;
14394+ }
14395+ rcu_read_lock();
14396+ fdt = files_fdtable(files);
14397+ for (i=0; i < fdt->max_fds; i++) {
14398+ file = fcheck_files(files, i);
14399+ if (file && S_ISCHR(file->f_dentry->d_inode->i_mode) &&
14400+ file->f_dentry->d_inode->i_rdev == our_file->f_dentry->d_inode->i_rdev) {
14401+ p3 = task;
14402+ while (p3->pid > 0) {
14403+ if (p3 == p)
14404+ break;
14405+ p3 = p3->parent;
14406+ }
14407+ if (p3 == p)
14408+ break;
14409+ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
14410+ gr_handle_alertkill(p);
14411+ rcu_read_unlock();
14412+ put_files_struct(files);
14413+ read_unlock(&tasklist_lock);
14414+ fput(our_file);
14415+ return 0;
14416+ }
14417+ }
14418+ rcu_read_unlock();
14419+ put_files_struct(files);
14420+ } while_each_thread(p2, p);
14421+ read_unlock(&tasklist_lock);
14422+
14423+ fput(our_file);
14424+ return 1;
14425+}
14426+
14427+ssize_t
14428+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
14429+{
14430+ struct gr_arg_wrapper uwrap;
14431+ unsigned char *sprole_salt;
14432+ unsigned char *sprole_sum;
14433+ int error = sizeof (struct gr_arg_wrapper);
14434+ int error2 = 0;
14435+
14436+ down(&gr_dev_sem);
14437+
14438+ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
14439+ error = -EPERM;
14440+ goto out;
14441+ }
14442+
14443+ if (count != sizeof (struct gr_arg_wrapper)) {
14444+ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
14445+ error = -EINVAL;
14446+ goto out;
14447+ }
14448+
14449+
14450+ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
14451+ gr_auth_expires = 0;
14452+ gr_auth_attempts = 0;
14453+ }
14454+
14455+ if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
14456+ error = -EFAULT;
14457+ goto out;
14458+ }
14459+
14460+ if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
14461+ error = -EINVAL;
14462+ goto out;
14463+ }
14464+
14465+ if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
14466+ error = -EFAULT;
14467+ goto out;
14468+ }
14469+
14470+ if (gr_usermode->mode != SPROLE && gr_usermode->mode != SPROLEPAM &&
14471+ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
14472+ time_after(gr_auth_expires, get_seconds())) {
14473+ error = -EBUSY;
14474+ goto out;
14475+ }
14476+
14477+ /* if non-root trying to do anything other than use a special role,
14478+ do not attempt authentication, do not count towards authentication
14479+ locking
14480+ */
14481+
14482+ if (gr_usermode->mode != SPROLE && gr_usermode->mode != STATUS &&
14483+ gr_usermode->mode != UNSPROLE && gr_usermode->mode != SPROLEPAM &&
14484+ current->uid) {
14485+ error = -EPERM;
14486+ goto out;
14487+ }
14488+
14489+ /* ensure pw and special role name are null terminated */
14490+
14491+ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
14492+ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
14493+
14494+ /* Okay.
14495+ * We have our enough of the argument structure..(we have yet
14496+ * to copy_from_user the tables themselves) . Copy the tables
14497+ * only if we need them, i.e. for loading operations. */
14498+
14499+ switch (gr_usermode->mode) {
14500+ case STATUS:
14501+ if (gr_status & GR_READY) {
14502+ error = 1;
14503+ if (!gr_check_secure_terminal(current))
14504+ error = 3;
14505+ } else
14506+ error = 2;
14507+ goto out;
14508+ case SHUTDOWN:
14509+ if ((gr_status & GR_READY)
14510+ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
14511+ gr_status &= ~GR_READY;
14512+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
14513+ free_variables();
14514+ memset(gr_usermode, 0, sizeof (struct gr_arg));
14515+ memset(gr_system_salt, 0, GR_SALT_LEN);
14516+ memset(gr_system_sum, 0, GR_SHA_LEN);
14517+ } else if (gr_status & GR_READY) {
14518+ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
14519+ error = -EPERM;
14520+ } else {
14521+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
14522+ error = -EAGAIN;
14523+ }
14524+ break;
14525+ case ENABLE:
14526+ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
14527+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
14528+ else {
14529+ if (gr_status & GR_READY)
14530+ error = -EAGAIN;
14531+ else
14532+ error = error2;
14533+ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
14534+ }
14535+ break;
14536+ case RELOAD:
14537+ if (!(gr_status & GR_READY)) {
14538+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
14539+ error = -EAGAIN;
14540+ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
14541+ lock_kernel();
14542+ gr_status &= ~GR_READY;
14543+ free_variables();
14544+ if (!(error2 = gracl_init(gr_usermode))) {
14545+ unlock_kernel();
14546+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
14547+ } else {
14548+ unlock_kernel();
14549+ error = error2;
14550+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
14551+ }
14552+ } else {
14553+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
14554+ error = -EPERM;
14555+ }
14556+ break;
14557+ case SEGVMOD:
14558+ if (unlikely(!(gr_status & GR_READY))) {
14559+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
14560+ error = -EAGAIN;
14561+ break;
14562+ }
14563+
14564+ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
14565+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
14566+ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
14567+ struct acl_subject_label *segvacl;
14568+ segvacl =
14569+ lookup_acl_subj_label(gr_usermode->segv_inode,
14570+ gr_usermode->segv_device,
14571+ current->role);
14572+ if (segvacl) {
14573+ segvacl->crashes = 0;
14574+ segvacl->expires = 0;
14575+ }
14576+ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
14577+ gr_remove_uid(gr_usermode->segv_uid);
14578+ }
14579+ } else {
14580+ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
14581+ error = -EPERM;
14582+ }
14583+ break;
14584+ case SPROLE:
14585+ case SPROLEPAM:
14586+ if (unlikely(!(gr_status & GR_READY))) {
14587+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
14588+ error = -EAGAIN;
14589+ break;
14590+ }
14591+
14592+ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
14593+ current->role->expires = 0;
14594+ current->role->auth_attempts = 0;
14595+ }
14596+
14597+ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
14598+ time_after(current->role->expires, get_seconds())) {
14599+ error = -EBUSY;
14600+ goto out;
14601+ }
14602+
14603+ if (lookup_special_role_auth
14604+ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
14605+ && ((!sprole_salt && !sprole_sum)
14606+ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
14607+ char *p = "";
14608+ assign_special_role(gr_usermode->sp_role);
14609+ read_lock(&tasklist_lock);
14610+ if (current->parent)
14611+ p = current->parent->role->rolename;
14612+ read_unlock(&tasklist_lock);
14613+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
14614+ p, acl_sp_role_value);
14615+ } else {
14616+ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
14617+ error = -EPERM;
14618+ if(!(current->role->auth_attempts++))
14619+ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
14620+
14621+ goto out;
14622+ }
14623+ break;
14624+ case UNSPROLE:
14625+ if (unlikely(!(gr_status & GR_READY))) {
14626+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
14627+ error = -EAGAIN;
14628+ break;
14629+ }
14630+
14631+ if (current->role->roletype & GR_ROLE_SPECIAL) {
14632+ char *p = "";
14633+ int i = 0;
14634+
14635+ read_lock(&tasklist_lock);
14636+ if (current->parent) {
14637+ p = current->parent->role->rolename;
14638+ i = current->parent->acl_role_id;
14639+ }
14640+ read_unlock(&tasklist_lock);
14641+
14642+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
14643+ gr_set_acls(1);
14644+ } else {
14645+ gr_log_str(GR_DONT_AUDIT, GR_UNSPROLEF_ACL_MSG, current->role->rolename);
14646+ error = -EPERM;
14647+ goto out;
14648+ }
14649+ break;
14650+ default:
14651+ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
14652+ error = -EINVAL;
14653+ break;
14654+ }
14655+
14656+ if (error != -EPERM)
14657+ goto out;
14658+
14659+ if(!(gr_auth_attempts++))
14660+ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
14661+
14662+ out:
14663+ up(&gr_dev_sem);
14664+ return error;
14665+}
14666+
14667+int
14668+gr_set_acls(const int type)
14669+{
14670+ struct acl_object_label *obj;
14671+ struct task_struct *task, *task2;
14672+ struct file *filp;
14673+ struct acl_role_label *role = current->role;
14674+ __u16 acl_role_id = current->acl_role_id;
14675+
14676+ read_lock(&tasklist_lock);
14677+ read_lock(&grsec_exec_file_lock);
14678+ do_each_thread(task2, task) {
14679+ /* check to see if we're called from the exit handler,
14680+ if so, only replace ACLs that have inherited the admin
14681+ ACL */
14682+
14683+ if (type && (task->role != role ||
14684+ task->acl_role_id != acl_role_id))
14685+ continue;
14686+
14687+ task->acl_role_id = 0;
14688+ task->acl_sp_role = 0;
14689+
14690+ if ((filp = task->exec_file)) {
14691+ task->role = lookup_acl_role_label(task, task->uid, task->gid);
14692+
14693+ task->acl =
14694+ chk_subj_label(filp->f_dentry, filp->f_vfsmnt,
14695+ task->role);
14696+ if (task->acl) {
14697+ struct acl_subject_label *curr;
14698+ curr = task->acl;
14699+
14700+ task->is_writable = 0;
14701+ /* ignore additional mmap checks for processes that are writable
14702+ by the default ACL */
14703+ obj = chk_obj_label(filp->f_dentry, filp->f_vfsmnt, default_role->root_label);
14704+ if (unlikely(obj->mode & GR_WRITE))
14705+ task->is_writable = 1;
14706+ obj = chk_obj_label(filp->f_dentry, filp->f_vfsmnt, task->role->root_label);
14707+ if (unlikely(obj->mode & GR_WRITE))
14708+ task->is_writable = 1;
14709+
14710+ gr_set_proc_res(task);
14711+
14712+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
14713+ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
14714+#endif
14715+ } else {
14716+ read_unlock(&grsec_exec_file_lock);
14717+ read_unlock(&tasklist_lock);
14718+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
14719+ return 1;
14720+ }
14721+ } else {
14722+ // it's a kernel process
14723+ task->role = kernel_role;
14724+ task->acl = kernel_role->root_label;
14725+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
14726+ task->acl->mode &= ~GR_PROCFIND;
14727+#endif
14728+ }
14729+ } while_each_thread(task2, task);
14730+ read_unlock(&grsec_exec_file_lock);
14731+ read_unlock(&tasklist_lock);
14732+ return 0;
14733+}
14734+
14735+void
14736+gr_learn_resource(const struct task_struct *task,
14737+ const int res, const unsigned long wanted, const int gt)
14738+{
14739+ struct acl_subject_label *acl;
14740+
14741+ if (unlikely((gr_status & GR_READY) &&
14742+ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
14743+ goto skip_reslog;
14744+
14745+#ifdef CONFIG_GRKERNSEC_RESLOG
14746+ gr_log_resource(task, res, wanted, gt);
14747+#endif
14748+ skip_reslog:
14749+
14750+ if (unlikely(!(gr_status & GR_READY) || !wanted))
14751+ return;
14752+
14753+ acl = task->acl;
14754+
14755+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
14756+ !(acl->resmask & (1 << (unsigned short) res))))
14757+ return;
14758+
14759+ if (wanted >= acl->res[res].rlim_cur) {
14760+ unsigned long res_add;
14761+
14762+ res_add = wanted;
14763+ switch (res) {
14764+ case RLIMIT_CPU:
14765+ res_add += GR_RLIM_CPU_BUMP;
14766+ break;
14767+ case RLIMIT_FSIZE:
14768+ res_add += GR_RLIM_FSIZE_BUMP;
14769+ break;
14770+ case RLIMIT_DATA:
14771+ res_add += GR_RLIM_DATA_BUMP;
14772+ break;
14773+ case RLIMIT_STACK:
14774+ res_add += GR_RLIM_STACK_BUMP;
14775+ break;
14776+ case RLIMIT_CORE:
14777+ res_add += GR_RLIM_CORE_BUMP;
14778+ break;
14779+ case RLIMIT_RSS:
14780+ res_add += GR_RLIM_RSS_BUMP;
14781+ break;
14782+ case RLIMIT_NPROC:
14783+ res_add += GR_RLIM_NPROC_BUMP;
14784+ break;
14785+ case RLIMIT_NOFILE:
14786+ res_add += GR_RLIM_NOFILE_BUMP;
14787+ break;
14788+ case RLIMIT_MEMLOCK:
14789+ res_add += GR_RLIM_MEMLOCK_BUMP;
14790+ break;
14791+ case RLIMIT_AS:
14792+ res_add += GR_RLIM_AS_BUMP;
14793+ break;
14794+ case RLIMIT_LOCKS:
14795+ res_add += GR_RLIM_LOCKS_BUMP;
14796+ break;
14797+ }
14798+
14799+ acl->res[res].rlim_cur = res_add;
14800+
14801+ if (wanted > acl->res[res].rlim_max)
14802+ acl->res[res].rlim_max = res_add;
14803+
14804+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
14805+ task->role->roletype, acl->filename,
14806+ acl->res[res].rlim_cur, acl->res[res].rlim_max,
14807+ "", (unsigned long) res);
14808+ }
14809+
14810+ return;
14811+}
14812+
14813+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
14814+void
14815+pax_set_initial_flags(struct linux_binprm *bprm)
14816+{
14817+ struct task_struct *task = current;
14818+ struct acl_subject_label *proc;
14819+ unsigned long flags;
14820+
14821+ if (unlikely(!(gr_status & GR_READY)))
14822+ return;
14823+
14824+ flags = pax_get_flags(task);
14825+
14826+ proc = task->acl;
14827+
14828+ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
14829+ flags &= ~MF_PAX_PAGEEXEC;
14830+ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
14831+ flags &= ~MF_PAX_SEGMEXEC;
14832+ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
14833+ flags &= ~MF_PAX_RANDMMAP;
14834+ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
14835+ flags &= ~MF_PAX_EMUTRAMP;
14836+ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
14837+ flags &= ~MF_PAX_MPROTECT;
14838+
14839+ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
14840+ flags |= MF_PAX_PAGEEXEC;
14841+ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
14842+ flags |= MF_PAX_SEGMEXEC;
14843+ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
14844+ flags |= MF_PAX_RANDMMAP;
14845+ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
14846+ flags |= MF_PAX_EMUTRAMP;
14847+ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
14848+ flags |= MF_PAX_MPROTECT;
14849+
14850+ pax_set_flags(task, flags);
14851+
14852+ return;
14853+}
14854+#endif
14855+
14856+#ifdef CONFIG_SYSCTL
14857+extern struct proc_dir_entry *proc_sys_root;
14858+
14859+/* the following function is called under the BKL */
14860+
14861+__u32
14862+gr_handle_sysctl(const struct ctl_table *table, const void *oldval,
14863+ const void *newval)
14864+{
14865+ struct proc_dir_entry *tmp;
14866+ struct nameidata nd;
14867+ const char *proc_sys = "/proc/sys";
14868+ char *path;
14869+ struct acl_object_label *obj;
14870+ unsigned short len = 0, pos = 0, depth = 0, i;
14871+ __u32 err = 0;
14872+ __u32 mode = 0;
14873+
14874+ if (unlikely(!(gr_status & GR_READY)))
14875+ return 1;
14876+
14877+ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
14878+
14879+ if (oldval)
14880+ mode |= GR_READ;
14881+ if (newval)
14882+ mode |= GR_WRITE;
14883+
14884+ /* convert the requested sysctl entry into a pathname */
14885+
14886+ for (tmp = table->de; tmp != proc_sys_root; tmp = tmp->parent) {
14887+ len += strlen(tmp->name);
14888+ len++;
14889+ depth++;
14890+ }
14891+
14892+ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE)
14893+ return 0; /* deny */
14894+
14895+ memset(path, 0, PAGE_SIZE);
14896+
14897+ memcpy(path, proc_sys, strlen(proc_sys));
14898+
14899+ pos += strlen(proc_sys);
14900+
14901+ for (; depth > 0; depth--) {
14902+ path[pos] = '/';
14903+ pos++;
14904+ for (i = 1, tmp = table->de; tmp != proc_sys_root;
14905+ tmp = tmp->parent) {
14906+ if (depth == i) {
14907+ memcpy(path + pos, tmp->name,
14908+ strlen(tmp->name));
14909+ pos += strlen(tmp->name);
14910+ }
14911+ i++;
14912+ }
14913+ }
14914+
14915+ err = path_lookup(path, LOOKUP_FOLLOW, &nd);
14916+
14917+ if (err)
14918+ goto out;
14919+
14920+ obj = chk_obj_label(nd.dentry, nd.mnt, current->acl);
14921+ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
14922+
14923+ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
14924+ ((err & mode) != mode))) {
14925+ __u32 new_mode = mode;
14926+
14927+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
14928+
14929+ err = new_mode;
14930+ gr_log_learn(current, nd.dentry, nd.mnt, new_mode);
14931+ } else if ((err & mode) != mode && !(err & GR_SUPPRESS)) {
14932+ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
14933+ path, (mode & GR_READ) ? " reading" : "",
14934+ (mode & GR_WRITE) ? " writing" : "");
14935+ err = 0;
14936+ } else if ((err & mode) != mode) {
14937+ err = 0;
14938+ } else if (((err & mode) == mode) && (err & GR_AUDITS)) {
14939+ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
14940+ path, (mode & GR_READ) ? " reading" : "",
14941+ (mode & GR_WRITE) ? " writing" : "");
14942+ }
14943+
14944+ path_release(&nd);
14945+
14946+ out:
14947+ return err;
14948+}
14949+#endif
14950+
14951+int
14952+gr_handle_proc_ptrace(struct task_struct *task)
14953+{
14954+ struct file *filp;
14955+ struct task_struct *tmp = task;
14956+ struct task_struct *curtemp = current;
14957+ __u32 retmode;
14958+
14959+ if (unlikely(!(gr_status & GR_READY)))
14960+ return 0;
14961+
14962+ read_lock(&tasklist_lock);
14963+ read_lock(&grsec_exec_file_lock);
14964+ filp = task->exec_file;
14965+
14966+ while (tmp->pid > 0) {
14967+ if (tmp == curtemp)
14968+ break;
14969+ tmp = tmp->parent;
14970+ }
14971+
14972+ if (!filp || (tmp->pid == 0 && !(current->acl->mode & GR_RELAXPTRACE))) {
14973+ read_unlock(&grsec_exec_file_lock);
14974+ read_unlock(&tasklist_lock);
14975+ return 1;
14976+ }
14977+
14978+ retmode = gr_search_file(filp->f_dentry, GR_NOPTRACE, filp->f_vfsmnt);
14979+ read_unlock(&grsec_exec_file_lock);
14980+ read_unlock(&tasklist_lock);
14981+
14982+ if (retmode & GR_NOPTRACE)
14983+ return 1;
14984+
14985+ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
14986+ && (current->acl != task->acl || (current->acl != current->role->root_label
14987+ && current->pid != task->pid)))
14988+ return 1;
14989+
14990+ return 0;
14991+}
14992+
14993+int
14994+gr_handle_ptrace(struct task_struct *task, const long request)
14995+{
14996+ struct task_struct *tmp = task;
14997+ struct task_struct *curtemp = current;
14998+ __u32 retmode;
14999+
15000+ if (unlikely(!(gr_status & GR_READY)))
15001+ return 0;
15002+
15003+ read_lock(&tasklist_lock);
15004+ while (tmp->pid > 0) {
15005+ if (tmp == curtemp)
15006+ break;
15007+ tmp = tmp->parent;
15008+ }
15009+
15010+ if (tmp->pid == 0 && !(current->acl->mode & GR_RELAXPTRACE)) {
15011+ read_unlock(&tasklist_lock);
15012+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
15013+ return 1;
15014+ }
15015+ read_unlock(&tasklist_lock);
15016+
15017+ read_lock(&grsec_exec_file_lock);
15018+ if (unlikely(!task->exec_file)) {
15019+ read_unlock(&grsec_exec_file_lock);
15020+ return 0;
15021+ }
15022+
15023+ retmode = gr_search_file(task->exec_file->f_dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_vfsmnt);
15024+ read_unlock(&grsec_exec_file_lock);
15025+
15026+ if (retmode & GR_NOPTRACE) {
15027+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
15028+ return 1;
15029+ }
15030+
15031+ if (retmode & GR_PTRACERD) {
15032+ switch (request) {
15033+ case PTRACE_POKETEXT:
15034+ case PTRACE_POKEDATA:
15035+ case PTRACE_POKEUSR:
15036+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
15037+ case PTRACE_SETREGS:
15038+ case PTRACE_SETFPREGS:
15039+#endif
15040+#ifdef CONFIG_X86
15041+ case PTRACE_SETFPXREGS:
15042+#endif
15043+#ifdef CONFIG_ALTIVEC
15044+ case PTRACE_SETVRREGS:
15045+#endif
15046+ return 1;
15047+ default:
15048+ return 0;
15049+ }
15050+ } else if (!(current->acl->mode & GR_POVERRIDE) &&
15051+ !(current->role->roletype & GR_ROLE_GOD) &&
15052+ (current->acl != task->acl)) {
15053+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
15054+ return 1;
15055+ }
15056+
15057+ return 0;
15058+}
15059+
15060+static int is_writable_mmap(const struct file *filp)
15061+{
15062+ struct task_struct *task = current;
15063+ struct acl_object_label *obj, *obj2;
15064+
15065+ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
15066+ !task->is_writable && S_ISREG(filp->f_dentry->d_inode->i_mode)) {
15067+ obj = chk_obj_label(filp->f_dentry, filp->f_vfsmnt, default_role->root_label);
15068+ obj2 = chk_obj_label(filp->f_dentry, filp->f_vfsmnt,
15069+ task->role->root_label);
15070+ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
15071+ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_dentry, filp->f_vfsmnt);
15072+ return 1;
15073+ }
15074+ }
15075+ return 0;
15076+}
15077+
15078+int
15079+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
15080+{
15081+ __u32 mode;
15082+
15083+ if (unlikely(!file || !(prot & PROT_EXEC)))
15084+ return 1;
15085+
15086+ if (is_writable_mmap(file))
15087+ return 0;
15088+
15089+ mode =
15090+ gr_search_file(file->f_dentry,
15091+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
15092+ file->f_vfsmnt);
15093+
15094+ if (!gr_tpe_allow(file))
15095+ return 0;
15096+
15097+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
15098+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_dentry, file->f_vfsmnt);
15099+ return 0;
15100+ } else if (unlikely(!(mode & GR_EXEC))) {
15101+ return 0;
15102+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
15103+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_dentry, file->f_vfsmnt);
15104+ return 1;
15105+ }
15106+
15107+ return 1;
15108+}
15109+
15110+int
15111+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
15112+{
15113+ __u32 mode;
15114+
15115+ if (unlikely(!file || !(prot & PROT_EXEC)))
15116+ return 1;
15117+
15118+ if (is_writable_mmap(file))
15119+ return 0;
15120+
15121+ mode =
15122+ gr_search_file(file->f_dentry,
15123+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
15124+ file->f_vfsmnt);
15125+
15126+ if (!gr_tpe_allow(file))
15127+ return 0;
15128+
15129+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
15130+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_dentry, file->f_vfsmnt);
15131+ return 0;
15132+ } else if (unlikely(!(mode & GR_EXEC))) {
15133+ return 0;
15134+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
15135+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_dentry, file->f_vfsmnt);
15136+ return 1;
15137+ }
15138+
15139+ return 1;
15140+}
15141+
15142+void
15143+gr_acl_handle_psacct(struct task_struct *task, const long code)
15144+{
15145+ unsigned long runtime;
15146+ unsigned long cputime;
15147+ unsigned int wday, cday;
15148+ __u8 whr, chr;
15149+ __u8 wmin, cmin;
15150+ __u8 wsec, csec;
15151+
15152+ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
15153+ !(task->acl->mode & GR_PROCACCT)))
15154+ return;
15155+
15156+ runtime = xtime.tv_sec - task->start_time.tv_sec;
15157+ wday = runtime / (3600 * 24);
15158+ runtime -= wday * (3600 * 24);
15159+ whr = runtime / 3600;
15160+ runtime -= whr * 3600;
15161+ wmin = runtime / 60;
15162+ runtime -= wmin * 60;
15163+ wsec = runtime;
15164+
15165+ cputime = (task->utime + task->stime) / HZ;
15166+ cday = cputime / (3600 * 24);
15167+ cputime -= cday * (3600 * 24);
15168+ chr = cputime / 3600;
15169+ cputime -= chr * 3600;
15170+ cmin = cputime / 60;
15171+ cputime -= cmin * 60;
15172+ csec = cputime;
15173+
15174+ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
15175+
15176+ return;
15177+}
15178+
15179+void gr_set_kernel_label(struct task_struct *task)
15180+{
15181+ if (gr_status & GR_READY) {
15182+ task->role = kernel_role;
15183+ task->acl = kernel_role->root_label;
15184+ }
15185+ return;
15186+}
15187+
15188+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
15189+{
15190+ struct task_struct *task = current;
15191+ struct dentry *dentry = file->f_dentry;
15192+ struct vfsmount *mnt = file->f_vfsmnt;
15193+ struct acl_object_label *obj, *tmp;
15194+ struct acl_subject_label *subj;
15195+ unsigned int bufsize;
15196+ int is_not_root;
15197+ char *path;
15198+
15199+ if (unlikely(!(gr_status & GR_READY)))
15200+ return 1;
15201+
15202+ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
15203+ return 1;
15204+
15205+ subj = task->acl;
15206+ do {
15207+ obj = lookup_acl_obj_label(ino, dentry->d_inode->i_sb->s_dev, subj);
15208+ if (obj != NULL)
15209+ return (obj->mode & GR_FIND) ? 1 : 0;
15210+ } while ((subj = subj->parent_subject));
15211+
15212+ obj = chk_obj_label(dentry, mnt, task->acl);
15213+ if (obj->globbed == NULL)
15214+ return (obj->mode & GR_FIND) ? 1 : 0;
15215+
15216+ is_not_root = ((obj->filename[0] == '/') &&
15217+ (obj->filename[1] == '\0')) ? 0 : 1;
15218+ bufsize = PAGE_SIZE - namelen - is_not_root;
15219+
15220+ /* check bufsize > PAGE_SIZE || bufsize == 0 */
15221+ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
15222+ return 1;
15223+
15224+ preempt_disable();
15225+ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
15226+ bufsize);
15227+
15228+ bufsize = strlen(path);
15229+
15230+ /* if base is "/", don't append an additional slash */
15231+ if (is_not_root)
15232+ *(path + bufsize) = '/';
15233+ memcpy(path + bufsize + is_not_root, name, namelen);
15234+ *(path + bufsize + namelen + is_not_root) = '\0';
15235+
15236+ tmp = obj->globbed;
15237+ while (tmp) {
15238+ if (!glob_match(tmp->filename, path)) {
15239+ preempt_enable();
15240+ return (tmp->mode & GR_FIND) ? 1 : 0;
15241+ }
15242+ tmp = tmp->next;
15243+ }
15244+ preempt_enable();
15245+ return (obj->mode & GR_FIND) ? 1 : 0;
15246+}
15247+
15248+EXPORT_SYMBOL(gr_learn_resource);
15249+EXPORT_SYMBOL(gr_set_kernel_label);
15250+#ifdef CONFIG_SECURITY
15251+EXPORT_SYMBOL(gr_check_user_change);
15252+EXPORT_SYMBOL(gr_check_group_change);
15253+#endif
15254+
15255diff -urNp linux-2.6.18/grsecurity/gracl_cap.c linux-2.6.18/grsecurity/gracl_cap.c
15256--- linux-2.6.18/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
15257+++ linux-2.6.18/grsecurity/gracl_cap.c 2006-09-22 20:04:35.000000000 -0400
15258@@ -0,0 +1,110 @@
15259+#include <linux/kernel.h>
15260+#include <linux/module.h>
15261+#include <linux/sched.h>
15262+#include <linux/capability.h>
15263+#include <linux/gracl.h>
15264+#include <linux/grsecurity.h>
15265+#include <linux/grinternal.h>
15266+
15267+static const char *captab_log[] = {
15268+ "CAP_CHOWN",
15269+ "CAP_DAC_OVERRIDE",
15270+ "CAP_DAC_READ_SEARCH",
15271+ "CAP_FOWNER",
15272+ "CAP_FSETID",
15273+ "CAP_KILL",
15274+ "CAP_SETGID",
15275+ "CAP_SETUID",
15276+ "CAP_SETPCAP",
15277+ "CAP_LINUX_IMMUTABLE",
15278+ "CAP_NET_BIND_SERVICE",
15279+ "CAP_NET_BROADCAST",
15280+ "CAP_NET_ADMIN",
15281+ "CAP_NET_RAW",
15282+ "CAP_IPC_LOCK",
15283+ "CAP_IPC_OWNER",
15284+ "CAP_SYS_MODULE",
15285+ "CAP_SYS_RAWIO",
15286+ "CAP_SYS_CHROOT",
15287+ "CAP_SYS_PTRACE",
15288+ "CAP_SYS_PACCT",
15289+ "CAP_SYS_ADMIN",
15290+ "CAP_SYS_BOOT",
15291+ "CAP_SYS_NICE",
15292+ "CAP_SYS_RESOURCE",
15293+ "CAP_SYS_TIME",
15294+ "CAP_SYS_TTY_CONFIG",
15295+ "CAP_MKNOD",
15296+ "CAP_LEASE"
15297+};
15298+
15299+EXPORT_SYMBOL(gr_task_is_capable);
15300+
15301+int
15302+gr_task_is_capable(struct task_struct *task, const int cap)
15303+{
15304+ struct acl_subject_label *curracl;
15305+ __u32 cap_drop = 0, cap_mask = 0;
15306+
15307+ if (!gr_acl_is_enabled())
15308+ return 1;
15309+
15310+ curracl = task->acl;
15311+
15312+ cap_drop = curracl->cap_lower;
15313+ cap_mask = curracl->cap_mask;
15314+
15315+ while ((curracl = curracl->parent_subject)) {
15316+ if (!(cap_mask & (1 << cap)) && (curracl->cap_mask & (1 << cap)))
15317+ cap_drop |= curracl->cap_lower & (1 << cap);
15318+ cap_mask |= curracl->cap_mask;
15319+ }
15320+
15321+ if (!cap_raised(cap_drop, cap))
15322+ return 1;
15323+
15324+ curracl = task->acl;
15325+
15326+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
15327+ && cap_raised(task->cap_effective, cap)) {
15328+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
15329+ task->role->roletype, task->uid,
15330+ task->gid, task->exec_file ?
15331+ gr_to_filename(task->exec_file->f_dentry,
15332+ task->exec_file->f_vfsmnt) : curracl->filename,
15333+ curracl->filename, 0UL,
15334+ 0UL, "", (unsigned long) cap, NIPQUAD(task->signal->curr_ip));
15335+ return 1;
15336+ }
15337+
15338+ if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(task->cap_effective, cap))
15339+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
15340+
15341+ return 0;
15342+}
15343+
15344+int
15345+gr_is_capable_nolog(const int cap)
15346+{
15347+ struct acl_subject_label *curracl;
15348+ __u32 cap_drop = 0, cap_mask = 0;
15349+
15350+ if (!gr_acl_is_enabled())
15351+ return 1;
15352+
15353+ curracl = current->acl;
15354+
15355+ cap_drop = curracl->cap_lower;
15356+ cap_mask = curracl->cap_mask;
15357+
15358+ while ((curracl = curracl->parent_subject)) {
15359+ cap_drop |= curracl->cap_lower & (cap_mask & ~curracl->cap_mask);
15360+ cap_mask |= curracl->cap_mask;
15361+ }
15362+
15363+ if (!cap_raised(cap_drop, cap))
15364+ return 1;
15365+
15366+ return 0;
15367+}
15368+
15369diff -urNp linux-2.6.18/grsecurity/gracl_fs.c linux-2.6.18/grsecurity/gracl_fs.c
15370--- linux-2.6.18/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
15371+++ linux-2.6.18/grsecurity/gracl_fs.c 2006-09-22 20:04:35.000000000 -0400
15372@@ -0,0 +1,423 @@
15373+#include <linux/kernel.h>
15374+#include <linux/sched.h>
15375+#include <linux/types.h>
15376+#include <linux/fs.h>
15377+#include <linux/file.h>
15378+#include <linux/stat.h>
15379+#include <linux/grsecurity.h>
15380+#include <linux/grinternal.h>
15381+#include <linux/gracl.h>
15382+
15383+__u32
15384+gr_acl_handle_hidden_file(const struct dentry * dentry,
15385+ const struct vfsmount * mnt)
15386+{
15387+ __u32 mode;
15388+
15389+ if (unlikely(!dentry->d_inode))
15390+ return GR_FIND;
15391+
15392+ mode =
15393+ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
15394+
15395+ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
15396+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
15397+ return mode;
15398+ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
15399+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
15400+ return 0;
15401+ } else if (unlikely(!(mode & GR_FIND)))
15402+ return 0;
15403+
15404+ return GR_FIND;
15405+}
15406+
15407+__u32
15408+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
15409+ const int fmode)
15410+{
15411+ __u32 reqmode = GR_FIND;
15412+ __u32 mode;
15413+
15414+ if (unlikely(!dentry->d_inode))
15415+ return reqmode;
15416+
15417+ if (unlikely(fmode & O_APPEND))
15418+ reqmode |= GR_APPEND;
15419+ else if (unlikely(fmode & FMODE_WRITE))
15420+ reqmode |= GR_WRITE;
15421+ if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
15422+ reqmode |= GR_READ;
15423+
15424+ mode =
15425+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
15426+ mnt);
15427+
15428+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
15429+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
15430+ reqmode & GR_READ ? " reading" : "",
15431+ reqmode & GR_WRITE ? " writing" : reqmode &
15432+ GR_APPEND ? " appending" : "");
15433+ return reqmode;
15434+ } else
15435+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
15436+ {
15437+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
15438+ reqmode & GR_READ ? " reading" : "",
15439+ reqmode & GR_WRITE ? " writing" : reqmode &
15440+ GR_APPEND ? " appending" : "");
15441+ return 0;
15442+ } else if (unlikely((mode & reqmode) != reqmode))
15443+ return 0;
15444+
15445+ return reqmode;
15446+}
15447+
15448+__u32
15449+gr_acl_handle_creat(const struct dentry * dentry,
15450+ const struct dentry * p_dentry,
15451+ const struct vfsmount * p_mnt, const int fmode,
15452+ const int imode)
15453+{
15454+ __u32 reqmode = GR_WRITE | GR_CREATE;
15455+ __u32 mode;
15456+
15457+ if (unlikely(fmode & O_APPEND))
15458+ reqmode |= GR_APPEND;
15459+ if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
15460+ reqmode |= GR_READ;
15461+ if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
15462+ reqmode |= GR_SETID;
15463+
15464+ mode =
15465+ gr_check_create(dentry, p_dentry, p_mnt,
15466+ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
15467+
15468+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
15469+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
15470+ reqmode & GR_READ ? " reading" : "",
15471+ reqmode & GR_WRITE ? " writing" : reqmode &
15472+ GR_APPEND ? " appending" : "");
15473+ return reqmode;
15474+ } else
15475+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
15476+ {
15477+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
15478+ reqmode & GR_READ ? " reading" : "",
15479+ reqmode & GR_WRITE ? " writing" : reqmode &
15480+ GR_APPEND ? " appending" : "");
15481+ return 0;
15482+ } else if (unlikely((mode & reqmode) != reqmode))
15483+ return 0;
15484+
15485+ return reqmode;
15486+}
15487+
15488+__u32
15489+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
15490+ const int fmode)
15491+{
15492+ __u32 mode, reqmode = GR_FIND;
15493+
15494+ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
15495+ reqmode |= GR_EXEC;
15496+ if (fmode & S_IWOTH)
15497+ reqmode |= GR_WRITE;
15498+ if (fmode & S_IROTH)
15499+ reqmode |= GR_READ;
15500+
15501+ mode =
15502+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
15503+ mnt);
15504+
15505+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
15506+ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
15507+ reqmode & GR_READ ? " reading" : "",
15508+ reqmode & GR_WRITE ? " writing" : "",
15509+ reqmode & GR_EXEC ? " executing" : "");
15510+ return reqmode;
15511+ } else
15512+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
15513+ {
15514+ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
15515+ reqmode & GR_READ ? " reading" : "",
15516+ reqmode & GR_WRITE ? " writing" : "",
15517+ reqmode & GR_EXEC ? " executing" : "");
15518+ return 0;
15519+ } else if (unlikely((mode & reqmode) != reqmode))
15520+ return 0;
15521+
15522+ return reqmode;
15523+}
15524+
15525+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
15526+{
15527+ __u32 mode;
15528+
15529+ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
15530+
15531+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
15532+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
15533+ return mode;
15534+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
15535+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
15536+ return 0;
15537+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
15538+ return 0;
15539+
15540+ return (reqmode);
15541+}
15542+
15543+__u32
15544+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
15545+{
15546+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
15547+}
15548+
15549+__u32
15550+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
15551+{
15552+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
15553+}
15554+
15555+__u32
15556+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
15557+{
15558+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
15559+}
15560+
15561+__u32
15562+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
15563+{
15564+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
15565+}
15566+
15567+__u32
15568+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
15569+ mode_t mode)
15570+{
15571+ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
15572+ return 1;
15573+
15574+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
15575+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
15576+ GR_FCHMOD_ACL_MSG);
15577+ } else {
15578+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
15579+ }
15580+}
15581+
15582+__u32
15583+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
15584+ mode_t mode)
15585+{
15586+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
15587+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
15588+ GR_CHMOD_ACL_MSG);
15589+ } else {
15590+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
15591+ }
15592+}
15593+
15594+__u32
15595+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
15596+{
15597+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
15598+}
15599+
15600+__u32
15601+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
15602+{
15603+ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
15604+}
15605+
15606+__u32
15607+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
15608+{
15609+ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
15610+ GR_UNIXCONNECT_ACL_MSG);
15611+}
15612+
15613+/* hardlinks require at minimum create permission,
15614+ any additional privilege required is based on the
15615+ privilege of the file being linked to
15616+*/
15617+__u32
15618+gr_acl_handle_link(const struct dentry * new_dentry,
15619+ const struct dentry * parent_dentry,
15620+ const struct vfsmount * parent_mnt,
15621+ const struct dentry * old_dentry,
15622+ const struct vfsmount * old_mnt, const char *to)
15623+{
15624+ __u32 mode;
15625+ __u32 needmode = GR_CREATE | GR_LINK;
15626+ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
15627+
15628+ mode =
15629+ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
15630+ old_mnt);
15631+
15632+ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
15633+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
15634+ return mode;
15635+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
15636+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
15637+ return 0;
15638+ } else if (unlikely((mode & needmode) != needmode))
15639+ return 0;
15640+
15641+ return 1;
15642+}
15643+
15644+__u32
15645+gr_acl_handle_symlink(const struct dentry * new_dentry,
15646+ const struct dentry * parent_dentry,
15647+ const struct vfsmount * parent_mnt, const char *from)
15648+{
15649+ __u32 needmode = GR_WRITE | GR_CREATE;
15650+ __u32 mode;
15651+
15652+ mode =
15653+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
15654+ GR_CREATE | GR_AUDIT_CREATE |
15655+ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
15656+
15657+ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
15658+ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
15659+ return mode;
15660+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
15661+ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
15662+ return 0;
15663+ } else if (unlikely((mode & needmode) != needmode))
15664+ return 0;
15665+
15666+ return (GR_WRITE | GR_CREATE);
15667+}
15668+
15669+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
15670+{
15671+ __u32 mode;
15672+
15673+ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
15674+
15675+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
15676+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
15677+ return mode;
15678+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
15679+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
15680+ return 0;
15681+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
15682+ return 0;
15683+
15684+ return (reqmode);
15685+}
15686+
15687+__u32
15688+gr_acl_handle_mknod(const struct dentry * new_dentry,
15689+ const struct dentry * parent_dentry,
15690+ const struct vfsmount * parent_mnt,
15691+ const int mode)
15692+{
15693+ __u32 reqmode = GR_WRITE | GR_CREATE;
15694+ if (unlikely(mode & (S_ISUID | S_ISGID)))
15695+ reqmode |= GR_SETID;
15696+
15697+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
15698+ reqmode, GR_MKNOD_ACL_MSG);
15699+}
15700+
15701+__u32
15702+gr_acl_handle_mkdir(const struct dentry *new_dentry,
15703+ const struct dentry *parent_dentry,
15704+ const struct vfsmount *parent_mnt)
15705+{
15706+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
15707+ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
15708+}
15709+
15710+#define RENAME_CHECK_SUCCESS(old, new) \
15711+ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
15712+ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
15713+
15714+int
15715+gr_acl_handle_rename(struct dentry *new_dentry,
15716+ struct dentry *parent_dentry,
15717+ const struct vfsmount *parent_mnt,
15718+ struct dentry *old_dentry,
15719+ struct inode *old_parent_inode,
15720+ struct vfsmount *old_mnt, const char *newname)
15721+{
15722+ __u32 comp1, comp2;
15723+ int error = 0;
15724+
15725+ if (unlikely(!gr_acl_is_enabled()))
15726+ return 0;
15727+
15728+ if (!new_dentry->d_inode) {
15729+ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
15730+ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
15731+ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
15732+ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
15733+ GR_DELETE | GR_AUDIT_DELETE |
15734+ GR_AUDIT_READ | GR_AUDIT_WRITE |
15735+ GR_SUPPRESS, old_mnt);
15736+ } else {
15737+ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
15738+ GR_CREATE | GR_DELETE |
15739+ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
15740+ GR_AUDIT_READ | GR_AUDIT_WRITE |
15741+ GR_SUPPRESS, parent_mnt);
15742+ comp2 =
15743+ gr_search_file(old_dentry,
15744+ GR_READ | GR_WRITE | GR_AUDIT_READ |
15745+ GR_DELETE | GR_AUDIT_DELETE |
15746+ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
15747+ }
15748+
15749+ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
15750+ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
15751+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
15752+ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
15753+ && !(comp2 & GR_SUPPRESS)) {
15754+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
15755+ error = -EACCES;
15756+ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
15757+ error = -EACCES;
15758+
15759+ return error;
15760+}
15761+
15762+void
15763+gr_acl_handle_exit(void)
15764+{
15765+ u16 id;
15766+ char *rolename;
15767+ struct file *exec_file;
15768+
15769+ if (unlikely(current->acl_sp_role && gr_acl_is_enabled())) {
15770+ id = current->acl_role_id;
15771+ rolename = current->role->rolename;
15772+ gr_set_acls(1);
15773+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
15774+ }
15775+
15776+ write_lock(&grsec_exec_file_lock);
15777+ exec_file = current->exec_file;
15778+ current->exec_file = NULL;
15779+ write_unlock(&grsec_exec_file_lock);
15780+
15781+ if (exec_file)
15782+ fput(exec_file);
15783+}
15784+
15785+int
15786+gr_acl_handle_procpidmem(const struct task_struct *task)
15787+{
15788+ if (unlikely(!gr_acl_is_enabled()))
15789+ return 0;
15790+
15791+ if (task->acl->mode & GR_PROTPROCFD)
15792+ return -EACCES;
15793+
15794+ return 0;
15795+}
15796diff -urNp linux-2.6.18/grsecurity/gracl_ip.c linux-2.6.18/grsecurity/gracl_ip.c
15797--- linux-2.6.18/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
15798+++ linux-2.6.18/grsecurity/gracl_ip.c 2006-09-22 20:04:35.000000000 -0400
15799@@ -0,0 +1,313 @@
15800+#include <linux/kernel.h>
15801+#include <asm/uaccess.h>
15802+#include <asm/errno.h>
15803+#include <net/sock.h>
15804+#include <linux/file.h>
15805+#include <linux/fs.h>
15806+#include <linux/net.h>
15807+#include <linux/in.h>
15808+#include <linux/skbuff.h>
15809+#include <linux/ip.h>
15810+#include <linux/udp.h>
15811+#include <linux/smp_lock.h>
15812+#include <linux/types.h>
15813+#include <linux/sched.h>
15814+#include <linux/netdevice.h>
15815+#include <linux/inetdevice.h>
15816+#include <linux/gracl.h>
15817+#include <linux/grsecurity.h>
15818+#include <linux/grinternal.h>
15819+
15820+#define GR_BIND 0x01
15821+#define GR_CONNECT 0x02
15822+#define GR_INVERT 0x04
15823+
15824+static const char * gr_protocols[256] = {
15825+ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
15826+ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
15827+ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
15828+ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
15829+ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
15830+ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
15831+ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
15832+ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
15833+ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
15834+ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
15835+ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
15836+ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
15837+ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
15838+ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
15839+ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
15840+ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
15841+ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
15842+ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
15843+ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
15844+ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
15845+ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
15846+ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
15847+ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
15848+ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
15849+ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
15850+ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
15851+ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
15852+ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
15853+ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
15854+ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
15855+ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
15856+ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
15857+ };
15858+
15859+static const char * gr_socktypes[11] = {
15860+ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
15861+ "unknown:7", "unknown:8", "unknown:9", "packet"
15862+ };
15863+
15864+const char *
15865+gr_proto_to_name(unsigned char proto)
15866+{
15867+ return gr_protocols[proto];
15868+}
15869+
15870+const char *
15871+gr_socktype_to_name(unsigned char type)
15872+{
15873+ return gr_socktypes[type];
15874+}
15875+
15876+int
15877+gr_search_socket(const int domain, const int type, const int protocol)
15878+{
15879+ struct acl_subject_label *curr;
15880+
15881+ if (unlikely(!gr_acl_is_enabled()))
15882+ goto exit;
15883+
15884+ if ((domain < 0) || (type < 0) || (protocol < 0) || (domain != PF_INET)
15885+ || (domain >= NPROTO) || (type >= SOCK_MAX) || (protocol > 255))
15886+ goto exit; // let the kernel handle it
15887+
15888+ curr = current->acl;
15889+
15890+ if (!curr->ips)
15891+ goto exit;
15892+
15893+ if ((curr->ip_type & (1 << type)) &&
15894+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
15895+ goto exit;
15896+
15897+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
15898+ /* we don't place acls on raw sockets , and sometimes
15899+ dgram/ip sockets are opened for ioctl and not
15900+ bind/connect, so we'll fake a bind learn log */
15901+ if (type == SOCK_RAW || type == SOCK_PACKET) {
15902+ __u32 fakeip = 0;
15903+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
15904+ current->role->roletype, current->uid,
15905+ current->gid, current->exec_file ?
15906+ gr_to_filename(current->exec_file->f_dentry,
15907+ current->exec_file->f_vfsmnt) :
15908+ curr->filename, curr->filename,
15909+ NIPQUAD(fakeip), 0, type,
15910+ protocol, GR_CONNECT,
15911+NIPQUAD(current->signal->curr_ip));
15912+ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
15913+ __u32 fakeip = 0;
15914+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
15915+ current->role->roletype, current->uid,
15916+ current->gid, current->exec_file ?
15917+ gr_to_filename(current->exec_file->f_dentry,
15918+ current->exec_file->f_vfsmnt) :
15919+ curr->filename, curr->filename,
15920+ NIPQUAD(fakeip), 0, type,
15921+ protocol, GR_BIND, NIPQUAD(current->signal->curr_ip));
15922+ }
15923+ /* we'll log when they use connect or bind */
15924+ goto exit;
15925+ }
15926+
15927+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, "inet",
15928+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
15929+
15930+ return 0;
15931+ exit:
15932+ return 1;
15933+}
15934+
15935+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
15936+{
15937+ if ((ip->mode & mode) &&
15938+ (ip_port >= ip->low) &&
15939+ (ip_port <= ip->high) &&
15940+ ((ntohl(ip_addr) & our_netmask) ==
15941+ (ntohl(our_addr) & our_netmask))
15942+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
15943+ && (ip->type & (1 << type))) {
15944+ if (ip->mode & GR_INVERT)
15945+ return 2; // specifically denied
15946+ else
15947+ return 1; // allowed
15948+ }
15949+
15950+ return 0; // not specifically allowed, may continue parsing
15951+}
15952+
15953+static int
15954+gr_search_connectbind(const int mode, const struct sock *sk,
15955+ const struct sockaddr_in *addr, const int type)
15956+{
15957+ char iface[IFNAMSIZ] = {0};
15958+ struct acl_subject_label *curr;
15959+ struct acl_ip_label *ip;
15960+ struct net_device *dev;
15961+ struct in_device *idev;
15962+ unsigned long i;
15963+ int ret;
15964+ __u32 ip_addr = 0;
15965+ __u32 our_addr;
15966+ __u32 our_netmask;
15967+ char *p;
15968+ __u16 ip_port = 0;
15969+
15970+ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
15971+ return 1;
15972+
15973+ curr = current->acl;
15974+
15975+ if (!curr->ips)
15976+ return 1;
15977+
15978+ ip_addr = addr->sin_addr.s_addr;
15979+ ip_port = ntohs(addr->sin_port);
15980+
15981+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
15982+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
15983+ current->role->roletype, current->uid,
15984+ current->gid, current->exec_file ?
15985+ gr_to_filename(current->exec_file->f_dentry,
15986+ current->exec_file->f_vfsmnt) :
15987+ curr->filename, curr->filename,
15988+ NIPQUAD(ip_addr), ip_port, type,
15989+ sk->sk_protocol, mode, NIPQUAD(current->signal->curr_ip));
15990+ return 1;
15991+ }
15992+
15993+ for (i = 0; i < curr->ip_num; i++) {
15994+ ip = *(curr->ips + i);
15995+ if (ip->iface != NULL) {
15996+ strncpy(iface, ip->iface, IFNAMSIZ - 1);
15997+ p = strchr(iface, ':');
15998+ if (p != NULL)
15999+ *p = '\0';
16000+ dev = dev_get_by_name(iface);
16001+ if (dev == NULL)
16002+ continue;
16003+ idev = in_dev_get(dev);
16004+ if (idev == NULL) {
16005+ dev_put(dev);
16006+ continue;
16007+ }
16008+ rcu_read_lock();
16009+ for_ifa(idev) {
16010+ if (!strcmp(ip->iface, ifa->ifa_label)) {
16011+ our_addr = ifa->ifa_address;
16012+ our_netmask = 0xffffffff;
16013+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
16014+ if (ret == 1) {
16015+ rcu_read_unlock();
16016+ in_dev_put(idev);
16017+ dev_put(dev);
16018+ return 1;
16019+ } else if (ret == 2) {
16020+ rcu_read_unlock();
16021+ in_dev_put(idev);
16022+ dev_put(dev);
16023+ goto denied;
16024+ }
16025+ }
16026+ } endfor_ifa(idev);
16027+ rcu_read_unlock();
16028+ in_dev_put(idev);
16029+ dev_put(dev);
16030+ } else {
16031+ our_addr = ip->addr;
16032+ our_netmask = ip->netmask;
16033+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
16034+ if (ret == 1)
16035+ return 1;
16036+ else if (ret == 2)
16037+ goto denied;
16038+ }
16039+ }
16040+
16041+denied:
16042+ if (mode == GR_BIND)
16043+ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, NIPQUAD(ip_addr), ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
16044+ else if (mode == GR_CONNECT)
16045+ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, NIPQUAD(ip_addr), ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
16046+
16047+ return 0;
16048+}
16049+
16050+int
16051+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
16052+{
16053+ return gr_search_connectbind(GR_CONNECT, sock->sk, addr, sock->type);
16054+}
16055+
16056+int
16057+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
16058+{
16059+ return gr_search_connectbind(GR_BIND, sock->sk, addr, sock->type);
16060+}
16061+
16062+int gr_search_listen(const struct socket *sock)
16063+{
16064+ struct sock *sk = sock->sk;
16065+ struct sockaddr_in addr;
16066+
16067+ addr.sin_addr.s_addr = inet_sk(sk)->saddr;
16068+ addr.sin_port = inet_sk(sk)->sport;
16069+
16070+ return gr_search_connectbind(GR_BIND, sock->sk, &addr, sock->type);
16071+}
16072+
16073+int gr_search_accept(const struct socket *sock)
16074+{
16075+ struct sock *sk = sock->sk;
16076+ struct sockaddr_in addr;
16077+
16078+ addr.sin_addr.s_addr = inet_sk(sk)->saddr;
16079+ addr.sin_port = inet_sk(sk)->sport;
16080+
16081+ return gr_search_connectbind(GR_BIND, sock->sk, &addr, sock->type);
16082+}
16083+
16084+int
16085+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
16086+{
16087+ if (addr)
16088+ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
16089+ else {
16090+ struct sockaddr_in sin;
16091+ const struct inet_sock *inet = inet_sk(sk);
16092+
16093+ sin.sin_addr.s_addr = inet->daddr;
16094+ sin.sin_port = inet->dport;
16095+
16096+ return gr_search_connectbind(GR_CONNECT, sk, &sin, SOCK_DGRAM);
16097+ }
16098+}
16099+
16100+int
16101+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
16102+{
16103+ struct sockaddr_in sin;
16104+
16105+ if (unlikely(skb->len < sizeof (struct udphdr)))
16106+ return 1; // skip this packet
16107+
16108+ sin.sin_addr.s_addr = skb->nh.iph->saddr;
16109+ sin.sin_port = skb->h.uh->source;
16110+
16111+ return gr_search_connectbind(GR_CONNECT, sk, &sin, SOCK_DGRAM);
16112+}
16113diff -urNp linux-2.6.18/grsecurity/gracl_learn.c linux-2.6.18/grsecurity/gracl_learn.c
16114--- linux-2.6.18/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
16115+++ linux-2.6.18/grsecurity/gracl_learn.c 2006-09-22 20:04:35.000000000 -0400
16116@@ -0,0 +1,204 @@
16117+#include <linux/kernel.h>
16118+#include <linux/mm.h>
16119+#include <linux/sched.h>
16120+#include <linux/poll.h>
16121+#include <linux/smp_lock.h>
16122+#include <linux/string.h>
16123+#include <linux/file.h>
16124+#include <linux/types.h>
16125+#include <linux/vmalloc.h>
16126+#include <linux/grinternal.h>
16127+
16128+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
16129+ size_t count, loff_t *ppos);
16130+extern int gr_acl_is_enabled(void);
16131+
16132+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
16133+static int gr_learn_attached;
16134+
16135+/* use a 512k buffer */
16136+#define LEARN_BUFFER_SIZE (512 * 1024)
16137+
16138+static spinlock_t gr_learn_lock = SPIN_LOCK_UNLOCKED;
16139+static DECLARE_MUTEX(gr_learn_user_sem);
16140+
16141+/* we need to maintain two buffers, so that the kernel context of grlearn
16142+ uses a semaphore around the userspace copying, and the other kernel contexts
16143+ use a spinlock when copying into the buffer, since they cannot sleep
16144+*/
16145+static char *learn_buffer;
16146+static char *learn_buffer_user;
16147+static int learn_buffer_len;
16148+static int learn_buffer_user_len;
16149+
16150+static ssize_t
16151+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
16152+{
16153+ DECLARE_WAITQUEUE(wait, current);
16154+ ssize_t retval = 0;
16155+
16156+ add_wait_queue(&learn_wait, &wait);
16157+ set_current_state(TASK_INTERRUPTIBLE);
16158+ do {
16159+ down(&gr_learn_user_sem);
16160+ spin_lock(&gr_learn_lock);
16161+ if (learn_buffer_len)
16162+ break;
16163+ spin_unlock(&gr_learn_lock);
16164+ up(&gr_learn_user_sem);
16165+ if (file->f_flags & O_NONBLOCK) {
16166+ retval = -EAGAIN;
16167+ goto out;
16168+ }
16169+ if (signal_pending(current)) {
16170+ retval = -ERESTARTSYS;
16171+ goto out;
16172+ }
16173+
16174+ schedule();
16175+ } while (1);
16176+
16177+ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
16178+ learn_buffer_user_len = learn_buffer_len;
16179+ retval = learn_buffer_len;
16180+ learn_buffer_len = 0;
16181+
16182+ spin_unlock(&gr_learn_lock);
16183+
16184+ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
16185+ retval = -EFAULT;
16186+
16187+ up(&gr_learn_user_sem);
16188+out:
16189+ set_current_state(TASK_RUNNING);
16190+ remove_wait_queue(&learn_wait, &wait);
16191+ return retval;
16192+}
16193+
16194+static unsigned int
16195+poll_learn(struct file * file, poll_table * wait)
16196+{
16197+ poll_wait(file, &learn_wait, wait);
16198+
16199+ if (learn_buffer_len)
16200+ return (POLLIN | POLLRDNORM);
16201+
16202+ return 0;
16203+}
16204+
16205+void
16206+gr_clear_learn_entries(void)
16207+{
16208+ char *tmp;
16209+
16210+ down(&gr_learn_user_sem);
16211+ if (learn_buffer != NULL) {
16212+ spin_lock(&gr_learn_lock);
16213+ tmp = learn_buffer;
16214+ learn_buffer = NULL;
16215+ spin_unlock(&gr_learn_lock);
16216+ vfree(learn_buffer);
16217+ }
16218+ if (learn_buffer_user != NULL) {
16219+ vfree(learn_buffer_user);
16220+ learn_buffer_user = NULL;
16221+ }
16222+ learn_buffer_len = 0;
16223+ up(&gr_learn_user_sem);
16224+
16225+ return;
16226+}
16227+
16228+void
16229+gr_add_learn_entry(const char *fmt, ...)
16230+{
16231+ va_list args;
16232+ unsigned int len;
16233+
16234+ if (!gr_learn_attached)
16235+ return;
16236+
16237+ spin_lock(&gr_learn_lock);
16238+
16239+ /* leave a gap at the end so we know when it's "full" but don't have to
16240+ compute the exact length of the string we're trying to append
16241+ */
16242+ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
16243+ spin_unlock(&gr_learn_lock);
16244+ wake_up_interruptible(&learn_wait);
16245+ return;
16246+ }
16247+ if (learn_buffer == NULL) {
16248+ spin_unlock(&gr_learn_lock);
16249+ return;
16250+ }
16251+
16252+ va_start(args, fmt);
16253+ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
16254+ va_end(args);
16255+
16256+ learn_buffer_len += len + 1;
16257+
16258+ spin_unlock(&gr_learn_lock);
16259+ wake_up_interruptible(&learn_wait);
16260+
16261+ return;
16262+}
16263+
16264+static int
16265+open_learn(struct inode *inode, struct file *file)
16266+{
16267+ if (file->f_mode & FMODE_READ && gr_learn_attached)
16268+ return -EBUSY;
16269+ if (file->f_mode & FMODE_READ) {
16270+ down(&gr_learn_user_sem);
16271+ if (learn_buffer == NULL)
16272+ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
16273+ if (learn_buffer_user == NULL)
16274+ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
16275+ if (learn_buffer == NULL)
16276+ return -ENOMEM;
16277+ if (learn_buffer_user == NULL)
16278+ return -ENOMEM;
16279+ learn_buffer_len = 0;
16280+ learn_buffer_user_len = 0;
16281+ gr_learn_attached = 1;
16282+ up(&gr_learn_user_sem);
16283+ }
16284+ return 0;
16285+}
16286+
16287+static int
16288+close_learn(struct inode *inode, struct file *file)
16289+{
16290+ char *tmp;
16291+
16292+ if (file->f_mode & FMODE_READ) {
16293+ down(&gr_learn_user_sem);
16294+ if (learn_buffer != NULL) {
16295+ spin_lock(&gr_learn_lock);
16296+ tmp = learn_buffer;
16297+ learn_buffer = NULL;
16298+ spin_unlock(&gr_learn_lock);
16299+ vfree(tmp);
16300+ }
16301+ if (learn_buffer_user != NULL) {
16302+ vfree(learn_buffer_user);
16303+ learn_buffer_user = NULL;
16304+ }
16305+ learn_buffer_len = 0;
16306+ learn_buffer_user_len = 0;
16307+ gr_learn_attached = 0;
16308+ up(&gr_learn_user_sem);
16309+ }
16310+
16311+ return 0;
16312+}
16313+
16314+struct file_operations grsec_fops = {
16315+ .read = read_learn,
16316+ .write = write_grsec_handler,
16317+ .open = open_learn,
16318+ .release = close_learn,
16319+ .poll = poll_learn,
16320+};
16321diff -urNp linux-2.6.18/grsecurity/gracl_res.c linux-2.6.18/grsecurity/gracl_res.c
16322--- linux-2.6.18/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
16323+++ linux-2.6.18/grsecurity/gracl_res.c 2006-09-22 20:04:35.000000000 -0400
16324@@ -0,0 +1,45 @@
16325+#include <linux/kernel.h>
16326+#include <linux/sched.h>
16327+#include <linux/gracl.h>
16328+#include <linux/grinternal.h>
16329+
16330+static const char *restab_log[] = {
16331+ [RLIMIT_CPU] = "RLIMIT_CPU",
16332+ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
16333+ [RLIMIT_DATA] = "RLIMIT_DATA",
16334+ [RLIMIT_STACK] = "RLIMIT_STACK",
16335+ [RLIMIT_CORE] = "RLIMIT_CORE",
16336+ [RLIMIT_RSS] = "RLIMIT_RSS",
16337+ [RLIMIT_NPROC] = "RLIMIT_NPROC",
16338+ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
16339+ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
16340+ [RLIMIT_AS] = "RLIMIT_AS",
16341+ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
16342+ [RLIMIT_LOCKS + 1] = "RLIMIT_CRASH"
16343+};
16344+
16345+void
16346+gr_log_resource(const struct task_struct *task,
16347+ const int res, const unsigned long wanted, const int gt)
16348+{
16349+ if (res == RLIMIT_NPROC &&
16350+ (cap_raised(task->cap_effective, CAP_SYS_ADMIN) ||
16351+ cap_raised(task->cap_effective, CAP_SYS_RESOURCE)))
16352+ return;
16353+ else if (res == RLIMIT_MEMLOCK &&
16354+ cap_raised(task->cap_effective, CAP_IPC_LOCK))
16355+ return;
16356+
16357+ if (!gr_acl_is_enabled() && !grsec_resource_logging)
16358+ return;
16359+
16360+ preempt_disable();
16361+
16362+ if (unlikely(((gt && wanted > task->signal->rlim[res].rlim_cur) ||
16363+ (!gt && wanted >= task->signal->rlim[res].rlim_cur)) &&
16364+ task->signal->rlim[res].rlim_cur != RLIM_INFINITY))
16365+ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], task->signal->rlim[res].rlim_cur);
16366+ preempt_enable_no_resched();
16367+
16368+ return;
16369+}
16370diff -urNp linux-2.6.18/grsecurity/gracl_segv.c linux-2.6.18/grsecurity/gracl_segv.c
16371--- linux-2.6.18/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
16372+++ linux-2.6.18/grsecurity/gracl_segv.c 2006-09-22 20:04:35.000000000 -0400
16373@@ -0,0 +1,295 @@
16374+#include <linux/kernel.h>
16375+#include <linux/mm.h>
16376+#include <asm/uaccess.h>
16377+#include <asm/errno.h>
16378+#include <asm/mman.h>
16379+#include <net/sock.h>
16380+#include <linux/file.h>
16381+#include <linux/fs.h>
16382+#include <linux/net.h>
16383+#include <linux/in.h>
16384+#include <linux/smp_lock.h>
16385+#include <linux/slab.h>
16386+#include <linux/types.h>
16387+#include <linux/sched.h>
16388+#include <linux/timer.h>
16389+#include <linux/gracl.h>
16390+#include <linux/grsecurity.h>
16391+#include <linux/grinternal.h>
16392+
16393+static struct crash_uid *uid_set;
16394+static unsigned short uid_used;
16395+static spinlock_t gr_uid_lock = SPIN_LOCK_UNLOCKED;
16396+extern rwlock_t gr_inode_lock;
16397+extern struct acl_subject_label *
16398+ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
16399+ struct acl_role_label *role);
16400+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
16401+
16402+int
16403+gr_init_uidset(void)
16404+{
16405+ uid_set =
16406+ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
16407+ uid_used = 0;
16408+
16409+ return uid_set ? 1 : 0;
16410+}
16411+
16412+void
16413+gr_free_uidset(void)
16414+{
16415+ if (uid_set)
16416+ kfree(uid_set);
16417+
16418+ return;
16419+}
16420+
16421+int
16422+gr_find_uid(const uid_t uid)
16423+{
16424+ struct crash_uid *tmp = uid_set;
16425+ uid_t buid;
16426+ int low = 0, high = uid_used - 1, mid;
16427+
16428+ while (high >= low) {
16429+ mid = (low + high) >> 1;
16430+ buid = tmp[mid].uid;
16431+ if (buid == uid)
16432+ return mid;
16433+ if (buid > uid)
16434+ high = mid - 1;
16435+ if (buid < uid)
16436+ low = mid + 1;
16437+ }
16438+
16439+ return -1;
16440+}
16441+
16442+static __inline__ void
16443+gr_insertsort(void)
16444+{
16445+ unsigned short i, j;
16446+ struct crash_uid index;
16447+
16448+ for (i = 1; i < uid_used; i++) {
16449+ index = uid_set[i];
16450+ j = i;
16451+ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
16452+ uid_set[j] = uid_set[j - 1];
16453+ j--;
16454+ }
16455+ uid_set[j] = index;
16456+ }
16457+
16458+ return;
16459+}
16460+
16461+static __inline__ void
16462+gr_insert_uid(const uid_t uid, const unsigned long expires)
16463+{
16464+ int loc;
16465+
16466+ if (uid_used == GR_UIDTABLE_MAX)
16467+ return;
16468+
16469+ loc = gr_find_uid(uid);
16470+
16471+ if (loc >= 0) {
16472+ uid_set[loc].expires = expires;
16473+ return;
16474+ }
16475+
16476+ uid_set[uid_used].uid = uid;
16477+ uid_set[uid_used].expires = expires;
16478+ uid_used++;
16479+
16480+ gr_insertsort();
16481+
16482+ return;
16483+}
16484+
16485+void
16486+gr_remove_uid(const unsigned short loc)
16487+{
16488+ unsigned short i;
16489+
16490+ for (i = loc + 1; i < uid_used; i++)
16491+ uid_set[i - 1] = uid_set[i];
16492+
16493+ uid_used--;
16494+
16495+ return;
16496+}
16497+
16498+int
16499+gr_check_crash_uid(const uid_t uid)
16500+{
16501+ int loc;
16502+ int ret = 0;
16503+
16504+ if (unlikely(!gr_acl_is_enabled()))
16505+ return 0;
16506+
16507+ spin_lock(&gr_uid_lock);
16508+ loc = gr_find_uid(uid);
16509+
16510+ if (loc < 0)
16511+ goto out_unlock;
16512+
16513+ if (time_before_eq(uid_set[loc].expires, get_seconds()))
16514+ gr_remove_uid(loc);
16515+ else
16516+ ret = 1;
16517+
16518+out_unlock:
16519+ spin_unlock(&gr_uid_lock);
16520+ return ret;
16521+}
16522+
16523+static __inline__ int
16524+proc_is_setxid(const struct task_struct *task)
16525+{
16526+ if (task->uid != task->euid || task->uid != task->suid ||
16527+ task->uid != task->fsuid)
16528+ return 1;
16529+ if (task->gid != task->egid || task->gid != task->sgid ||
16530+ task->gid != task->fsgid)
16531+ return 1;
16532+
16533+ return 0;
16534+}
16535+static __inline__ int
16536+gr_fake_force_sig(int sig, struct task_struct *t)
16537+{
16538+ unsigned long int flags;
16539+ int ret;
16540+
16541+ spin_lock_irqsave(&t->sighand->siglock, flags);
16542+ if (sigismember(&t->blocked, sig) || t->sighand->action[sig-1].sa.sa_handler == SIG_IGN) {
16543+ t->sighand->action[sig-1].sa.sa_handler = SIG_DFL;
16544+ sigdelset(&t->blocked, sig);
16545+ recalc_sigpending_tsk(t);
16546+ }
16547+ ret = specific_send_sig_info(sig, (void*)1L, t);
16548+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
16549+
16550+ return ret;
16551+}
16552+
16553+void
16554+gr_handle_crash(struct task_struct *task, const int sig)
16555+{
16556+ struct acl_subject_label *curr;
16557+ struct acl_subject_label *curr2;
16558+ struct task_struct *tsk, *tsk2;
16559+
16560+ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
16561+ return;
16562+
16563+ if (unlikely(!gr_acl_is_enabled()))
16564+ return;
16565+
16566+ curr = task->acl;
16567+
16568+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
16569+ return;
16570+
16571+ if (time_before_eq(curr->expires, get_seconds())) {
16572+ curr->expires = 0;
16573+ curr->crashes = 0;
16574+ }
16575+
16576+ curr->crashes++;
16577+
16578+ if (!curr->expires)
16579+ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
16580+
16581+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
16582+ time_after(curr->expires, get_seconds())) {
16583+ if (task->uid && proc_is_setxid(task)) {
16584+ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
16585+ spin_lock(&gr_uid_lock);
16586+ gr_insert_uid(task->uid, curr->expires);
16587+ spin_unlock(&gr_uid_lock);
16588+ curr->expires = 0;
16589+ curr->crashes = 0;
16590+ read_lock(&tasklist_lock);
16591+ do_each_thread(tsk2, tsk) {
16592+ if (tsk != task && tsk->uid == task->uid)
16593+ gr_fake_force_sig(SIGKILL, tsk);
16594+ } while_each_thread(tsk2, tsk);
16595+ read_unlock(&tasklist_lock);
16596+ } else {
16597+ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
16598+ read_lock(&tasklist_lock);
16599+ do_each_thread(tsk2, tsk) {
16600+ if (likely(tsk != task)) {
16601+ curr2 = tsk->acl;
16602+
16603+ if (curr2->device == curr->device &&
16604+ curr2->inode == curr->inode)
16605+ gr_fake_force_sig(SIGKILL, tsk);
16606+ }
16607+ } while_each_thread(tsk2, tsk);
16608+ read_unlock(&tasklist_lock);
16609+ }
16610+ }
16611+
16612+ return;
16613+}
16614+
16615+int
16616+gr_check_crash_exec(const struct file *filp)
16617+{
16618+ struct acl_subject_label *curr;
16619+
16620+ if (unlikely(!gr_acl_is_enabled()))
16621+ return 0;
16622+
16623+ read_lock(&gr_inode_lock);
16624+ curr = lookup_acl_subj_label(filp->f_dentry->d_inode->i_ino,
16625+ filp->f_dentry->d_inode->i_sb->s_dev,
16626+ current->role);
16627+ read_unlock(&gr_inode_lock);
16628+
16629+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
16630+ (!curr->crashes && !curr->expires))
16631+ return 0;
16632+
16633+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
16634+ time_after(curr->expires, get_seconds()))
16635+ return 1;
16636+ else if (time_before_eq(curr->expires, get_seconds())) {
16637+ curr->crashes = 0;
16638+ curr->expires = 0;
16639+ }
16640+
16641+ return 0;
16642+}
16643+
16644+void
16645+gr_handle_alertkill(struct task_struct *task)
16646+{
16647+ struct acl_subject_label *curracl;
16648+ __u32 curr_ip;
16649+ struct task_struct *p, *p2;
16650+
16651+ if (unlikely(!gr_acl_is_enabled()))
16652+ return;
16653+
16654+ curracl = task->acl;
16655+ curr_ip = task->signal->curr_ip;
16656+
16657+ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
16658+ read_lock(&tasklist_lock);
16659+ do_each_thread(p2, p) {
16660+ if (p->signal->curr_ip == curr_ip)
16661+ gr_fake_force_sig(SIGKILL, p);
16662+ } while_each_thread(p2, p);
16663+ read_unlock(&tasklist_lock);
16664+ } else if (curracl->mode & GR_KILLPROC)
16665+ gr_fake_force_sig(SIGKILL, task);
16666+
16667+ return;
16668+}
16669diff -urNp linux-2.6.18/grsecurity/gracl_shm.c linux-2.6.18/grsecurity/gracl_shm.c
16670--- linux-2.6.18/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
16671+++ linux-2.6.18/grsecurity/gracl_shm.c 2006-09-22 20:04:35.000000000 -0400
16672@@ -0,0 +1,33 @@
16673+#include <linux/kernel.h>
16674+#include <linux/mm.h>
16675+#include <linux/sched.h>
16676+#include <linux/file.h>
16677+#include <linux/ipc.h>
16678+#include <linux/gracl.h>
16679+#include <linux/grsecurity.h>
16680+#include <linux/grinternal.h>
16681+
16682+int
16683+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
16684+ const time_t shm_createtime, const uid_t cuid, const int shmid)
16685+{
16686+ struct task_struct *task;
16687+
16688+ if (!gr_acl_is_enabled())
16689+ return 1;
16690+
16691+ task = find_task_by_pid(shm_cprid);
16692+
16693+ if (unlikely(!task))
16694+ task = find_task_by_pid(shm_lapid);
16695+
16696+ if (unlikely(task && (time_before((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
16697+ (task->pid == shm_lapid)) &&
16698+ (task->acl->mode & GR_PROTSHM) &&
16699+ (task->acl != current->acl))) {
16700+ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
16701+ return 0;
16702+ }
16703+
16704+ return 1;
16705+}
16706diff -urNp linux-2.6.18/grsecurity/grsec_chdir.c linux-2.6.18/grsecurity/grsec_chdir.c
16707--- linux-2.6.18/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
16708+++ linux-2.6.18/grsecurity/grsec_chdir.c 2006-09-22 20:04:35.000000000 -0400
16709@@ -0,0 +1,19 @@
16710+#include <linux/kernel.h>
16711+#include <linux/sched.h>
16712+#include <linux/fs.h>
16713+#include <linux/file.h>
16714+#include <linux/grsecurity.h>
16715+#include <linux/grinternal.h>
16716+
16717+void
16718+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
16719+{
16720+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
16721+ if ((grsec_enable_chdir && grsec_enable_group &&
16722+ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
16723+ !grsec_enable_group)) {
16724+ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
16725+ }
16726+#endif
16727+ return;
16728+}
16729diff -urNp linux-2.6.18/grsecurity/grsec_chroot.c linux-2.6.18/grsecurity/grsec_chroot.c
16730--- linux-2.6.18/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
16731+++ linux-2.6.18/grsecurity/grsec_chroot.c 2006-09-22 20:04:35.000000000 -0400
16732@@ -0,0 +1,332 @@
16733+#include <linux/kernel.h>
16734+#include <linux/module.h>
16735+#include <linux/sched.h>
16736+#include <linux/file.h>
16737+#include <linux/fs.h>
16738+#include <linux/mount.h>
16739+#include <linux/types.h>
16740+#include <linux/grinternal.h>
16741+
16742+int
16743+gr_handle_chroot_unix(const pid_t pid)
16744+{
16745+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
16746+ struct pid *spid = NULL;
16747+
16748+ if (unlikely(!grsec_enable_chroot_unix))
16749+ return 1;
16750+
16751+ if (likely(!proc_is_chrooted(current)))
16752+ return 1;
16753+
16754+ read_lock(&tasklist_lock);
16755+
16756+ spid = find_pid(pid);
16757+ if (spid) {
16758+ struct task_struct *p;
16759+ p = pid_task(spid, PIDTYPE_PID);
16760+ task_lock(p);
16761+ if (unlikely(!have_same_root(current, p))) {
16762+ task_unlock(p);
16763+ read_unlock(&tasklist_lock);
16764+ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
16765+ return 0;
16766+ }
16767+ task_unlock(p);
16768+ }
16769+ read_unlock(&tasklist_lock);
16770+#endif
16771+ return 1;
16772+}
16773+
16774+int
16775+gr_handle_chroot_nice(void)
16776+{
16777+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
16778+ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
16779+ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
16780+ return -EPERM;
16781+ }
16782+#endif
16783+ return 0;
16784+}
16785+
16786+int
16787+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
16788+{
16789+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
16790+ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
16791+ && proc_is_chrooted(current)) {
16792+ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
16793+ return -EACCES;
16794+ }
16795+#endif
16796+ return 0;
16797+}
16798+
16799+int
16800+gr_handle_chroot_rawio(const struct inode *inode)
16801+{
16802+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
16803+ if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
16804+ inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
16805+ return 1;
16806+#endif
16807+ return 0;
16808+}
16809+
16810+int
16811+gr_pid_is_chrooted(struct task_struct *p)
16812+{
16813+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
16814+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !p)
16815+ return 0;
16816+
16817+ task_lock(p);
16818+ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
16819+ !have_same_root(current, p)) {
16820+ task_unlock(p);
16821+ return 1;
16822+ }
16823+ task_unlock(p);
16824+#endif
16825+ return 0;
16826+}
16827+
16828+EXPORT_SYMBOL(gr_pid_is_chrooted);
16829+
16830+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
16831+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
16832+{
16833+ struct dentry *dentry = (struct dentry *)u_dentry;
16834+ struct vfsmount *mnt = (struct vfsmount *)u_mnt;
16835+ struct dentry *realroot;
16836+ struct vfsmount *realrootmnt;
16837+ struct dentry *currentroot;
16838+ struct vfsmount *currentmnt;
16839+ int ret = 1;
16840+
16841+ read_lock(&child_reaper->fs->lock);
16842+ realrootmnt = mntget(child_reaper->fs->rootmnt);
16843+ realroot = dget(child_reaper->fs->root);
16844+ read_unlock(&child_reaper->fs->lock);
16845+
16846+ read_lock(&current->fs->lock);
16847+ currentmnt = mntget(current->fs->rootmnt);
16848+ currentroot = dget(current->fs->root);
16849+ read_unlock(&current->fs->lock);
16850+
16851+ spin_lock(&dcache_lock);
16852+ for (;;) {
16853+ if (unlikely((dentry == realroot && mnt == realrootmnt)
16854+ || (dentry == currentroot && mnt == currentmnt)))
16855+ break;
16856+ if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
16857+ if (mnt->mnt_parent == mnt)
16858+ break;
16859+ dentry = mnt->mnt_mountpoint;
16860+ mnt = mnt->mnt_parent;
16861+ continue;
16862+ }
16863+ dentry = dentry->d_parent;
16864+ }
16865+ spin_unlock(&dcache_lock);
16866+
16867+ dput(currentroot);
16868+ mntput(currentmnt);
16869+
16870+ /* access is outside of chroot */
16871+ if (dentry == realroot && mnt == realrootmnt)
16872+ ret = 0;
16873+
16874+ dput(realroot);
16875+ mntput(realrootmnt);
16876+ return ret;
16877+}
16878+#endif
16879+
16880+int
16881+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
16882+{
16883+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
16884+ if (!grsec_enable_chroot_fchdir)
16885+ return 1;
16886+
16887+ if (!proc_is_chrooted(current))
16888+ return 1;
16889+ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
16890+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
16891+ return 0;
16892+ }
16893+#endif
16894+ return 1;
16895+}
16896+
16897+int
16898+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
16899+ const time_t shm_createtime)
16900+{
16901+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
16902+ struct pid *pid = NULL;
16903+ time_t starttime;
16904+
16905+ if (unlikely(!grsec_enable_chroot_shmat))
16906+ return 1;
16907+
16908+ if (likely(!proc_is_chrooted(current)))
16909+ return 1;
16910+
16911+ read_lock(&tasklist_lock);
16912+
16913+ pid = find_pid(shm_cprid);
16914+ if (pid) {
16915+ struct task_struct *p;
16916+ p = pid_task(pid, PIDTYPE_PID);
16917+ task_lock(p);
16918+ starttime = p->start_time.tv_sec;
16919+ if (unlikely(!have_same_root(current, p) &&
16920+ time_before((unsigned long)starttime, (unsigned long)shm_createtime))) {
16921+ task_unlock(p);
16922+ read_unlock(&tasklist_lock);
16923+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
16924+ return 0;
16925+ }
16926+ task_unlock(p);
16927+ } else {
16928+ pid = find_pid(shm_lapid);
16929+ if (pid) {
16930+ struct task_struct *p;
16931+ p = pid_task(pid, PIDTYPE_PID);
16932+ task_lock(p);
16933+ if (unlikely(!have_same_root(current, p))) {
16934+ task_unlock(p);
16935+ read_unlock(&tasklist_lock);
16936+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
16937+ return 0;
16938+ }
16939+ task_unlock(p);
16940+ }
16941+ }
16942+
16943+ read_unlock(&tasklist_lock);
16944+#endif
16945+ return 1;
16946+}
16947+
16948+void
16949+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
16950+{
16951+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
16952+ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
16953+ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
16954+#endif
16955+ return;
16956+}
16957+
16958+int
16959+gr_handle_chroot_mknod(const struct dentry *dentry,
16960+ const struct vfsmount *mnt, const int mode)
16961+{
16962+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
16963+ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
16964+ proc_is_chrooted(current)) {
16965+ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
16966+ return -EPERM;
16967+ }
16968+#endif
16969+ return 0;
16970+}
16971+
16972+int
16973+gr_handle_chroot_mount(const struct dentry *dentry,
16974+ const struct vfsmount *mnt, const char *dev_name)
16975+{
16976+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
16977+ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
16978+ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name, dentry, mnt);
16979+ return -EPERM;
16980+ }
16981+#endif
16982+ return 0;
16983+}
16984+
16985+int
16986+gr_handle_chroot_pivot(void)
16987+{
16988+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
16989+ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
16990+ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
16991+ return -EPERM;
16992+ }
16993+#endif
16994+ return 0;
16995+}
16996+
16997+int
16998+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
16999+{
17000+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
17001+ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
17002+ !gr_is_outside_chroot(dentry, mnt)) {
17003+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
17004+ return -EPERM;
17005+ }
17006+#endif
17007+ return 0;
17008+}
17009+
17010+void
17011+gr_handle_chroot_caps(struct task_struct *task)
17012+{
17013+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
17014+ if (grsec_enable_chroot_caps && proc_is_chrooted(task)) {
17015+ task->cap_permitted =
17016+ cap_drop(task->cap_permitted, GR_CHROOT_CAPS);
17017+ task->cap_inheritable =
17018+ cap_drop(task->cap_inheritable, GR_CHROOT_CAPS);
17019+ task->cap_effective =
17020+ cap_drop(task->cap_effective, GR_CHROOT_CAPS);
17021+ }
17022+#endif
17023+ return;
17024+}
17025+
17026+int
17027+gr_handle_chroot_sysctl(const int op)
17028+{
17029+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
17030+ if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
17031+ && (op & 002))
17032+ return -EACCES;
17033+#endif
17034+ return 0;
17035+}
17036+
17037+void
17038+gr_handle_chroot_chdir(struct dentry *dentry, struct vfsmount *mnt)
17039+{
17040+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
17041+ if (grsec_enable_chroot_chdir)
17042+ set_fs_pwd(current->fs, mnt, dentry);
17043+#endif
17044+ return;
17045+}
17046+
17047+int
17048+gr_handle_chroot_chmod(const struct dentry *dentry,
17049+ const struct vfsmount *mnt, const int mode)
17050+{
17051+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
17052+ if (grsec_enable_chroot_chmod &&
17053+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
17054+ proc_is_chrooted(current)) {
17055+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
17056+ return -EPERM;
17057+ }
17058+#endif
17059+ return 0;
17060+}
17061+
17062+#ifdef CONFIG_SECURITY
17063+EXPORT_SYMBOL(gr_handle_chroot_caps);
17064+#endif
17065diff -urNp linux-2.6.18/grsecurity/grsec_disabled.c linux-2.6.18/grsecurity/grsec_disabled.c
17066--- linux-2.6.18/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
17067+++ linux-2.6.18/grsecurity/grsec_disabled.c 2006-09-22 20:04:35.000000000 -0400
17068@@ -0,0 +1,418 @@
17069+#include <linux/kernel.h>
17070+#include <linux/module.h>
17071+#include <linux/config.h>
17072+#include <linux/sched.h>
17073+#include <linux/file.h>
17074+#include <linux/fs.h>
17075+#include <linux/kdev_t.h>
17076+#include <linux/net.h>
17077+#include <linux/in.h>
17078+#include <linux/ip.h>
17079+#include <linux/skbuff.h>
17080+#include <linux/sysctl.h>
17081+
17082+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
17083+void
17084+pax_set_initial_flags(struct linux_binprm *bprm)
17085+{
17086+ return;
17087+}
17088+#endif
17089+
17090+#ifdef CONFIG_SYSCTL
17091+__u32
17092+gr_handle_sysctl(const struct ctl_table * table, __u32 mode)
17093+{
17094+ return mode;
17095+}
17096+#endif
17097+
17098+int
17099+gr_acl_is_enabled(void)
17100+{
17101+ return 0;
17102+}
17103+
17104+int
17105+gr_handle_rawio(const struct inode *inode)
17106+{
17107+ return 0;
17108+}
17109+
17110+void
17111+gr_acl_handle_psacct(struct task_struct *task, const long code)
17112+{
17113+ return;
17114+}
17115+
17116+int
17117+gr_handle_ptrace(struct task_struct *task, const long request)
17118+{
17119+ return 0;
17120+}
17121+
17122+int
17123+gr_handle_proc_ptrace(struct task_struct *task)
17124+{
17125+ return 0;
17126+}
17127+
17128+void
17129+gr_learn_resource(const struct task_struct *task,
17130+ const int res, const unsigned long wanted, const int gt)
17131+{
17132+ return;
17133+}
17134+
17135+int
17136+gr_set_acls(const int type)
17137+{
17138+ return 0;
17139+}
17140+
17141+int
17142+gr_check_hidden_task(const struct task_struct *tsk)
17143+{
17144+ return 0;
17145+}
17146+
17147+int
17148+gr_check_protected_task(const struct task_struct *task)
17149+{
17150+ return 0;
17151+}
17152+
17153+void
17154+gr_copy_label(struct task_struct *tsk)
17155+{
17156+ return;
17157+}
17158+
17159+void
17160+gr_set_pax_flags(struct task_struct *task)
17161+{
17162+ return;
17163+}
17164+
17165+int
17166+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt)
17167+{
17168+ return 0;
17169+}
17170+
17171+void
17172+gr_handle_delete(const ino_t ino, const dev_t dev)
17173+{
17174+ return;
17175+}
17176+
17177+void
17178+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
17179+{
17180+ return;
17181+}
17182+
17183+void
17184+gr_handle_crash(struct task_struct *task, const int sig)
17185+{
17186+ return;
17187+}
17188+
17189+int
17190+gr_check_crash_exec(const struct file *filp)
17191+{
17192+ return 0;
17193+}
17194+
17195+int
17196+gr_check_crash_uid(const uid_t uid)
17197+{
17198+ return 0;
17199+}
17200+
17201+void
17202+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
17203+ struct dentry *old_dentry,
17204+ struct dentry *new_dentry,
17205+ struct vfsmount *mnt, const __u8 replace)
17206+{
17207+ return;
17208+}
17209+
17210+int
17211+gr_search_socket(const int family, const int type, const int protocol)
17212+{
17213+ return 1;
17214+}
17215+
17216+int
17217+gr_search_connectbind(const int mode, const struct socket *sock,
17218+ const struct sockaddr_in *addr)
17219+{
17220+ return 1;
17221+}
17222+
17223+int
17224+gr_task_is_capable(struct task_struct *task, const int cap)
17225+{
17226+ return 1;
17227+}
17228+
17229+int
17230+gr_is_capable_nolog(const int cap)
17231+{
17232+ return 1;
17233+}
17234+
17235+void
17236+gr_handle_alertkill(struct task_struct *task)
17237+{
17238+ return;
17239+}
17240+
17241+__u32
17242+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
17243+{
17244+ return 1;
17245+}
17246+
17247+__u32
17248+gr_acl_handle_hidden_file(const struct dentry * dentry,
17249+ const struct vfsmount * mnt)
17250+{
17251+ return 1;
17252+}
17253+
17254+__u32
17255+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
17256+ const int fmode)
17257+{
17258+ return 1;
17259+}
17260+
17261+__u32
17262+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
17263+{
17264+ return 1;
17265+}
17266+
17267+__u32
17268+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
17269+{
17270+ return 1;
17271+}
17272+
17273+int
17274+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
17275+ unsigned int *vm_flags)
17276+{
17277+ return 1;
17278+}
17279+
17280+__u32
17281+gr_acl_handle_truncate(const struct dentry * dentry,
17282+ const struct vfsmount * mnt)
17283+{
17284+ return 1;
17285+}
17286+
17287+__u32
17288+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
17289+{
17290+ return 1;
17291+}
17292+
17293+__u32
17294+gr_acl_handle_access(const struct dentry * dentry,
17295+ const struct vfsmount * mnt, const int fmode)
17296+{
17297+ return 1;
17298+}
17299+
17300+__u32
17301+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
17302+ mode_t mode)
17303+{
17304+ return 1;
17305+}
17306+
17307+__u32
17308+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
17309+ mode_t mode)
17310+{
17311+ return 1;
17312+}
17313+
17314+__u32
17315+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
17316+{
17317+ return 1;
17318+}
17319+
17320+void
17321+grsecurity_init(void)
17322+{
17323+ return;
17324+}
17325+
17326+__u32
17327+gr_acl_handle_mknod(const struct dentry * new_dentry,
17328+ const struct dentry * parent_dentry,
17329+ const struct vfsmount * parent_mnt,
17330+ const int mode)
17331+{
17332+ return 1;
17333+}
17334+
17335+__u32
17336+gr_acl_handle_mkdir(const struct dentry * new_dentry,
17337+ const struct dentry * parent_dentry,
17338+ const struct vfsmount * parent_mnt)
17339+{
17340+ return 1;
17341+}
17342+
17343+__u32
17344+gr_acl_handle_symlink(const struct dentry * new_dentry,
17345+ const struct dentry * parent_dentry,
17346+ const struct vfsmount * parent_mnt, const char *from)
17347+{
17348+ return 1;
17349+}
17350+
17351+__u32
17352+gr_acl_handle_link(const struct dentry * new_dentry,
17353+ const struct dentry * parent_dentry,
17354+ const struct vfsmount * parent_mnt,
17355+ const struct dentry * old_dentry,
17356+ const struct vfsmount * old_mnt, const char *to)
17357+{
17358+ return 1;
17359+}
17360+
17361+int
17362+gr_acl_handle_rename(const struct dentry *new_dentry,
17363+ const struct dentry *parent_dentry,
17364+ const struct vfsmount *parent_mnt,
17365+ const struct dentry *old_dentry,
17366+ const struct inode *old_parent_inode,
17367+ const struct vfsmount *old_mnt, const char *newname)
17368+{
17369+ return 0;
17370+}
17371+
17372+int
17373+gr_acl_handle_filldir(const struct file *file, const char *name,
17374+ const int namelen, const ino_t ino)
17375+{
17376+ return 1;
17377+}
17378+
17379+int
17380+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
17381+ const time_t shm_createtime, const uid_t cuid, const int shmid)
17382+{
17383+ return 1;
17384+}
17385+
17386+int
17387+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
17388+{
17389+ return 1;
17390+}
17391+
17392+int
17393+gr_search_accept(const struct socket *sock)
17394+{
17395+ return 1;
17396+}
17397+
17398+int
17399+gr_search_listen(const struct socket *sock)
17400+{
17401+ return 1;
17402+}
17403+
17404+int
17405+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
17406+{
17407+ return 1;
17408+}
17409+
17410+__u32
17411+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
17412+{
17413+ return 1;
17414+}
17415+
17416+__u32
17417+gr_acl_handle_creat(const struct dentry * dentry,
17418+ const struct dentry * p_dentry,
17419+ const struct vfsmount * p_mnt, const int fmode,
17420+ const int imode)
17421+{
17422+ return 1;
17423+}
17424+
17425+void
17426+gr_acl_handle_exit(void)
17427+{
17428+ return;
17429+}
17430+
17431+int
17432+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
17433+{
17434+ return 1;
17435+}
17436+
17437+void
17438+gr_set_role_label(const uid_t uid, const gid_t gid)
17439+{
17440+ return;
17441+}
17442+
17443+int
17444+gr_acl_handle_procpidmem(const struct task_struct *task)
17445+{
17446+ return 0;
17447+}
17448+
17449+int
17450+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
17451+{
17452+ return 1;
17453+}
17454+
17455+int
17456+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
17457+{
17458+ return 1;
17459+}
17460+
17461+void
17462+gr_set_kernel_label(struct task_struct *task)
17463+{
17464+ return;
17465+}
17466+
17467+int
17468+gr_check_user_change(int real, int effective, int fs)
17469+{
17470+ return 0;
17471+}
17472+
17473+int
17474+gr_check_group_change(int real, int effective, int fs)
17475+{
17476+ return 0;
17477+}
17478+
17479+
17480+EXPORT_SYMBOL(gr_task_is_capable);
17481+EXPORT_SYMBOL(gr_learn_resource);
17482+EXPORT_SYMBOL(gr_set_kernel_label);
17483+#ifdef CONFIG_SECURITY
17484+EXPORT_SYMBOL(gr_check_user_change);
17485+EXPORT_SYMBOL(gr_check_group_change);
17486+#endif
17487diff -urNp linux-2.6.18/grsecurity/grsec_exec.c linux-2.6.18/grsecurity/grsec_exec.c
17488--- linux-2.6.18/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
17489+++ linux-2.6.18/grsecurity/grsec_exec.c 2006-09-22 20:04:35.000000000 -0400
17490@@ -0,0 +1,88 @@
17491+#include <linux/kernel.h>
17492+#include <linux/sched.h>
17493+#include <linux/file.h>
17494+#include <linux/binfmts.h>
17495+#include <linux/smp_lock.h>
17496+#include <linux/fs.h>
17497+#include <linux/types.h>
17498+#include <linux/grdefs.h>
17499+#include <linux/grinternal.h>
17500+#include <linux/capability.h>
17501+
17502+#include <asm/uaccess.h>
17503+
17504+#ifdef CONFIG_GRKERNSEC_EXECLOG
17505+static char gr_exec_arg_buf[132];
17506+static DECLARE_MUTEX(gr_exec_arg_sem);
17507+#endif
17508+
17509+int
17510+gr_handle_nproc(void)
17511+{
17512+#ifdef CONFIG_GRKERNSEC_EXECVE
17513+ if (grsec_enable_execve && current->user &&
17514+ (atomic_read(&current->user->processes) >
17515+ current->signal->rlim[RLIMIT_NPROC].rlim_cur) &&
17516+ !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
17517+ gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
17518+ return -EAGAIN;
17519+ }
17520+#endif
17521+ return 0;
17522+}
17523+
17524+void
17525+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *__user *argv)
17526+{
17527+#ifdef CONFIG_GRKERNSEC_EXECLOG
17528+ char *grarg = gr_exec_arg_buf;
17529+ unsigned int i, x, execlen = 0;
17530+ char c;
17531+
17532+ if (!((grsec_enable_execlog && grsec_enable_group &&
17533+ in_group_p(grsec_audit_gid))
17534+ || (grsec_enable_execlog && !grsec_enable_group)))
17535+ return;
17536+
17537+ down(&gr_exec_arg_sem);
17538+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
17539+
17540+ if (unlikely(argv == NULL))
17541+ goto log;
17542+
17543+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
17544+ const char __user *p;
17545+ unsigned int len;
17546+
17547+ if (copy_from_user(&p, argv + i, sizeof(p)))
17548+ goto log;
17549+ if (!p)
17550+ goto log;
17551+ len = strnlen_user(p, 128 - execlen);
17552+ if (len > 128 - execlen)
17553+ len = 128 - execlen;
17554+ else if (len > 0)
17555+ len--;
17556+ if (copy_from_user(grarg + execlen, p, len))
17557+ goto log;
17558+
17559+ /* rewrite unprintable characters */
17560+ for (x = 0; x < len; x++) {
17561+ c = *(grarg + execlen + x);
17562+ if (c < 32 || c > 126)
17563+ *(grarg + execlen + x) = ' ';
17564+ }
17565+
17566+ execlen += len;
17567+ *(grarg + execlen) = ' ';
17568+ *(grarg + execlen + 1) = '\0';
17569+ execlen++;
17570+ }
17571+
17572+ log:
17573+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_dentry,
17574+ bprm->file->f_vfsmnt, grarg);
17575+ up(&gr_exec_arg_sem);
17576+#endif
17577+ return;
17578+}
17579diff -urNp linux-2.6.18/grsecurity/grsec_fifo.c linux-2.6.18/grsecurity/grsec_fifo.c
17580--- linux-2.6.18/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
17581+++ linux-2.6.18/grsecurity/grsec_fifo.c 2006-09-22 20:04:35.000000000 -0400
17582@@ -0,0 +1,22 @@
17583+#include <linux/kernel.h>
17584+#include <linux/sched.h>
17585+#include <linux/fs.h>
17586+#include <linux/file.h>
17587+#include <linux/grinternal.h>
17588+
17589+int
17590+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
17591+ const struct dentry *dir, const int flag, const int acc_mode)
17592+{
17593+#ifdef CONFIG_GRKERNSEC_FIFO
17594+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
17595+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
17596+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
17597+ (current->fsuid != dentry->d_inode->i_uid)) {
17598+ if (!generic_permission(dentry->d_inode, acc_mode, NULL))
17599+ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
17600+ return -EACCES;
17601+ }
17602+#endif
17603+ return 0;
17604+}
17605diff -urNp linux-2.6.18/grsecurity/grsec_fork.c linux-2.6.18/grsecurity/grsec_fork.c
17606--- linux-2.6.18/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
17607+++ linux-2.6.18/grsecurity/grsec_fork.c 2006-09-22 20:04:35.000000000 -0400
17608@@ -0,0 +1,15 @@
17609+#include <linux/kernel.h>
17610+#include <linux/sched.h>
17611+#include <linux/grsecurity.h>
17612+#include <linux/grinternal.h>
17613+#include <linux/errno.h>
17614+
17615+void
17616+gr_log_forkfail(const int retval)
17617+{
17618+#ifdef CONFIG_GRKERNSEC_FORKFAIL
17619+ if (grsec_enable_forkfail && retval != -ERESTARTNOINTR)
17620+ gr_log_int(GR_DONT_AUDIT, GR_FAILFORK_MSG, retval);
17621+#endif
17622+ return;
17623+}
17624diff -urNp linux-2.6.18/grsecurity/grsec_init.c linux-2.6.18/grsecurity/grsec_init.c
17625--- linux-2.6.18/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
17626+++ linux-2.6.18/grsecurity/grsec_init.c 2006-09-22 20:04:35.000000000 -0400
17627@@ -0,0 +1,236 @@
17628+#include <linux/kernel.h>
17629+#include <linux/sched.h>
17630+#include <linux/mm.h>
17631+#include <linux/smp_lock.h>
17632+#include <linux/gracl.h>
17633+#include <linux/slab.h>
17634+#include <linux/vmalloc.h>
17635+#include <linux/percpu.h>
17636+
17637+int grsec_enable_shm;
17638+int grsec_enable_link;
17639+int grsec_enable_dmesg;
17640+int grsec_enable_fifo;
17641+int grsec_enable_execve;
17642+int grsec_enable_execlog;
17643+int grsec_enable_signal;
17644+int grsec_enable_forkfail;
17645+int grsec_enable_time;
17646+int grsec_enable_audit_textrel;
17647+int grsec_enable_group;
17648+int grsec_audit_gid;
17649+int grsec_enable_chdir;
17650+int grsec_enable_audit_ipc;
17651+int grsec_enable_mount;
17652+int grsec_enable_chroot_findtask;
17653+int grsec_enable_chroot_mount;
17654+int grsec_enable_chroot_shmat;
17655+int grsec_enable_chroot_fchdir;
17656+int grsec_enable_chroot_double;
17657+int grsec_enable_chroot_pivot;
17658+int grsec_enable_chroot_chdir;
17659+int grsec_enable_chroot_chmod;
17660+int grsec_enable_chroot_mknod;
17661+int grsec_enable_chroot_nice;
17662+int grsec_enable_chroot_execlog;
17663+int grsec_enable_chroot_caps;
17664+int grsec_enable_chroot_sysctl;
17665+int grsec_enable_chroot_unix;
17666+int grsec_enable_tpe;
17667+int grsec_tpe_gid;
17668+int grsec_enable_tpe_all;
17669+int grsec_enable_randpid;
17670+int grsec_enable_socket_all;
17671+int grsec_socket_all_gid;
17672+int grsec_enable_socket_client;
17673+int grsec_socket_client_gid;
17674+int grsec_enable_socket_server;
17675+int grsec_socket_server_gid;
17676+int grsec_resource_logging;
17677+int grsec_lock;
17678+
17679+spinlock_t grsec_alert_lock = SPIN_LOCK_UNLOCKED;
17680+unsigned long grsec_alert_wtime = 0;
17681+unsigned long grsec_alert_fyet = 0;
17682+
17683+spinlock_t grsec_audit_lock = SPIN_LOCK_UNLOCKED;
17684+
17685+rwlock_t grsec_exec_file_lock = RW_LOCK_UNLOCKED;
17686+
17687+char *gr_shared_page[4];
17688+
17689+char *gr_alert_log_fmt;
17690+char *gr_audit_log_fmt;
17691+char *gr_alert_log_buf;
17692+char *gr_audit_log_buf;
17693+
17694+extern struct gr_arg *gr_usermode;
17695+extern unsigned char *gr_system_salt;
17696+extern unsigned char *gr_system_sum;
17697+
17698+void
17699+grsecurity_init(void)
17700+{
17701+ int j;
17702+ /* create the per-cpu shared pages */
17703+
17704+ preempt_disable();
17705+ for (j = 0; j < 4; j++) {
17706+ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE);
17707+ if (gr_shared_page[j] == NULL) {
17708+ panic("Unable to allocate grsecurity shared page");
17709+ return;
17710+ }
17711+ }
17712+ preempt_enable();
17713+
17714+ /* allocate log buffers */
17715+ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
17716+ if (!gr_alert_log_fmt) {
17717+ panic("Unable to allocate grsecurity alert log format buffer");
17718+ return;
17719+ }
17720+ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
17721+ if (!gr_audit_log_fmt) {
17722+ panic("Unable to allocate grsecurity audit log format buffer");
17723+ return;
17724+ }
17725+ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
17726+ if (!gr_alert_log_buf) {
17727+ panic("Unable to allocate grsecurity alert log buffer");
17728+ return;
17729+ }
17730+ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
17731+ if (!gr_audit_log_buf) {
17732+ panic("Unable to allocate grsecurity audit log buffer");
17733+ return;
17734+ }
17735+
17736+ /* allocate memory for authentication structure */
17737+ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
17738+ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
17739+ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
17740+
17741+ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
17742+ panic("Unable to allocate grsecurity authentication structure");
17743+ return;
17744+ }
17745+
17746+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
17747+#ifndef CONFIG_GRKERNSEC_SYSCTL
17748+ grsec_lock = 1;
17749+#endif
17750+#ifdef CONFIG_GRKERNSEC_SHM
17751+ grsec_enable_shm = 1;
17752+#endif
17753+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
17754+ grsec_enable_audit_textrel = 1;
17755+#endif
17756+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
17757+ grsec_enable_group = 1;
17758+ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
17759+#endif
17760+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
17761+ grsec_enable_chdir = 1;
17762+#endif
17763+#ifdef CONFIG_GRKERNSEC_AUDIT_IPC
17764+ grsec_enable_audit_ipc = 1;
17765+#endif
17766+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
17767+ grsec_enable_mount = 1;
17768+#endif
17769+#ifdef CONFIG_GRKERNSEC_LINK
17770+ grsec_enable_link = 1;
17771+#endif
17772+#ifdef CONFIG_GRKERNSEC_DMESG
17773+ grsec_enable_dmesg = 1;
17774+#endif
17775+#ifdef CONFIG_GRKERNSEC_FIFO
17776+ grsec_enable_fifo = 1;
17777+#endif
17778+#ifdef CONFIG_GRKERNSEC_EXECVE
17779+ grsec_enable_execve = 1;
17780+#endif
17781+#ifdef CONFIG_GRKERNSEC_EXECLOG
17782+ grsec_enable_execlog = 1;
17783+#endif
17784+#ifdef CONFIG_GRKERNSEC_SIGNAL
17785+ grsec_enable_signal = 1;
17786+#endif
17787+#ifdef CONFIG_GRKERNSEC_FORKFAIL
17788+ grsec_enable_forkfail = 1;
17789+#endif
17790+#ifdef CONFIG_GRKERNSEC_TIME
17791+ grsec_enable_time = 1;
17792+#endif
17793+#ifdef CONFIG_GRKERNSEC_RESLOG
17794+ grsec_resource_logging = 1;
17795+#endif
17796+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
17797+ grsec_enable_chroot_findtask = 1;
17798+#endif
17799+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
17800+ grsec_enable_chroot_unix = 1;
17801+#endif
17802+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
17803+ grsec_enable_chroot_mount = 1;
17804+#endif
17805+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
17806+ grsec_enable_chroot_fchdir = 1;
17807+#endif
17808+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
17809+ grsec_enable_chroot_shmat = 1;
17810+#endif
17811+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
17812+ grsec_enable_chroot_double = 1;
17813+#endif
17814+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
17815+ grsec_enable_chroot_pivot = 1;
17816+#endif
17817+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
17818+ grsec_enable_chroot_chdir = 1;
17819+#endif
17820+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
17821+ grsec_enable_chroot_chmod = 1;
17822+#endif
17823+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
17824+ grsec_enable_chroot_mknod = 1;
17825+#endif
17826+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
17827+ grsec_enable_chroot_nice = 1;
17828+#endif
17829+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
17830+ grsec_enable_chroot_execlog = 1;
17831+#endif
17832+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
17833+ grsec_enable_chroot_caps = 1;
17834+#endif
17835+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
17836+ grsec_enable_chroot_sysctl = 1;
17837+#endif
17838+#ifdef CONFIG_GRKERNSEC_TPE
17839+ grsec_enable_tpe = 1;
17840+ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
17841+#ifdef CONFIG_GRKERNSEC_TPE_ALL
17842+ grsec_enable_tpe_all = 1;
17843+#endif
17844+#endif
17845+#ifdef CONFIG_GRKERNSEC_RANDPID
17846+ grsec_enable_randpid = 1;
17847+#endif
17848+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
17849+ grsec_enable_socket_all = 1;
17850+ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
17851+#endif
17852+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
17853+ grsec_enable_socket_client = 1;
17854+ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
17855+#endif
17856+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
17857+ grsec_enable_socket_server = 1;
17858+ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
17859+#endif
17860+#endif
17861+
17862+ return;
17863+}
17864diff -urNp linux-2.6.18/grsecurity/grsec_ipc.c linux-2.6.18/grsecurity/grsec_ipc.c
17865--- linux-2.6.18/grsecurity/grsec_ipc.c 1969-12-31 19:00:00.000000000 -0500
17866+++ linux-2.6.18/grsecurity/grsec_ipc.c 2006-09-22 20:04:35.000000000 -0400
17867@@ -0,0 +1,81 @@
17868+#include <linux/kernel.h>
17869+#include <linux/sched.h>
17870+#include <linux/types.h>
17871+#include <linux/ipc.h>
17872+#include <linux/grsecurity.h>
17873+#include <linux/grinternal.h>
17874+
17875+void
17876+gr_log_msgget(const int ret, const int msgflg)
17877+{
17878+#ifdef CONFIG_GRKERNSEC_AUDIT_IPC
17879+ if (((grsec_enable_group && in_group_p(grsec_audit_gid) &&
17880+ grsec_enable_audit_ipc) || (grsec_enable_audit_ipc &&
17881+ !grsec_enable_group)) && (ret >= 0)
17882+ && (msgflg & IPC_CREAT))
17883+ gr_log_noargs(GR_DO_AUDIT, GR_MSGQ_AUDIT_MSG);
17884+#endif
17885+ return;
17886+}
17887+
17888+void
17889+gr_log_msgrm(const uid_t uid, const uid_t cuid)
17890+{
17891+#ifdef CONFIG_GRKERNSEC_AUDIT_IPC
17892+ if ((grsec_enable_group && in_group_p(grsec_audit_gid) &&
17893+ grsec_enable_audit_ipc) ||
17894+ (grsec_enable_audit_ipc && !grsec_enable_group))
17895+ gr_log_int_int(GR_DO_AUDIT, GR_MSGQR_AUDIT_MSG, uid, cuid);
17896+#endif
17897+ return;
17898+}
17899+
17900+void
17901+gr_log_semget(const int err, const int semflg)
17902+{
17903+#ifdef CONFIG_GRKERNSEC_AUDIT_IPC
17904+ if (((grsec_enable_group && in_group_p(grsec_audit_gid) &&
17905+ grsec_enable_audit_ipc) || (grsec_enable_audit_ipc &&
17906+ !grsec_enable_group)) && (err >= 0)
17907+ && (semflg & IPC_CREAT))
17908+ gr_log_noargs(GR_DO_AUDIT, GR_SEM_AUDIT_MSG);
17909+#endif
17910+ return;
17911+}
17912+
17913+void
17914+gr_log_semrm(const uid_t uid, const uid_t cuid)
17915+{
17916+#ifdef CONFIG_GRKERNSEC_AUDIT_IPC
17917+ if ((grsec_enable_group && in_group_p(grsec_audit_gid) &&
17918+ grsec_enable_audit_ipc) ||
17919+ (grsec_enable_audit_ipc && !grsec_enable_group))
17920+ gr_log_int_int(GR_DO_AUDIT, GR_SEMR_AUDIT_MSG, uid, cuid);
17921+#endif
17922+ return;
17923+}
17924+
17925+void
17926+gr_log_shmget(const int err, const int shmflg, const size_t size)
17927+{
17928+#ifdef CONFIG_GRKERNSEC_AUDIT_IPC
17929+ if (((grsec_enable_group && in_group_p(grsec_audit_gid) &&
17930+ grsec_enable_audit_ipc) || (grsec_enable_audit_ipc &&
17931+ !grsec_enable_group)) && (err >= 0)
17932+ && (shmflg & IPC_CREAT))
17933+ gr_log_int(GR_DO_AUDIT, GR_SHM_AUDIT_MSG, size);
17934+#endif
17935+ return;
17936+}
17937+
17938+void
17939+gr_log_shmrm(const uid_t uid, const uid_t cuid)
17940+{
17941+#ifdef CONFIG_GRKERNSEC_AUDIT_IPC
17942+ if ((grsec_enable_group && in_group_p(grsec_audit_gid) &&
17943+ grsec_enable_audit_ipc) ||
17944+ (grsec_enable_audit_ipc && !grsec_enable_group))
17945+ gr_log_int_int(GR_DO_AUDIT, GR_SHMR_AUDIT_MSG, uid, cuid);
17946+#endif
17947+ return;
17948+}
17949diff -urNp linux-2.6.18/grsecurity/grsec_link.c linux-2.6.18/grsecurity/grsec_link.c
17950--- linux-2.6.18/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
17951+++ linux-2.6.18/grsecurity/grsec_link.c 2006-09-22 20:04:35.000000000 -0400
17952@@ -0,0 +1,39 @@
17953+#include <linux/kernel.h>
17954+#include <linux/sched.h>
17955+#include <linux/fs.h>
17956+#include <linux/file.h>
17957+#include <linux/grinternal.h>
17958+
17959+int
17960+gr_handle_follow_link(const struct inode *parent,
17961+ const struct inode *inode,
17962+ const struct dentry *dentry, const struct vfsmount *mnt)
17963+{
17964+#ifdef CONFIG_GRKERNSEC_LINK
17965+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
17966+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
17967+ (parent->i_mode & S_IWOTH) && (current->fsuid != inode->i_uid)) {
17968+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
17969+ return -EACCES;
17970+ }
17971+#endif
17972+ return 0;
17973+}
17974+
17975+int
17976+gr_handle_hardlink(const struct dentry *dentry,
17977+ const struct vfsmount *mnt,
17978+ struct inode *inode, const int mode, const char *to)
17979+{
17980+#ifdef CONFIG_GRKERNSEC_LINK
17981+ if (grsec_enable_link && current->fsuid != inode->i_uid &&
17982+ (!S_ISREG(mode) || (mode & S_ISUID) ||
17983+ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
17984+ (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
17985+ !capable(CAP_FOWNER) && current->uid) {
17986+ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
17987+ return -EPERM;
17988+ }
17989+#endif
17990+ return 0;
17991+}
17992diff -urNp linux-2.6.18/grsecurity/grsec_log.c linux-2.6.18/grsecurity/grsec_log.c
17993--- linux-2.6.18/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
17994+++ linux-2.6.18/grsecurity/grsec_log.c 2006-09-22 20:04:35.000000000 -0400
17995@@ -0,0 +1,265 @@
17996+#include <linux/kernel.h>
17997+#include <linux/sched.h>
17998+#include <linux/file.h>
17999+#include <linux/tty.h>
18000+#include <linux/fs.h>
18001+#include <linux/grinternal.h>
18002+
18003+#define BEGIN_LOCKS(x) \
18004+ read_lock(&tasklist_lock); \
18005+ read_lock(&grsec_exec_file_lock); \
18006+ if (x != GR_DO_AUDIT) \
18007+ spin_lock(&grsec_alert_lock); \
18008+ else \
18009+ spin_lock(&grsec_audit_lock)
18010+
18011+#define END_LOCKS(x) \
18012+ if (x != GR_DO_AUDIT) \
18013+ spin_unlock(&grsec_alert_lock); \
18014+ else \
18015+ spin_unlock(&grsec_audit_lock); \
18016+ read_unlock(&grsec_exec_file_lock); \
18017+ read_unlock(&tasklist_lock); \
18018+ if (x == GR_DONT_AUDIT) \
18019+ gr_handle_alertkill(current)
18020+
18021+enum {
18022+ FLOODING,
18023+ NO_FLOODING
18024+};
18025+
18026+extern char *gr_alert_log_fmt;
18027+extern char *gr_audit_log_fmt;
18028+extern char *gr_alert_log_buf;
18029+extern char *gr_audit_log_buf;
18030+
18031+static int gr_log_start(int audit)
18032+{
18033+ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
18034+ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
18035+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
18036+
18037+ if (audit == GR_DO_AUDIT)
18038+ goto set_fmt;
18039+
18040+ if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
18041+ grsec_alert_wtime = jiffies;
18042+ grsec_alert_fyet = 0;
18043+ } else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
18044+ grsec_alert_fyet++;
18045+ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
18046+ grsec_alert_wtime = jiffies;
18047+ grsec_alert_fyet++;
18048+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
18049+ return FLOODING;
18050+ } else return FLOODING;
18051+
18052+set_fmt:
18053+ memset(buf, 0, PAGE_SIZE);
18054+ if (current->signal->curr_ip && gr_acl_is_enabled()) {
18055+ sprintf(fmt, "%s%s", loglevel, "grsec: From %u.%u.%u.%u: (%.64s:%c:%.950s) ");
18056+ snprintf(buf, PAGE_SIZE - 1, fmt, NIPQUAD(current->signal->curr_ip), current->role->rolename, gr_roletype_to_char(), current->acl->filename);
18057+ } else if (current->signal->curr_ip) {
18058+ sprintf(fmt, "%s%s", loglevel, "grsec: From %u.%u.%u.%u: ");
18059+ snprintf(buf, PAGE_SIZE - 1, fmt, NIPQUAD(current->signal->curr_ip));
18060+ } else if (gr_acl_is_enabled()) {
18061+ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
18062+ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
18063+ } else {
18064+ sprintf(fmt, "%s%s", loglevel, "grsec: ");
18065+ strcpy(buf, fmt);
18066+ }
18067+
18068+ return NO_FLOODING;
18069+}
18070+
18071+static void gr_log_middle(int audit, const char *msg, va_list ap)
18072+{
18073+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
18074+ unsigned int len = strlen(buf);
18075+
18076+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
18077+
18078+ return;
18079+}
18080+
18081+static void gr_log_middle_varargs(int audit, const char *msg, ...)
18082+{
18083+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
18084+ unsigned int len = strlen(buf);
18085+ va_list ap;
18086+
18087+ va_start(ap, msg);
18088+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
18089+ va_end(ap);
18090+
18091+ return;
18092+}
18093+
18094+static void gr_log_end(int audit)
18095+{
18096+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
18097+ unsigned int len = strlen(buf);
18098+
18099+ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current));
18100+ printk("%s\n", buf);
18101+
18102+ return;
18103+}
18104+
18105+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
18106+{
18107+ int logtype;
18108+ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
18109+ char *str1, *str2, *str3;
18110+ int num1, num2;
18111+ unsigned long ulong1, ulong2;
18112+ struct dentry *dentry;
18113+ struct vfsmount *mnt;
18114+ struct file *file;
18115+ struct task_struct *task;
18116+ va_list ap;
18117+
18118+ BEGIN_LOCKS(audit);
18119+ logtype = gr_log_start(audit);
18120+ if (logtype == FLOODING) {
18121+ END_LOCKS(audit);
18122+ return;
18123+ }
18124+ va_start(ap, argtypes);
18125+ switch (argtypes) {
18126+ case GR_TTYSNIFF:
18127+ task = va_arg(ap, struct task_struct *);
18128+ gr_log_middle_varargs(audit, msg, NIPQUAD(task->signal->curr_ip), gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid);
18129+ break;
18130+ case GR_RBAC:
18131+ dentry = va_arg(ap, struct dentry *);
18132+ mnt = va_arg(ap, struct vfsmount *);
18133+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
18134+ break;
18135+ case GR_RBAC_STR:
18136+ dentry = va_arg(ap, struct dentry *);
18137+ mnt = va_arg(ap, struct vfsmount *);
18138+ str1 = va_arg(ap, char *);
18139+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
18140+ break;
18141+ case GR_STR_RBAC:
18142+ str1 = va_arg(ap, char *);
18143+ dentry = va_arg(ap, struct dentry *);
18144+ mnt = va_arg(ap, struct vfsmount *);
18145+ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
18146+ break;
18147+ case GR_RBAC_MODE2:
18148+ dentry = va_arg(ap, struct dentry *);
18149+ mnt = va_arg(ap, struct vfsmount *);
18150+ str1 = va_arg(ap, char *);
18151+ str2 = va_arg(ap, char *);
18152+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
18153+ break;
18154+ case GR_RBAC_MODE3:
18155+ dentry = va_arg(ap, struct dentry *);
18156+ mnt = va_arg(ap, struct vfsmount *);
18157+ str1 = va_arg(ap, char *);
18158+ str2 = va_arg(ap, char *);
18159+ str3 = va_arg(ap, char *);
18160+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
18161+ break;
18162+ case GR_FILENAME:
18163+ dentry = va_arg(ap, struct dentry *);
18164+ mnt = va_arg(ap, struct vfsmount *);
18165+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
18166+ break;
18167+ case GR_STR_FILENAME:
18168+ str1 = va_arg(ap, char *);
18169+ dentry = va_arg(ap, struct dentry *);
18170+ mnt = va_arg(ap, struct vfsmount *);
18171+ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
18172+ break;
18173+ case GR_FILENAME_STR:
18174+ dentry = va_arg(ap, struct dentry *);
18175+ mnt = va_arg(ap, struct vfsmount *);
18176+ str1 = va_arg(ap, char *);
18177+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
18178+ break;
18179+ case GR_FILENAME_TWO_INT:
18180+ dentry = va_arg(ap, struct dentry *);
18181+ mnt = va_arg(ap, struct vfsmount *);
18182+ num1 = va_arg(ap, int);
18183+ num2 = va_arg(ap, int);
18184+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
18185+ break;
18186+ case GR_FILENAME_TWO_INT_STR:
18187+ dentry = va_arg(ap, struct dentry *);
18188+ mnt = va_arg(ap, struct vfsmount *);
18189+ num1 = va_arg(ap, int);
18190+ num2 = va_arg(ap, int);
18191+ str1 = va_arg(ap, char *);
18192+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
18193+ break;
18194+ case GR_TEXTREL:
18195+ file = va_arg(ap, struct file *);
18196+ ulong1 = va_arg(ap, unsigned long);
18197+ ulong2 = va_arg(ap, unsigned long);
18198+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_dentry, file->f_vfsmnt) : "<anonymous mapping>", ulong1, ulong2);
18199+ break;
18200+ case GR_PTRACE:
18201+ task = va_arg(ap, struct task_struct *);
18202+ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_dentry, task->exec_file->f_vfsmnt) : "(none)", task->comm, task->pid);
18203+ break;
18204+ case GR_RESOURCE:
18205+ task = va_arg(ap, struct task_struct *);
18206+ ulong1 = va_arg(ap, unsigned long);
18207+ str1 = va_arg(ap, char *);
18208+ ulong2 = va_arg(ap, unsigned long);
18209+ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, task->uid, task->euid, task->gid, task->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, task->parent->uid, task->parent->euid, task->parent->gid, task->parent->egid);
18210+ break;
18211+ case GR_CAP:
18212+ task = va_arg(ap, struct task_struct *);
18213+ str1 = va_arg(ap, char *);
18214+ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, task->uid, task->euid, task->gid, task->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, task->parent->uid, task->parent->euid, task->parent->gid, task->parent->egid);
18215+ break;
18216+ case GR_SIG:
18217+ task = va_arg(ap, struct task_struct *);
18218+ num1 = va_arg(ap, int);
18219+ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, task->uid, task->euid, task->gid, task->egid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid, task->parent->uid, task->parent->euid, task->parent->gid, task->parent->egid);
18220+ break;
18221+ case GR_CRASH1:
18222+ task = va_arg(ap, struct task_struct *);
18223+ ulong1 = va_arg(ap, unsigned long);
18224+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, task->uid, task->euid, task->gid, task->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, task->parent->uid, task->parent->euid, task->parent->gid, task->parent->egid, task->uid, ulong1);
18225+ break;
18226+ case GR_CRASH2:
18227+ task = va_arg(ap, struct task_struct *);
18228+ ulong1 = va_arg(ap, unsigned long);
18229+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, task->uid, task->euid, task->gid, task->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, task->parent->uid, task->parent->euid, task->parent->gid, task->parent->egid, ulong1);
18230+ break;
18231+ case GR_PSACCT:
18232+ {
18233+ unsigned int wday, cday;
18234+ __u8 whr, chr;
18235+ __u8 wmin, cmin;
18236+ __u8 wsec, csec;
18237+ char cur_tty[64] = { 0 };
18238+ char parent_tty[64] = { 0 };
18239+
18240+ task = va_arg(ap, struct task_struct *);
18241+ wday = va_arg(ap, unsigned int);
18242+ cday = va_arg(ap, unsigned int);
18243+ whr = va_arg(ap, int);
18244+ chr = va_arg(ap, int);
18245+ wmin = va_arg(ap, int);
18246+ cmin = va_arg(ap, int);
18247+ wsec = va_arg(ap, int);
18248+ csec = va_arg(ap, int);
18249+ ulong1 = va_arg(ap, unsigned long);
18250+
18251+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, NIPQUAD(task->signal->curr_ip), tty_name(task->signal->tty, cur_tty), task->uid, task->euid, task->gid, task->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, NIPQUAD(task->parent->signal->curr_ip), tty_name(task->parent->signal->tty, parent_tty), task->parent->uid, task->parent->euid, task->parent->gid, task->parent->egid);
18252+ }
18253+ break;
18254+ default:
18255+ gr_log_middle(audit, msg, ap);
18256+ }
18257+ va_end(ap);
18258+ gr_log_end(audit);
18259+ END_LOCKS(audit);
18260+}
18261diff -urNp linux-2.6.18/grsecurity/grsec_mem.c linux-2.6.18/grsecurity/grsec_mem.c
18262--- linux-2.6.18/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
18263+++ linux-2.6.18/grsecurity/grsec_mem.c 2006-09-22 20:04:35.000000000 -0400
18264@@ -0,0 +1,71 @@
18265+#include <linux/kernel.h>
18266+#include <linux/sched.h>
18267+#include <linux/mm.h>
18268+#include <linux/mman.h>
18269+#include <linux/grinternal.h>
18270+
18271+void
18272+gr_handle_ioperm(void)
18273+{
18274+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
18275+ return;
18276+}
18277+
18278+void
18279+gr_handle_iopl(void)
18280+{
18281+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
18282+ return;
18283+}
18284+
18285+void
18286+gr_handle_mem_write(void)
18287+{
18288+ gr_log_noargs(GR_DONT_AUDIT, GR_MEM_WRITE_MSG);
18289+ return;
18290+}
18291+
18292+void
18293+gr_handle_kmem_write(void)
18294+{
18295+ gr_log_noargs(GR_DONT_AUDIT, GR_KMEM_MSG);
18296+ return;
18297+}
18298+
18299+void
18300+gr_handle_open_port(void)
18301+{
18302+ gr_log_noargs(GR_DONT_AUDIT, GR_PORT_OPEN_MSG);
18303+ return;
18304+}
18305+
18306+int
18307+gr_handle_mem_mmap(const unsigned long offset, struct vm_area_struct *vma)
18308+{
18309+ unsigned long start, end;
18310+
18311+ start = offset;
18312+ end = start + vma->vm_end - vma->vm_start;
18313+
18314+ if (start > end) {
18315+ gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
18316+ return -EPERM;
18317+ }
18318+
18319+ /* allowed ranges : ISA I/O BIOS */
18320+ if ((start >= __pa(high_memory))
18321+#ifdef CONFIG_X86
18322+ || (start >= 0x000a0000 && end <= 0x00100000)
18323+ || (start >= 0x00000000 && end <= 0x00001000)
18324+#endif
18325+ )
18326+ return 0;
18327+
18328+ if (vma->vm_flags & VM_WRITE) {
18329+ gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
18330+ return -EPERM;
18331+ } else
18332+ vma->vm_flags &= ~VM_MAYWRITE;
18333+
18334+ return 0;
18335+}
18336diff -urNp linux-2.6.18/grsecurity/grsec_mount.c linux-2.6.18/grsecurity/grsec_mount.c
18337--- linux-2.6.18/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
18338+++ linux-2.6.18/grsecurity/grsec_mount.c 2006-09-22 20:04:35.000000000 -0400
18339@@ -0,0 +1,34 @@
18340+#include <linux/kernel.h>
18341+#include <linux/sched.h>
18342+#include <linux/grsecurity.h>
18343+#include <linux/grinternal.h>
18344+
18345+void
18346+gr_log_remount(const char *devname, const int retval)
18347+{
18348+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
18349+ if (grsec_enable_mount && (retval >= 0))
18350+ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
18351+#endif
18352+ return;
18353+}
18354+
18355+void
18356+gr_log_unmount(const char *devname, const int retval)
18357+{
18358+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
18359+ if (grsec_enable_mount && (retval >= 0))
18360+ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
18361+#endif
18362+ return;
18363+}
18364+
18365+void
18366+gr_log_mount(const char *from, const char *to, const int retval)
18367+{
18368+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
18369+ if (grsec_enable_mount && (retval >= 0))
18370+ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from, to);
18371+#endif
18372+ return;
18373+}
18374diff -urNp linux-2.6.18/grsecurity/grsec_rand.c linux-2.6.18/grsecurity/grsec_rand.c
18375--- linux-2.6.18/grsecurity/grsec_rand.c 1969-12-31 19:00:00.000000000 -0500
18376+++ linux-2.6.18/grsecurity/grsec_rand.c 2006-09-22 20:04:35.000000000 -0400
18377@@ -0,0 +1,26 @@
18378+#include <linux/kernel.h>
18379+#include <linux/sched.h>
18380+#include <linux/smp_lock.h>
18381+#include <linux/grsecurity.h>
18382+#include <linux/grinternal.h>
18383+
18384+extern int pid_max;
18385+
18386+int
18387+gr_random_pid(void)
18388+{
18389+#ifdef CONFIG_GRKERNSEC_RANDPID
18390+ int pid;
18391+
18392+ if (grsec_enable_randpid && current->fs->root) {
18393+ /* return a pid in the range 1 ... pid_max - 1
18394+ optimize this so we don't have to do a real division
18395+ */
18396+ pid = 1 + (get_random_long() % pid_max);
18397+ if (pid == pid_max)
18398+ pid = pid_max - 1;
18399+ return pid;
18400+ }
18401+#endif
18402+ return 0;
18403+}
18404diff -urNp linux-2.6.18/grsecurity/grsec_sig.c linux-2.6.18/grsecurity/grsec_sig.c
18405--- linux-2.6.18/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
18406+++ linux-2.6.18/grsecurity/grsec_sig.c 2006-09-22 20:04:35.000000000 -0400
18407@@ -0,0 +1,59 @@
18408+#include <linux/kernel.h>
18409+#include <linux/sched.h>
18410+#include <linux/grsecurity.h>
18411+#include <linux/grinternal.h>
18412+
18413+void
18414+gr_log_signal(const int sig, const struct task_struct *t)
18415+{
18416+#ifdef CONFIG_GRKERNSEC_SIGNAL
18417+ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
18418+ (sig == SIGABRT) || (sig == SIGBUS))) {
18419+ if (t->pid == current->pid) {
18420+ gr_log_int(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, sig);
18421+ } else {
18422+ gr_log_sig(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
18423+ }
18424+ }
18425+#endif
18426+ return;
18427+}
18428+
18429+int
18430+gr_handle_signal(const struct task_struct *p, const int sig)
18431+{
18432+#ifdef CONFIG_GRKERNSEC
18433+ if (current->pid > 1 && gr_check_protected_task(p)) {
18434+ gr_log_sig(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
18435+ return -EPERM;
18436+ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
18437+ return -EPERM;
18438+ }
18439+#endif
18440+ return 0;
18441+}
18442+
18443+void gr_handle_brute_attach(struct task_struct *p)
18444+{
18445+#ifdef CONFIG_GRKERNSEC_BRUTE
18446+ read_lock(&tasklist_lock);
18447+ read_lock(&grsec_exec_file_lock);
18448+ if (p->parent && p->parent->exec_file == p->exec_file)
18449+ p->parent->brute = 1;
18450+ read_unlock(&grsec_exec_file_lock);
18451+ read_unlock(&tasklist_lock);
18452+#endif
18453+ return;
18454+}
18455+
18456+void gr_handle_brute_check(void)
18457+{
18458+#ifdef CONFIG_GRKERNSEC_BRUTE
18459+ if (current->brute) {
18460+ set_current_state(TASK_UNINTERRUPTIBLE);
18461+ schedule_timeout(30 * HZ);
18462+ }
18463+#endif
18464+ return;
18465+}
18466+
18467diff -urNp linux-2.6.18/grsecurity/grsec_sock.c linux-2.6.18/grsecurity/grsec_sock.c
18468--- linux-2.6.18/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
18469+++ linux-2.6.18/grsecurity/grsec_sock.c 2006-09-22 20:04:35.000000000 -0400
18470@@ -0,0 +1,263 @@
18471+#include <linux/kernel.h>
18472+#include <linux/module.h>
18473+#include <linux/sched.h>
18474+#include <linux/file.h>
18475+#include <linux/net.h>
18476+#include <linux/in.h>
18477+#include <linux/ip.h>
18478+#include <net/sock.h>
18479+#include <net/inet_sock.h>
18480+#include <linux/grsecurity.h>
18481+#include <linux/grinternal.h>
18482+#include <linux/gracl.h>
18483+
18484+#if defined(CONFIG_IP_NF_MATCH_STEALTH_MODULE)
18485+extern struct sock *udp_v4_lookup(u32 saddr, u16 sport, u32 daddr, u16 dport, int dif);
18486+EXPORT_SYMBOL(udp_v4_lookup);
18487+#endif
18488+
18489+EXPORT_SYMBOL(gr_cap_rtnetlink);
18490+
18491+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
18492+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
18493+
18494+EXPORT_SYMBOL(gr_search_udp_recvmsg);
18495+EXPORT_SYMBOL(gr_search_udp_sendmsg);
18496+
18497+#ifdef CONFIG_UNIX_MODULE
18498+EXPORT_SYMBOL(gr_acl_handle_unix);
18499+EXPORT_SYMBOL(gr_acl_handle_mknod);
18500+EXPORT_SYMBOL(gr_handle_chroot_unix);
18501+EXPORT_SYMBOL(gr_handle_create);
18502+#endif
18503+
18504+#ifdef CONFIG_GRKERNSEC
18505+#define gr_conn_table_size 32749
18506+struct conn_table_entry {
18507+ struct conn_table_entry *next;
18508+ struct signal_struct *sig;
18509+};
18510+
18511+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
18512+spinlock_t gr_conn_table_lock = SPIN_LOCK_UNLOCKED;
18513+
18514+extern const char * gr_socktype_to_name(unsigned char type);
18515+extern const char * gr_proto_to_name(unsigned char proto);
18516+
18517+static __inline__ int
18518+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
18519+{
18520+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
18521+}
18522+
18523+static __inline__ int
18524+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
18525+ __u16 sport, __u16 dport)
18526+{
18527+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
18528+ sig->gr_sport == sport && sig->gr_dport == dport))
18529+ return 1;
18530+ else
18531+ return 0;
18532+}
18533+
18534+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
18535+{
18536+ struct conn_table_entry **match;
18537+ unsigned int index;
18538+
18539+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
18540+ sig->gr_sport, sig->gr_dport,
18541+ gr_conn_table_size);
18542+
18543+ newent->sig = sig;
18544+
18545+ match = &gr_conn_table[index];
18546+ newent->next = *match;
18547+ *match = newent;
18548+
18549+ return;
18550+}
18551+
18552+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
18553+{
18554+ struct conn_table_entry *match, *last = NULL;
18555+ unsigned int index;
18556+
18557+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
18558+ sig->gr_sport, sig->gr_dport,
18559+ gr_conn_table_size);
18560+
18561+ match = gr_conn_table[index];
18562+ while (match && !conn_match(match->sig,
18563+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
18564+ sig->gr_dport)) {
18565+ last = match;
18566+ match = match->next;
18567+ }
18568+
18569+ if (match) {
18570+ if (last)
18571+ last->next = match->next;
18572+ else
18573+ gr_conn_table[index] = NULL;
18574+ kfree(match);
18575+ }
18576+
18577+ return;
18578+}
18579+
18580+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
18581+ __u16 sport, __u16 dport)
18582+{
18583+ struct conn_table_entry *match;
18584+ unsigned int index;
18585+
18586+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
18587+
18588+ match = gr_conn_table[index];
18589+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
18590+ match = match->next;
18591+
18592+ if (match)
18593+ return match->sig;
18594+ else
18595+ return NULL;
18596+}
18597+
18598+#endif
18599+
18600+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
18601+{
18602+#ifdef CONFIG_GRKERNSEC
18603+ struct signal_struct *sig = task->signal;
18604+ struct conn_table_entry *newent;
18605+
18606+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
18607+ if (newent == NULL)
18608+ return;
18609+ /* no bh lock needed since we are called with bh disabled */
18610+ spin_lock(&gr_conn_table_lock);
18611+ gr_del_task_from_ip_table_nolock(sig);
18612+ sig->gr_saddr = inet->rcv_saddr;
18613+ sig->gr_daddr = inet->daddr;
18614+ sig->gr_sport = inet->sport;
18615+ sig->gr_dport = inet->dport;
18616+ gr_add_to_task_ip_table_nolock(sig, newent);
18617+ spin_unlock(&gr_conn_table_lock);
18618+#endif
18619+ return;
18620+}
18621+
18622+void gr_del_task_from_ip_table(struct task_struct *task)
18623+{
18624+#ifdef CONFIG_GRKERNSEC
18625+ spin_lock(&gr_conn_table_lock);
18626+ gr_del_task_from_ip_table_nolock(task->signal);
18627+ spin_unlock(&gr_conn_table_lock);
18628+#endif
18629+ return;
18630+}
18631+
18632+void
18633+gr_attach_curr_ip(const struct sock *sk)
18634+{
18635+#ifdef CONFIG_GRKERNSEC
18636+ struct signal_struct *p, *set;
18637+ const struct inet_sock *inet = inet_sk(sk);
18638+
18639+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
18640+ return;
18641+
18642+ set = current->signal;
18643+
18644+ spin_lock_bh(&gr_conn_table_lock);
18645+ p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
18646+ inet->dport, inet->sport);
18647+ if (unlikely(p != NULL)) {
18648+ set->curr_ip = p->curr_ip;
18649+ set->used_accept = 1;
18650+ gr_del_task_from_ip_table_nolock(p);
18651+ spin_unlock_bh(&gr_conn_table_lock);
18652+ return;
18653+ }
18654+ spin_unlock_bh(&gr_conn_table_lock);
18655+
18656+ set->curr_ip = inet->daddr;
18657+ set->used_accept = 1;
18658+#endif
18659+ return;
18660+}
18661+
18662+int
18663+gr_handle_sock_all(const int family, const int type, const int protocol)
18664+{
18665+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
18666+ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
18667+ (family != AF_UNIX) && (family != AF_LOCAL)) {
18668+ gr_log_int_str2(GR_DONT_AUDIT, GR_SOCK2_MSG, family, gr_socktype_to_name(type), gr_proto_to_name(protocol));
18669+ return -EACCES;
18670+ }
18671+#endif
18672+ return 0;
18673+}
18674+
18675+int
18676+gr_handle_sock_server(const struct sockaddr *sck)
18677+{
18678+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
18679+ if (grsec_enable_socket_server &&
18680+ in_group_p(grsec_socket_server_gid) &&
18681+ sck && (sck->sa_family != AF_UNIX) &&
18682+ (sck->sa_family != AF_LOCAL)) {
18683+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
18684+ return -EACCES;
18685+ }
18686+#endif
18687+ return 0;
18688+}
18689+
18690+int
18691+gr_handle_sock_server_other(const struct sock *sck)
18692+{
18693+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
18694+ if (grsec_enable_socket_server &&
18695+ in_group_p(grsec_socket_server_gid) &&
18696+ sck && (sck->sk_family != AF_UNIX) &&
18697+ (sck->sk_family != AF_LOCAL)) {
18698+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
18699+ return -EACCES;
18700+ }
18701+#endif
18702+ return 0;
18703+}
18704+
18705+int
18706+gr_handle_sock_client(const struct sockaddr *sck)
18707+{
18708+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
18709+ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
18710+ sck && (sck->sa_family != AF_UNIX) &&
18711+ (sck->sa_family != AF_LOCAL)) {
18712+ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
18713+ return -EACCES;
18714+ }
18715+#endif
18716+ return 0;
18717+}
18718+
18719+__u32
18720+gr_cap_rtnetlink(void)
18721+{
18722+#ifdef CONFIG_GRKERNSEC
18723+ if (!gr_acl_is_enabled())
18724+ return current->cap_effective;
18725+ else if (cap_raised(current->cap_effective, CAP_NET_ADMIN) &&
18726+ gr_task_is_capable(current, CAP_NET_ADMIN))
18727+ return current->cap_effective;
18728+ else
18729+ return 0;
18730+#else
18731+ return current->cap_effective;
18732+#endif
18733+}
18734diff -urNp linux-2.6.18/grsecurity/grsec_sysctl.c linux-2.6.18/grsecurity/grsec_sysctl.c
18735--- linux-2.6.18/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
18736+++ linux-2.6.18/grsecurity/grsec_sysctl.c 2006-09-22 20:04:35.000000000 -0400
18737@@ -0,0 +1,466 @@
18738+#include <linux/kernel.h>
18739+#include <linux/sched.h>
18740+#include <linux/sysctl.h>
18741+#include <linux/grsecurity.h>
18742+#include <linux/grinternal.h>
18743+
18744+#ifdef CONFIG_GRKERNSEC_MODSTOP
18745+int grsec_modstop;
18746+#endif
18747+
18748+int
18749+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
18750+{
18751+#ifdef CONFIG_GRKERNSEC_SYSCTL
18752+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & 002)) {
18753+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
18754+ return -EACCES;
18755+ }
18756+#endif
18757+#ifdef CONFIG_GRKERNSEC_MODSTOP
18758+ if (!strcmp(dirname, "grsecurity") && !strcmp(name, "disable_modules") &&
18759+ grsec_modstop && (op & 002)) {
18760+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
18761+ return -EACCES;
18762+ }
18763+#endif
18764+ return 0;
18765+}
18766+
18767+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_MODSTOP)
18768+enum {GS_LINK=1, GS_FIFO, GS_EXECVE, GS_EXECLOG, GS_SIGNAL,
18769+GS_FORKFAIL, GS_TIME, GS_CHROOT_SHMAT, GS_CHROOT_UNIX, GS_CHROOT_MNT,
18770+GS_CHROOT_FCHDIR, GS_CHROOT_DBL, GS_CHROOT_PVT, GS_CHROOT_CD, GS_CHROOT_CM,
18771+GS_CHROOT_MK, GS_CHROOT_NI, GS_CHROOT_EXECLOG, GS_CHROOT_CAPS,
18772+GS_CHROOT_SYSCTL, GS_TPE, GS_TPE_GID, GS_TPE_ALL, GS_SIDCAPS,
18773+GS_RANDPID, GS_SOCKET_ALL, GS_SOCKET_ALL_GID, GS_SOCKET_CLIENT,
18774+GS_SOCKET_CLIENT_GID, GS_SOCKET_SERVER, GS_SOCKET_SERVER_GID,
18775+GS_GROUP, GS_GID, GS_ACHDIR, GS_AMOUNT, GS_AIPC, GS_DMSG,
18776+GS_TEXTREL, GS_FINDTASK, GS_SHM, GS_LOCK, GS_MODSTOP, GS_RESLOG};
18777+
18778+
18779+ctl_table grsecurity_table[] = {
18780+#ifdef CONFIG_GRKERNSEC_SYSCTL
18781+#ifdef CONFIG_GRKERNSEC_LINK
18782+ {
18783+ .ctl_name = GS_LINK,
18784+ .procname = "linking_restrictions",
18785+ .data = &grsec_enable_link,
18786+ .maxlen = sizeof(int),
18787+ .mode = 0600,
18788+ .proc_handler = &proc_dointvec,
18789+ },
18790+#endif
18791+#ifdef CONFIG_GRKERNSEC_FIFO
18792+ {
18793+ .ctl_name = GS_FIFO,
18794+ .procname = "fifo_restrictions",
18795+ .data = &grsec_enable_fifo,
18796+ .maxlen = sizeof(int),
18797+ .mode = 0600,
18798+ .proc_handler = &proc_dointvec,
18799+ },
18800+#endif
18801+#ifdef CONFIG_GRKERNSEC_EXECVE
18802+ {
18803+ .ctl_name = GS_EXECVE,
18804+ .procname = "execve_limiting",
18805+ .data = &grsec_enable_execve,
18806+ .maxlen = sizeof(int),
18807+ .mode = 0600,
18808+ .proc_handler = &proc_dointvec,
18809+ },
18810+#endif
18811+#ifdef CONFIG_GRKERNSEC_EXECLOG
18812+ {
18813+ .ctl_name = GS_EXECLOG,
18814+ .procname = "exec_logging",
18815+ .data = &grsec_enable_execlog,
18816+ .maxlen = sizeof(int),
18817+ .mode = 0600,
18818+ .proc_handler = &proc_dointvec,
18819+ },
18820+#endif
18821+#ifdef CONFIG_GRKERNSEC_SIGNAL
18822+ {
18823+ .ctl_name = GS_SIGNAL,
18824+ .procname = "signal_logging",
18825+ .data = &grsec_enable_signal,
18826+ .maxlen = sizeof(int),
18827+ .mode = 0600,
18828+ .proc_handler = &proc_dointvec,
18829+ },
18830+#endif
18831+#ifdef CONFIG_GRKERNSEC_FORKFAIL
18832+ {
18833+ .ctl_name = GS_FORKFAIL,
18834+ .procname = "forkfail_logging",
18835+ .data = &grsec_enable_forkfail,
18836+ .maxlen = sizeof(int),
18837+ .mode = 0600,
18838+ .proc_handler = &proc_dointvec,
18839+ },
18840+#endif
18841+#ifdef CONFIG_GRKERNSEC_TIME
18842+ {
18843+ .ctl_name = GS_TIME,
18844+ .procname = "timechange_logging",
18845+ .data = &grsec_enable_time,
18846+ .maxlen = sizeof(int),
18847+ .mode = 0600,
18848+ .proc_handler = &proc_dointvec,
18849+ },
18850+#endif
18851+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
18852+ {
18853+ .ctl_name = GS_CHROOT_SHMAT,
18854+ .procname = "chroot_deny_shmat",
18855+ .data = &grsec_enable_chroot_shmat,
18856+ .maxlen = sizeof(int),
18857+ .mode = 0600,
18858+ .proc_handler = &proc_dointvec,
18859+ },
18860+#endif
18861+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
18862+ {
18863+ .ctl_name = GS_CHROOT_UNIX,
18864+ .procname = "chroot_deny_unix",
18865+ .data = &grsec_enable_chroot_unix,
18866+ .maxlen = sizeof(int),
18867+ .mode = 0600,
18868+ .proc_handler = &proc_dointvec,
18869+ },
18870+#endif
18871+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
18872+ {
18873+ .ctl_name = GS_CHROOT_MNT,
18874+ .procname = "chroot_deny_mount",
18875+ .data = &grsec_enable_chroot_mount,
18876+ .maxlen = sizeof(int),
18877+ .mode = 0600,
18878+ .proc_handler = &proc_dointvec,
18879+ },
18880+#endif
18881+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
18882+ {
18883+ .ctl_name = GS_CHROOT_FCHDIR,
18884+ .procname = "chroot_deny_fchdir",
18885+ .data = &grsec_enable_chroot_fchdir,
18886+ .maxlen = sizeof(int),
18887+ .mode = 0600,
18888+ .proc_handler = &proc_dointvec,
18889+ },
18890+#endif
18891+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
18892+ {
18893+ .ctl_name = GS_CHROOT_DBL,
18894+ .procname = "chroot_deny_chroot",
18895+ .data = &grsec_enable_chroot_double,
18896+ .maxlen = sizeof(int),
18897+ .mode = 0600,
18898+ .proc_handler = &proc_dointvec,
18899+ },
18900+#endif
18901+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
18902+ {
18903+ .ctl_name = GS_CHROOT_PVT,
18904+ .procname = "chroot_deny_pivot",
18905+ .data = &grsec_enable_chroot_pivot,
18906+ .maxlen = sizeof(int),
18907+ .mode = 0600,
18908+ .proc_handler = &proc_dointvec,
18909+ },
18910+#endif
18911+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
18912+ {
18913+ .ctl_name = GS_CHROOT_CD,
18914+ .procname = "chroot_enforce_chdir",
18915+ .data = &grsec_enable_chroot_chdir,
18916+ .maxlen = sizeof(int),
18917+ .mode = 0600,
18918+ .proc_handler = &proc_dointvec,
18919+ },
18920+#endif
18921+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
18922+ {
18923+ .ctl_name = GS_CHROOT_CM,
18924+ .procname = "chroot_deny_chmod",
18925+ .data = &grsec_enable_chroot_chmod,
18926+ .maxlen = sizeof(int),
18927+ .mode = 0600,
18928+ .proc_handler = &proc_dointvec,
18929+ },
18930+#endif
18931+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
18932+ {
18933+ .ctl_name = GS_CHROOT_MK,
18934+ .procname = "chroot_deny_mknod",
18935+ .data = &grsec_enable_chroot_mknod,
18936+ .maxlen = sizeof(int),
18937+ .mode = 0600,
18938+ .proc_handler = &proc_dointvec,
18939+ },
18940+#endif
18941+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
18942+ {
18943+ .ctl_name = GS_CHROOT_NI,
18944+ .procname = "chroot_restrict_nice",
18945+ .data = &grsec_enable_chroot_nice,
18946+ .maxlen = sizeof(int),
18947+ .mode = 0600,
18948+ .proc_handler = &proc_dointvec,
18949+ },
18950+#endif
18951+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
18952+ {
18953+ .ctl_name = GS_CHROOT_EXECLOG,
18954+ .procname = "chroot_execlog",
18955+ .data = &grsec_enable_chroot_execlog,
18956+ .maxlen = sizeof(int),
18957+ .mode = 0600,
18958+ .proc_handler = &proc_dointvec,
18959+ },
18960+#endif
18961+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
18962+ {
18963+ .ctl_name = GS_CHROOT_CAPS,
18964+ .procname = "chroot_caps",
18965+ .data = &grsec_enable_chroot_caps,
18966+ .maxlen = sizeof(int),
18967+ .mode = 0600,
18968+ .proc_handler = &proc_dointvec,
18969+ },
18970+#endif
18971+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
18972+ {
18973+ .ctl_name = GS_CHROOT_SYSCTL,
18974+ .procname = "chroot_deny_sysctl",
18975+ .data = &grsec_enable_chroot_sysctl,
18976+ .maxlen = sizeof(int),
18977+ .mode = 0600,
18978+ .proc_handler = &proc_dointvec,
18979+ },
18980+#endif
18981+#ifdef CONFIG_GRKERNSEC_TPE
18982+ {
18983+ .ctl_name = GS_TPE,
18984+ .procname = "tpe",
18985+ .data = &grsec_enable_tpe,
18986+ .maxlen = sizeof(int),
18987+ .mode = 0600,
18988+ .proc_handler = &proc_dointvec,
18989+ },
18990+ {
18991+ .ctl_name = GS_TPE_GID,
18992+ .procname = "tpe_gid",
18993+ .data = &grsec_tpe_gid,
18994+ .maxlen = sizeof(int),
18995+ .mode = 0600,
18996+ .proc_handler = &proc_dointvec,
18997+ },
18998+#endif
18999+#ifdef CONFIG_GRKERNSEC_TPE_ALL
19000+ {
19001+ .ctl_name = GS_TPE_ALL,
19002+ .procname = "tpe_restrict_all",
19003+ .data = &grsec_enable_tpe_all,
19004+ .maxlen = sizeof(int),
19005+ .mode = 0600,
19006+ .proc_handler = &proc_dointvec,
19007+ },
19008+#endif
19009+#ifdef CONFIG_GRKERNSEC_RANDPID
19010+ {
19011+ .ctl_name = GS_RANDPID,
19012+ .procname = "rand_pids",
19013+ .data = &grsec_enable_randpid,
19014+ .maxlen = sizeof(int),
19015+ .mode = 0600,
19016+ .proc_handler = &proc_dointvec,
19017+ },
19018+#endif
19019+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
19020+ {
19021+ .ctl_name = GS_SOCKET_ALL,
19022+ .procname = "socket_all",
19023+ .data = &grsec_enable_socket_all,
19024+ .maxlen = sizeof(int),
19025+ .mode = 0600,
19026+ .proc_handler = &proc_dointvec,
19027+ },
19028+ {
19029+ .ctl_name = GS_SOCKET_ALL_GID,
19030+ .procname = "socket_all_gid",
19031+ .data = &grsec_socket_all_gid,
19032+ .maxlen = sizeof(int),
19033+ .mode = 0600,
19034+ .proc_handler = &proc_dointvec,
19035+ },
19036+#endif
19037+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
19038+ {
19039+ .ctl_name = GS_SOCKET_CLIENT,
19040+ .procname = "socket_client",
19041+ .data = &grsec_enable_socket_client,
19042+ .maxlen = sizeof(int),
19043+ .mode = 0600,
19044+ .proc_handler = &proc_dointvec,
19045+ },
19046+ {
19047+ .ctl_name = GS_SOCKET_CLIENT_GID,
19048+ .procname = "socket_client_gid",
19049+ .data = &grsec_socket_client_gid,
19050+ .maxlen = sizeof(int),
19051+ .mode = 0600,
19052+ .proc_handler = &proc_dointvec,
19053+ },
19054+#endif
19055+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
19056+ {
19057+ .ctl_name = GS_SOCKET_SERVER,
19058+ .procname = "socket_server",
19059+ .data = &grsec_enable_socket_server,
19060+ .maxlen = sizeof(int),
19061+ .mode = 0600,
19062+ .proc_handler = &proc_dointvec,
19063+ },
19064+ {
19065+ .ctl_name = GS_SOCKET_SERVER_GID,
19066+ .procname = "socket_server_gid",
19067+ .data = &grsec_socket_server_gid,
19068+ .maxlen = sizeof(int),
19069+ .mode = 0600,
19070+ .proc_handler = &proc_dointvec,
19071+ },
19072+#endif
19073+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
19074+ {
19075+ .ctl_name = GS_GROUP,
19076+ .procname = "audit_group",
19077+ .data = &grsec_enable_group,
19078+ .maxlen = sizeof(int),
19079+ .mode = 0600,
19080+ .proc_handler = &proc_dointvec,
19081+ },
19082+ {
19083+ .ctl_name = GS_GID,
19084+ .procname = "audit_gid",
19085+ .data = &grsec_audit_gid,
19086+ .maxlen = sizeof(int),
19087+ .mode = 0600,
19088+ .proc_handler = &proc_dointvec,
19089+ },
19090+#endif
19091+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
19092+ {
19093+ .ctl_name = GS_ACHDIR,
19094+ .procname = "audit_chdir",
19095+ .data = &grsec_enable_chdir,
19096+ .maxlen = sizeof(int),
19097+ .mode = 0600,
19098+ .proc_handler = &proc_dointvec,
19099+ },
19100+#endif
19101+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
19102+ {
19103+ .ctl_name = GS_AMOUNT,
19104+ .procname = "audit_mount",
19105+ .data = &grsec_enable_mount,
19106+ .maxlen = sizeof(int),
19107+ .mode = 0600,
19108+ .proc_handler = &proc_dointvec,
19109+ },
19110+#endif
19111+#ifdef CONFIG_GRKERNSEC_AUDIT_IPC
19112+ {
19113+ .ctl_name = GS_AIPC,
19114+ .procname = "audit_ipc",
19115+ .data = &grsec_enable_audit_ipc,
19116+ .maxlen = sizeof(int),
19117+ .mode = 0600,
19118+ .proc_handler = &proc_dointvec,
19119+ },
19120+#endif
19121+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
19122+ {
19123+ .ctl_name = GS_TEXTREL,
19124+ .procname = "audit_textrel",
19125+ .data = &grsec_enable_audit_textrel,
19126+ .maxlen = sizeof(int),
19127+ .mode = 0600,
19128+ .proc_handler = &proc_dointvec,
19129+ },
19130+#endif
19131+#ifdef CONFIG_GRKERNSEC_DMESG
19132+ {
19133+ .ctl_name = GS_DMSG,
19134+ .procname = "dmesg",
19135+ .data = &grsec_enable_dmesg,
19136+ .maxlen = sizeof(int),
19137+ .mode = 0600,
19138+ .proc_handler = &proc_dointvec,
19139+ },
19140+#endif
19141+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
19142+ {
19143+ .ctl_name = GS_FINDTASK,
19144+ .procname = "chroot_findtask",
19145+ .data = &grsec_enable_chroot_findtask,
19146+ .maxlen = sizeof(int),
19147+ .mode = 0600,
19148+ .proc_handler = &proc_dointvec,
19149+ },
19150+#endif
19151+#ifdef CONFIG_GRKERNSEC_SHM
19152+ {
19153+ .ctl_name = GS_SHM,
19154+ .procname = "destroy_unused_shm",
19155+ .data = &grsec_enable_shm,
19156+ .maxlen = sizeof(int),
19157+ .mode = 0600,
19158+ .proc_handler = &proc_dointvec,
19159+ },
19160+#endif
19161+#ifdef CONFIG_GRKERNSEC_RESLOG
19162+ {
19163+ .ctl_name = GS_RESLOG,
19164+ .procname = "resource_logging",
19165+ .data = &grsec_resource_logging,
19166+ .maxlen = sizeof(int),
19167+ .mode = 0600,
19168+ .proc_handler = &proc_dointvec,
19169+ },
19170+#endif
19171+ {
19172+ .ctl_name = GS_LOCK,
19173+ .procname = "grsec_lock",
19174+ .data = &grsec_lock,
19175+ .maxlen = sizeof(int),
19176+ .mode = 0600,
19177+ .proc_handler = &proc_dointvec,
19178+ },
19179+#endif
19180+#ifdef CONFIG_GRKERNSEC_MODSTOP
19181+ {
19182+ .ctl_name = GS_MODSTOP,
19183+ .procname = "disable_modules",
19184+ .data = &grsec_modstop,
19185+ .maxlen = sizeof(int),
19186+ .mode = 0600,
19187+ .proc_handler = &proc_dointvec,
19188+ },
19189+#endif
19190+ { .ctl_name = 0 }
19191+};
19192+#endif
19193+
19194+int gr_check_modstop(void)
19195+{
19196+#ifdef CONFIG_GRKERNSEC_MODSTOP
19197+ if (grsec_modstop == 1) {
19198+ gr_log_noargs(GR_DONT_AUDIT, GR_STOPMOD_MSG);
19199+ return 1;
19200+ }
19201+#endif
19202+ return 0;
19203+}
19204diff -urNp linux-2.6.18/grsecurity/grsec_textrel.c linux-2.6.18/grsecurity/grsec_textrel.c
19205--- linux-2.6.18/grsecurity/grsec_textrel.c 1969-12-31 19:00:00.000000000 -0500
19206+++ linux-2.6.18/grsecurity/grsec_textrel.c 2006-09-22 20:04:35.000000000 -0400
19207@@ -0,0 +1,16 @@
19208+#include <linux/kernel.h>
19209+#include <linux/sched.h>
19210+#include <linux/mm.h>
19211+#include <linux/file.h>
19212+#include <linux/grinternal.h>
19213+#include <linux/grsecurity.h>
19214+
19215+void
19216+gr_log_textrel(struct vm_area_struct * vma)
19217+{
19218+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
19219+ if (grsec_enable_audit_textrel)
19220+ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
19221+#endif
19222+ return;
19223+}
19224diff -urNp linux-2.6.18/grsecurity/grsec_time.c linux-2.6.18/grsecurity/grsec_time.c
19225--- linux-2.6.18/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
19226+++ linux-2.6.18/grsecurity/grsec_time.c 2006-09-22 20:04:35.000000000 -0400
19227@@ -0,0 +1,13 @@
19228+#include <linux/kernel.h>
19229+#include <linux/sched.h>
19230+#include <linux/grinternal.h>
19231+
19232+void
19233+gr_log_timechange(void)
19234+{
19235+#ifdef CONFIG_GRKERNSEC_TIME
19236+ if (grsec_enable_time)
19237+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
19238+#endif
19239+ return;
19240+}
19241diff -urNp linux-2.6.18/grsecurity/grsec_tpe.c linux-2.6.18/grsecurity/grsec_tpe.c
19242--- linux-2.6.18/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
19243+++ linux-2.6.18/grsecurity/grsec_tpe.c 2006-09-22 20:04:35.000000000 -0400
19244@@ -0,0 +1,37 @@
19245+#include <linux/kernel.h>
19246+#include <linux/sched.h>
19247+#include <linux/file.h>
19248+#include <linux/fs.h>
19249+#include <linux/grinternal.h>
19250+
19251+extern int gr_acl_tpe_check(void);
19252+
19253+int
19254+gr_tpe_allow(const struct file *file)
19255+{
19256+#ifdef CONFIG_GRKERNSEC
19257+ struct inode *inode = file->f_dentry->d_parent->d_inode;
19258+
19259+ if (current->uid && ((grsec_enable_tpe &&
19260+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
19261+ !in_group_p(grsec_tpe_gid)
19262+#else
19263+ in_group_p(grsec_tpe_gid)
19264+#endif
19265+ ) || gr_acl_tpe_check()) &&
19266+ (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
19267+ (inode->i_mode & S_IWOTH))))) {
19268+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_dentry, file->f_vfsmnt);
19269+ return 0;
19270+ }
19271+#ifdef CONFIG_GRKERNSEC_TPE_ALL
19272+ if (current->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
19273+ ((inode->i_uid && (inode->i_uid != current->uid)) ||
19274+ (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
19275+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_dentry, file->f_vfsmnt);
19276+ return 0;
19277+ }
19278+#endif
19279+#endif
19280+ return 1;
19281+}
19282diff -urNp linux-2.6.18/grsecurity/grsum.c linux-2.6.18/grsecurity/grsum.c
19283--- linux-2.6.18/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
19284+++ linux-2.6.18/grsecurity/grsum.c 2006-09-22 20:04:35.000000000 -0400
19285@@ -0,0 +1,59 @@
19286+#include <linux/kernel.h>
19287+#include <linux/sched.h>
19288+#include <linux/mm.h>
19289+#include <asm/scatterlist.h>
19290+#include <linux/crypto.h>
19291+#include <linux/gracl.h>
19292+
19293+
19294+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
19295+#error "crypto and sha256 must be built into the kernel"
19296+#endif
19297+
19298+int
19299+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
19300+{
19301+ char *p;
19302+ struct crypto_tfm *tfm;
19303+ unsigned char temp_sum[GR_SHA_LEN];
19304+ struct scatterlist sg[2];
19305+ volatile int retval = 0;
19306+ volatile int dummy = 0;
19307+ unsigned int i;
19308+
19309+ tfm = crypto_alloc_tfm("sha256", 0);
19310+ if (tfm == NULL) {
19311+ /* should never happen, since sha256 should be built in */
19312+ return 1;
19313+ }
19314+
19315+ crypto_digest_init(tfm);
19316+
19317+ p = salt;
19318+ sg[0].page = virt_to_page(p);
19319+ sg[0].offset = ((long) p & ~PAGE_MASK);
19320+ sg[0].length = GR_SALT_LEN;
19321+
19322+ crypto_digest_update(tfm, sg, 1);
19323+
19324+ p = entry->pw;
19325+ sg[0].page = virt_to_page(p);
19326+ sg[0].offset = ((long) p & ~PAGE_MASK);
19327+ sg[0].length = strlen(entry->pw);
19328+
19329+ crypto_digest_update(tfm, sg, 1);
19330+
19331+ crypto_digest_final(tfm, temp_sum);
19332+
19333+ memset(entry->pw, 0, GR_PW_LEN);
19334+
19335+ for (i = 0; i < GR_SHA_LEN; i++)
19336+ if (sum[i] != temp_sum[i])
19337+ retval = 1;
19338+ else
19339+ dummy = 1; // waste a cycle
19340+
19341+ crypto_free_tfm(tfm);
19342+
19343+ return retval;
19344+}
19345diff -urNp linux-2.6.18/grsecurity/Kconfig linux-2.6.18/grsecurity/Kconfig
19346--- linux-2.6.18/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
19347+++ linux-2.6.18/grsecurity/Kconfig 2006-09-22 22:12:27.000000000 -0400
19348@@ -0,0 +1,888 @@
19349+#
19350+# grecurity configuration
19351+#
19352+
19353+menu "Grsecurity"
19354+
19355+config GRKERNSEC
19356+ bool "Grsecurity"
19357+ select CRYPTO
19358+ select CRYPTO_SHA256
19359+ help
19360+ If you say Y here, you will be able to configure many features
19361+ that will enhance the security of your system. It is highly
19362+ recommended that you say Y here and read through the help
19363+ for each option so that you fully understand the features and
19364+ can evaluate their usefulness for your machine.
19365+
19366+choice
19367+ prompt "Security Level"
19368+ depends GRKERNSEC
19369+ default GRKERNSEC_CUSTOM
19370+
19371+config GRKERNSEC_LOW
19372+ bool "Low"
19373+ select GRKERNSEC_LINK
19374+ select GRKERNSEC_FIFO
19375+ select GRKERNSEC_RANDPID
19376+ select GRKERNSEC_EXECVE
19377+ select GRKERNSEC_RANDNET
19378+ select GRKERNSEC_DMESG
19379+ select GRKERNSEC_CHROOT_CHDIR
19380+ select GRKERNSEC_MODSTOP if (MODULES)
19381+
19382+ help
19383+ If you choose this option, several of the grsecurity options will
19384+ be enabled that will give you greater protection against a number
19385+ of attacks, while assuring that none of your software will have any
19386+ conflicts with the additional security measures. If you run a lot
19387+ of unusual software, or you are having problems with the higher
19388+ security levels, you should say Y here. With this option, the
19389+ following features are enabled:
19390+
19391+ - Linking restrictions
19392+ - FIFO restrictions
19393+ - Randomized PIDs
19394+ - Enforcing RLIMIT_NPROC on execve
19395+ - Restricted dmesg
19396+ - Enforced chdir("/") on chroot
19397+ - Runtime module disabling
19398+
19399+config GRKERNSEC_MEDIUM
19400+ bool "Medium"
19401+ select PAX
19402+ select PAX_EI_PAX
19403+ select PAX_PT_PAX_FLAGS
19404+ select PAX_HAVE_ACL_FLAGS
19405+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
19406+ select GRKERNSEC_CHROOT_SYSCTL
19407+ select GRKERNSEC_LINK
19408+ select GRKERNSEC_FIFO
19409+ select GRKERNSEC_RANDPID
19410+ select GRKERNSEC_EXECVE
19411+ select GRKERNSEC_DMESG
19412+ select GRKERNSEC_RANDNET
19413+ select GRKERNSEC_FORKFAIL
19414+ select GRKERNSEC_TIME
19415+ select GRKERNSEC_SIGNAL
19416+ select GRKERNSEC_CHROOT
19417+ select GRKERNSEC_CHROOT_UNIX
19418+ select GRKERNSEC_CHROOT_MOUNT
19419+ select GRKERNSEC_CHROOT_PIVOT
19420+ select GRKERNSEC_CHROOT_DOUBLE
19421+ select GRKERNSEC_CHROOT_CHDIR
19422+ select GRKERNSEC_CHROOT_MKNOD
19423+ select GRKERNSEC_PROC
19424+ select GRKERNSEC_PROC_USERGROUP
19425+ select GRKERNSEC_MODSTOP if (MODULES)
19426+ select PAX_RANDUSTACK
19427+ select PAX_ASLR
19428+ select PAX_RANDMMAP
19429+
19430+ help
19431+ If you say Y here, several features in addition to those included
19432+ in the low additional security level will be enabled. These
19433+ features provide even more security to your system, though in rare
19434+ cases they may be incompatible with very old or poorly written
19435+ software. If you enable this option, make sure that your auth
19436+ service (identd) is running as gid 1001. With this option,
19437+ the following features (in addition to those provided in the
19438+ low additional security level) will be enabled:
19439+
19440+ - Randomized TCP source ports
19441+ - Failed fork logging
19442+ - Time change logging
19443+ - Signal logging
19444+ - Deny mounts in chroot
19445+ - Deny double chrooting
19446+ - Deny sysctl writes in chroot
19447+ - Deny mknod in chroot
19448+ - Deny access to abstract AF_UNIX sockets out of chroot
19449+ - Deny pivot_root in chroot
19450+ - Denied writes of /dev/kmem, /dev/mem, and /dev/port
19451+ - /proc restrictions with special GID set to 10 (usually wheel)
19452+ - Address Space Layout Randomization (ASLR)
19453+
19454+config GRKERNSEC_HIGH
19455+ bool "High"
19456+ select GRKERNSEC_LINK
19457+ select GRKERNSEC_FIFO
19458+ select GRKERNSEC_RANDPID
19459+ select GRKERNSEC_EXECVE
19460+ select GRKERNSEC_DMESG
19461+ select GRKERNSEC_FORKFAIL
19462+ select GRKERNSEC_TIME
19463+ select GRKERNSEC_SIGNAL
19464+ select GRKERNSEC_CHROOT_SHMAT
19465+ select GRKERNSEC_CHROOT_UNIX
19466+ select GRKERNSEC_CHROOT_MOUNT
19467+ select GRKERNSEC_CHROOT_FCHDIR
19468+ select GRKERNSEC_CHROOT_PIVOT
19469+ select GRKERNSEC_CHROOT_DOUBLE
19470+ select GRKERNSEC_CHROOT_CHDIR
19471+ select GRKERNSEC_CHROOT_MKNOD
19472+ select GRKERNSEC_CHROOT_CAPS
19473+ select GRKERNSEC_CHROOT_SYSCTL
19474+ select GRKERNSEC_CHROOT_FINDTASK
19475+ select GRKERNSEC_PROC
19476+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
19477+ select GRKERNSEC_HIDESYM
19478+ select GRKERNSEC_BRUTE
19479+ select GRKERNSEC_SHM if (SYSVIPC)
19480+ select GRKERNSEC_PROC_USERGROUP
19481+ select GRKERNSEC_KMEM
19482+ select GRKERNSEC_RESLOG
19483+ select GRKERNSEC_RANDNET
19484+ select GRKERNSEC_PROC_ADD
19485+ select GRKERNSEC_CHROOT_CHMOD
19486+ select GRKERNSEC_CHROOT_NICE
19487+ select GRKERNSEC_AUDIT_MOUNT
19488+ select GRKERNSEC_MODSTOP if (MODULES)
19489+ select PAX
19490+ select PAX_RANDUSTACK
19491+ select PAX_ASLR
19492+ select PAX_RANDMMAP
19493+ select PAX_NOEXEC
19494+ select PAX_MPROTECT
19495+ select PAX_EI_PAX
19496+ select PAX_PT_PAX_FLAGS
19497+ select PAX_HAVE_ACL_FLAGS
19498+ select PAX_KERNEXEC if (!X86_64 && !MODULES && !HOTPLUG_PCI_COMPAQ_NVRAM && !PCI_BIOS)
19499+ select PAX_RANDKSTACK if (X86_TSC && !X86_64)
19500+ select PAX_SEGMEXEC if (X86 && !X86_64)
19501+ select PAX_PAGEEXEC if (!X86)
19502+ select PAX_EMUPLT if (ALPHA || PARISC || PPC32 || SPARC32 || SPARC64)
19503+ select PAX_DLRESOLVE if (SPARC32 || SPARC64)
19504+ select PAX_SYSCALL if (PPC32)
19505+ select PAX_EMUTRAMP if (PARISC)
19506+ select PAX_EMUSIGRT if (PARISC)
19507+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
19508+ help
19509+ If you say Y here, many of the features of grsecurity will be
19510+ enabled, which will protect you against many kinds of attacks
19511+ against your system. The heightened security comes at a cost
19512+ of an increased chance of incompatibilities with rare software
19513+ on your machine. Since this security level enables PaX, you should
19514+ view <http://pax.grsecurity.net> and read about the PaX
19515+ project. While you are there, download chpax and run it on
19516+ binaries that cause problems with PaX. Also remember that
19517+ since the /proc restrictions are enabled, you must run your
19518+ identd as gid 1001. This security level enables the following
19519+ features in addition to those listed in the low and medium
19520+ security levels:
19521+
19522+ - Additional /proc restrictions
19523+ - Chmod restrictions in chroot
19524+ - No signals, ptrace, or viewing of processes outside of chroot
19525+ - Capability restrictions in chroot
19526+ - Deny fchdir out of chroot
19527+ - Priority restrictions in chroot
19528+ - Segmentation-based implementation of PaX
19529+ - Mprotect restrictions
19530+ - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
19531+ - Kernel stack randomization
19532+ - Mount/unmount/remount logging
19533+ - Kernel symbol hiding
19534+ - Destroy unused shared memory
19535+ - Prevention of memory exhaustion-based exploits
19536+config GRKERNSEC_CUSTOM
19537+ bool "Custom"
19538+ help
19539+ If you say Y here, you will be able to configure every grsecurity
19540+ option, which allows you to enable many more features that aren't
19541+ covered in the basic security levels. These additional features
19542+ include TPE, socket restrictions, and the sysctl system for
19543+ grsecurity. It is advised that you read through the help for
19544+ each option to determine its usefulness in your situation.
19545+
19546+endchoice
19547+
19548+menu "Address Space Protection"
19549+depends on GRKERNSEC
19550+
19551+config GRKERNSEC_KMEM
19552+ bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
19553+ help
19554+ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
19555+ be written to via mmap or otherwise to modify the running kernel.
19556+ /dev/port will also not be allowed to be opened. If you have module
19557+ support disabled, enabling this will close up four ways that are
19558+ currently used to insert malicious code into the running kernel.
19559+ Even with all these features enabled, we still highly recommend that
19560+ you use the RBAC system, as it is still possible for an attacker to
19561+ modify the running kernel through privileged I/O granted by ioperm/iopl.
19562+ If you are not using XFree86, you may be able to stop this additional
19563+ case by enabling the 'Disable privileged I/O' option. Though nothing
19564+ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
19565+ but only to video memory, which is the only writing we allow in this
19566+ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
19567+ not be allowed to mprotect it with PROT_WRITE later.
19568+ It is highly recommended that you say Y here if you meet all the
19569+ conditions above.
19570+
19571+config GRKERNSEC_IO
19572+ bool "Disable privileged I/O"
19573+ depends on X86
19574+ select RTC
19575+ help
19576+ If you say Y here, all ioperm and iopl calls will return an error.
19577+ Ioperm and iopl can be used to modify the running kernel.
19578+ Unfortunately, some programs need this access to operate properly,
19579+ the most notable of which are XFree86 and hwclock. hwclock can be
19580+ remedied by having RTC support in the kernel, so CONFIG_RTC is
19581+ enabled if this option is enabled, to ensure that hwclock operates
19582+ correctly. XFree86 still will not operate correctly with this option
19583+ enabled, so DO NOT CHOOSE Y IF YOU USE XFree86. If you use XFree86
19584+ and you still want to protect your kernel against modification,
19585+ use the RBAC system.
19586+
19587+config GRKERNSEC_PROC_MEMMAP
19588+ bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
19589+ depends on PAX_NOEXEC || PAX_ASLR
19590+ help
19591+ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
19592+ give no information about the addresses of its mappings if
19593+ PaX features that rely on random addresses are enabled on the task.
19594+ If you use PaX it is greatly recommended that you say Y here as it
19595+ closes up a hole that makes the full ASLR useless for suid
19596+ binaries.
19597+
19598+config GRKERNSEC_BRUTE
19599+ bool "Deter exploit bruteforcing"
19600+ help
19601+ If you say Y here, attempts to bruteforce exploits against forking
19602+ daemons such as apache or sshd will be deterred. When a child of a
19603+ forking daemon is killed by PaX or crashes due to an illegal
19604+ instruction, the parent process will be delayed 30 seconds upon every
19605+ subsequent fork until the administrator is able to assess the
19606+ situation and restart the daemon. It is recommended that you also
19607+ enable signal logging in the auditing section so that logs are
19608+ generated when a process performs an illegal instruction.
19609+
19610+config GRKERNSEC_MODSTOP
19611+ bool "Runtime module disabling"
19612+ depends on MODULES
19613+ help
19614+ If you say Y here, you will be able to disable the ability to (un)load
19615+ modules at runtime. This feature is useful if you need the ability
19616+ to load kernel modules at boot time, but do not want to allow an
19617+ attacker to load a rootkit kernel module into the system, or to remove
19618+ a loaded kernel module important to system functioning. You should
19619+ enable the /dev/mem protection feature as well, since rootkits can be
19620+ inserted into the kernel via other methods than kernel modules. Since
19621+ an untrusted module could still be loaded by modifying init scripts and
19622+ rebooting the system, it is also recommended that you enable the RBAC
19623+ system. If you enable this option, a sysctl option with name
19624+ "disable_modules" will be created. Setting this option to "1" disables
19625+ module loading. After this option is set, no further writes to it are
19626+ allowed until the system is rebooted.
19627+
19628+config GRKERNSEC_HIDESYM
19629+ bool "Hide kernel symbols"
19630+ help
19631+ If you say Y here, getting information on loaded modules, and
19632+ displaying all kernel symbols through a syscall will be restricted
19633+ to users with CAP_SYS_MODULE. This option is only effective
19634+ provided the following conditions are met:
19635+ 1) The kernel using grsecurity is not precompiled by some distribution
19636+ 2) You are using the RBAC system and hiding other files such as your
19637+ kernel image and System.map
19638+ 3) You have the additional /proc restrictions enabled, which removes
19639+ /proc/kcore
19640+ If the above conditions are met, this option will aid to provide a
19641+ useful protection against local and remote kernel exploitation of
19642+ overflows and arbitrary read/write vulnerabilities.
19643+
19644+endmenu
19645+menu "Role Based Access Control Options"
19646+depends on GRKERNSEC
19647+
19648+config GRKERNSEC_ACL_HIDEKERN
19649+ bool "Hide kernel processes"
19650+ help
19651+ If you say Y here, all kernel threads will be hidden to all
19652+ processes but those whose subject has the "view hidden processes"
19653+ flag.
19654+
19655+config GRKERNSEC_ACL_MAXTRIES
19656+ int "Maximum tries before password lockout"
19657+ default 3
19658+ help
19659+ This option enforces the maximum number of times a user can attempt
19660+ to authorize themselves with the grsecurity RBAC system before being
19661+ denied the ability to attempt authorization again for a specified time.
19662+ The lower the number, the harder it will be to brute-force a password.
19663+
19664+config GRKERNSEC_ACL_TIMEOUT
19665+ int "Time to wait after max password tries, in seconds"
19666+ default 30
19667+ help
19668+ This option specifies the time the user must wait after attempting to
19669+ authorize to the RBAC system with the maximum number of invalid
19670+ passwords. The higher the number, the harder it will be to brute-force
19671+ a password.
19672+
19673+endmenu
19674+menu "Filesystem Protections"
19675+depends on GRKERNSEC
19676+
19677+config GRKERNSEC_PROC
19678+ bool "Proc restrictions"
19679+ help
19680+ If you say Y here, the permissions of the /proc filesystem
19681+ will be altered to enhance system security and privacy. You MUST
19682+ choose either a user only restriction or a user and group restriction.
19683+ Depending upon the option you choose, you can either restrict users to
19684+ see only the processes they themselves run, or choose a group that can
19685+ view all processes and files normally restricted to root if you choose
19686+ the "restrict to user only" option. NOTE: If you're running identd as
19687+ a non-root user, you will have to run it as the group you specify here.
19688+
19689+config GRKERNSEC_PROC_USER
19690+ bool "Restrict /proc to user only"
19691+ depends on GRKERNSEC_PROC
19692+ help
19693+ If you say Y here, non-root users will only be able to view their own
19694+ processes, and restricts them from viewing network-related information,
19695+ and viewing kernel symbol and module information.
19696+
19697+config GRKERNSEC_PROC_USERGROUP
19698+ bool "Allow special group"
19699+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
19700+ help
19701+ If you say Y here, you will be able to select a group that will be
19702+ able to view all processes, network-related information, and
19703+ kernel and symbol information. This option is useful if you want
19704+ to run identd as a non-root user.
19705+
19706+config GRKERNSEC_PROC_GID
19707+ int "GID for special group"
19708+ depends on GRKERNSEC_PROC_USERGROUP
19709+ default 1001
19710+
19711+config GRKERNSEC_PROC_ADD
19712+ bool "Additional restrictions"
19713+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
19714+ help
19715+ If you say Y here, additional restrictions will be placed on
19716+ /proc that keep normal users from viewing device information and
19717+ slabinfo information that could be useful for exploits.
19718+
19719+config GRKERNSEC_LINK
19720+ bool "Linking restrictions"
19721+ help
19722+ If you say Y here, /tmp race exploits will be prevented, since users
19723+ will no longer be able to follow symlinks owned by other users in
19724+ world-writable +t directories (i.e. /tmp), unless the owner of the
19725+ symlink is the owner of the directory. users will also not be
19726+ able to hardlink to files they do not own. If the sysctl option is
19727+ enabled, a sysctl option with name "linking_restrictions" is created.
19728+
19729+config GRKERNSEC_FIFO
19730+ bool "FIFO restrictions"
19731+ help
19732+ If you say Y here, users will not be able to write to FIFOs they don't
19733+ own in world-writable +t directories (i.e. /tmp), unless the owner of
19734+ the FIFO is the same owner of the directory it's held in. If the sysctl
19735+ option is enabled, a sysctl option with name "fifo_restrictions" is
19736+ created.
19737+
19738+config GRKERNSEC_CHROOT
19739+ bool "Chroot jail restrictions"
19740+ help
19741+ If you say Y here, you will be able to choose several options that will
19742+ make breaking out of a chrooted jail much more difficult. If you
19743+ encounter no software incompatibilities with the following options, it
19744+ is recommended that you enable each one.
19745+
19746+config GRKERNSEC_CHROOT_MOUNT
19747+ bool "Deny mounts"
19748+ depends on GRKERNSEC_CHROOT
19749+ help
19750+ If you say Y here, processes inside a chroot will not be able to
19751+ mount or remount filesystems. If the sysctl option is enabled, a
19752+ sysctl option with name "chroot_deny_mount" is created.
19753+
19754+config GRKERNSEC_CHROOT_DOUBLE
19755+ bool "Deny double-chroots"
19756+ depends on GRKERNSEC_CHROOT
19757+ help
19758+ If you say Y here, processes inside a chroot will not be able to chroot
19759+ again outside the chroot. This is a widely used method of breaking
19760+ out of a chroot jail and should not be allowed. If the sysctl
19761+ option is enabled, a sysctl option with name
19762+ "chroot_deny_chroot" is created.
19763+
19764+config GRKERNSEC_CHROOT_PIVOT
19765+ bool "Deny pivot_root in chroot"
19766+ depends on GRKERNSEC_CHROOT
19767+ help
19768+ If you say Y here, processes inside a chroot will not be able to use
19769+ a function called pivot_root() that was introduced in Linux 2.3.41. It
19770+ works similar to chroot in that it changes the root filesystem. This
19771+ function could be misused in a chrooted process to attempt to break out
19772+ of the chroot, and therefore should not be allowed. If the sysctl
19773+ option is enabled, a sysctl option with name "chroot_deny_pivot" is
19774+ created.
19775+
19776+config GRKERNSEC_CHROOT_CHDIR
19777+ bool "Enforce chdir(\"/\") on all chroots"
19778+ depends on GRKERNSEC_CHROOT
19779+ help
19780+ If you say Y here, the current working directory of all newly-chrooted
19781+ applications will be set to the the root directory of the chroot.
19782+ The man page on chroot(2) states:
19783+ Note that this call does not change the current working
19784+ directory, so that `.' can be outside the tree rooted at
19785+ `/'. In particular, the super-user can escape from a
19786+ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
19787+
19788+ It is recommended that you say Y here, since it's not known to break
19789+ any software. If the sysctl option is enabled, a sysctl option with
19790+ name "chroot_enforce_chdir" is created.
19791+
19792+config GRKERNSEC_CHROOT_CHMOD
19793+ bool "Deny (f)chmod +s"
19794+ depends on GRKERNSEC_CHROOT
19795+ help
19796+ If you say Y here, processes inside a chroot will not be able to chmod
19797+ or fchmod files to make them have suid or sgid bits. This protects
19798+ against another published method of breaking a chroot. If the sysctl
19799+ option is enabled, a sysctl option with name "chroot_deny_chmod" is
19800+ created.
19801+
19802+config GRKERNSEC_CHROOT_FCHDIR
19803+ bool "Deny fchdir out of chroot"
19804+ depends on GRKERNSEC_CHROOT
19805+ help
19806+ If you say Y here, a well-known method of breaking chroots by fchdir'ing
19807+ to a file descriptor of the chrooting process that points to a directory
19808+ outside the filesystem will be stopped. If the sysctl option
19809+ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
19810+
19811+config GRKERNSEC_CHROOT_MKNOD
19812+ bool "Deny mknod"
19813+ depends on GRKERNSEC_CHROOT
19814+ help
19815+ If you say Y here, processes inside a chroot will not be allowed to
19816+ mknod. The problem with using mknod inside a chroot is that it
19817+ would allow an attacker to create a device entry that is the same
19818+ as one on the physical root of your system, which could range from
19819+ anything from the console device to a device for your harddrive (which
19820+ they could then use to wipe the drive or steal data). It is recommended
19821+ that you say Y here, unless you run into software incompatibilities.
19822+ If the sysctl option is enabled, a sysctl option with name
19823+ "chroot_deny_mknod" is created.
19824+
19825+config GRKERNSEC_CHROOT_SHMAT
19826+ bool "Deny shmat() out of chroot"
19827+ depends on GRKERNSEC_CHROOT
19828+ help
19829+ If you say Y here, processes inside a chroot will not be able to attach
19830+ to shared memory segments that were created outside of the chroot jail.
19831+ It is recommended that you say Y here. If the sysctl option is enabled,
19832+ a sysctl option with name "chroot_deny_shmat" is created.
19833+
19834+config GRKERNSEC_CHROOT_UNIX
19835+ bool "Deny access to abstract AF_UNIX sockets out of chroot"
19836+ depends on GRKERNSEC_CHROOT
19837+ help
19838+ If you say Y here, processes inside a chroot will not be able to
19839+ connect to abstract (meaning not belonging to a filesystem) Unix
19840+ domain sockets that were bound outside of a chroot. It is recommended
19841+ that you say Y here. If the sysctl option is enabled, a sysctl option
19842+ with name "chroot_deny_unix" is created.
19843+
19844+config GRKERNSEC_CHROOT_FINDTASK
19845+ bool "Protect outside processes"
19846+ depends on GRKERNSEC_CHROOT
19847+ help
19848+ If you say Y here, processes inside a chroot will not be able to
19849+ kill, send signals with fcntl, ptrace, capget, setpgid, getpgid,
19850+ getsid, or view any process outside of the chroot. If the sysctl
19851+ option is enabled, a sysctl option with name "chroot_findtask" is
19852+ created.
19853+
19854+config GRKERNSEC_CHROOT_NICE
19855+ bool "Restrict priority changes"
19856+ depends on GRKERNSEC_CHROOT
19857+ help
19858+ If you say Y here, processes inside a chroot will not be able to raise
19859+ the priority of processes in the chroot, or alter the priority of
19860+ processes outside the chroot. This provides more security than simply
19861+ removing CAP_SYS_NICE from the process' capability set. If the
19862+ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
19863+ is created.
19864+
19865+config GRKERNSEC_CHROOT_SYSCTL
19866+ bool "Deny sysctl writes"
19867+ depends on GRKERNSEC_CHROOT
19868+ help
19869+ If you say Y here, an attacker in a chroot will not be able to
19870+ write to sysctl entries, either by sysctl(2) or through a /proc
19871+ interface. It is strongly recommended that you say Y here. If the
19872+ sysctl option is enabled, a sysctl option with name
19873+ "chroot_deny_sysctl" is created.
19874+
19875+config GRKERNSEC_CHROOT_CAPS
19876+ bool "Capability restrictions"
19877+ depends on GRKERNSEC_CHROOT
19878+ help
19879+ If you say Y here, the capabilities on all root processes within a
19880+ chroot jail will be lowered to stop module insertion, raw i/o,
19881+ system and net admin tasks, rebooting the system, modifying immutable
19882+ files, modifying IPC owned by another, and changing the system time.
19883+ This is left an option because it can break some apps. Disable this
19884+ if your chrooted apps are having problems performing those kinds of
19885+ tasks. If the sysctl option is enabled, a sysctl option with
19886+ name "chroot_caps" is created.
19887+
19888+endmenu
19889+menu "Kernel Auditing"
19890+depends on GRKERNSEC
19891+
19892+config GRKERNSEC_AUDIT_GROUP
19893+ bool "Single group for auditing"
19894+ help
19895+ If you say Y here, the exec, chdir, (un)mount, and ipc logging features
19896+ will only operate on a group you specify. This option is recommended
19897+ if you only want to watch certain users instead of having a large
19898+ amount of logs from the entire system. If the sysctl option is enabled,
19899+ a sysctl option with name "audit_group" is created.
19900+
19901+config GRKERNSEC_AUDIT_GID
19902+ int "GID for auditing"
19903+ depends on GRKERNSEC_AUDIT_GROUP
19904+ default 1007
19905+
19906+config GRKERNSEC_EXECLOG
19907+ bool "Exec logging"
19908+ help
19909+ If you say Y here, all execve() calls will be logged (since the
19910+ other exec*() calls are frontends to execve(), all execution
19911+ will be logged). Useful for shell-servers that like to keep track
19912+ of their users. If the sysctl option is enabled, a sysctl option with
19913+ name "exec_logging" is created.
19914+ WARNING: This option when enabled will produce a LOT of logs, especially
19915+ on an active system.
19916+
19917+config GRKERNSEC_RESLOG
19918+ bool "Resource logging"
19919+ help
19920+ If you say Y here, all attempts to overstep resource limits will
19921+ be logged with the resource name, the requested size, and the current
19922+ limit. It is highly recommended that you say Y here. If the sysctl
19923+ option is enabled, a sysctl option with name "resource_logging" is
19924+ created. If the RBAC system is enabled, the sysctl value is ignored.
19925+
19926+config GRKERNSEC_CHROOT_EXECLOG
19927+ bool "Log execs within chroot"
19928+ help
19929+ If you say Y here, all executions inside a chroot jail will be logged
19930+ to syslog. This can cause a large amount of logs if certain
19931+ applications (eg. djb's daemontools) are installed on the system, and
19932+ is therefore left as an option. If the sysctl option is enabled, a
19933+ sysctl option with name "chroot_execlog" is created.
19934+
19935+config GRKERNSEC_AUDIT_CHDIR
19936+ bool "Chdir logging"
19937+ help
19938+ If you say Y here, all chdir() calls will be logged. If the sysctl
19939+ option is enabled, a sysctl option with name "audit_chdir" is created.
19940+
19941+config GRKERNSEC_AUDIT_MOUNT
19942+ bool "(Un)Mount logging"
19943+ help
19944+ If you say Y here, all mounts and unmounts will be logged. If the
19945+ sysctl option is enabled, a sysctl option with name "audit_mount" is
19946+ created.
19947+
19948+config GRKERNSEC_AUDIT_IPC
19949+ bool "IPC logging"
19950+ help
19951+ If you say Y here, creation and removal of message queues, semaphores,
19952+ and shared memory will be logged. If the sysctl option is enabled, a
19953+ sysctl option with name "audit_ipc" is created.
19954+
19955+config GRKERNSEC_SIGNAL
19956+ bool "Signal logging"
19957+ help
19958+ If you say Y here, certain important signals will be logged, such as
19959+ SIGSEGV, which will as a result inform you of when a error in a program
19960+ occurred, which in some cases could mean a possible exploit attempt.
19961+ If the sysctl option is enabled, a sysctl option with name
19962+ "signal_logging" is created.
19963+
19964+config GRKERNSEC_FORKFAIL
19965+ bool "Fork failure logging"
19966+ help
19967+ If you say Y here, all failed fork() attempts will be logged.
19968+ This could suggest a fork bomb, or someone attempting to overstep
19969+ their process limit. If the sysctl option is enabled, a sysctl option
19970+ with name "forkfail_logging" is created.
19971+
19972+config GRKERNSEC_TIME
19973+ bool "Time change logging"
19974+ help
19975+ If you say Y here, any changes of the system clock will be logged.
19976+ If the sysctl option is enabled, a sysctl option with name
19977+ "timechange_logging" is created.
19978+
19979+config GRKERNSEC_PROC_IPADDR
19980+ bool "/proc/<pid>/ipaddr support"
19981+ help
19982+ If you say Y here, a new entry will be added to each /proc/<pid>
19983+ directory that contains the IP address of the person using the task.
19984+ The IP is carried across local TCP and AF_UNIX stream sockets.
19985+ This information can be useful for IDS/IPSes to perform remote response
19986+ to a local attack. The entry is readable by only the owner of the
19987+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
19988+ the RBAC system), and thus does not create privacy concerns.
19989+
19990+config GRKERNSEC_AUDIT_TEXTREL
19991+ bool 'ELF text relocations logging (READ HELP)'
19992+ depends on PAX_MPROTECT
19993+ help
19994+ If you say Y here, text relocations will be logged with the filename
19995+ of the offending library or binary. The purpose of the feature is
19996+ to help Linux distribution developers get rid of libraries and
19997+ binaries that need text relocations which hinder the future progress
19998+ of PaX. Only Linux distribution developers should say Y here, and
19999+ never on a production machine, as this option creates an information
20000+ leak that could aid an attacker in defeating the randomization of
20001+ a single memory region. If the sysctl option is enabled, a sysctl
20002+ option with name "audit_textrel" is created.
20003+
20004+endmenu
20005+
20006+menu "Executable Protections"
20007+depends on GRKERNSEC
20008+
20009+config GRKERNSEC_EXECVE
20010+ bool "Enforce RLIMIT_NPROC on execs"
20011+ help
20012+ If you say Y here, users with a resource limit on processes will
20013+ have the value checked during execve() calls. The current system
20014+ only checks the system limit during fork() calls. If the sysctl option
20015+ is enabled, a sysctl option with name "execve_limiting" is created.
20016+
20017+config GRKERNSEC_SHM
20018+ bool "Destroy unused shared memory"
20019+ depends on SYSVIPC
20020+ help
20021+ If you say Y here, shared memory will be destroyed when no one is
20022+ attached to it. Otherwise, resources involved with the shared
20023+ memory can be used up and not be associated with any process (as the
20024+ shared memory still exists, and the creating process has exited). If
20025+ the sysctl option is enabled, a sysctl option with name
20026+ "destroy_unused_shm" is created.
20027+
20028+config GRKERNSEC_DMESG
20029+ bool "Dmesg(8) restriction"
20030+ help
20031+ If you say Y here, non-root users will not be able to use dmesg(8)
20032+ to view up to the last 4kb of messages in the kernel's log buffer.
20033+ If the sysctl option is enabled, a sysctl option with name "dmesg" is
20034+ created.
20035+
20036+config GRKERNSEC_RANDPID
20037+ bool "Randomized PIDs"
20038+ help
20039+ If you say Y here, all PIDs created on the system will be
20040+ pseudo-randomly generated. This is extremely effective along
20041+ with the /proc restrictions to disallow an attacker from guessing
20042+ pids of daemons, etc. PIDs are also used in some cases as part
20043+ of a naming system for temporary files, so this option would keep
20044+ those filenames from being predicted as well. We also use code
20045+ to make sure that PID numbers aren't reused too soon. If the sysctl
20046+ option is enabled, a sysctl option with name "rand_pids" is created.
20047+
20048+config GRKERNSEC_TPE
20049+ bool "Trusted Path Execution (TPE)"
20050+ help
20051+ If you say Y here, you will be able to choose a gid to add to the
20052+ supplementary groups of users you want to mark as "untrusted."
20053+ These users will not be able to execute any files that are not in
20054+ root-owned directories writable only by root. If the sysctl option
20055+ is enabled, a sysctl option with name "tpe" is created.
20056+
20057+config GRKERNSEC_TPE_ALL
20058+ bool "Partially restrict non-root users"
20059+ depends on GRKERNSEC_TPE
20060+ help
20061+ If you say Y here, All non-root users other than the ones in the
20062+ group specified in the main TPE option will only be allowed to
20063+ execute files in directories they own that are not group or
20064+ world-writable, or in directories owned by root and writable only by
20065+ root. If the sysctl option is enabled, a sysctl option with name
20066+ "tpe_restrict_all" is created.
20067+
20068+config GRKERNSEC_TPE_INVERT
20069+ bool "Invert GID option"
20070+ depends on GRKERNSEC_TPE
20071+ help
20072+ If you say Y here, the group you specify in the TPE configuration will
20073+ decide what group TPE restrictions will be *disabled* for. This
20074+ option is useful if you want TPE restrictions to be applied to most
20075+ users on the system.
20076+
20077+config GRKERNSEC_TPE_GID
20078+ int "GID for untrusted users"
20079+ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
20080+ default 1005
20081+ help
20082+ If you have selected the "Invert GID option" above, setting this
20083+ GID determines what group TPE restrictions will be *disabled* for.
20084+ If you have not selected the "Invert GID option" above, setting this
20085+ GID determines what group TPE restrictions will be *enabled* for.
20086+ If the sysctl option is enabled, a sysctl option with name "tpe_gid"
20087+ is created.
20088+
20089+config GRKERNSEC_TPE_GID
20090+ int "GID for trusted users"
20091+ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
20092+ default 1005
20093+ help
20094+ If you have selected the "Invert GID option" above, setting this
20095+ GID determines what group TPE restrictions will be *disabled* for.
20096+ If you have not selected the "Invert GID option" above, setting this
20097+ GID determines what group TPE restrictions will be *enabled* for.
20098+ If the sysctl option is enabled, a sysctl option with name "tpe_gid"
20099+ is created.
20100+
20101+endmenu
20102+menu "Network Protections"
20103+depends on GRKERNSEC
20104+
20105+config GRKERNSEC_RANDNET
20106+ bool "Larger entropy pools"
20107+ help
20108+ If you say Y here, the entropy pools used for many features of Linux
20109+ and grsecurity will be doubled in size. Since several grsecurity
20110+ features use additional randomness, it is recommended that you say Y
20111+ here. Saying Y here has a similar effect as modifying
20112+ /proc/sys/kernel/random/poolsize.
20113+
20114+config GRKERNSEC_SOCKET
20115+ bool "Socket restrictions"
20116+ help
20117+ If you say Y here, you will be able to choose from several options.
20118+ If you assign a GID on your system and add it to the supplementary
20119+ groups of users you want to restrict socket access to, this patch
20120+ will perform up to three things, based on the option(s) you choose.
20121+
20122+config GRKERNSEC_SOCKET_ALL
20123+ bool "Deny any sockets to group"
20124+ depends on GRKERNSEC_SOCKET
20125+ help
20126+ If you say Y here, you will be able to choose a GID of whose users will
20127+ be unable to connect to other hosts from your machine or run server
20128+ applications from your machine. If the sysctl option is enabled, a
20129+ sysctl option with name "socket_all" is created.
20130+
20131+config GRKERNSEC_SOCKET_ALL_GID
20132+ int "GID to deny all sockets for"
20133+ depends on GRKERNSEC_SOCKET_ALL
20134+ default 1004
20135+ help
20136+ Here you can choose the GID to disable socket access for. Remember to
20137+ add the users you want socket access disabled for to the GID
20138+ specified here. If the sysctl option is enabled, a sysctl option
20139+ with name "socket_all_gid" is created.
20140+
20141+config GRKERNSEC_SOCKET_CLIENT
20142+ bool "Deny client sockets to group"
20143+ depends on GRKERNSEC_SOCKET
20144+ help
20145+ If you say Y here, you will be able to choose a GID of whose users will
20146+ be unable to connect to other hosts from your machine, but will be
20147+ able to run servers. If this option is enabled, all users in the group
20148+ you specify will have to use passive mode when initiating ftp transfers
20149+ from the shell on your machine. If the sysctl option is enabled, a
20150+ sysctl option with name "socket_client" is created.
20151+
20152+config GRKERNSEC_SOCKET_CLIENT_GID
20153+ int "GID to deny client sockets for"
20154+ depends on GRKERNSEC_SOCKET_CLIENT
20155+ default 1003
20156+ help
20157+ Here you can choose the GID to disable client socket access for.
20158+ Remember to add the users you want client socket access disabled for to
20159+ the GID specified here. If the sysctl option is enabled, a sysctl
20160+ option with name "socket_client_gid" is created.
20161+
20162+config GRKERNSEC_SOCKET_SERVER
20163+ bool "Deny server sockets to group"
20164+ depends on GRKERNSEC_SOCKET
20165+ help
20166+ If you say Y here, you will be able to choose a GID of whose users will
20167+ be unable to run server applications from your machine. If the sysctl
20168+ option is enabled, a sysctl option with name "socket_server" is created.
20169+
20170+config GRKERNSEC_SOCKET_SERVER_GID
20171+ int "GID to deny server sockets for"
20172+ depends on GRKERNSEC_SOCKET_SERVER
20173+ default 1002
20174+ help
20175+ Here you can choose the GID to disable server socket access for.
20176+ Remember to add the users you want server socket access disabled for to
20177+ the GID specified here. If the sysctl option is enabled, a sysctl
20178+ option with name "socket_server_gid" is created.
20179+
20180+endmenu
20181+menu "Sysctl support"
20182+depends on GRKERNSEC && SYSCTL
20183+
20184+config GRKERNSEC_SYSCTL
20185+ bool "Sysctl support"
20186+ help
20187+ If you say Y here, you will be able to change the options that
20188+ grsecurity runs with at bootup, without having to recompile your
20189+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
20190+ to enable (1) or disable (0) various features. All the sysctl entries
20191+ are mutable until the "grsec_lock" entry is set to a non-zero value.
20192+ All features enabled in the kernel configuration are disabled at boot
20193+ if you do not say Y to the "Turn on features by default" option.
20194+ All options should be set at startup, and the grsec_lock entry should
20195+ be set to a non-zero value after all the options are set.
20196+ *THIS IS EXTREMELY IMPORTANT*
20197+
20198+config GRKERNSEC_SYSCTL_ON
20199+ bool "Turn on features by default"
20200+ depends on GRKERNSEC_SYSCTL
20201+ help
20202+ If you say Y here, instead of having all features enabled in the
20203+ kernel configuration disabled at boot time, the features will be
20204+ enabled at boot time. It is recommended you say Y here unless
20205+ there is some reason you would want all sysctl-tunable features to
20206+ be disabled by default. As mentioned elsewhere, it is important
20207+ to enable the grsec_lock entry once you have finished modifying
20208+ the sysctl entries.
20209+
20210+endmenu
20211+menu "Logging Options"
20212+depends on GRKERNSEC
20213+
20214+config GRKERNSEC_FLOODTIME
20215+ int "Seconds in between log messages (minimum)"
20216+ default 10
20217+ help
20218+ This option allows you to enforce the number of seconds between
20219+ grsecurity log messages. The default should be suitable for most
20220+ people, however, if you choose to change it, choose a value small enough
20221+ to allow informative logs to be produced, but large enough to
20222+ prevent flooding.
20223+
20224+config GRKERNSEC_FLOODBURST
20225+ int "Number of messages in a burst (maximum)"
20226+ default 4
20227+ help
20228+ This option allows you to choose the maximum number of messages allowed
20229+ within the flood time interval you chose in a separate option. The
20230+ default should be suitable for most people, however if you find that
20231+ many of your logs are being interpreted as flooding, you may want to
20232+ raise this value.
20233+
20234+endmenu
20235+
20236+endmenu
20237diff -urNp linux-2.6.18/grsecurity/Makefile linux-2.6.18/grsecurity/Makefile
20238--- linux-2.6.18/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
20239+++ linux-2.6.18/grsecurity/Makefile 2006-09-22 20:04:35.000000000 -0400
20240@@ -0,0 +1,20 @@
20241+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
20242+# during 2001-2005 it has been completely redesigned by Brad Spengler
20243+# into an RBAC system
20244+#
20245+# All code in this directory and various hooks inserted throughout the kernel
20246+# are copyright Brad Spengler, and released under the GPL v2 or higher
20247+
20248+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
20249+ grsec_mount.o grsec_rand.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
20250+ grsec_time.o grsec_tpe.o grsec_ipc.o grsec_link.o grsec_textrel.o
20251+
20252+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_ip.o gracl_segv.o \
20253+ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
20254+ gracl_learn.o grsec_log.o
20255+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
20256+
20257+ifndef CONFIG_GRKERNSEC
20258+obj-y += grsec_disabled.o
20259+endif
20260+
20261diff -urNp linux-2.6.18/include/acpi/acmacros.h linux-2.6.18/include/acpi/acmacros.h
20262--- linux-2.6.18/include/acpi/acmacros.h 2006-09-19 23:42:06.000000000 -0400
20263+++ linux-2.6.18/include/acpi/acmacros.h 2006-09-22 20:45:04.000000000 -0400
20264@@ -672,7 +672,7 @@
20265 #define ACPI_DUMP_PATHNAME(a,b,c,d)
20266 #define ACPI_DUMP_RESOURCE_LIST(a)
20267 #define ACPI_DUMP_BUFFER(a,b)
20268-#define ACPI_DEBUG_PRINT(pl)
20269+#define ACPI_DEBUG_PRINT(pl) do {} while (0)
20270 #define ACPI_DEBUG_PRINT_RAW(pl)
20271
20272 #define return_VOID return
20273diff -urNp linux-2.6.18/include/asm-alpha/a.out.h linux-2.6.18/include/asm-alpha/a.out.h
20274--- linux-2.6.18/include/asm-alpha/a.out.h 2006-09-19 23:42:06.000000000 -0400
20275+++ linux-2.6.18/include/asm-alpha/a.out.h 2006-09-22 20:45:04.000000000 -0400
20276@@ -98,7 +98,7 @@ struct exec
20277 set_personality (((BFPM->sh_bang || EX.ah.entry < 0x100000000L \
20278 ? ADDR_LIMIT_32BIT : 0) | PER_OSF4))
20279
20280-#define STACK_TOP \
20281+#define __STACK_TOP \
20282 (current->personality & ADDR_LIMIT_32BIT ? 0x80000000 : 0x00120000000UL)
20283
20284 #endif
20285diff -urNp linux-2.6.18/include/asm-alpha/elf.h linux-2.6.18/include/asm-alpha/elf.h
20286--- linux-2.6.18/include/asm-alpha/elf.h 2006-09-19 23:42:06.000000000 -0400
20287+++ linux-2.6.18/include/asm-alpha/elf.h 2006-09-22 20:45:04.000000000 -0400
20288@@ -91,6 +91,17 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
20289
20290 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
20291
20292+#ifdef CONFIG_PAX_ASLR
20293+#define PAX_ELF_ET_DYN_BASE(tsk) ((tsk)->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
20294+
20295+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
20296+#define PAX_DELTA_MMAP_LEN(tsk) ((tsk)->personality & ADDR_LIMIT_32BIT ? 14 : 28)
20297+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
20298+#define PAX_DELTA_EXEC_LEN(tsk) ((tsk)->personality & ADDR_LIMIT_32BIT ? 14 : 28)
20299+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
20300+#define PAX_DELTA_STACK_LEN(tsk) ((tsk)->personality & ADDR_LIMIT_32BIT ? 14 : 19)
20301+#endif
20302+
20303 /* $0 is set by ld.so to a pointer to a function which might be
20304 registered using atexit. This provides a mean for the dynamic
20305 linker to call DT_FINI functions for shared libraries that have
20306diff -urNp linux-2.6.18/include/asm-alpha/kmap_types.h linux-2.6.18/include/asm-alpha/kmap_types.h
20307--- linux-2.6.18/include/asm-alpha/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
20308+++ linux-2.6.18/include/asm-alpha/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
20309@@ -24,7 +24,8 @@ D(9) KM_IRQ0,
20310 D(10) KM_IRQ1,
20311 D(11) KM_SOFTIRQ0,
20312 D(12) KM_SOFTIRQ1,
20313-D(13) KM_TYPE_NR
20314+D(13) KM_CLEARPAGE,
20315+D(14) KM_TYPE_NR
20316 };
20317
20318 #undef D
20319diff -urNp linux-2.6.18/include/asm-alpha/page.h linux-2.6.18/include/asm-alpha/page.h
20320--- linux-2.6.18/include/asm-alpha/page.h 2006-09-19 23:42:06.000000000 -0400
20321+++ linux-2.6.18/include/asm-alpha/page.h 2006-09-22 20:45:04.000000000 -0400
20322@@ -93,6 +93,15 @@ typedef unsigned long pgprot_t;
20323 #define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | VM_EXEC | \
20324 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
20325
20326+#ifdef CONFIG_PAX_PAGEEXEC
20327+#ifdef CONFIG_PAX_MPROTECT
20328+#define __VM_STACK_FLAGS (((current->mm->pax_flags & MF_PAX_MPROTECT)?0:VM_MAYEXEC) | \
20329+ ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
20330+#else
20331+#define __VM_STACK_FLAGS (VM_MAYEXEC | ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
20332+#endif
20333+#endif
20334+
20335 #include <asm-generic/memory_model.h>
20336 #include <asm-generic/page.h>
20337
20338diff -urNp linux-2.6.18/include/asm-alpha/pgtable.h linux-2.6.18/include/asm-alpha/pgtable.h
20339--- linux-2.6.18/include/asm-alpha/pgtable.h 2006-09-19 23:42:06.000000000 -0400
20340+++ linux-2.6.18/include/asm-alpha/pgtable.h 2006-09-22 20:45:04.000000000 -0400
20341@@ -101,6 +101,17 @@ struct vm_area_struct;
20342 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
20343 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
20344 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
20345+
20346+#ifdef CONFIG_PAX_PAGEEXEC
20347+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
20348+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
20349+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
20350+#else
20351+# define PAGE_SHARED_NOEXEC PAGE_SHARED
20352+# define PAGE_COPY_NOEXEC PAGE_COPY
20353+# define PAGE_READONLY_NOEXEC PAGE_READONLY
20354+#endif
20355+
20356 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
20357
20358 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
20359diff -urNp linux-2.6.18/include/asm-arm/a.out.h linux-2.6.18/include/asm-arm/a.out.h
20360--- linux-2.6.18/include/asm-arm/a.out.h 2006-09-19 23:42:06.000000000 -0400
20361+++ linux-2.6.18/include/asm-arm/a.out.h 2006-09-22 20:45:04.000000000 -0400
20362@@ -28,7 +28,7 @@ struct exec
20363 #define M_ARM 103
20364
20365 #ifdef __KERNEL__
20366-#define STACK_TOP ((current->personality == PER_LINUX_32BIT) ? \
20367+#define __STACK_TOP ((current->personality == PER_LINUX_32BIT) ? \
20368 TASK_SIZE : TASK_SIZE_26)
20369 #endif
20370
20371diff -urNp linux-2.6.18/include/asm-arm/elf.h linux-2.6.18/include/asm-arm/elf.h
20372--- linux-2.6.18/include/asm-arm/elf.h 2006-09-19 23:42:06.000000000 -0400
20373+++ linux-2.6.18/include/asm-arm/elf.h 2006-09-22 20:45:04.000000000 -0400
20374@@ -57,6 +57,17 @@ typedef struct user_fp elf_fpregset_t;
20375
20376 #define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
20377
20378+#ifdef CONFIG_PAX_ASLR
20379+#define PAX_ELF_ET_DYN_BASE(tsk) 0x00008000UL
20380+
20381+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
20382+#define PAX_DELTA_MMAP_LEN(tsk) ((tsk->personality == PER_LINUX_32BIT) ? 16 : 10)
20383+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
20384+#define PAX_DELTA_EXEC_LEN(tsk) ((tsk->personality == PER_LINUX_32BIT) ? 16 : 10)
20385+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
20386+#define PAX_DELTA_STACK_LEN(tsk) ((tsk->personality == PER_LINUX_32BIT) ? 16 : 10)
20387+#endif
20388+
20389 /* When the program starts, a1 contains a pointer to a function to be
20390 registered with atexit, as per the SVR4 ABI. A value of 0 means we
20391 have no such handler. */
20392diff -urNp linux-2.6.18/include/asm-arm/kmap_types.h linux-2.6.18/include/asm-arm/kmap_types.h
20393--- linux-2.6.18/include/asm-arm/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
20394+++ linux-2.6.18/include/asm-arm/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
20395@@ -18,6 +18,7 @@ enum km_type {
20396 KM_IRQ1,
20397 KM_SOFTIRQ0,
20398 KM_SOFTIRQ1,
20399+ KM_CLEARPAGE,
20400 KM_TYPE_NR
20401 };
20402
20403diff -urNp linux-2.6.18/include/asm-arm26/kmap_types.h linux-2.6.18/include/asm-arm26/kmap_types.h
20404--- linux-2.6.18/include/asm-arm26/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
20405+++ linux-2.6.18/include/asm-arm26/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
20406@@ -6,7 +6,8 @@
20407 */
20408 enum km_type {
20409 KM_IRQ0,
20410- KM_USER1
20411+ KM_USER1,
20412+ KM_CLEARPAGE
20413 };
20414
20415 #endif
20416diff -urNp linux-2.6.18/include/asm-cris/kmap_types.h linux-2.6.18/include/asm-cris/kmap_types.h
20417--- linux-2.6.18/include/asm-cris/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
20418+++ linux-2.6.18/include/asm-cris/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
20419@@ -19,6 +19,7 @@ enum km_type {
20420 KM_IRQ1,
20421 KM_SOFTIRQ0,
20422 KM_SOFTIRQ1,
20423+ KM_CLEARPAGE,
20424 KM_TYPE_NR
20425 };
20426
20427diff -urNp linux-2.6.18/include/asm-frv/kmap_types.h linux-2.6.18/include/asm-frv/kmap_types.h
20428--- linux-2.6.18/include/asm-frv/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
20429+++ linux-2.6.18/include/asm-frv/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
20430@@ -23,6 +23,7 @@ enum km_type {
20431 KM_IRQ1,
20432 KM_SOFTIRQ0,
20433 KM_SOFTIRQ1,
20434+ KM_CLEARPAGE,
20435 KM_TYPE_NR
20436 };
20437
20438diff -urNp linux-2.6.18/include/asm-h8300/kmap_types.h linux-2.6.18/include/asm-h8300/kmap_types.h
20439--- linux-2.6.18/include/asm-h8300/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
20440+++ linux-2.6.18/include/asm-h8300/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
20441@@ -15,6 +15,7 @@ enum km_type {
20442 KM_IRQ1,
20443 KM_SOFTIRQ0,
20444 KM_SOFTIRQ1,
20445+ KM_CLEARPAGE,
20446 KM_TYPE_NR
20447 };
20448
20449diff -urNp linux-2.6.18/include/asm-i386/alternative.h linux-2.6.18/include/asm-i386/alternative.h
20450--- linux-2.6.18/include/asm-i386/alternative.h 2006-09-19 23:42:06.000000000 -0400
20451+++ linux-2.6.18/include/asm-i386/alternative.h 2006-09-22 20:45:04.000000000 -0400
20452@@ -57,7 +57,7 @@ static inline void alternatives_smp_swit
20453 " .byte 662b-661b\n" /* sourcelen */ \
20454 " .byte 664f-663f\n" /* replacementlen */ \
20455 ".previous\n" \
20456- ".section .altinstr_replacement,\"ax\"\n" \
20457+ ".section .altinstr_replacement,\"a\"\n" \
20458 "663:\n\t" newinstr "\n664:\n" /* replacement */\
20459 ".previous" :: "i" (feature) : "memory")
20460
20461@@ -81,7 +81,7 @@ static inline void alternatives_smp_swit
20462 " .byte 662b-661b\n" /* sourcelen */ \
20463 " .byte 664f-663f\n" /* replacementlen */ \
20464 ".previous\n" \
20465- ".section .altinstr_replacement,\"ax\"\n" \
20466+ ".section .altinstr_replacement,\"a\"\n" \
20467 "663:\n\t" newinstr "\n664:\n" /* replacement */\
20468 ".previous" :: "i" (feature), ##input)
20469
20470diff -urNp linux-2.6.18/include/asm-i386/a.out.h linux-2.6.18/include/asm-i386/a.out.h
20471--- linux-2.6.18/include/asm-i386/a.out.h 2006-09-19 23:42:06.000000000 -0400
20472+++ linux-2.6.18/include/asm-i386/a.out.h 2006-09-22 20:45:04.000000000 -0400
20473@@ -19,7 +19,11 @@ struct exec
20474
20475 #ifdef __KERNEL__
20476
20477-#define STACK_TOP TASK_SIZE
20478+#ifdef CONFIG_PAX_SEGMEXEC
20479+#define __STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?TASK_SIZE/2:TASK_SIZE)
20480+#else
20481+#define __STACK_TOP TASK_SIZE
20482+#endif
20483
20484 #endif
20485
20486diff -urNp linux-2.6.18/include/asm-i386/apic.h linux-2.6.18/include/asm-i386/apic.h
20487--- linux-2.6.18/include/asm-i386/apic.h 2006-09-19 23:42:06.000000000 -0400
20488+++ linux-2.6.18/include/asm-i386/apic.h 2006-09-22 20:45:04.000000000 -0400
20489@@ -7,7 +7,7 @@
20490 #include <asm/processor.h>
20491 #include <asm/system.h>
20492
20493-#define Dprintk(x...)
20494+#define Dprintk(x...) do {} while (0)
20495
20496 /*
20497 * Debugging macros
20498diff -urNp linux-2.6.18/include/asm-i386/bug.h linux-2.6.18/include/asm-i386/bug.h
20499--- linux-2.6.18/include/asm-i386/bug.h 2006-09-19 23:42:06.000000000 -0400
20500+++ linux-2.6.18/include/asm-i386/bug.h 2006-09-22 20:45:04.000000000 -0400
20501@@ -11,10 +11,9 @@
20502 #ifdef CONFIG_BUG
20503 #define HAVE_ARCH_BUG
20504 #ifdef CONFIG_DEBUG_BUGVERBOSE
20505-#define BUG() \
20506- __asm__ __volatile__( "ud2\n" \
20507- "\t.word %c0\n" \
20508- "\t.long %c1\n" \
20509+#define BUG() \
20510+ __asm__ __volatile__( "ud2\n\t" \
20511+ "ljmp %0, %1\n\t" \
20512 : : "i" (__LINE__), "i" (__FILE__))
20513 #else
20514 #define BUG() __asm__ __volatile__("ud2\n")
20515diff -urNp linux-2.6.18/include/asm-i386/checksum.h linux-2.6.18/include/asm-i386/checksum.h
20516--- linux-2.6.18/include/asm-i386/checksum.h 2006-09-19 23:42:06.000000000 -0400
20517+++ linux-2.6.18/include/asm-i386/checksum.h 2006-09-22 20:45:04.000000000 -0400
20518@@ -30,6 +30,12 @@ asmlinkage unsigned int csum_partial(con
20519 asmlinkage unsigned int csum_partial_copy_generic(const unsigned char *src, unsigned char *dst,
20520 int len, int sum, int *src_err_ptr, int *dst_err_ptr);
20521
20522+asmlinkage unsigned int csum_partial_copy_generic_to_user(const unsigned char *src, unsigned char *dst,
20523+ int len, int sum, int *src_err_ptr, int *dst_err_ptr);
20524+
20525+asmlinkage unsigned int csum_partial_copy_generic_from_user(const unsigned char *src, unsigned char *dst,
20526+ int len, int sum, int *src_err_ptr, int *dst_err_ptr);
20527+
20528 /*
20529 * Note: when you get a NULL pointer exception here this means someone
20530 * passed in an incorrect kernel address to one of these functions.
20531@@ -49,7 +55,7 @@ unsigned int csum_partial_copy_from_user
20532 int len, int sum, int *err_ptr)
20533 {
20534 might_sleep();
20535- return csum_partial_copy_generic((__force unsigned char *)src, dst,
20536+ return csum_partial_copy_generic_from_user((__force unsigned char *)src, dst,
20537 len, sum, err_ptr, NULL);
20538 }
20539
20540@@ -183,7 +189,7 @@ static __inline__ unsigned int csum_and_
20541 {
20542 might_sleep();
20543 if (access_ok(VERIFY_WRITE, dst, len))
20544- return csum_partial_copy_generic(src, (__force unsigned char *)dst, len, sum, NULL, err_ptr);
20545+ return csum_partial_copy_generic_to_user(src, (__force unsigned char *)dst, len, sum, NULL, err_ptr);
20546
20547 if (len)
20548 *err_ptr = -EFAULT;
20549diff -urNp linux-2.6.18/include/asm-i386/desc.h linux-2.6.18/include/asm-i386/desc.h
20550--- linux-2.6.18/include/asm-i386/desc.h 2006-09-19 23:42:06.000000000 -0400
20551+++ linux-2.6.18/include/asm-i386/desc.h 2006-09-22 20:45:04.000000000 -0400
20552@@ -10,11 +10,13 @@
20553
20554 #include <linux/preempt.h>
20555 #include <linux/smp.h>
20556-#include <linux/percpu.h>
20557+#include <linux/sched.h>
20558
20559 #include <asm/mmu.h>
20560+#include <asm/pgtable.h>
20561+#include <asm/tlbflush.h>
20562
20563-extern struct desc_struct cpu_gdt_table[GDT_ENTRIES];
20564+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
20565
20566 DECLARE_PER_CPU(unsigned char, cpu_16bit_stack[CPU_16BIT_STACK_SIZE]);
20567
20568@@ -24,13 +26,53 @@ struct Xgt_desc_struct {
20569 unsigned short pad;
20570 } __attribute__ ((packed));
20571
20572-extern struct Xgt_desc_struct idt_descr;
20573-DECLARE_PER_CPU(struct Xgt_desc_struct, cpu_gdt_descr);
20574-
20575+extern struct Xgt_desc_struct idt_descr, cpu_gdt_descr[NR_CPUS];
20576
20577 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
20578 {
20579- return (struct desc_struct *)per_cpu(cpu_gdt_descr, cpu).address;
20580+ return cpu_gdt_table[cpu];
20581+}
20582+
20583+#define pax_open_kernel(cr0) \
20584+do { \
20585+ typecheck(unsigned long,cr0); \
20586+ preempt_disable(); \
20587+ cr0 = read_cr0(); \
20588+ write_cr0(cr0 & ~0x10000UL); \
20589+} while(0)
20590+
20591+#define pax_close_kernel(cr0) \
20592+do { \
20593+ typecheck(unsigned long,cr0); \
20594+ write_cr0(cr0); \
20595+ preempt_enable_no_resched(); \
20596+} while(0)
20597+
20598+static inline void set_user_cs(struct mm_struct *mm, int cpu)
20599+{
20600+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
20601+ unsigned long base = mm->context.user_cs_base;
20602+ unsigned long limit = mm->context.user_cs_limit;
20603+
20604+#ifdef CONFIG_PAX_KERNEXEC
20605+ unsigned long cr0;
20606+
20607+ pax_open_kernel(cr0);
20608+#endif
20609+
20610+ if (likely(limit)) {
20611+ limit -= 1UL;
20612+ limit >>= 12;
20613+ }
20614+
20615+ get_cpu_gdt_table(cpu)[GDT_ENTRY_DEFAULT_USER_CS].a = (limit & 0xFFFFUL) | (base << 16);
20616+ get_cpu_gdt_table(cpu)[GDT_ENTRY_DEFAULT_USER_CS].b = (limit & 0xF0000UL) | 0xC0FB00UL | (base & 0xFF000000UL) | ((base >> 16) & 0xFFUL);
20617+
20618+#ifdef CONFIG_PAX_KERNEXEC
20619+ pax_close_kernel(cr0);
20620+#endif
20621+
20622+#endif
20623 }
20624
20625 #define load_TR_desc() __asm__ __volatile__("ltr %w0"::"q" (GDT_ENTRY_TSS*8))
20626@@ -50,7 +92,7 @@ static inline struct desc_struct *get_cp
20627 * This is the ldt that every process will get unless we need
20628 * something other than this.
20629 */
20630-extern struct desc_struct default_ldt[];
20631+extern const struct desc_struct default_ldt[];
20632 extern void set_intr_gate(unsigned int irq, void * addr);
20633
20634 #define _set_tssldt_desc(n,addr,limit,type) \
20635@@ -64,7 +106,7 @@ __asm__ __volatile__ ("movw %w3,0(%2)\n\
20636 "rorl $16,%1" \
20637 : "=m"(*(n)) : "q" (addr), "r"(n), "ir"(limit), "i"(type))
20638
20639-static inline void __set_tss_desc(unsigned int cpu, unsigned int entry, void *addr)
20640+static inline void __set_tss_desc(unsigned int cpu, unsigned int entry, const void *addr)
20641 {
20642 _set_tssldt_desc(&get_cpu_gdt_table(cpu)[entry], (int)addr,
20643 offsetof(struct tss_struct, __cacheline_filler) - 1, 0x89);
20644@@ -72,11 +114,28 @@ static inline void __set_tss_desc(unsign
20645
20646 #define set_tss_desc(cpu,addr) __set_tss_desc(cpu, GDT_ENTRY_TSS, addr)
20647
20648-static inline void set_ldt_desc(unsigned int cpu, void *addr, unsigned int size)
20649+static inline void __set_ldt_desc(unsigned int cpu, const void *addr, unsigned int size)
20650 {
20651 _set_tssldt_desc(&get_cpu_gdt_table(cpu)[GDT_ENTRY_LDT], (int)addr, ((size << 3)-1), 0x82);
20652 }
20653
20654+static inline void set_ldt_desc(unsigned int cpu, const void *addr, unsigned int size)
20655+{
20656+
20657+#ifdef CONFIG_PAX_KERNEXEC
20658+ unsigned long cr0;
20659+
20660+ pax_open_kernel(cr0);
20661+#endif
20662+
20663+ _set_tssldt_desc(&get_cpu_gdt_table(cpu)[GDT_ENTRY_LDT], (int)addr, ((size << 3)-1), 0x82);
20664+
20665+#ifdef CONFIG_PAX_KERNEXEC
20666+ pax_close_kernel(cr0);
20667+#endif
20668+
20669+}
20670+
20671 #define LDT_entry_a(info) \
20672 ((((info)->base_addr & 0x0000ffff) << 16) | ((info)->limit & 0x0ffff))
20673
20674@@ -90,7 +149,7 @@ static inline void set_ldt_desc(unsigned
20675 ((info)->seg_32bit << 22) | \
20676 ((info)->limit_in_pages << 23) | \
20677 ((info)->useable << 20) | \
20678- 0x7000)
20679+ 0x7100)
20680
20681 #define LDT_empty(info) (\
20682 (info)->base_addr == 0 && \
20683@@ -134,7 +193,7 @@ static inline void clear_LDT(void)
20684 */
20685 static inline void load_LDT_nolock(mm_context_t *pc, int cpu)
20686 {
20687- void *segments = pc->ldt;
20688+ const void *segments = pc->ldt;
20689 int count = pc->size;
20690
20691 if (likely(!count)) {
20692@@ -162,6 +221,22 @@ static inline unsigned long get_desc_bas
20693 return base;
20694 }
20695
20696+static inline void _load_LDT(mm_context_t *pc)
20697+{
20698+ int cpu = get_cpu();
20699+ const void *segments = pc->ldt;
20700+ int count = pc->size;
20701+
20702+ if (likely(!count)) {
20703+ segments = &default_ldt[0];
20704+ count = 5;
20705+ }
20706+
20707+ __set_ldt_desc(cpu, segments, count);
20708+ load_LDT_desc();
20709+ put_cpu();
20710+}
20711+
20712 #endif /* !__ASSEMBLY__ */
20713
20714 #endif
20715diff -urNp linux-2.6.18/include/asm-i386/elf.h linux-2.6.18/include/asm-i386/elf.h
20716--- linux-2.6.18/include/asm-i386/elf.h 2006-09-19 23:42:06.000000000 -0400
20717+++ linux-2.6.18/include/asm-i386/elf.h 2006-09-22 20:45:04.000000000 -0400
20718@@ -75,7 +75,22 @@ typedef struct user_fxsr_struct elf_fpxr
20719 the loader. We need to make sure that it is out of the way of the program
20720 that it will "exec", and that there is sufficient room for the brk. */
20721
20722+#ifdef CONFIG_PAX_SEGMEXEC
20723+#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
20724+#else
20725 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
20726+#endif
20727+
20728+#ifdef CONFIG_PAX_ASLR
20729+#define PAX_ELF_ET_DYN_BASE(tsk) 0x10000000UL
20730+
20731+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
20732+#define PAX_DELTA_MMAP_LEN(tsk) ((tsk)->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
20733+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
20734+#define PAX_DELTA_EXEC_LEN(tsk) 15
20735+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
20736+#define PAX_DELTA_STACK_LEN(tsk) ((tsk)->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
20737+#endif
20738
20739 /* regs is struct pt_regs, pr_reg is elf_gregset_t (which is
20740 now struct_user_regs, they are different) */
20741diff -urNp linux-2.6.18/include/asm-i386/i387.h linux-2.6.18/include/asm-i386/i387.h
20742--- linux-2.6.18/include/asm-i386/i387.h 2006-09-19 23:42:06.000000000 -0400
20743+++ linux-2.6.18/include/asm-i386/i387.h 2006-09-22 20:45:04.000000000 -0400
20744@@ -40,13 +40,8 @@ extern void kernel_fpu_begin(void);
20745 #define kernel_fpu_end() do { stts(); preempt_enable(); } while(0)
20746
20747 /* We need a safe address that is cheap to find and that is already
20748- in L1 during context switch. The best choices are unfortunately
20749- different for UP and SMP */
20750-#ifdef CONFIG_SMP
20751-#define safe_address (__per_cpu_offset[0])
20752-#else
20753-#define safe_address (kstat_cpu(0).cpustat.user)
20754-#endif
20755+ in L1 during context switch. */
20756+#define safe_address (init_tss[smp_processor_id()].esp0)
20757
20758 /*
20759 * These must be called with preempt disabled
20760diff -urNp linux-2.6.18/include/asm-i386/kmap_types.h linux-2.6.18/include/asm-i386/kmap_types.h
20761--- linux-2.6.18/include/asm-i386/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
20762+++ linux-2.6.18/include/asm-i386/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
20763@@ -22,7 +22,8 @@ D(9) KM_IRQ0,
20764 D(10) KM_IRQ1,
20765 D(11) KM_SOFTIRQ0,
20766 D(12) KM_SOFTIRQ1,
20767-D(13) KM_TYPE_NR
20768+D(13) KM_CLEARPAGE,
20769+D(14) KM_TYPE_NR
20770 };
20771
20772 #undef D
20773diff -urNp linux-2.6.18/include/asm-i386/mach-default/apm.h linux-2.6.18/include/asm-i386/mach-default/apm.h
20774--- linux-2.6.18/include/asm-i386/mach-default/apm.h 2006-09-19 23:42:06.000000000 -0400
20775+++ linux-2.6.18/include/asm-i386/mach-default/apm.h 2006-09-22 20:45:04.000000000 -0400
20776@@ -36,7 +36,7 @@ static inline void apm_bios_call_asm(u32
20777 __asm__ __volatile__(APM_DO_ZERO_SEGS
20778 "pushl %%edi\n\t"
20779 "pushl %%ebp\n\t"
20780- "lcall *%%cs:apm_bios_entry\n\t"
20781+ "lcall *%%ss:apm_bios_entry\n\t"
20782 "setc %%al\n\t"
20783 "popl %%ebp\n\t"
20784 "popl %%edi\n\t"
20785@@ -60,7 +60,7 @@ static inline u8 apm_bios_call_simple_as
20786 __asm__ __volatile__(APM_DO_ZERO_SEGS
20787 "pushl %%edi\n\t"
20788 "pushl %%ebp\n\t"
20789- "lcall *%%cs:apm_bios_entry\n\t"
20790+ "lcall *%%ss:apm_bios_entry\n\t"
20791 "setc %%bl\n\t"
20792 "popl %%ebp\n\t"
20793 "popl %%edi\n\t"
20794diff -urNp linux-2.6.18/include/asm-i386/mach-default/do_timer.h linux-2.6.18/include/asm-i386/mach-default/do_timer.h
20795--- linux-2.6.18/include/asm-i386/mach-default/do_timer.h 2006-09-19 23:42:06.000000000 -0400
20796+++ linux-2.6.18/include/asm-i386/mach-default/do_timer.h 2006-09-22 20:45:04.000000000 -0400
20797@@ -18,7 +18,7 @@ static inline void do_timer_interrupt_ho
20798 {
20799 do_timer(regs);
20800 #ifndef CONFIG_SMP
20801- update_process_times(user_mode_vm(regs));
20802+ update_process_times(user_mode(regs));
20803 #endif
20804 /*
20805 * In the SMP case we use the local APIC timer interrupt to do the
20806diff -urNp linux-2.6.18/include/asm-i386/mach-visws/do_timer.h linux-2.6.18/include/asm-i386/mach-visws/do_timer.h
20807--- linux-2.6.18/include/asm-i386/mach-visws/do_timer.h 2006-09-19 23:42:06.000000000 -0400
20808+++ linux-2.6.18/include/asm-i386/mach-visws/do_timer.h 2006-09-22 20:45:04.000000000 -0400
20809@@ -11,7 +11,7 @@ static inline void do_timer_interrupt_ho
20810
20811 do_timer(regs);
20812 #ifndef CONFIG_SMP
20813- update_process_times(user_mode_vm(regs));
20814+ update_process_times(user_mode(regs));
20815 #endif
20816 /*
20817 * In the SMP case we use the local APIC timer interrupt to do the
20818diff -urNp linux-2.6.18/include/asm-i386/mach-voyager/do_timer.h linux-2.6.18/include/asm-i386/mach-voyager/do_timer.h
20819--- linux-2.6.18/include/asm-i386/mach-voyager/do_timer.h 2006-09-19 23:42:06.000000000 -0400
20820+++ linux-2.6.18/include/asm-i386/mach-voyager/do_timer.h 2006-09-22 20:45:04.000000000 -0400
20821@@ -5,7 +5,7 @@ static inline void do_timer_interrupt_ho
20822 {
20823 do_timer(regs);
20824 #ifndef CONFIG_SMP
20825- update_process_times(user_mode_vm(regs));
20826+ update_process_times(user_mode(regs));
20827 #endif
20828
20829 voyager_timer_interrupt(regs);
20830diff -urNp linux-2.6.18/include/asm-i386/mman.h linux-2.6.18/include/asm-i386/mman.h
20831--- linux-2.6.18/include/asm-i386/mman.h 2006-09-19 23:42:06.000000000 -0400
20832+++ linux-2.6.18/include/asm-i386/mman.h 2006-09-22 20:45:04.000000000 -0400
20833@@ -11,6 +11,10 @@
20834 #define MAP_POPULATE 0x8000 /* populate (prefault) pagetables */
20835 #define MAP_NONBLOCK 0x10000 /* do not block on IO */
20836
20837+#ifdef CONFIG_PAX_SEGMEXEC
20838+#define MAP_MIRROR 0x20000
20839+#endif
20840+
20841 #define MCL_CURRENT 1 /* lock all current mappings */
20842 #define MCL_FUTURE 2 /* lock all future mappings */
20843
20844diff -urNp linux-2.6.18/include/asm-i386/mmu_context.h linux-2.6.18/include/asm-i386/mmu_context.h
20845--- linux-2.6.18/include/asm-i386/mmu_context.h 2006-09-19 23:42:06.000000000 -0400
20846+++ linux-2.6.18/include/asm-i386/mmu_context.h 2006-09-22 23:33:51.000000000 -0400
20847@@ -45,6 +45,17 @@ static inline void switch_mm(struct mm_s
20848 */
20849 if (unlikely(prev->context.ldt != next->context.ldt))
20850 load_LDT_nolock(&next->context, cpu);
20851+
20852+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
20853+ cpu_clear(cpu, prev->context.cpu_user_cs_mask);
20854+ cpu_set(cpu, next->context.cpu_user_cs_mask);
20855+#endif
20856+
20857+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
20858+ if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
20859+ prev->context.user_cs_limit != next->context.user_cs_limit))
20860+#endif
20861+ set_user_cs(next, cpu);
20862 }
20863 #ifdef CONFIG_SMP
20864 else {
20865@@ -57,6 +68,12 @@ static inline void switch_mm(struct mm_s
20866 */
20867 load_cr3(next->pgd);
20868 load_LDT_nolock(&next->context, cpu);
20869+
20870+#ifdef CONFIG_PAX_PAGEEXEC
20871+ cpu_set(cpu, next->context.cpu_user_cs_mask);
20872+#endif
20873+
20874+ set_user_cs(next, cpu);
20875 }
20876 }
20877 #endif
20878diff -urNp linux-2.6.18/include/asm-i386/mmu.h linux-2.6.18/include/asm-i386/mmu.h
20879--- linux-2.6.18/include/asm-i386/mmu.h 2006-09-19 23:42:06.000000000 -0400
20880+++ linux-2.6.18/include/asm-i386/mmu.h 2006-09-22 20:45:04.000000000 -0400
20881@@ -13,6 +13,17 @@ typedef struct {
20882 struct semaphore sem;
20883 void *ldt;
20884 void *vdso;
20885+
20886+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
20887+ unsigned long user_cs_base;
20888+ unsigned long user_cs_limit;
20889+
20890+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
20891+ cpumask_t cpu_user_cs_mask;
20892+#endif
20893+
20894+#endif
20895+
20896 } mm_context_t;
20897
20898 #endif
20899diff -urNp linux-2.6.18/include/asm-i386/module.h linux-2.6.18/include/asm-i386/module.h
20900--- linux-2.6.18/include/asm-i386/module.h 2006-09-19 23:42:06.000000000 -0400
20901+++ linux-2.6.18/include/asm-i386/module.h 2006-09-22 20:04:35.000000000 -0400
20902@@ -72,6 +72,12 @@ struct mod_arch_specific
20903 #define MODULE_STACKSIZE ""
20904 #endif
20905
20906-#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_REGPARM MODULE_STACKSIZE
20907+#ifdef CONFIG_GRKERNSEC
20908+#define MODULE_GRSEC "GRSECURITY "
20909+#else
20910+#define MODULE_GRSEC ""
20911+#endif
20912+
20913+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_REGPARM MODULE_STACKSIZE MODULE_GRSEC
20914
20915 #endif /* _ASM_I386_MODULE_H */
20916diff -urNp linux-2.6.18/include/asm-i386/page.h linux-2.6.18/include/asm-i386/page.h
20917--- linux-2.6.18/include/asm-i386/page.h 2006-09-19 23:42:06.000000000 -0400
20918+++ linux-2.6.18/include/asm-i386/page.h 2006-09-22 20:45:04.000000000 -0400
20919@@ -51,13 +51,14 @@ typedef struct { unsigned long long pgpr
20920 #define pmd_val(x) ((x).pmd)
20921 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
20922 #define __pmd(x) ((pmd_t) { (x) } )
20923+#define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
20924 #define HPAGE_SHIFT 21
20925 #else
20926 typedef struct { unsigned long pte_low; } pte_t;
20927 typedef struct { unsigned long pgd; } pgd_t;
20928 typedef struct { unsigned long pgprot; } pgprot_t;
20929-#define boot_pte_t pte_t /* or would you rather have a typedef */
20930 #define pte_val(x) ((x).pte_low)
20931+#define __pte(x) ((pte_t) { (x) } )
20932 #define HPAGE_SHIFT 22
20933 #endif
20934 #define PTE_MASK PAGE_MASK
20935@@ -72,7 +73,6 @@ typedef struct { unsigned long pgprot; }
20936 #define pgd_val(x) ((x).pgd)
20937 #define pgprot_val(x) ((x).pgprot)
20938
20939-#define __pte(x) ((pte_t) { (x) } )
20940 #define __pgd(x) ((pgd_t) { (x) } )
20941 #define __pgprot(x) ((pgprot_t) { (x) } )
20942
20943@@ -119,6 +119,15 @@ extern int page_is_ram(unsigned long pag
20944 #endif
20945 #define __KERNEL_START (__PAGE_OFFSET + __PHYSICAL_START)
20946
20947+#ifdef CONFIG_PAX_KERNEXEC
20948+#define __KERNEL_TEXT_OFFSET (__PAGE_OFFSET + ((__PHYSICAL_START + ~(4*1024*1024)) & (4*1024*1024)))
20949+#ifndef __ASSEMBLY__
20950+extern unsigned char MODULES_VADDR[];
20951+extern unsigned char MODULES_END[];
20952+#endif
20953+#else
20954+#define __KERNEL_TEXT_OFFSET (0)
20955+#endif
20956
20957 #define PAGE_OFFSET ((unsigned long)__PAGE_OFFSET)
20958 #define VMALLOC_RESERVE ((unsigned long)__VMALLOC_RESERVE)
20959@@ -138,6 +147,19 @@ extern int page_is_ram(unsigned long pag
20960 ((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0 ) | \
20961 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
20962
20963+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
20964+#ifdef CONFIG_PAX_MPROTECT
20965+#define __VM_STACK_FLAGS (((current->mm->pax_flags & MF_PAX_MPROTECT)?0:VM_MAYEXEC) | \
20966+ ((current->mm->pax_flags & (MF_PAX_PAGEEXEC|MF_PAX_SEGMEXEC))?0:VM_EXEC))
20967+#else
20968+#define __VM_STACK_FLAGS (VM_MAYEXEC | ((current->mm->pax_flags & (MF_PAX_PAGEEXEC|MF_PAX_SEGMEXEC))?0:VM_EXEC))
20969+#endif
20970+#endif
20971+
20972+#ifdef CONFIG_PAX_PAGEEXEC
20973+#define CONFIG_ARCH_TRACK_EXEC_LIMIT 1
20974+#endif
20975+
20976 #include <asm-generic/memory_model.h>
20977 #include <asm-generic/page.h>
20978
20979diff -urNp linux-2.6.18/include/asm-i386/pgalloc.h linux-2.6.18/include/asm-i386/pgalloc.h
20980--- linux-2.6.18/include/asm-i386/pgalloc.h 2006-09-19 23:42:06.000000000 -0400
20981+++ linux-2.6.18/include/asm-i386/pgalloc.h 2006-09-22 20:45:04.000000000 -0400
20982@@ -2,11 +2,17 @@
20983 #define _I386_PGALLOC_H
20984
20985 #include <asm/fixmap.h>
20986+#include <asm/desc.h>
20987 #include <linux/threads.h>
20988 #include <linux/mm.h> /* for struct page */
20989
20990+#ifdef CONFIG_COMPAT_VDSO
20991 #define pmd_populate_kernel(mm, pmd, pte) \
20992 set_pmd(pmd, __pmd(_PAGE_TABLE + __pa(pte)))
20993+#else
20994+#define pmd_populate_kernel(mm, pmd, pte) \
20995+ set_pmd(pmd, __pmd(_KERNPG_TABLE + __pa(pte)))
20996+#endif
20997
20998 #define pmd_populate(mm, pmd, pte) \
20999 set_pmd(pmd, __pmd(_PAGE_TABLE + \
21000diff -urNp linux-2.6.18/include/asm-i386/pgtable.h linux-2.6.18/include/asm-i386/pgtable.h
21001--- linux-2.6.18/include/asm-i386/pgtable.h 2006-09-19 23:42:06.000000000 -0400
21002+++ linux-2.6.18/include/asm-i386/pgtable.h 2006-09-22 20:45:04.000000000 -0400
21003@@ -33,7 +33,6 @@ struct vm_area_struct;
21004 */
21005 #define ZERO_PAGE(vaddr) (virt_to_page(empty_zero_page))
21006 extern unsigned long empty_zero_page[1024];
21007-extern pgd_t swapper_pg_dir[1024];
21008 extern kmem_cache_t *pgd_cache;
21009 extern kmem_cache_t *pmd_cache;
21010 extern spinlock_t pgd_lock;
21011@@ -58,6 +57,11 @@ void paging_init(void);
21012 # include <asm/pgtable-2level-defs.h>
21013 #endif
21014
21015+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
21016+#ifdef CONFIG_X86_PAE
21017+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
21018+#endif
21019+
21020 #define PGDIR_SIZE (1UL << PGDIR_SHIFT)
21021 #define PGDIR_MASK (~(PGDIR_SIZE-1))
21022
21023@@ -67,9 +71,11 @@ void paging_init(void);
21024 #define USER_PGD_PTRS (PAGE_OFFSET >> PGDIR_SHIFT)
21025 #define KERNEL_PGD_PTRS (PTRS_PER_PGD-USER_PGD_PTRS)
21026
21027+#ifndef CONFIG_X86_PAE
21028 #define TWOLEVEL_PGDIR_SHIFT 22
21029 #define BOOT_USER_PGD_PTRS (__PAGE_OFFSET >> TWOLEVEL_PGDIR_SHIFT)
21030 #define BOOT_KERNEL_PGD_PTRS (1024-BOOT_USER_PGD_PTRS)
21031+#endif
21032
21033 /* Just any arbitrary offset to the start of the vmalloc VM area: the
21034 * current 8MB value just means that there will be a 8MB "hole" after the
21035@@ -140,17 +146,26 @@ void paging_init(void);
21036
21037 #define PAGE_SHARED_EXEC \
21038 __pgprot(_PAGE_PRESENT | _PAGE_RW | _PAGE_USER | _PAGE_ACCESSED)
21039-#define PAGE_COPY_NOEXEC \
21040- __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_ACCESSED | _PAGE_NX)
21041 #define PAGE_COPY_EXEC \
21042 __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_ACCESSED)
21043-#define PAGE_COPY \
21044- PAGE_COPY_NOEXEC
21045 #define PAGE_READONLY \
21046 __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_ACCESSED | _PAGE_NX)
21047 #define PAGE_READONLY_EXEC \
21048 __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_ACCESSED)
21049
21050+#ifdef CONFIG_PAX_PAGEEXEC
21051+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED)
21052+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_ACCESSED)
21053+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_ACCESSED)
21054+#else
21055+# define PAGE_SHARED_NOEXEC PAGE_SHARED
21056+# define PAGE_COPY_NOEXEC \
21057+ __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_ACCESSED | _PAGE_NX)
21058+# define PAGE_READONLY_NOEXEC PAGE_READONLY
21059+#endif
21060+
21061+#define PAGE_COPY \
21062+ PAGE_COPY_NOEXEC
21063 #define _PAGE_KERNEL \
21064 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_NX)
21065 #define _PAGE_KERNEL_EXEC \
21066@@ -175,18 +190,18 @@ extern unsigned long long __PAGE_KERNEL,
21067 * This is the closest we can get..
21068 */
21069 #define __P000 PAGE_NONE
21070-#define __P001 PAGE_READONLY
21071-#define __P010 PAGE_COPY
21072-#define __P011 PAGE_COPY
21073+#define __P001 PAGE_READONLY_NOEXEC
21074+#define __P010 PAGE_COPY_NOEXEC
21075+#define __P011 PAGE_COPY_NOEXEC
21076 #define __P100 PAGE_READONLY_EXEC
21077 #define __P101 PAGE_READONLY_EXEC
21078 #define __P110 PAGE_COPY_EXEC
21079 #define __P111 PAGE_COPY_EXEC
21080
21081 #define __S000 PAGE_NONE
21082-#define __S001 PAGE_READONLY
21083-#define __S010 PAGE_SHARED
21084-#define __S011 PAGE_SHARED
21085+#define __S001 PAGE_READONLY_NOEXEC
21086+#define __S010 PAGE_SHARED_NOEXEC
21087+#define __S011 PAGE_SHARED_NOEXEC
21088 #define __S100 PAGE_READONLY_EXEC
21089 #define __S101 PAGE_READONLY_EXEC
21090 #define __S110 PAGE_SHARED_EXEC
21091@@ -430,6 +445,9 @@ extern void noexec_setup(const char *str
21092
21093 #endif /* !__ASSEMBLY__ */
21094
21095+#define HAVE_ARCH_UNMAPPED_AREA
21096+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
21097+
21098 #ifdef CONFIG_FLATMEM
21099 #define kern_addr_valid(addr) (1)
21100 #endif /* CONFIG_FLATMEM */
21101diff -urNp linux-2.6.18/include/asm-i386/processor.h linux-2.6.18/include/asm-i386/processor.h
21102--- linux-2.6.18/include/asm-i386/processor.h 2006-09-19 23:42:06.000000000 -0400
21103+++ linux-2.6.18/include/asm-i386/processor.h 2006-09-22 20:45:04.000000000 -0400
21104@@ -18,7 +18,6 @@
21105 #include <asm/system.h>
21106 #include <linux/cache.h>
21107 #include <linux/threads.h>
21108-#include <asm/percpu.h>
21109 #include <linux/cpumask.h>
21110
21111 /* flag for disabling the tsc */
21112@@ -97,8 +96,6 @@ struct cpuinfo_x86 {
21113
21114 extern struct cpuinfo_x86 boot_cpu_data;
21115 extern struct cpuinfo_x86 new_cpu_data;
21116-extern struct tss_struct doublefault_tss;
21117-DECLARE_PER_CPU(struct tss_struct, init_tss);
21118
21119 #ifdef CONFIG_SMP
21120 extern struct cpuinfo_x86 cpu_data[];
21121@@ -327,10 +324,19 @@ extern int bootloader_type;
21122 */
21123 #define TASK_SIZE (PAGE_OFFSET)
21124
21125+#ifdef CONFIG_PAX_SEGMEXEC
21126+#define SEGMEXEC_TASK_SIZE ((PAGE_OFFSET) / 2)
21127+#endif
21128+
21129 /* This decides where the kernel will search for a free chunk of vm
21130 * space during mmap's.
21131 */
21132+
21133+#ifdef CONFIG_PAX_SEGMEXEC
21134+#define TASK_UNMAPPED_BASE (PAGE_ALIGN((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3 : TASK_SIZE/3))
21135+#else
21136 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
21137+#endif
21138
21139 #define HAVE_ARCH_PICK_MMAP_LAYOUT
21140
21141@@ -446,6 +452,9 @@ struct tss_struct {
21142
21143 #define ARCH_MIN_TASKALIGN 16
21144
21145+extern struct tss_struct doublefault_tss;
21146+extern struct tss_struct init_tss[NR_CPUS];
21147+
21148 struct thread_struct {
21149 /* cached TLS descriptors. */
21150 struct desc_struct tls_array[GDT_ENTRY_TLS_ENTRIES];
21151@@ -474,6 +483,7 @@ struct thread_struct {
21152 };
21153
21154 #define INIT_THREAD { \
21155+ .esp0 = sizeof(init_stack) + (long)&init_stack - 8, \
21156 .vm86_info = NULL, \
21157 .sysenter_cs = __KERNEL_CS, \
21158 .io_bitmap_ptr = NULL, \
21159@@ -486,7 +496,7 @@ struct thread_struct {
21160 * be within the limit.
21161 */
21162 #define INIT_TSS { \
21163- .esp0 = sizeof(init_stack) + (long)&init_stack, \
21164+ .esp0 = sizeof(init_stack) + (long)&init_stack - 8, \
21165 .ss0 = __KERNEL_DS, \
21166 .ss1 = __KERNEL_CS, \
21167 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
21168@@ -562,11 +572,7 @@ void show_trace(struct task_struct *task
21169 unsigned long get_wchan(struct task_struct *p);
21170
21171 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
21172-#define KSTK_TOP(info) \
21173-({ \
21174- unsigned long *__ptr = (unsigned long *)(info); \
21175- (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
21176-})
21177+#define KSTK_TOP(info) ((info)->task.thread.esp0)
21178
21179 /*
21180 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
21181@@ -581,7 +587,7 @@ unsigned long get_wchan(struct task_stru
21182 #define task_pt_regs(task) \
21183 ({ \
21184 struct pt_regs *__regs__; \
21185- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
21186+ __regs__ = (struct pt_regs *)((task)->thread.esp0); \
21187 __regs__ - 1; \
21188 })
21189
21190diff -urNp linux-2.6.18/include/asm-i386/ptrace.h linux-2.6.18/include/asm-i386/ptrace.h
21191--- linux-2.6.18/include/asm-i386/ptrace.h 2006-09-19 23:42:06.000000000 -0400
21192+++ linux-2.6.18/include/asm-i386/ptrace.h 2006-09-22 20:45:04.000000000 -0400
21193@@ -65,17 +65,18 @@ struct task_struct;
21194 extern void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, int error_code);
21195
21196 /*
21197- * user_mode_vm(regs) determines whether a register set came from user mode.
21198+ * user_mode(regs) determines whether a register set came from user mode.
21199 * This is true if V8086 mode was enabled OR if the register set was from
21200 * protected mode with RPL-3 CS value. This tricky test checks that with
21201 * one comparison. Many places in the kernel can bypass this full check
21202- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
21203+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
21204+ * be used.
21205 */
21206-static inline int user_mode(struct pt_regs *regs)
21207+static inline int user_mode_novm(struct pt_regs *regs)
21208 {
21209 return (regs->xcs & 3) != 0;
21210 }
21211-static inline int user_mode_vm(struct pt_regs *regs)
21212+static inline int user_mode(struct pt_regs *regs)
21213 {
21214 return ((regs->xcs & 3) | (regs->eflags & VM_MASK)) != 0;
21215 }
21216diff -urNp linux-2.6.18/include/asm-i386/system.h linux-2.6.18/include/asm-i386/system.h
21217--- linux-2.6.18/include/asm-i386/system.h 2006-09-19 23:42:06.000000000 -0400
21218+++ linux-2.6.18/include/asm-i386/system.h 2006-09-22 20:45:04.000000000 -0400
21219@@ -4,6 +4,7 @@
21220 #include <linux/kernel.h>
21221 #include <asm/segment.h>
21222 #include <asm/cpufeature.h>
21223+#include <asm/page.h>
21224 #include <linux/bitops.h> /* for LOCK_PREFIX */
21225
21226 #ifdef __KERNEL__
21227@@ -155,7 +156,7 @@ static inline unsigned long get_limit(un
21228 unsigned long __limit;
21229 __asm__("lsll %1,%0"
21230 :"=r" (__limit):"r" (segment));
21231- return __limit+1;
21232+ return __limit;
21233 }
21234
21235 #define nop() __asm__ __volatile__ ("nop")
21236@@ -480,7 +481,7 @@ static inline void sched_cacheflush(void
21237 wbinvd();
21238 }
21239
21240-extern unsigned long arch_align_stack(unsigned long sp);
21241+#define arch_align_stack(x) (x)
21242 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
21243
21244 void default_idle(void);
21245diff -urNp linux-2.6.18/include/asm-i386/uaccess.h linux-2.6.18/include/asm-i386/uaccess.h
21246--- linux-2.6.18/include/asm-i386/uaccess.h 2006-09-19 23:42:06.000000000 -0400
21247+++ linux-2.6.18/include/asm-i386/uaccess.h 2006-09-22 20:45:04.000000000 -0400
21248@@ -9,6 +9,8 @@
21249 #include <linux/prefetch.h>
21250 #include <linux/string.h>
21251 #include <asm/page.h>
21252+#include <asm/segment.h>
21253+#include <asm/desc.h>
21254
21255 #define VERIFY_READ 0
21256 #define VERIFY_WRITE 1
21257@@ -29,7 +31,8 @@
21258
21259 #define get_ds() (KERNEL_DS)
21260 #define get_fs() (current_thread_info()->addr_limit)
21261-#define set_fs(x) (current_thread_info()->addr_limit = (x))
21262+void __set_fs(mm_segment_t x, int cpu);
21263+void set_fs(mm_segment_t x);
21264
21265 #define segment_eq(a,b) ((a).seg == (b).seg)
21266
21267@@ -280,9 +283,12 @@ extern void __put_user_8(void);
21268
21269 #define __put_user_u64(x, addr, err) \
21270 __asm__ __volatile__( \
21271- "1: movl %%eax,0(%2)\n" \
21272- "2: movl %%edx,4(%2)\n" \
21273+ " movw %w5,%%ds\n" \
21274+ "1: movl %%eax,%%ds:0(%2)\n" \
21275+ "2: movl %%edx,%%ds:4(%2)\n" \
21276 "3:\n" \
21277+ " pushl %%ss\n" \
21278+ " popl %%ds\n" \
21279 ".section .fixup,\"ax\"\n" \
21280 "4: movl %3,%0\n" \
21281 " jmp 3b\n" \
21282@@ -293,7 +299,8 @@ extern void __put_user_8(void);
21283 " .long 2b,4b\n" \
21284 ".previous" \
21285 : "=r"(err) \
21286- : "A" (x), "r" (addr), "i"(-EFAULT), "0"(err))
21287+ : "A" (x), "r" (addr), "i"(-EFAULT), "0"(err), \
21288+ "r"(__USER_DS))
21289
21290 #ifdef CONFIG_X86_WP_WORKS_OK
21291
21292@@ -332,8 +339,11 @@ struct __large_struct { unsigned long bu
21293 */
21294 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
21295 __asm__ __volatile__( \
21296- "1: mov"itype" %"rtype"1,%2\n" \
21297+ " movw %w5,%%ds\n" \
21298+ "1: mov"itype" %"rtype"1,%%ds:%2\n" \
21299 "2:\n" \
21300+ " pushl %%ss\n" \
21301+ " popl %%ds\n" \
21302 ".section .fixup,\"ax\"\n" \
21303 "3: movl %3,%0\n" \
21304 " jmp 2b\n" \
21305@@ -343,7 +353,8 @@ struct __large_struct { unsigned long bu
21306 " .long 1b,3b\n" \
21307 ".previous" \
21308 : "=r"(err) \
21309- : ltype (x), "m"(__m(addr)), "i"(errret), "0"(err))
21310+ : ltype (x), "m"(__m(addr)), "i"(errret), "0"(err), \
21311+ "r"(__USER_DS))
21312
21313
21314 #define __get_user_nocheck(x,ptr,size) \
21315@@ -371,8 +382,11 @@ do { \
21316
21317 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
21318 __asm__ __volatile__( \
21319- "1: mov"itype" %2,%"rtype"1\n" \
21320+ " movw %w5,%%ds\n" \
21321+ "1: mov"itype" %%ds:%2,%"rtype"1\n" \
21322 "2:\n" \
21323+ " pushl %%ss\n" \
21324+ " popl %%ds\n" \
21325 ".section .fixup,\"ax\"\n" \
21326 "3: movl %3,%0\n" \
21327 " xor"itype" %"rtype"1,%"rtype"1\n" \
21328@@ -383,7 +397,7 @@ do { \
21329 " .long 1b,3b\n" \
21330 ".previous" \
21331 : "=r"(err), ltype (x) \
21332- : "m"(__m(addr)), "i"(errret), "0"(err))
21333+ : "m"(__m(addr)), "i"(errret), "0"(err), "r"(__USER_DS))
21334
21335
21336 unsigned long __must_check __copy_to_user_ll(void __user *to,
21337diff -urNp linux-2.6.18/include/asm-i386/unwind.h linux-2.6.18/include/asm-i386/unwind.h
21338--- linux-2.6.18/include/asm-i386/unwind.h 2006-09-19 23:42:06.000000000 -0400
21339+++ linux-2.6.18/include/asm-i386/unwind.h 2006-09-22 20:45:04.000000000 -0400
21340@@ -45,7 +45,7 @@ struct unwind_frame_info
21341 static inline void arch_unw_init_frame_info(struct unwind_frame_info *info,
21342 /*const*/ struct pt_regs *regs)
21343 {
21344- if (user_mode_vm(regs))
21345+ if (user_mode(regs))
21346 info->regs = *regs;
21347 else {
21348 memcpy(&info->regs, regs, offsetof(struct pt_regs, esp));
21349@@ -62,8 +62,8 @@ static inline void arch_unw_init_blocked
21350 __get_user(info->regs.ebp, (long *)info->task->thread.esp);
21351 info->regs.esp = info->task->thread.esp;
21352 info->regs.xss = __KERNEL_DS;
21353- info->regs.xds = __USER_DS;
21354- info->regs.xes = __USER_DS;
21355+ info->regs.xds = __KERNEL_DS;
21356+ info->regs.xes = __KERNEL_DS;
21357 }
21358
21359 extern asmlinkage int arch_unwind_init_running(struct unwind_frame_info *,
21360@@ -75,9 +75,9 @@ static inline int arch_unw_user_mode(con
21361 {
21362 #if 0 /* This can only work when selector register and EFLAGS saves/restores
21363 are properly annotated (and tracked in UNW_REGISTER_INFO). */
21364- return user_mode_vm(&info->regs);
21365+ return user_mode(&info->regs);
21366 #else
21367- return info->regs.eip < PAGE_OFFSET
21368+ return (info->regs.eip < PAGE_OFFSET && (info->regs.xcs & 0xFFFF) != __KERNEL_CS)
21369 || (info->regs.eip >= __fix_to_virt(FIX_VDSO)
21370 && info->regs.eip < __fix_to_virt(FIX_VDSO) + PAGE_SIZE)
21371 || info->regs.esp < PAGE_OFFSET;
21372diff -urNp linux-2.6.18/include/asm-ia64/elf.h linux-2.6.18/include/asm-ia64/elf.h
21373--- linux-2.6.18/include/asm-ia64/elf.h 2006-09-19 23:42:06.000000000 -0400
21374+++ linux-2.6.18/include/asm-ia64/elf.h 2006-09-22 20:45:04.000000000 -0400
21375@@ -162,6 +162,16 @@ typedef elf_greg_t elf_gregset_t[ELF_NGR
21376 typedef struct ia64_fpreg elf_fpreg_t;
21377 typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
21378
21379+#ifdef CONFIG_PAX_ASLR
21380+#define PAX_ELF_ET_DYN_BASE(tsk) ((tsk)->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
21381+
21382+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
21383+#define PAX_DELTA_MMAP_LEN(tsk) ((tsk)->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
21384+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
21385+#define PAX_DELTA_EXEC_LEN(tsk) ((tsk)->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
21386+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
21387+#define PAX_DELTA_STACK_LEN(tsk) ((tsk)->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
21388+#endif
21389
21390
21391 struct pt_regs; /* forward declaration... */
21392diff -urNp linux-2.6.18/include/asm-ia64/kmap_types.h linux-2.6.18/include/asm-ia64/kmap_types.h
21393--- linux-2.6.18/include/asm-ia64/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
21394+++ linux-2.6.18/include/asm-ia64/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
21395@@ -22,7 +22,8 @@ D(9) KM_IRQ0,
21396 D(10) KM_IRQ1,
21397 D(11) KM_SOFTIRQ0,
21398 D(12) KM_SOFTIRQ1,
21399-D(13) KM_TYPE_NR
21400+D(13) KM_CLEARPAGE,
21401+D(14) KM_TYPE_NR
21402 };
21403
21404 #undef D
21405diff -urNp linux-2.6.18/include/asm-ia64/page.h linux-2.6.18/include/asm-ia64/page.h
21406--- linux-2.6.18/include/asm-ia64/page.h 2006-09-19 23:42:06.000000000 -0400
21407+++ linux-2.6.18/include/asm-ia64/page.h 2006-09-22 20:45:04.000000000 -0400
21408@@ -227,5 +227,14 @@ get_order (unsigned long size)
21409 (((current->personality & READ_IMPLIES_EXEC) != 0) \
21410 ? VM_EXEC : 0))
21411
21412+#ifdef CONFIG_PAX_PAGEEXEC
21413+#ifdef CONFIG_PAX_MPROTECT
21414+#define __VM_STACK_FLAGS (((current->mm->pax_flags & MF_PAX_MPROTECT)?0:VM_MAYEXEC) | \
21415+ ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
21416+#else
21417+#define __VM_STACK_FLAGS (VM_MAYEXEC | ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
21418+#endif
21419+#endif
21420+
21421 # endif /* __KERNEL__ */
21422 #endif /* _ASM_IA64_PAGE_H */
21423diff -urNp linux-2.6.18/include/asm-ia64/pgtable.h linux-2.6.18/include/asm-ia64/pgtable.h
21424--- linux-2.6.18/include/asm-ia64/pgtable.h 2006-09-19 23:42:06.000000000 -0400
21425+++ linux-2.6.18/include/asm-ia64/pgtable.h 2006-09-22 20:45:04.000000000 -0400
21426@@ -143,6 +143,17 @@
21427 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
21428 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
21429 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
21430+
21431+#ifdef CONFIG_PAX_PAGEEXEC
21432+# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
21433+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
21434+# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
21435+#else
21436+# define PAGE_SHARED_NOEXEC PAGE_SHARED
21437+# define PAGE_READONLY_NOEXEC PAGE_READONLY
21438+# define PAGE_COPY_NOEXEC PAGE_COPY
21439+#endif
21440+
21441 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
21442 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
21443 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
21444diff -urNp linux-2.6.18/include/asm-ia64/processor.h linux-2.6.18/include/asm-ia64/processor.h
21445--- linux-2.6.18/include/asm-ia64/processor.h 2006-09-19 23:42:06.000000000 -0400
21446+++ linux-2.6.18/include/asm-ia64/processor.h 2006-09-22 20:45:04.000000000 -0400
21447@@ -283,7 +283,7 @@ struct thread_struct {
21448 .on_ustack = 0, \
21449 .ksp = 0, \
21450 .map_base = DEFAULT_MAP_BASE, \
21451- .rbs_bot = STACK_TOP - DEFAULT_USER_STACK_SIZE, \
21452+ .rbs_bot = __STACK_TOP - DEFAULT_USER_STACK_SIZE, \
21453 .task_size = DEFAULT_TASK_SIZE, \
21454 .last_fph_cpu = -1, \
21455 INIT_THREAD_IA32 \
21456diff -urNp linux-2.6.18/include/asm-ia64/ustack.h linux-2.6.18/include/asm-ia64/ustack.h
21457--- linux-2.6.18/include/asm-ia64/ustack.h 2006-09-19 23:42:06.000000000 -0400
21458+++ linux-2.6.18/include/asm-ia64/ustack.h 2006-09-22 20:45:04.000000000 -0400
21459@@ -10,10 +10,10 @@
21460
21461 /* The absolute hard limit for stack size is 1/2 of the mappable space in the region */
21462 #define MAX_USER_STACK_SIZE (RGN_MAP_LIMIT/2)
21463-#define STACK_TOP (0x6000000000000000UL + RGN_MAP_LIMIT)
21464+#define __STACK_TOP (0x6000000000000000UL + RGN_MAP_LIMIT)
21465 #endif
21466
21467-/* Make a default stack size of 2GiB */
21468+/* Make a default stack size of 2GB */
21469 #define DEFAULT_USER_STACK_SIZE (1UL << 31)
21470
21471 #endif /* _ASM_IA64_USTACK_H */
21472diff -urNp linux-2.6.18/include/asm-m32r/kmap_types.h linux-2.6.18/include/asm-m32r/kmap_types.h
21473--- linux-2.6.18/include/asm-m32r/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
21474+++ linux-2.6.18/include/asm-m32r/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
21475@@ -24,7 +24,8 @@ D(9) KM_IRQ0,
21476 D(10) KM_IRQ1,
21477 D(11) KM_SOFTIRQ0,
21478 D(12) KM_SOFTIRQ1,
21479-D(13) KM_TYPE_NR
21480+D(13) KM_CLEARPAGE,
21481+D(14) KM_TYPE_NR
21482 };
21483
21484 #undef D
21485diff -urNp linux-2.6.18/include/asm-m68k/kmap_types.h linux-2.6.18/include/asm-m68k/kmap_types.h
21486--- linux-2.6.18/include/asm-m68k/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
21487+++ linux-2.6.18/include/asm-m68k/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
21488@@ -15,6 +15,7 @@ enum km_type {
21489 KM_IRQ1,
21490 KM_SOFTIRQ0,
21491 KM_SOFTIRQ1,
21492+ KM_CLEARPAGE,
21493 KM_TYPE_NR
21494 };
21495
21496diff -urNp linux-2.6.18/include/asm-m68knommu/kmap_types.h linux-2.6.18/include/asm-m68knommu/kmap_types.h
21497--- linux-2.6.18/include/asm-m68knommu/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
21498+++ linux-2.6.18/include/asm-m68knommu/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
21499@@ -15,6 +15,7 @@ enum km_type {
21500 KM_IRQ1,
21501 KM_SOFTIRQ0,
21502 KM_SOFTIRQ1,
21503+ KM_CLEARPAGE,
21504 KM_TYPE_NR
21505 };
21506
21507diff -urNp linux-2.6.18/include/asm-mips/a.out.h linux-2.6.18/include/asm-mips/a.out.h
21508--- linux-2.6.18/include/asm-mips/a.out.h 2006-09-19 23:42:06.000000000 -0400
21509+++ linux-2.6.18/include/asm-mips/a.out.h 2006-09-22 20:45:04.000000000 -0400
21510@@ -35,10 +35,10 @@ struct exec
21511 #ifdef __KERNEL__
21512
21513 #ifdef CONFIG_32BIT
21514-#define STACK_TOP TASK_SIZE
21515+#define __STACK_TOP TASK_SIZE
21516 #endif
21517 #ifdef CONFIG_64BIT
21518-#define STACK_TOP (current->thread.mflags & MF_32BIT_ADDR ? TASK_SIZE32 : TASK_SIZE)
21519+#define __STACK_TOP (current->thread.mflags & MF_32BIT_ADDR ? TASK_SIZE32 : TASK_SIZE)
21520 #endif
21521
21522 #endif
21523diff -urNp linux-2.6.18/include/asm-mips/elf.h linux-2.6.18/include/asm-mips/elf.h
21524--- linux-2.6.18/include/asm-mips/elf.h 2006-09-19 23:42:06.000000000 -0400
21525+++ linux-2.6.18/include/asm-mips/elf.h 2006-09-22 20:45:04.000000000 -0400
21526@@ -371,4 +371,15 @@ extern int dump_task_fpu(struct task_str
21527 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
21528 #endif
21529
21530+#ifdef CONFIG_PAX_ASLR
21531+#define PAX_ELF_ET_DYN_BASE(tsk) (((tsk)->thread.mflags & MF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
21532+
21533+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
21534+#define PAX_DELTA_MMAP_LEN(tsk) (((tsk)->thread.mflags & MF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
21535+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
21536+#define PAX_DELTA_EXEC_LEN(tsk) (((tsk)->thread.mflags & MF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
21537+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
21538+#define PAX_DELTA_STACK_LEN(tsk) (((tsk)->thread.mflags & MF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
21539+#endif
21540+
21541 #endif /* _ASM_ELF_H */
21542diff -urNp linux-2.6.18/include/asm-mips/kmap_types.h linux-2.6.18/include/asm-mips/kmap_types.h
21543--- linux-2.6.18/include/asm-mips/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
21544+++ linux-2.6.18/include/asm-mips/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
21545@@ -22,7 +22,8 @@ D(9) KM_IRQ0,
21546 D(10) KM_IRQ1,
21547 D(11) KM_SOFTIRQ0,
21548 D(12) KM_SOFTIRQ1,
21549-D(13) KM_TYPE_NR
21550+D(13) KM_CLEARPAGE,
21551+D(14) KM_TYPE_NR
21552 };
21553
21554 #undef D
21555diff -urNp linux-2.6.18/include/asm-mips/page.h linux-2.6.18/include/asm-mips/page.h
21556--- linux-2.6.18/include/asm-mips/page.h 2006-09-19 23:42:06.000000000 -0400
21557+++ linux-2.6.18/include/asm-mips/page.h 2006-09-22 20:45:04.000000000 -0400
21558@@ -74,15 +74,17 @@ static inline void copy_user_page(void *
21559 #ifdef CONFIG_CPU_MIPS32
21560 typedef struct { unsigned long pte_low, pte_high; } pte_t;
21561 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
21562+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
21563 #else
21564 typedef struct { unsigned long long pte; } pte_t;
21565 #define pte_val(x) ((x).pte)
21566+ #define __pte(x) ((pte_t) { (x) } )
21567 #endif
21568 #else
21569 typedef struct { unsigned long pte; } pte_t;
21570 #define pte_val(x) ((x).pte)
21571-#endif
21572 #define __pte(x) ((pte_t) { (x) } )
21573+#endif
21574
21575 /*
21576 * For 3-level pagetables we defines these ourselves, for 2-level the
21577@@ -161,6 +163,15 @@ typedef struct { unsigned long pgprot; }
21578 #define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | VM_EXEC | \
21579 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
21580
21581+#ifdef CONFIG_PAX_PAGEEXEC
21582+#ifdef CONFIG_PAX_MPROTECT
21583+#define __VM_STACK_FLAGS (((current->mm->pax_flags & MF_PAX_MPROTECT)?0:VM_MAYEXEC) | \
21584+ ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
21585+#else
21586+#define __VM_STACK_FLAGS (VM_MAYEXEC | ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
21587+#endif
21588+#endif
21589+
21590 #define UNCAC_ADDR(addr) ((addr) - PAGE_OFFSET + UNCAC_BASE)
21591 #define CAC_ADDR(addr) ((addr) - UNCAC_BASE + PAGE_OFFSET)
21592
21593diff -urNp linux-2.6.18/include/asm-parisc/a.out.h linux-2.6.18/include/asm-parisc/a.out.h
21594--- linux-2.6.18/include/asm-parisc/a.out.h 2006-09-19 23:42:06.000000000 -0400
21595+++ linux-2.6.18/include/asm-parisc/a.out.h 2006-09-22 20:45:04.000000000 -0400
21596@@ -22,7 +22,7 @@ struct exec
21597 /* XXX: STACK_TOP actually should be STACK_BOTTOM for parisc.
21598 * prumpf */
21599
21600-#define STACK_TOP TASK_SIZE
21601+#define __STACK_TOP TASK_SIZE
21602
21603 #endif
21604
21605diff -urNp linux-2.6.18/include/asm-parisc/elf.h linux-2.6.18/include/asm-parisc/elf.h
21606--- linux-2.6.18/include/asm-parisc/elf.h 2006-09-19 23:42:06.000000000 -0400
21607+++ linux-2.6.18/include/asm-parisc/elf.h 2006-09-22 20:45:04.000000000 -0400
21608@@ -337,6 +337,17 @@ struct pt_regs; /* forward declaration..
21609
21610 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
21611
21612+#ifdef CONFIG_PAX_ASLR
21613+#define PAX_ELF_ET_DYN_BASE(tsk) 0x10000UL
21614+
21615+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
21616+#define PAX_DELTA_MMAP_LEN(tsk) 16
21617+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
21618+#define PAX_DELTA_EXEC_LEN(tsk) 16
21619+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
21620+#define PAX_DELTA_STACK_LEN(tsk) 16
21621+#endif
21622+
21623 /* This yields a mask that user programs can use to figure out what
21624 instruction set this CPU supports. This could be done in user space,
21625 but it's not easy, and we've already done it here. */
21626diff -urNp linux-2.6.18/include/asm-parisc/kmap_types.h linux-2.6.18/include/asm-parisc/kmap_types.h
21627--- linux-2.6.18/include/asm-parisc/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
21628+++ linux-2.6.18/include/asm-parisc/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
21629@@ -22,7 +22,8 @@ D(9) KM_IRQ0,
21630 D(10) KM_IRQ1,
21631 D(11) KM_SOFTIRQ0,
21632 D(12) KM_SOFTIRQ1,
21633-D(13) KM_TYPE_NR
21634+D(13) KM_CLEARPAGE,
21635+D(14) KM_TYPE_NR
21636 };
21637
21638 #undef D
21639diff -urNp linux-2.6.18/include/asm-parisc/page.h linux-2.6.18/include/asm-parisc/page.h
21640--- linux-2.6.18/include/asm-parisc/page.h 2006-09-19 23:42:06.000000000 -0400
21641+++ linux-2.6.18/include/asm-parisc/page.h 2006-09-22 20:45:04.000000000 -0400
21642@@ -180,6 +180,15 @@ extern int npmem_ranges;
21643 #define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | VM_EXEC | \
21644 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
21645
21646+#ifdef CONFIG_PAX_PAGEEXEC
21647+#ifdef CONFIG_PAX_MPROTECT
21648+#define __VM_STACK_FLAGS (((current->mm->pax_flags & MF_PAX_MPROTECT)?0:VM_MAYEXEC) | \
21649+ ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
21650+#else
21651+#define __VM_STACK_FLAGS (VM_MAYEXEC | ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
21652+#endif
21653+#endif
21654+
21655 #include <asm-generic/memory_model.h>
21656 #include <asm-generic/page.h>
21657
21658diff -urNp linux-2.6.18/include/asm-parisc/pgtable.h linux-2.6.18/include/asm-parisc/pgtable.h
21659--- linux-2.6.18/include/asm-parisc/pgtable.h 2006-09-19 23:42:06.000000000 -0400
21660+++ linux-2.6.18/include/asm-parisc/pgtable.h 2006-09-22 20:45:04.000000000 -0400
21661@@ -219,6 +219,17 @@ extern void *vmalloc_start;
21662 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
21663 #define PAGE_COPY PAGE_EXECREAD
21664 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
21665+
21666+#ifdef CONFIG_PAX_PAGEEXEC
21667+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
21668+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
21669+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
21670+#else
21671+# define PAGE_SHARED_NOEXEC PAGE_SHARED
21672+# define PAGE_COPY_NOEXEC PAGE_COPY
21673+# define PAGE_READONLY_NOEXEC PAGE_READONLY
21674+#endif
21675+
21676 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
21677 #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
21678 #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
21679diff -urNp linux-2.6.18/include/asm-powerpc/a.out.h linux-2.6.18/include/asm-powerpc/a.out.h
21680--- linux-2.6.18/include/asm-powerpc/a.out.h 2006-09-19 23:42:06.000000000 -0400
21681+++ linux-2.6.18/include/asm-powerpc/a.out.h 2006-09-22 20:45:04.000000000 -0400
21682@@ -23,12 +23,12 @@ struct exec
21683 #define STACK_TOP_USER64 TASK_SIZE_USER64
21684 #define STACK_TOP_USER32 TASK_SIZE_USER32
21685
21686-#define STACK_TOP (test_thread_flag(TIF_32BIT) ? \
21687+#define __STACK_TOP (test_thread_flag(TIF_32BIT) ? \
21688 STACK_TOP_USER32 : STACK_TOP_USER64)
21689
21690 #else /* __powerpc64__ */
21691
21692-#define STACK_TOP TASK_SIZE
21693+#define __STACK_TOP TASK_SIZE
21694
21695 #endif /* __powerpc64__ */
21696 #endif /* __KERNEL__ */
21697diff -urNp linux-2.6.18/include/asm-powerpc/elf.h linux-2.6.18/include/asm-powerpc/elf.h
21698--- linux-2.6.18/include/asm-powerpc/elf.h 2006-09-19 23:42:06.000000000 -0400
21699+++ linux-2.6.18/include/asm-powerpc/elf.h 2006-09-22 20:45:04.000000000 -0400
21700@@ -161,6 +161,26 @@ typedef elf_vrreg_t elf_vrregset_t[ELF_N
21701 typedef elf_vrreg_t elf_vrregset_t32[ELF_NVRREG32];
21702 #endif
21703
21704+#ifdef CONFIG_PAX_ASLR
21705+#define PAX_ELF_ET_DYN_BASE(tsk) (0x10000000UL)
21706+
21707+#ifdef __powerpc64__
21708+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
21709+#define PAX_DELTA_MMAP_LEN(tsk) (test_thread_flag(TIF_32BIT) ? 16 : 28)
21710+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
21711+#define PAX_DELTA_EXEC_LEN(tsk) (test_thread_flag(TIF_32BIT) ? 16 : 28)
21712+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
21713+#define PAX_DELTA_STACK_LEN(tsk) (test_thread_flag(TIF_32BIT) ? 16 : 28)
21714+#else
21715+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
21716+#define PAX_DELTA_MMAP_LEN(tsk) 15
21717+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
21718+#define PAX_DELTA_EXEC_LEN(tsk) 15
21719+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
21720+#define PAX_DELTA_STACK_LEN(tsk) 15
21721+#endif
21722+#endif
21723+
21724 #ifdef __KERNEL__
21725 /*
21726 * This is used to ensure we don't load something for the wrong architecture.
21727diff -urNp linux-2.6.18/include/asm-powerpc/kmap_types.h linux-2.6.18/include/asm-powerpc/kmap_types.h
21728--- linux-2.6.18/include/asm-powerpc/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
21729+++ linux-2.6.18/include/asm-powerpc/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
21730@@ -26,6 +26,7 @@ enum km_type {
21731 KM_SOFTIRQ1,
21732 KM_PPC_SYNC_PAGE,
21733 KM_PPC_SYNC_ICACHE,
21734+ KM_CLEARPAGE,
21735 KM_TYPE_NR
21736 };
21737
21738diff -urNp linux-2.6.18/include/asm-powerpc/page_64.h linux-2.6.18/include/asm-powerpc/page_64.h
21739--- linux-2.6.18/include/asm-powerpc/page_64.h 2006-09-19 23:42:06.000000000 -0400
21740+++ linux-2.6.18/include/asm-powerpc/page_64.h 2006-09-22 20:45:04.000000000 -0400
21741@@ -160,15 +160,18 @@ extern unsigned int HPAGE_SHIFT;
21742 * stack by default, so in the absense of a PT_GNU_STACK program header
21743 * we turn execute permission off.
21744 */
21745-#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
21746- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
21747+#define VM_STACK_DEFAULT_FLAGS32 \
21748+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0 ) | \
21749+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
21750
21751 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
21752 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
21753
21754+#ifndef CONFIG_PAX_PAGEEXEC
21755 #define VM_STACK_DEFAULT_FLAGS \
21756 (test_thread_flag(TIF_32BIT) ? \
21757 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
21758+#endif
21759
21760 #include <asm-generic/page.h>
21761
21762diff -urNp linux-2.6.18/include/asm-powerpc/page.h linux-2.6.18/include/asm-powerpc/page.h
21763--- linux-2.6.18/include/asm-powerpc/page.h 2006-09-19 23:42:06.000000000 -0400
21764+++ linux-2.6.18/include/asm-powerpc/page.h 2006-09-22 20:45:04.000000000 -0400
21765@@ -77,8 +77,9 @@
21766 * and needs to be executable. This means the whole heap ends
21767 * up being executable.
21768 */
21769-#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
21770- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
21771+#define VM_DATA_DEFAULT_FLAGS32 \
21772+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0 ) | \
21773+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
21774
21775 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
21776 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
21777@@ -89,6 +90,15 @@
21778 #include <asm/page_32.h>
21779 #endif
21780
21781+#ifdef CONFIG_PAX_PAGEEXEC
21782+#ifdef CONFIG_PAX_MPROTECT
21783+#define __VM_STACK_FLAGS (((current->mm->pax_flags & MF_PAX_MPROTECT)?0:VM_MAYEXEC) | \
21784+ ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
21785+#else
21786+#define __VM_STACK_FLAGS (VM_MAYEXEC | ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
21787+#endif
21788+#endif
21789+
21790 /* align addr on a size boundary - adjust address up/down if needed */
21791 #define _ALIGN_UP(addr,size) (((addr)+((size)-1))&(~((size)-1)))
21792 #define _ALIGN_DOWN(addr,size) ((addr)&(~((size)-1)))
21793diff -urNp linux-2.6.18/include/asm-ppc/page.h linux-2.6.18/include/asm-ppc/page.h
21794--- linux-2.6.18/include/asm-ppc/page.h 2006-09-19 23:42:06.000000000 -0400
21795+++ linux-2.6.18/include/asm-ppc/page.h 2006-09-22 20:45:04.000000000 -0400
21796@@ -173,6 +173,15 @@ extern __inline__ int get_order(unsigned
21797 /* We do define AT_SYSINFO_EHDR but don't use the gate mechanism */
21798 #define __HAVE_ARCH_GATE_AREA 1
21799
21800+#ifdef CONFIG_PAX_PAGEEXEC
21801+#ifdef CONFIG_PAX_MPROTECT
21802+#define __VM_STACK_FLAGS (((current->mm->pax_flags & MF_PAX_MPROTECT)?0:VM_MAYEXEC) | \
21803+ ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
21804+#else
21805+#define __VM_STACK_FLAGS (VM_MAYEXEC | ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
21806+#endif
21807+#endif
21808+
21809 #include <asm-generic/memory_model.h>
21810 #endif /* __KERNEL__ */
21811 #endif /* _PPC_PAGE_H */
21812diff -urNp linux-2.6.18/include/asm-ppc/pgtable.h linux-2.6.18/include/asm-ppc/pgtable.h
21813--- linux-2.6.18/include/asm-ppc/pgtable.h 2006-09-19 23:42:06.000000000 -0400
21814+++ linux-2.6.18/include/asm-ppc/pgtable.h 2006-09-22 20:45:04.000000000 -0400
21815@@ -440,11 +440,21 @@ extern unsigned long ioremap_bot, iorema
21816
21817 #define PAGE_NONE __pgprot(_PAGE_BASE)
21818 #define PAGE_READONLY __pgprot(_PAGE_BASE | _PAGE_USER)
21819-#define PAGE_READONLY_X __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_EXEC)
21820+#define PAGE_READONLY_X __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_EXEC | _PAGE_HWEXEC)
21821 #define PAGE_SHARED __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RW)
21822-#define PAGE_SHARED_X __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RW | _PAGE_EXEC)
21823+#define PAGE_SHARED_X __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RW | _PAGE_EXEC | _PAGE_HWEXEC)
21824 #define PAGE_COPY __pgprot(_PAGE_BASE | _PAGE_USER)
21825-#define PAGE_COPY_X __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_EXEC)
21826+#define PAGE_COPY_X __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_EXEC | _PAGE_HWEXEC)
21827+
21828+#if defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_40x) && !defined(CONFIG_44x)
21829+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RW | _PAGE_GUARDED)
21830+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_GUARDED)
21831+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_GUARDED)
21832+#else
21833+# define PAGE_SHARED_NOEXEC PAGE_SHARED
21834+# define PAGE_COPY_NOEXEC PAGE_COPY
21835+# define PAGE_READONLY_NOEXEC PAGE_READONLY
21836+#endif
21837
21838 #define PAGE_KERNEL __pgprot(_PAGE_RAM)
21839 #define PAGE_KERNEL_NOCACHE __pgprot(_PAGE_IO)
21840@@ -456,21 +466,21 @@ extern unsigned long ioremap_bot, iorema
21841 * This is the closest we can get..
21842 */
21843 #define __P000 PAGE_NONE
21844-#define __P001 PAGE_READONLY_X
21845-#define __P010 PAGE_COPY
21846-#define __P011 PAGE_COPY_X
21847-#define __P100 PAGE_READONLY
21848+#define __P001 PAGE_READONLY_NOEXEC
21849+#define __P010 PAGE_COPY_NOEXEC
21850+#define __P011 PAGE_COPY_NOEXEC
21851+#define __P100 PAGE_READONLY_X
21852 #define __P101 PAGE_READONLY_X
21853-#define __P110 PAGE_COPY
21854+#define __P110 PAGE_COPY_X
21855 #define __P111 PAGE_COPY_X
21856
21857 #define __S000 PAGE_NONE
21858-#define __S001 PAGE_READONLY_X
21859-#define __S010 PAGE_SHARED
21860-#define __S011 PAGE_SHARED_X
21861-#define __S100 PAGE_READONLY
21862+#define __S001 PAGE_READONLY_NOEXEC
21863+#define __S010 PAGE_SHARED_NOEXEC
21864+#define __S011 PAGE_SHARED_NOEXEC
21865+#define __S100 PAGE_READONLY_X
21866 #define __S101 PAGE_READONLY_X
21867-#define __S110 PAGE_SHARED
21868+#define __S110 PAGE_SHARED_X
21869 #define __S111 PAGE_SHARED_X
21870
21871 #ifndef __ASSEMBLY__
21872diff -urNp linux-2.6.18/include/asm-s390/kmap_types.h linux-2.6.18/include/asm-s390/kmap_types.h
21873--- linux-2.6.18/include/asm-s390/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
21874+++ linux-2.6.18/include/asm-s390/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
21875@@ -16,6 +16,7 @@ enum km_type {
21876 KM_IRQ1,
21877 KM_SOFTIRQ0,
21878 KM_SOFTIRQ1,
21879+ KM_CLEARPAGE,
21880 KM_TYPE_NR
21881 };
21882
21883diff -urNp linux-2.6.18/include/asm-sh/kmap_types.h linux-2.6.18/include/asm-sh/kmap_types.h
21884--- linux-2.6.18/include/asm-sh/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
21885+++ linux-2.6.18/include/asm-sh/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
21886@@ -24,7 +24,8 @@ D(9) KM_IRQ0,
21887 D(10) KM_IRQ1,
21888 D(11) KM_SOFTIRQ0,
21889 D(12) KM_SOFTIRQ1,
21890-D(13) KM_TYPE_NR
21891+D(13) KM_CLEARPAGE,
21892+D(14) KM_TYPE_NR
21893 };
21894
21895 #undef D
21896diff -urNp linux-2.6.18/include/asm-sparc/a.out.h linux-2.6.18/include/asm-sparc/a.out.h
21897--- linux-2.6.18/include/asm-sparc/a.out.h 2006-09-19 23:42:06.000000000 -0400
21898+++ linux-2.6.18/include/asm-sparc/a.out.h 2006-09-22 20:45:04.000000000 -0400
21899@@ -91,7 +91,7 @@ struct relocation_info /* used when head
21900
21901 #include <asm/page.h>
21902
21903-#define STACK_TOP (PAGE_OFFSET - PAGE_SIZE)
21904+#define __STACK_TOP (PAGE_OFFSET - PAGE_SIZE)
21905
21906 #endif /* __KERNEL__ */
21907
21908diff -urNp linux-2.6.18/include/asm-sparc/elf.h linux-2.6.18/include/asm-sparc/elf.h
21909--- linux-2.6.18/include/asm-sparc/elf.h 2006-09-19 23:42:06.000000000 -0400
21910+++ linux-2.6.18/include/asm-sparc/elf.h 2006-09-22 20:45:04.000000000 -0400
21911@@ -144,6 +144,17 @@ typedef struct {
21912
21913 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
21914
21915+#ifdef CONFIG_PAX_ASLR
21916+#define PAX_ELF_ET_DYN_BASE(tsk) 0x10000UL
21917+
21918+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
21919+#define PAX_DELTA_MMAP_LEN(tsk) 16
21920+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
21921+#define PAX_DELTA_EXEC_LEN(tsk) 16
21922+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
21923+#define PAX_DELTA_STACK_LEN(tsk) 16
21924+#endif
21925+
21926 /* This yields a mask that user programs can use to figure out what
21927 instruction set this cpu supports. This can NOT be done in userspace
21928 on Sparc. */
21929diff -urNp linux-2.6.18/include/asm-sparc/kmap_types.h linux-2.6.18/include/asm-sparc/kmap_types.h
21930--- linux-2.6.18/include/asm-sparc/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
21931+++ linux-2.6.18/include/asm-sparc/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
21932@@ -15,6 +15,7 @@ enum km_type {
21933 KM_IRQ1,
21934 KM_SOFTIRQ0,
21935 KM_SOFTIRQ1,
21936+ KM_CLEARPAGE,
21937 KM_TYPE_NR
21938 };
21939
21940diff -urNp linux-2.6.18/include/asm-sparc/page.h linux-2.6.18/include/asm-sparc/page.h
21941--- linux-2.6.18/include/asm-sparc/page.h 2006-09-19 23:42:06.000000000 -0400
21942+++ linux-2.6.18/include/asm-sparc/page.h 2006-09-22 20:45:04.000000000 -0400
21943@@ -160,6 +160,15 @@ extern unsigned long pfn_base;
21944 #define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | VM_EXEC | \
21945 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
21946
21947+#ifdef CONFIG_PAX_PAGEEXEC
21948+#ifdef CONFIG_PAX_MPROTECT
21949+#define __VM_STACK_FLAGS (((current->mm->pax_flags & MF_PAX_MPROTECT)?0:VM_MAYEXEC) | \
21950+ ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
21951+#else
21952+#define __VM_STACK_FLAGS (VM_MAYEXEC | ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
21953+#endif
21954+#endif
21955+
21956 #endif /* __KERNEL__ */
21957
21958 #include <asm-generic/memory_model.h>
21959diff -urNp linux-2.6.18/include/asm-sparc/pgtable.h linux-2.6.18/include/asm-sparc/pgtable.h
21960--- linux-2.6.18/include/asm-sparc/pgtable.h 2006-09-19 23:42:06.000000000 -0400
21961+++ linux-2.6.18/include/asm-sparc/pgtable.h 2006-09-22 20:45:04.000000000 -0400
21962@@ -49,6 +49,13 @@ BTFIXUPDEF_INT(page_none)
21963 BTFIXUPDEF_INT(page_shared)
21964 BTFIXUPDEF_INT(page_copy)
21965 BTFIXUPDEF_INT(page_readonly)
21966+
21967+#ifdef CONFIG_PAX_PAGEEXEC
21968+BTFIXUPDEF_INT(page_shared_noexec)
21969+BTFIXUPDEF_INT(page_copy_noexec)
21970+BTFIXUPDEF_INT(page_readonly_noexec)
21971+#endif
21972+
21973 BTFIXUPDEF_INT(page_kernel)
21974
21975 #define PMD_SHIFT SUN4C_PMD_SHIFT
21976@@ -70,6 +77,16 @@ BTFIXUPDEF_INT(page_kernel)
21977 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
21978 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
21979
21980+#ifdef CONFIG_PAX_PAGEEXEC
21981+# define PAGE_SHARED_NOEXEC __pgprot(BTFIXUP_INT(page_shared_noexec))
21982+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
21983+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
21984+#else
21985+# define PAGE_SHARED_NOEXEC PAGE_SHARED
21986+# define PAGE_COPY_NOEXEC PAGE_COPY
21987+# define PAGE_READONLY_NOEXEC PAGE_READONLY
21988+#endif
21989+
21990 extern unsigned long page_kernel;
21991
21992 #ifdef MODULE
21993diff -urNp linux-2.6.18/include/asm-sparc/pgtsrmmu.h linux-2.6.18/include/asm-sparc/pgtsrmmu.h
21994--- linux-2.6.18/include/asm-sparc/pgtsrmmu.h 2006-09-19 23:42:06.000000000 -0400
21995+++ linux-2.6.18/include/asm-sparc/pgtsrmmu.h 2006-09-22 20:45:04.000000000 -0400
21996@@ -115,6 +115,16 @@
21997 SRMMU_EXEC | SRMMU_REF)
21998 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
21999 SRMMU_EXEC | SRMMU_REF)
22000+
22001+#ifdef CONFIG_PAX_PAGEEXEC
22002+#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | \
22003+ SRMMU_WRITE | SRMMU_REF)
22004+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | \
22005+ SRMMU_REF)
22006+#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | \
22007+ SRMMU_REF)
22008+#endif
22009+
22010 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
22011 SRMMU_DIRTY | SRMMU_REF)
22012
22013diff -urNp linux-2.6.18/include/asm-sparc/uaccess.h linux-2.6.18/include/asm-sparc/uaccess.h
22014--- linux-2.6.18/include/asm-sparc/uaccess.h 2006-09-19 23:42:06.000000000 -0400
22015+++ linux-2.6.18/include/asm-sparc/uaccess.h 2006-09-22 20:45:04.000000000 -0400
22016@@ -41,7 +41,7 @@
22017 * No one can read/write anything from userland in the kernel space by setting
22018 * large size and address near to PAGE_OFFSET - a fault will break his intentions.
22019 */
22020-#define __user_ok(addr, size) ({ (void)(size); (addr) < STACK_TOP; })
22021+#define __user_ok(addr, size) ({ (void)(size); (addr) < __STACK_TOP; })
22022 #define __kernel_ok (segment_eq(get_fs(), KERNEL_DS))
22023 #define __access_ok(addr,size) (__user_ok((addr) & get_fs().seg,(size)))
22024 #define access_ok(type, addr, size) \
22025diff -urNp linux-2.6.18/include/asm-sparc64/a.out.h linux-2.6.18/include/asm-sparc64/a.out.h
22026--- linux-2.6.18/include/asm-sparc64/a.out.h 2006-09-19 23:42:06.000000000 -0400
22027+++ linux-2.6.18/include/asm-sparc64/a.out.h 2006-09-22 20:45:04.000000000 -0400
22028@@ -98,7 +98,7 @@ struct relocation_info /* used when head
22029 #define STACK_TOP32 ((1UL << 32UL) - PAGE_SIZE)
22030 #define STACK_TOP64 (0x0000080000000000UL - (1UL << 32UL))
22031
22032-#define STACK_TOP (test_thread_flag(TIF_32BIT) ? \
22033+#define __STACK_TOP (test_thread_flag(TIF_32BIT) ? \
22034 STACK_TOP32 : STACK_TOP64)
22035
22036 #endif
22037diff -urNp linux-2.6.18/include/asm-sparc64/elf.h linux-2.6.18/include/asm-sparc64/elf.h
22038--- linux-2.6.18/include/asm-sparc64/elf.h 2006-09-19 23:42:06.000000000 -0400
22039+++ linux-2.6.18/include/asm-sparc64/elf.h 2006-09-22 20:45:04.000000000 -0400
22040@@ -142,6 +142,16 @@ typedef struct {
22041 #define ELF_ET_DYN_BASE 0x0000010000000000UL
22042 #endif
22043
22044+#ifdef CONFIG_PAX_ASLR
22045+#define PAX_ELF_ET_DYN_BASE(tsk) (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
22046+
22047+#define PAX_DELTA_MMAP_LSB(tsk) (PAGE_SHIFT + 1)
22048+#define PAX_DELTA_MMAP_LEN(tsk) (test_thread_flag(TIF_32BIT) ? 14 : 28 )
22049+#define PAX_DELTA_EXEC_LSB(tsk) (PAGE_SHIFT + 1)
22050+#define PAX_DELTA_EXEC_LEN(tsk) (test_thread_flag(TIF_32BIT) ? 14 : 28 )
22051+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
22052+#define PAX_DELTA_STACK_LEN(tsk) (test_thread_flag(TIF_32BIT) ? 15 : 29 )
22053+#endif
22054
22055 /* This yields a mask that user programs can use to figure out what
22056 instruction set this cpu supports. */
22057diff -urNp linux-2.6.18/include/asm-sparc64/kmap_types.h linux-2.6.18/include/asm-sparc64/kmap_types.h
22058--- linux-2.6.18/include/asm-sparc64/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
22059+++ linux-2.6.18/include/asm-sparc64/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
22060@@ -19,6 +19,7 @@ enum km_type {
22061 KM_IRQ1,
22062 KM_SOFTIRQ0,
22063 KM_SOFTIRQ1,
22064+ KM_CLEARPAGE,
22065 KM_TYPE_NR
22066 };
22067
22068diff -urNp linux-2.6.18/include/asm-sparc64/page.h linux-2.6.18/include/asm-sparc64/page.h
22069--- linux-2.6.18/include/asm-sparc64/page.h 2006-09-19 23:42:06.000000000 -0400
22070+++ linux-2.6.18/include/asm-sparc64/page.h 2006-09-22 20:45:04.000000000 -0400
22071@@ -141,6 +141,15 @@ typedef unsigned long pgprot_t;
22072 #define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | VM_EXEC | \
22073 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
22074
22075+#ifdef CONFIG_PAX_PAGEEXEC
22076+#ifdef CONFIG_PAX_MPROTECT
22077+#define __VM_STACK_FLAGS (((current->mm->pax_flags & MF_PAX_MPROTECT)?0:VM_MAYEXEC) | \
22078+ ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
22079+#else
22080+#define __VM_STACK_FLAGS (VM_MAYEXEC | ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
22081+#endif
22082+#endif
22083+
22084 #endif /* !(__KERNEL__) */
22085
22086 #include <asm-generic/page.h>
22087diff -urNp linux-2.6.18/include/asm-v850/kmap_types.h linux-2.6.18/include/asm-v850/kmap_types.h
22088--- linux-2.6.18/include/asm-v850/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
22089+++ linux-2.6.18/include/asm-v850/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
22090@@ -13,6 +13,7 @@ enum km_type {
22091 KM_PTE1,
22092 KM_IRQ0,
22093 KM_IRQ1,
22094+ KM_CLEARPAGE,
22095 KM_TYPE_NR
22096 };
22097
22098diff -urNp linux-2.6.18/include/asm-x86_64/a.out.h linux-2.6.18/include/asm-x86_64/a.out.h
22099--- linux-2.6.18/include/asm-x86_64/a.out.h 2006-09-19 23:42:06.000000000 -0400
22100+++ linux-2.6.18/include/asm-x86_64/a.out.h 2006-09-22 20:45:04.000000000 -0400
22101@@ -21,7 +21,7 @@ struct exec
22102
22103 #ifdef __KERNEL__
22104 #include <linux/thread_info.h>
22105-#define STACK_TOP TASK_SIZE
22106+#define __STACK_TOP TASK_SIZE
22107 #endif
22108
22109 #endif /* __A_OUT_GNU_H__ */
22110diff -urNp linux-2.6.18/include/asm-x86_64/elf.h linux-2.6.18/include/asm-x86_64/elf.h
22111--- linux-2.6.18/include/asm-x86_64/elf.h 2006-09-19 23:42:06.000000000 -0400
22112+++ linux-2.6.18/include/asm-x86_64/elf.h 2006-09-22 20:45:04.000000000 -0400
22113@@ -93,6 +93,17 @@ typedef struct user_i387_struct elf_fpre
22114
22115 #define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
22116
22117+#ifdef CONFIG_PAX_ASLR
22118+#define PAX_ELF_ET_DYN_BASE(tsk) (test_thread_flag(TIF_IA32) ? 0x08048000UL : 0x400000UL)
22119+
22120+#define PAX_DELTA_MMAP_LSB(tsk) PAGE_SHIFT
22121+#define PAX_DELTA_MMAP_LEN(tsk) (test_thread_flag(TIF_IA32) ? 16 : 32)
22122+#define PAX_DELTA_EXEC_LSB(tsk) PAGE_SHIFT
22123+#define PAX_DELTA_EXEC_LEN(tsk) (test_thread_flag(TIF_IA32) ? 16 : 32)
22124+#define PAX_DELTA_STACK_LSB(tsk) PAGE_SHIFT
22125+#define PAX_DELTA_STACK_LEN(tsk) (test_thread_flag(TIF_IA32) ? 16 : 32)
22126+#endif
22127+
22128 /* regs is struct pt_regs, pr_reg is elf_gregset_t (which is
22129 now struct_user_regs, they are different). Assumes current is the process
22130 getting dumped. */
22131diff -urNp linux-2.6.18/include/asm-x86_64/ia32.h linux-2.6.18/include/asm-x86_64/ia32.h
22132--- linux-2.6.18/include/asm-x86_64/ia32.h 2006-09-19 23:42:06.000000000 -0400
22133+++ linux-2.6.18/include/asm-x86_64/ia32.h 2006-09-22 20:45:04.000000000 -0400
22134@@ -156,7 +156,13 @@ struct ustat32 {
22135 char f_fpack[6];
22136 };
22137
22138-#define IA32_STACK_TOP IA32_PAGE_OFFSET
22139+#ifdef CONFIG_PAX_RANDUSTACK
22140+#define IA32_DELTA_STACK (current->mm->delta_stack)
22141+#else
22142+#define IA32_DELTA_STACK 0UL
22143+#endif
22144+
22145+#define IA32_STACK_TOP (IA32_PAGE_OFFSET - IA32_DELTA_STACK)
22146
22147 #ifdef __KERNEL__
22148 struct user_desc;
22149diff -urNp linux-2.6.18/include/asm-x86_64/kmap_types.h linux-2.6.18/include/asm-x86_64/kmap_types.h
22150--- linux-2.6.18/include/asm-x86_64/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
22151+++ linux-2.6.18/include/asm-x86_64/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
22152@@ -13,6 +13,7 @@ enum km_type {
22153 KM_IRQ1,
22154 KM_SOFTIRQ0,
22155 KM_SOFTIRQ1,
22156+ KM_CLEARPAGE,
22157 KM_TYPE_NR
22158 };
22159
22160diff -urNp linux-2.6.18/include/asm-x86_64/page.h linux-2.6.18/include/asm-x86_64/page.h
22161--- linux-2.6.18/include/asm-x86_64/page.h 2006-09-19 23:42:06.000000000 -0400
22162+++ linux-2.6.18/include/asm-x86_64/page.h 2006-09-22 20:45:04.000000000 -0400
22163@@ -88,6 +88,8 @@ typedef struct { unsigned long pgprot; }
22164 #define __PAGE_OFFSET 0xffff810000000000
22165 #endif /* !__ASSEMBLY__ */
22166
22167+#define __KERNEL_TEXT_OFFSET (0)
22168+
22169 /* to align the pointer to the (next) page boundary */
22170 #define PAGE_ALIGN(addr) (((addr)+PAGE_SIZE-1)&PAGE_MASK)
22171
22172@@ -133,6 +135,15 @@ typedef struct { unsigned long pgprot; }
22173 (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0 ) | \
22174 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
22175
22176+#ifdef CONFIG_PAX_PAGEEXEC
22177+#ifdef CONFIG_PAX_MPROTECT
22178+#define __VM_STACK_FLAGS (((current->mm->pax_flags & MF_PAX_MPROTECT)?0:VM_MAYEXEC) | \
22179+ ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
22180+#else
22181+#define __VM_STACK_FLAGS (VM_MAYEXEC | ((current->mm->pax_flags & MF_PAX_PAGEEXEC)?0:VM_EXEC))
22182+#endif
22183+#endif
22184+
22185 #define __HAVE_ARCH_GATE_AREA 1
22186
22187 #include <asm-generic/memory_model.h>
22188diff -urNp linux-2.6.18/include/asm-x86_64/pci-direct.h linux-2.6.18/include/asm-x86_64/pci-direct.h
22189--- linux-2.6.18/include/asm-x86_64/pci-direct.h 2006-09-19 23:42:06.000000000 -0400
22190+++ linux-2.6.18/include/asm-x86_64/pci-direct.h 2006-09-22 20:45:04.000000000 -0400
22191@@ -7,7 +7,7 @@
22192 /* Direct PCI access. This is used for PCI accesses in early boot before
22193 the PCI subsystem works. */
22194
22195-#define PDprintk(x...)
22196+#define PDprintk(x...) do {} while (0)
22197
22198 static inline u32 read_pci_config(u8 bus, u8 slot, u8 func, u8 offset)
22199 {
22200diff -urNp linux-2.6.18/include/asm-x86_64/pgalloc.h linux-2.6.18/include/asm-x86_64/pgalloc.h
22201--- linux-2.6.18/include/asm-x86_64/pgalloc.h 2006-09-19 23:42:06.000000000 -0400
22202+++ linux-2.6.18/include/asm-x86_64/pgalloc.h 2006-09-22 20:45:04.000000000 -0400
22203@@ -7,7 +7,7 @@
22204 #include <linux/mm.h>
22205
22206 #define pmd_populate_kernel(mm, pmd, pte) \
22207- set_pmd(pmd, __pmd(_PAGE_TABLE | __pa(pte)))
22208+ set_pmd(pmd, __pmd(_KERNPG_TABLE | __pa(pte)))
22209 #define pud_populate(mm, pud, pmd) \
22210 set_pud(pud, __pud(_PAGE_TABLE | __pa(pmd)))
22211 #define pgd_populate(mm, pgd, pud) \
22212diff -urNp linux-2.6.18/include/asm-x86_64/pgtable.h linux-2.6.18/include/asm-x86_64/pgtable.h
22213--- linux-2.6.18/include/asm-x86_64/pgtable.h 2006-09-19 23:42:06.000000000 -0400
22214+++ linux-2.6.18/include/asm-x86_64/pgtable.h 2006-09-22 20:45:04.000000000 -0400
22215@@ -180,6 +180,10 @@ static inline pte_t ptep_get_and_clear_f
22216 #define PAGE_COPY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_ACCESSED)
22217 #define PAGE_READONLY __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_ACCESSED | _PAGE_NX)
22218 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_ACCESSED)
22219+
22220+#define PAGE_READONLY_NOEXEC PAGE_READONLY
22221+#define PAGE_SHARED_NOEXEC PAGE_SHARED
22222+
22223 #define __PAGE_KERNEL \
22224 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_NX)
22225 #define __PAGE_KERNEL_EXEC \
22226@@ -268,7 +272,13 @@ static inline pte_t pfn_pte(unsigned lon
22227 #define __LARGE_PTE (_PAGE_PSE|_PAGE_PRESENT)
22228 static inline int pte_user(pte_t pte) { return pte_val(pte) & _PAGE_USER; }
22229 static inline int pte_read(pte_t pte) { return pte_val(pte) & _PAGE_USER; }
22230-static inline int pte_exec(pte_t pte) { return pte_val(pte) & _PAGE_USER; }
22231+extern inline int pte_exec(pte_t pte)
22232+{
22233+ if (__supported_pte_mask & _PAGE_NX)
22234+ return pte_val(pte) & _PAGE_NX;
22235+ else
22236+ return pte_val(pte) & _PAGE_USER;
22237+}
22238 static inline int pte_dirty(pte_t pte) { return pte_val(pte) & _PAGE_DIRTY; }
22239 static inline int pte_young(pte_t pte) { return pte_val(pte) & _PAGE_ACCESSED; }
22240 static inline int pte_write(pte_t pte) { return pte_val(pte) & _PAGE_RW; }
22241@@ -276,12 +286,26 @@ static inline int pte_file(pte_t pte) {
22242 static inline int pte_huge(pte_t pte) { return pte_val(pte) & _PAGE_PSE; }
22243
22244 static inline pte_t pte_rdprotect(pte_t pte) { set_pte(&pte, __pte(pte_val(pte) & ~_PAGE_USER)); return pte; }
22245-static inline pte_t pte_exprotect(pte_t pte) { set_pte(&pte, __pte(pte_val(pte) & ~_PAGE_USER)); return pte; }
22246+extern inline pte_t pte_exprotect(pte_t pte)
22247+{
22248+ if (__supported_pte_mask & _PAGE_NX)
22249+ set_pte(&pte, __pte(pte_val(pte) & ~_PAGE_NX));
22250+ else
22251+ set_pte(&pte, __pte(pte_val(pte) & ~_PAGE_USER));
22252+ return pte;
22253+}
22254 static inline pte_t pte_mkclean(pte_t pte) { set_pte(&pte, __pte(pte_val(pte) & ~_PAGE_DIRTY)); return pte; }
22255 static inline pte_t pte_mkold(pte_t pte) { set_pte(&pte, __pte(pte_val(pte) & ~_PAGE_ACCESSED)); return pte; }
22256 static inline pte_t pte_wrprotect(pte_t pte) { set_pte(&pte, __pte(pte_val(pte) & ~_PAGE_RW)); return pte; }
22257 static inline pte_t pte_mkread(pte_t pte) { set_pte(&pte, __pte(pte_val(pte) | _PAGE_USER)); return pte; }
22258-static inline pte_t pte_mkexec(pte_t pte) { set_pte(&pte, __pte(pte_val(pte) | _PAGE_USER)); return pte; }
22259+extern inline pte_t pte_mkexec(pte_t pte)
22260+{
22261+ if (__supported_pte_mask & _PAGE_NX)
22262+ set_pte(&pte, __pte(pte_val(pte) | _PAGE_NX));
22263+ else
22264+ set_pte(&pte, __pte(pte_val(pte) | _PAGE_USER));
22265+ return pte;
22266+}
22267 static inline pte_t pte_mkdirty(pte_t pte) { set_pte(&pte, __pte(pte_val(pte) | _PAGE_DIRTY)); return pte; }
22268 static inline pte_t pte_mkyoung(pte_t pte) { set_pte(&pte, __pte(pte_val(pte) | _PAGE_ACCESSED)); return pte; }
22269 static inline pte_t pte_mkwrite(pte_t pte) { set_pte(&pte, __pte(pte_val(pte) | _PAGE_RW)); return pte; }
22270diff -urNp linux-2.6.18/include/asm-x86_64/system.h linux-2.6.18/include/asm-x86_64/system.h
22271--- linux-2.6.18/include/asm-x86_64/system.h 2006-09-19 23:42:06.000000000 -0400
22272+++ linux-2.6.18/include/asm-x86_64/system.h 2006-09-22 20:45:04.000000000 -0400
22273@@ -247,7 +247,7 @@ static inline unsigned long __cmpxchg(vo
22274
22275 void cpu_idle_wait(void);
22276
22277-extern unsigned long arch_align_stack(unsigned long sp);
22278+#define arch_align_stack(x) (x)
22279 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
22280
22281 #endif
22282diff -urNp linux-2.6.18/include/asm-xtensa/kmap_types.h linux-2.6.18/include/asm-xtensa/kmap_types.h
22283--- linux-2.6.18/include/asm-xtensa/kmap_types.h 2006-09-19 23:42:06.000000000 -0400
22284+++ linux-2.6.18/include/asm-xtensa/kmap_types.h 2006-09-22 20:45:04.000000000 -0400
22285@@ -25,6 +25,7 @@ enum km_type {
22286 KM_IRQ1,
22287 KM_SOFTIRQ0,
22288 KM_SOFTIRQ1,
22289+ KM_CLEARPAGE,
22290 KM_TYPE_NR
22291 };
22292
22293diff -urNp linux-2.6.18/include/linux/a.out.h linux-2.6.18/include/linux/a.out.h
22294--- linux-2.6.18/include/linux/a.out.h 2006-09-19 23:42:06.000000000 -0400
22295+++ linux-2.6.18/include/linux/a.out.h 2006-09-22 20:45:04.000000000 -0400
22296@@ -7,6 +7,16 @@
22297
22298 #include <asm/a.out.h>
22299
22300+#ifdef CONFIG_PAX_RANDUSTACK
22301+#define __DELTA_STACK (current->mm->delta_stack)
22302+#else
22303+#define __DELTA_STACK 0UL
22304+#endif
22305+
22306+#ifndef STACK_TOP
22307+#define STACK_TOP (__STACK_TOP - __DELTA_STACK)
22308+#endif
22309+
22310 #endif /* __STRUCT_EXEC_OVERRIDE__ */
22311
22312 /* these go in the N_MACHTYPE field */
22313@@ -37,6 +47,14 @@ enum machine_type {
22314 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
22315 };
22316
22317+/* Constants for the N_FLAGS field */
22318+#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
22319+#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
22320+#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
22321+#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
22322+/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
22323+#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
22324+
22325 #if !defined (N_MAGIC)
22326 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
22327 #endif
22328diff -urNp linux-2.6.18/include/linux/binfmts.h linux-2.6.18/include/linux/binfmts.h
22329--- linux-2.6.18/include/linux/binfmts.h 2006-09-19 23:42:06.000000000 -0400
22330+++ linux-2.6.18/include/linux/binfmts.h 2006-09-22 20:45:04.000000000 -0400
22331@@ -7,10 +7,10 @@ struct pt_regs;
22332
22333 /*
22334 * MAX_ARG_PAGES defines the number of pages allocated for arguments
22335- * and envelope for the new program. 32 should suffice, this gives
22336- * a maximum env+arg of 128kB w/4KB pages!
22337+ * and envelope for the new program. 33 should suffice, this gives
22338+ * a maximum env+arg of 132kB w/4KB pages!
22339 */
22340-#define MAX_ARG_PAGES 32
22341+#define MAX_ARG_PAGES 33
22342
22343 /* sizeof(linux_binprm->buf) */
22344 #define BINPRM_BUF_SIZE 128
22345@@ -38,6 +38,7 @@ struct linux_binprm{
22346 unsigned interp_flags;
22347 unsigned interp_data;
22348 unsigned long loader, exec;
22349+ int misc;
22350 };
22351
22352 #define BINPRM_FLAGS_ENFORCE_NONDUMP_BIT 0
22353@@ -87,5 +88,8 @@ extern void compute_creds(struct linux_b
22354 extern int do_coredump(long signr, int exit_code, struct pt_regs * regs);
22355 extern int set_binfmt(struct linux_binfmt *new);
22356
22357+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
22358+void pax_report_insns(void *pc, void *sp);
22359+
22360 #endif /* __KERNEL__ */
22361 #endif /* _LINUX_BINFMTS_H */
22362diff -urNp linux-2.6.18/include/linux/capability.h linux-2.6.18/include/linux/capability.h
22363--- linux-2.6.18/include/linux/capability.h 2006-09-19 23:42:06.000000000 -0400
22364+++ linux-2.6.18/include/linux/capability.h 2006-09-22 20:04:35.000000000 -0400
22365@@ -358,6 +358,7 @@ static inline kernel_cap_t cap_invert(ke
22366 #define cap_is_fs_cap(c) (CAP_TO_MASK(c) & CAP_FS_MASK)
22367
22368 int capable(int cap);
22369+int capable_nolog(int cap);
22370 int __capable(struct task_struct *t, int cap);
22371
22372 #endif /* __KERNEL__ */
22373diff -urNp linux-2.6.18/include/linux/elf.h linux-2.6.18/include/linux/elf.h
22374--- linux-2.6.18/include/linux/elf.h 2006-09-19 23:42:06.000000000 -0400
22375+++ linux-2.6.18/include/linux/elf.h 2006-09-22 20:45:04.000000000 -0400
22376@@ -6,6 +6,10 @@
22377 #include <linux/elf-em.h>
22378 #include <asm/elf.h>
22379
22380+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22381+#undef elf_read_implies_exec
22382+#endif
22383+
22384 #ifndef elf_read_implies_exec
22385 /* Executables for which elf_read_implies_exec() returns TRUE will
22386 have the READ_IMPLIES_EXEC personality flag set automatically.
22387@@ -47,6 +51,16 @@ typedef __s64 Elf64_Sxword;
22388
22389 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
22390
22391+#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
22392+
22393+/* Constants for the e_flags field */
22394+#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
22395+#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
22396+#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
22397+#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
22398+/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
22399+#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
22400+
22401 /* These constants define the different elf file types */
22402 #define ET_NONE 0
22403 #define ET_REL 1
22404@@ -81,6 +95,8 @@ typedef __s64 Elf64_Sxword;
22405 #define DT_DEBUG 21
22406 #define DT_TEXTREL 22
22407 #define DT_JMPREL 23
22408+#define DT_FLAGS 30
22409+ #define DF_TEXTREL 0x00000004
22410 #define DT_LOPROC 0x70000000
22411 #define DT_HIPROC 0x7fffffff
22412
22413@@ -210,6 +226,19 @@ typedef struct elf64_hdr {
22414 #define PF_W 0x2
22415 #define PF_X 0x1
22416
22417+#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
22418+#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
22419+#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
22420+#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
22421+#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
22422+#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
22423+/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
22424+/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
22425+#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
22426+#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
22427+#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
22428+#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
22429+
22430 typedef struct elf32_phdr{
22431 Elf32_Word p_type;
22432 Elf32_Off p_offset;
22433@@ -302,6 +331,8 @@ typedef struct elf64_shdr {
22434 #define EI_OSABI 7
22435 #define EI_PAD 8
22436
22437+#define EI_PAX 14
22438+
22439 #define ELFMAG0 0x7f /* EI_MAG */
22440 #define ELFMAG1 'E'
22441 #define ELFMAG2 'L'
22442@@ -358,6 +389,7 @@ extern Elf32_Dyn _DYNAMIC [];
22443 #define elfhdr elf32_hdr
22444 #define elf_phdr elf32_phdr
22445 #define elf_note elf32_note
22446+#define elf_dyn Elf32_Dyn
22447
22448 #else
22449
22450@@ -365,6 +397,7 @@ extern Elf64_Dyn _DYNAMIC [];
22451 #define elfhdr elf64_hdr
22452 #define elf_phdr elf64_phdr
22453 #define elf_note elf64_note
22454+#define elf_dyn Elf64_Dyn
22455
22456 #endif
22457
22458diff -urNp linux-2.6.18/include/linux/gracl.h linux-2.6.18/include/linux/gracl.h
22459--- linux-2.6.18/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
22460+++ linux-2.6.18/include/linux/gracl.h 2006-09-22 20:04:35.000000000 -0400
22461@@ -0,0 +1,316 @@
22462+#ifndef GR_ACL_H
22463+#define GR_ACL_H
22464+
22465+#include <linux/grdefs.h>
22466+#include <linux/resource.h>
22467+#include <linux/dcache.h>
22468+#include <asm/resource.h>
22469+
22470+/* Major status information */
22471+
22472+#define GR_VERSION "grsecurity 2.1.9"
22473+#define GRSECURITY_VERSION 0x219
22474+
22475+enum {
22476+
22477+ SHUTDOWN = 0,
22478+ ENABLE = 1,
22479+ SPROLE = 2,
22480+ RELOAD = 3,
22481+ SEGVMOD = 4,
22482+ STATUS = 5,
22483+ UNSPROLE = 6,
22484+ PASSSET = 7,
22485+ SPROLEPAM = 8
22486+};
22487+
22488+/* Password setup definitions
22489+ * kernel/grhash.c */
22490+enum {
22491+ GR_PW_LEN = 128,
22492+ GR_SALT_LEN = 16,
22493+ GR_SHA_LEN = 32,
22494+};
22495+
22496+enum {
22497+ GR_SPROLE_LEN = 64,
22498+};
22499+
22500+#define GR_NLIMITS (RLIMIT_LOCKS + 2)
22501+
22502+/* Begin Data Structures */
22503+
22504+struct sprole_pw {
22505+ unsigned char *rolename;
22506+ unsigned char salt[GR_SALT_LEN];
22507+ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
22508+};
22509+
22510+struct name_entry {
22511+ __u32 key;
22512+ ino_t inode;
22513+ dev_t device;
22514+ char *name;
22515+ __u16 len;
22516+ struct name_entry *prev;
22517+ struct name_entry *next;
22518+};
22519+
22520+struct inodev_entry {
22521+ struct name_entry *nentry;
22522+ struct inodev_entry *prev;
22523+ struct inodev_entry *next;
22524+};
22525+
22526+struct acl_role_db {
22527+ struct acl_role_label **r_hash;
22528+ __u32 r_size;
22529+};
22530+
22531+struct inodev_db {
22532+ struct inodev_entry **i_hash;
22533+ __u32 i_size;
22534+};
22535+
22536+struct name_db {
22537+ struct name_entry **n_hash;
22538+ __u32 n_size;
22539+};
22540+
22541+struct crash_uid {
22542+ uid_t uid;
22543+ unsigned long expires;
22544+};
22545+
22546+struct gr_hash_struct {
22547+ void **table;
22548+ void **nametable;
22549+ void *first;
22550+ __u32 table_size;
22551+ __u32 used_size;
22552+ int type;
22553+};
22554+
22555+/* Userspace Grsecurity ACL data structures */
22556+
22557+struct acl_subject_label {
22558+ char *filename;
22559+ ino_t inode;
22560+ dev_t device;
22561+ __u32 mode;
22562+ __u32 cap_mask;
22563+ __u32 cap_lower;
22564+
22565+ struct rlimit res[GR_NLIMITS];
22566+ __u16 resmask;
22567+
22568+ __u8 user_trans_type;
22569+ __u8 group_trans_type;
22570+ uid_t *user_transitions;
22571+ gid_t *group_transitions;
22572+ __u16 user_trans_num;
22573+ __u16 group_trans_num;
22574+
22575+ __u32 ip_proto[8];
22576+ __u32 ip_type;
22577+ struct acl_ip_label **ips;
22578+ __u32 ip_num;
22579+
22580+ __u32 crashes;
22581+ unsigned long expires;
22582+
22583+ struct acl_subject_label *parent_subject;
22584+ struct gr_hash_struct *hash;
22585+ struct acl_subject_label *prev;
22586+ struct acl_subject_label *next;
22587+
22588+ struct acl_object_label **obj_hash;
22589+ __u32 obj_hash_size;
22590+ __u16 pax_flags;
22591+};
22592+
22593+struct role_allowed_ip {
22594+ __u32 addr;
22595+ __u32 netmask;
22596+
22597+ struct role_allowed_ip *prev;
22598+ struct role_allowed_ip *next;
22599+};
22600+
22601+struct role_transition {
22602+ char *rolename;
22603+
22604+ struct role_transition *prev;
22605+ struct role_transition *next;
22606+};
22607+
22608+struct acl_role_label {
22609+ char *rolename;
22610+ uid_t uidgid;
22611+ __u16 roletype;
22612+
22613+ __u16 auth_attempts;
22614+ unsigned long expires;
22615+
22616+ struct acl_subject_label *root_label;
22617+ struct gr_hash_struct *hash;
22618+
22619+ struct acl_role_label *prev;
22620+ struct acl_role_label *next;
22621+
22622+ struct role_transition *transitions;
22623+ struct role_allowed_ip *allowed_ips;
22624+ uid_t *domain_children;
22625+ __u16 domain_child_num;
22626+
22627+ struct acl_subject_label **subj_hash;
22628+ __u32 subj_hash_size;
22629+};
22630+
22631+struct user_acl_role_db {
22632+ struct acl_role_label **r_table;
22633+ __u32 num_pointers; /* Number of allocations to track */
22634+ __u32 num_roles; /* Number of roles */
22635+ __u32 num_domain_children; /* Number of domain children */
22636+ __u32 num_subjects; /* Number of subjects */
22637+ __u32 num_objects; /* Number of objects */
22638+};
22639+
22640+struct acl_object_label {
22641+ char *filename;
22642+ ino_t inode;
22643+ dev_t device;
22644+ __u32 mode;
22645+
22646+ struct acl_subject_label *nested;
22647+ struct acl_object_label *globbed;
22648+
22649+ /* next two structures not used */
22650+
22651+ struct acl_object_label *prev;
22652+ struct acl_object_label *next;
22653+};
22654+
22655+struct acl_ip_label {
22656+ char *iface;
22657+ __u32 addr;
22658+ __u32 netmask;
22659+ __u16 low, high;
22660+ __u8 mode;
22661+ __u32 type;
22662+ __u32 proto[8];
22663+
22664+ /* next two structures not used */
22665+
22666+ struct acl_ip_label *prev;
22667+ struct acl_ip_label *next;
22668+};
22669+
22670+struct gr_arg {
22671+ struct user_acl_role_db role_db;
22672+ unsigned char pw[GR_PW_LEN];
22673+ unsigned char salt[GR_SALT_LEN];
22674+ unsigned char sum[GR_SHA_LEN];
22675+ unsigned char sp_role[GR_SPROLE_LEN];
22676+ struct sprole_pw *sprole_pws;
22677+ dev_t segv_device;
22678+ ino_t segv_inode;
22679+ uid_t segv_uid;
22680+ __u16 num_sprole_pws;
22681+ __u16 mode;
22682+};
22683+
22684+struct gr_arg_wrapper {
22685+ struct gr_arg *arg;
22686+ __u32 version;
22687+ __u32 size;
22688+};
22689+
22690+struct subject_map {
22691+ struct acl_subject_label *user;
22692+ struct acl_subject_label *kernel;
22693+ struct subject_map *prev;
22694+ struct subject_map *next;
22695+};
22696+
22697+struct acl_subj_map_db {
22698+ struct subject_map **s_hash;
22699+ __u32 s_size;
22700+};
22701+
22702+/* End Data Structures Section */
22703+
22704+/* Hash functions generated by empirical testing by Brad Spengler
22705+ Makes good use of the low bits of the inode. Generally 0-1 times
22706+ in loop for successful match. 0-3 for unsuccessful match.
22707+ Shift/add algorithm with modulus of table size and an XOR*/
22708+
22709+static __inline__ unsigned int
22710+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
22711+{
22712+ return (((uid << type) + (uid ^ type)) % sz);
22713+}
22714+
22715+ static __inline__ unsigned int
22716+shash(const struct acl_subject_label *userp, const unsigned int sz)
22717+{
22718+ return ((const unsigned long)userp % sz);
22719+}
22720+
22721+static __inline__ unsigned int
22722+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
22723+{
22724+ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
22725+}
22726+
22727+static __inline__ unsigned int
22728+nhash(const char *name, const __u16 len, const unsigned int sz)
22729+{
22730+ return full_name_hash(name, len) % sz;
22731+}
22732+
22733+#define FOR_EACH_ROLE_START(role,iter) \
22734+ role = NULL; \
22735+ iter = 0; \
22736+ while (iter < acl_role_set.r_size) { \
22737+ if (role == NULL) \
22738+ role = acl_role_set.r_hash[iter]; \
22739+ if (role == NULL) { \
22740+ iter++; \
22741+ continue; \
22742+ }
22743+
22744+#define FOR_EACH_ROLE_END(role,iter) \
22745+ role = role->next; \
22746+ if (role == NULL) \
22747+ iter++; \
22748+ }
22749+
22750+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
22751+ subj = NULL; \
22752+ iter = 0; \
22753+ while (iter < role->subj_hash_size) { \
22754+ if (subj == NULL) \
22755+ subj = role->subj_hash[iter]; \
22756+ if (subj == NULL) { \
22757+ iter++; \
22758+ continue; \
22759+ }
22760+
22761+#define FOR_EACH_SUBJECT_END(subj,iter) \
22762+ subj = subj->next; \
22763+ if (subj == NULL) \
22764+ iter++; \
22765+ }
22766+
22767+
22768+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
22769+ subj = role->hash->first; \
22770+ while (subj != NULL) {
22771+
22772+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
22773+ subj = subj->next; \
22774+ }
22775+
22776+#endif
22777+
22778diff -urNp linux-2.6.18/include/linux/gralloc.h linux-2.6.18/include/linux/gralloc.h
22779--- linux-2.6.18/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
22780+++ linux-2.6.18/include/linux/gralloc.h 2006-09-22 20:04:35.000000000 -0400
22781@@ -0,0 +1,8 @@
22782+#ifndef __GRALLOC_H
22783+#define __GRALLOC_H
22784+
22785+void acl_free_all(void);
22786+int acl_alloc_stack_init(unsigned long size);
22787+void *acl_alloc(unsigned long len);
22788+
22789+#endif
22790diff -urNp linux-2.6.18/include/linux/grdefs.h linux-2.6.18/include/linux/grdefs.h
22791--- linux-2.6.18/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
22792+++ linux-2.6.18/include/linux/grdefs.h 2006-09-22 20:04:35.000000000 -0400
22793@@ -0,0 +1,131 @@
22794+#ifndef GRDEFS_H
22795+#define GRDEFS_H
22796+
22797+/* Begin grsecurity status declarations */
22798+
22799+enum {
22800+ GR_READY = 0x01,
22801+ GR_STATUS_INIT = 0x00 // disabled state
22802+};
22803+
22804+/* Begin ACL declarations */
22805+
22806+/* Role flags */
22807+
22808+enum {
22809+ GR_ROLE_USER = 0x0001,
22810+ GR_ROLE_GROUP = 0x0002,
22811+ GR_ROLE_DEFAULT = 0x0004,
22812+ GR_ROLE_SPECIAL = 0x0008,
22813+ GR_ROLE_AUTH = 0x0010,
22814+ GR_ROLE_NOPW = 0x0020,
22815+ GR_ROLE_GOD = 0x0040,
22816+ GR_ROLE_LEARN = 0x0080,
22817+ GR_ROLE_TPE = 0x0100,
22818+ GR_ROLE_DOMAIN = 0x0200,
22819+ GR_ROLE_PAM = 0x0400
22820+};
22821+
22822+/* ACL Subject and Object mode flags */
22823+enum {
22824+ GR_DELETED = 0x80000000
22825+};
22826+
22827+/* ACL Object-only mode flags */
22828+enum {
22829+ GR_READ = 0x00000001,
22830+ GR_APPEND = 0x00000002,
22831+ GR_WRITE = 0x00000004,
22832+ GR_EXEC = 0x00000008,
22833+ GR_FIND = 0x00000010,
22834+ GR_INHERIT = 0x00000020,
22835+ GR_SETID = 0x00000040,
22836+ GR_CREATE = 0x00000080,
22837+ GR_DELETE = 0x00000100,
22838+ GR_LINK = 0x00000200,
22839+ GR_AUDIT_READ = 0x00000400,
22840+ GR_AUDIT_APPEND = 0x00000800,
22841+ GR_AUDIT_WRITE = 0x00001000,
22842+ GR_AUDIT_EXEC = 0x00002000,
22843+ GR_AUDIT_FIND = 0x00004000,
22844+ GR_AUDIT_INHERIT= 0x00008000,
22845+ GR_AUDIT_SETID = 0x00010000,
22846+ GR_AUDIT_CREATE = 0x00020000,
22847+ GR_AUDIT_DELETE = 0x00040000,
22848+ GR_AUDIT_LINK = 0x00080000,
22849+ GR_PTRACERD = 0x00100000,
22850+ GR_NOPTRACE = 0x00200000,
22851+ GR_SUPPRESS = 0x00400000,
22852+ GR_NOLEARN = 0x00800000
22853+};
22854+
22855+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
22856+ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
22857+ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
22858+
22859+/* ACL subject-only mode flags */
22860+enum {
22861+ GR_KILL = 0x00000001,
22862+ GR_VIEW = 0x00000002,
22863+ GR_PROTECTED = 0x00000004,
22864+ GR_LEARN = 0x00000008,
22865+ GR_OVERRIDE = 0x00000010,
22866+ /* just a placeholder, this mode is only used in userspace */
22867+ GR_DUMMY = 0x00000020,
22868+ GR_PROTSHM = 0x00000040,
22869+ GR_KILLPROC = 0x00000080,
22870+ GR_KILLIPPROC = 0x00000100,
22871+ /* just a placeholder, this mode is only used in userspace */
22872+ GR_NOTROJAN = 0x00000200,
22873+ GR_PROTPROCFD = 0x00000400,
22874+ GR_PROCACCT = 0x00000800,
22875+ GR_RELAXPTRACE = 0x00001000,
22876+ GR_NESTED = 0x00002000,
22877+ GR_INHERITLEARN = 0x00004000,
22878+ GR_PROCFIND = 0x00008000,
22879+ GR_POVERRIDE = 0x00010000,
22880+ GR_KERNELAUTH = 0x00020000,
22881+};
22882+
22883+enum {
22884+ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
22885+ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
22886+ GR_PAX_ENABLE_MPROTECT = 0x0004,
22887+ GR_PAX_ENABLE_RANDMMAP = 0x0008,
22888+ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
22889+ GR_PAX_DISABLE_SEGMEXEC = 0x8001,
22890+ GR_PAX_DISABLE_PAGEEXEC = 0x8002,
22891+ GR_PAX_DISABLE_MPROTECT = 0x8004,
22892+ GR_PAX_DISABLE_RANDMMAP = 0x8008,
22893+ GR_PAX_DISABLE_EMUTRAMP = 0x8010,
22894+};
22895+
22896+enum {
22897+ GR_ID_USER = 0x01,
22898+ GR_ID_GROUP = 0x02,
22899+};
22900+
22901+enum {
22902+ GR_ID_ALLOW = 0x01,
22903+ GR_ID_DENY = 0x02,
22904+};
22905+
22906+#define GR_CRASH_RES 11
22907+#define GR_UIDTABLE_MAX 500
22908+
22909+/* begin resource learning section */
22910+enum {
22911+ GR_RLIM_CPU_BUMP = 60,
22912+ GR_RLIM_FSIZE_BUMP = 50000,
22913+ GR_RLIM_DATA_BUMP = 10000,
22914+ GR_RLIM_STACK_BUMP = 1000,
22915+ GR_RLIM_CORE_BUMP = 10000,
22916+ GR_RLIM_RSS_BUMP = 500000,
22917+ GR_RLIM_NPROC_BUMP = 1,
22918+ GR_RLIM_NOFILE_BUMP = 5,
22919+ GR_RLIM_MEMLOCK_BUMP = 50000,
22920+ GR_RLIM_AS_BUMP = 500000,
22921+ GR_RLIM_LOCKS_BUMP = 2
22922+};
22923+
22924+#endif
22925diff -urNp linux-2.6.18/include/linux/grinternal.h linux-2.6.18/include/linux/grinternal.h
22926--- linux-2.6.18/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
22927+++ linux-2.6.18/include/linux/grinternal.h 2006-09-22 20:04:35.000000000 -0400
22928@@ -0,0 +1,211 @@
22929+#ifndef __GRINTERNAL_H
22930+#define __GRINTERNAL_H
22931+
22932+#ifdef CONFIG_GRKERNSEC
22933+
22934+#include <linux/fs.h>
22935+#include <linux/gracl.h>
22936+#include <linux/grdefs.h>
22937+#include <linux/grmsg.h>
22938+
22939+extern void gr_add_learn_entry(const char *fmt, ...);
22940+extern __u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
22941+ const struct vfsmount *mnt);
22942+extern __u32 gr_check_create(const struct dentry *new_dentry,
22943+ const struct dentry *parent,
22944+ const struct vfsmount *mnt, const __u32 mode);
22945+extern int gr_check_protected_task(const struct task_struct *task);
22946+extern __u32 to_gr_audit(const __u32 reqmode);
22947+extern int gr_set_acls(const int type);
22948+
22949+extern int gr_acl_is_enabled(void);
22950+extern char gr_roletype_to_char(void);
22951+
22952+extern void gr_handle_alertkill(struct task_struct *task);
22953+extern char *gr_to_filename(const struct dentry *dentry,
22954+ const struct vfsmount *mnt);
22955+extern char *gr_to_filename1(const struct dentry *dentry,
22956+ const struct vfsmount *mnt);
22957+extern char *gr_to_filename2(const struct dentry *dentry,
22958+ const struct vfsmount *mnt);
22959+extern char *gr_to_filename3(const struct dentry *dentry,
22960+ const struct vfsmount *mnt);
22961+
22962+extern int grsec_enable_link;
22963+extern int grsec_enable_fifo;
22964+extern int grsec_enable_execve;
22965+extern int grsec_enable_shm;
22966+extern int grsec_enable_execlog;
22967+extern int grsec_enable_signal;
22968+extern int grsec_enable_forkfail;
22969+extern int grsec_enable_time;
22970+extern int grsec_enable_chroot_shmat;
22971+extern int grsec_enable_chroot_findtask;
22972+extern int grsec_enable_chroot_mount;
22973+extern int grsec_enable_chroot_double;
22974+extern int grsec_enable_chroot_pivot;
22975+extern int grsec_enable_chroot_chdir;
22976+extern int grsec_enable_chroot_chmod;
22977+extern int grsec_enable_chroot_mknod;
22978+extern int grsec_enable_chroot_fchdir;
22979+extern int grsec_enable_chroot_nice;
22980+extern int grsec_enable_chroot_execlog;
22981+extern int grsec_enable_chroot_caps;
22982+extern int grsec_enable_chroot_sysctl;
22983+extern int grsec_enable_chroot_unix;
22984+extern int grsec_enable_tpe;
22985+extern int grsec_tpe_gid;
22986+extern int grsec_enable_tpe_all;
22987+extern int grsec_enable_sidcaps;
22988+extern int grsec_enable_randpid;
22989+extern int grsec_enable_socket_all;
22990+extern int grsec_socket_all_gid;
22991+extern int grsec_enable_socket_client;
22992+extern int grsec_socket_client_gid;
22993+extern int grsec_enable_socket_server;
22994+extern int grsec_socket_server_gid;
22995+extern int grsec_audit_gid;
22996+extern int grsec_enable_group;
22997+extern int grsec_enable_audit_ipc;
22998+extern int grsec_enable_audit_textrel;
22999+extern int grsec_enable_mount;
23000+extern int grsec_enable_chdir;
23001+extern int grsec_resource_logging;
23002+extern int grsec_lock;
23003+
23004+extern struct task_struct *child_reaper;
23005+
23006+extern spinlock_t grsec_alert_lock;
23007+extern unsigned long grsec_alert_wtime;
23008+extern unsigned long grsec_alert_fyet;
23009+
23010+extern spinlock_t grsec_audit_lock;
23011+
23012+extern rwlock_t grsec_exec_file_lock;
23013+
23014+#define gr_task_fullpath(tsk) (tsk->exec_file ? \
23015+ gr_to_filename2(tsk->exec_file->f_dentry, \
23016+ tsk->exec_file->f_vfsmnt) : "/")
23017+
23018+#define gr_parent_task_fullpath(tsk) (tsk->parent->exec_file ? \
23019+ gr_to_filename3(tsk->parent->exec_file->f_dentry, \
23020+ tsk->parent->exec_file->f_vfsmnt) : "/")
23021+
23022+#define gr_task_fullpath0(tsk) (tsk->exec_file ? \
23023+ gr_to_filename(tsk->exec_file->f_dentry, \
23024+ tsk->exec_file->f_vfsmnt) : "/")
23025+
23026+#define gr_parent_task_fullpath0(tsk) (tsk->parent->exec_file ? \
23027+ gr_to_filename1(tsk->parent->exec_file->f_dentry, \
23028+ tsk->parent->exec_file->f_vfsmnt) : "/")
23029+
23030+#define proc_is_chrooted(tsk_a) ((tsk_a->pid > 1) && (tsk_a->fs != NULL) && \
23031+ ((tsk_a->fs->root->d_inode->i_sb->s_dev != \
23032+ child_reaper->fs->root->d_inode->i_sb->s_dev) || \
23033+ (tsk_a->fs->root->d_inode->i_ino != \
23034+ child_reaper->fs->root->d_inode->i_ino)))
23035+
23036+#define have_same_root(tsk_a,tsk_b) ((tsk_a->fs != NULL) && (tsk_b->fs != NULL) && \
23037+ (tsk_a->fs->root->d_inode->i_sb->s_dev == \
23038+ tsk_b->fs->root->d_inode->i_sb->s_dev) && \
23039+ (tsk_a->fs->root->d_inode->i_ino == \
23040+ tsk_b->fs->root->d_inode->i_ino))
23041+
23042+#define DEFAULTSECARGS(task) gr_task_fullpath(task), task->comm, \
23043+ task->pid, task->uid, \
23044+ task->euid, task->gid, task->egid, \
23045+ gr_parent_task_fullpath(task), \
23046+ task->parent->comm, task->parent->pid, \
23047+ task->parent->uid, task->parent->euid, \
23048+ task->parent->gid, task->parent->egid
23049+
23050+#define GR_CHROOT_CAPS ( \
23051+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
23052+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
23053+ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
23054+ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
23055+ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
23056+ CAP_TO_MASK(CAP_IPC_OWNER))
23057+
23058+#define security_learn(normal_msg,args...) \
23059+({ \
23060+ read_lock(&grsec_exec_file_lock); \
23061+ gr_add_learn_entry(normal_msg "\n", ## args); \
23062+ read_unlock(&grsec_exec_file_lock); \
23063+})
23064+
23065+enum {
23066+ GR_DO_AUDIT,
23067+ GR_DONT_AUDIT,
23068+ GR_DONT_AUDIT_GOOD
23069+};
23070+
23071+enum {
23072+ GR_TTYSNIFF,
23073+ GR_RBAC,
23074+ GR_RBAC_STR,
23075+ GR_STR_RBAC,
23076+ GR_RBAC_MODE2,
23077+ GR_RBAC_MODE3,
23078+ GR_FILENAME,
23079+ GR_NOARGS,
23080+ GR_ONE_INT,
23081+ GR_ONE_INT_TWO_STR,
23082+ GR_ONE_STR,
23083+ GR_STR_INT,
23084+ GR_TWO_INT,
23085+ GR_THREE_INT,
23086+ GR_FIVE_INT_TWO_STR,
23087+ GR_TWO_STR,
23088+ GR_THREE_STR,
23089+ GR_FOUR_STR,
23090+ GR_STR_FILENAME,
23091+ GR_FILENAME_STR,
23092+ GR_FILENAME_TWO_INT,
23093+ GR_FILENAME_TWO_INT_STR,
23094+ GR_TEXTREL,
23095+ GR_PTRACE,
23096+ GR_RESOURCE,
23097+ GR_CAP,
23098+ GR_SIG,
23099+ GR_CRASH1,
23100+ GR_CRASH2,
23101+ GR_PSACCT
23102+};
23103+
23104+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
23105+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
23106+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
23107+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
23108+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
23109+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
23110+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
23111+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
23112+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
23113+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
23114+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
23115+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
23116+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
23117+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
23118+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
23119+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
23120+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
23121+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
23122+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
23123+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
23124+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
23125+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
23126+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
23127+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
23128+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
23129+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
23130+#define gr_log_sig(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG, task, num)
23131+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
23132+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
23133+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
23134+
23135+extern void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
23136+
23137+#endif
23138+
23139+#endif
23140diff -urNp linux-2.6.18/include/linux/grmsg.h linux-2.6.18/include/linux/grmsg.h
23141--- linux-2.6.18/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
23142+++ linux-2.6.18/include/linux/grmsg.h 2006-09-22 20:04:35.000000000 -0400
23143@@ -0,0 +1,108 @@
23144+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
23145+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%u.%u.%u.%u TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%u.%u.%u.%u TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
23146+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
23147+#define GR_STOPMOD_MSG "denied modification of module state by "
23148+#define GR_IOPERM_MSG "denied use of ioperm() by "
23149+#define GR_IOPL_MSG "denied use of iopl() by "
23150+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
23151+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
23152+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
23153+#define GR_KMEM_MSG "denied write of /dev/kmem by "
23154+#define GR_PORT_OPEN_MSG "denied open of /dev/port by "
23155+#define GR_MEM_WRITE_MSG "denied write of /dev/mem by "
23156+#define GR_MEM_MMAP_MSG "denied mmap write of /dev/[k]mem by "
23157+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
23158+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%u.%u.%u.%u"
23159+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%u.%u.%u.%u"
23160+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
23161+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
23162+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
23163+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
23164+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
23165+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
23166+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
23167+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%u.%u.%u.%u %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
23168+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
23169+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
23170+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
23171+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
23172+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
23173+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
23174+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
23175+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
23176+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
23177+#define GR_NPROC_MSG "denied overstep of process limit by "
23178+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
23179+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
23180+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
23181+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
23182+#define GR_MOUNT_CHROOT_MSG "denied mount of %.30s as %.930s from chroot by "
23183+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
23184+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
23185+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
23186+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
23187+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
23188+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
23189+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
23190+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
23191+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
23192+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
23193+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
23194+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
23195+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
23196+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
23197+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
23198+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
23199+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
23200+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
23201+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
23202+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
23203+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
23204+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
23205+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
23206+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
23207+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
23208+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
23209+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
23210+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
23211+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
23212+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
23213+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
23214+#define GR_UNSPROLEF_ACL_MSG "special role unauth of %s failure for "
23215+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
23216+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
23217+#define GR_FAILFORK_MSG "failed fork with errno %d by "
23218+#define GR_NICE_CHROOT_MSG "denied priority change by "
23219+#define GR_UNISIGLOG_MSG "signal %d sent to "
23220+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
23221+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
23222+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
23223+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
23224+#define GR_TIME_MSG "time set by "
23225+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
23226+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
23227+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
23228+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
23229+#define GR_SOCK2_MSG "denied socket(%d,%.16s,%.16s) by "
23230+#define GR_BIND_MSG "denied bind() by "
23231+#define GR_CONNECT_MSG "denied connect() by "
23232+#define GR_BIND_ACL_MSG "denied bind() to %u.%u.%u.%u port %u sock type %.16s protocol %.16s by "
23233+#define GR_CONNECT_ACL_MSG "denied connect() to %u.%u.%u.%u port %u sock type %.16s protocol %.16s by "
23234+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%u.%u.%u.%u\t%u\t%u\t%u\t%u\t%u.%u.%u.%u"
23235+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
23236+#define GR_CAP_ACL_MSG "use of %s denied for "
23237+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
23238+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
23239+#define GR_REMOUNT_AUDIT_MSG "remount of %.30s by "
23240+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.30s by "
23241+#define GR_MOUNT_AUDIT_MSG "mount of %.30s to %.64s by "
23242+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
23243+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
23244+#define GR_MSGQ_AUDIT_MSG "message queue created by "
23245+#define GR_MSGQR_AUDIT_MSG "message queue of uid:%u euid:%u removed by "
23246+#define GR_SEM_AUDIT_MSG "semaphore created by "
23247+#define GR_SEMR_AUDIT_MSG "semaphore of uid:%u euid:%u removed by "
23248+#define GR_SHM_AUDIT_MSG "shared memory of size %d created by "
23249+#define GR_SHMR_AUDIT_MSG "shared memory of uid:%u euid:%u removed by "
23250+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
23251+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
23252diff -urNp linux-2.6.18/include/linux/grsecurity.h linux-2.6.18/include/linux/grsecurity.h
23253--- linux-2.6.18/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
23254+++ linux-2.6.18/include/linux/grsecurity.h 2006-09-22 20:04:35.000000000 -0400
23255@@ -0,0 +1,196 @@
23256+#ifndef GR_SECURITY_H
23257+#define GR_SECURITY_H
23258+#include <linux/fs.h>
23259+#include <linux/binfmts.h>
23260+#include <linux/gracl.h>
23261+
23262+extern void gr_handle_brute_attach(struct task_struct *p);
23263+extern void gr_handle_brute_check(void);
23264+
23265+extern char gr_roletype_to_char(void);
23266+
23267+extern int gr_check_user_change(int real, int effective, int fs);
23268+extern int gr_check_group_change(int real, int effective, int fs);
23269+
23270+extern void gr_del_task_from_ip_table(struct task_struct *p);
23271+
23272+extern int gr_pid_is_chrooted(struct task_struct *p);
23273+extern int gr_handle_chroot_nice(void);
23274+extern int gr_handle_chroot_sysctl(const int op);
23275+extern int gr_handle_chroot_setpriority(struct task_struct *p,
23276+ const int niceval);
23277+extern int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
23278+extern int gr_handle_chroot_chroot(const struct dentry *dentry,
23279+ const struct vfsmount *mnt);
23280+extern void gr_handle_chroot_caps(struct task_struct *task);
23281+extern void gr_handle_chroot_chdir(struct dentry *dentry, struct vfsmount *mnt);
23282+extern int gr_handle_chroot_chmod(const struct dentry *dentry,
23283+ const struct vfsmount *mnt, const int mode);
23284+extern int gr_handle_chroot_mknod(const struct dentry *dentry,
23285+ const struct vfsmount *mnt, const int mode);
23286+extern int gr_handle_chroot_mount(const struct dentry *dentry,
23287+ const struct vfsmount *mnt,
23288+ const char *dev_name);
23289+extern int gr_handle_chroot_pivot(void);
23290+extern int gr_handle_chroot_unix(const pid_t pid);
23291+
23292+extern int gr_handle_rawio(const struct inode *inode);
23293+extern int gr_handle_nproc(void);
23294+
23295+extern void gr_handle_ioperm(void);
23296+extern void gr_handle_iopl(void);
23297+
23298+extern int gr_tpe_allow(const struct file *file);
23299+
23300+extern int gr_random_pid(void);
23301+
23302+extern void gr_log_forkfail(const int retval);
23303+extern void gr_log_timechange(void);
23304+extern void gr_log_signal(const int sig, const struct task_struct *t);
23305+extern void gr_log_chdir(const struct dentry *dentry,
23306+ const struct vfsmount *mnt);
23307+extern void gr_log_chroot_exec(const struct dentry *dentry,
23308+ const struct vfsmount *mnt);
23309+extern void gr_handle_exec_args(struct linux_binprm *bprm, char **argv);
23310+extern void gr_log_remount(const char *devname, const int retval);
23311+extern void gr_log_unmount(const char *devname, const int retval);
23312+extern void gr_log_mount(const char *from, const char *to, const int retval);
23313+extern void gr_log_msgget(const int ret, const int msgflg);
23314+extern void gr_log_msgrm(const uid_t uid, const uid_t cuid);
23315+extern void gr_log_semget(const int err, const int semflg);
23316+extern void gr_log_semrm(const uid_t uid, const uid_t cuid);
23317+extern void gr_log_shmget(const int err, const int shmflg, const size_t size);
23318+extern void gr_log_shmrm(const uid_t uid, const uid_t cuid);
23319+extern void gr_log_textrel(struct vm_area_struct *vma);
23320+
23321+extern int gr_handle_follow_link(const struct inode *parent,
23322+ const struct inode *inode,
23323+ const struct dentry *dentry,
23324+ const struct vfsmount *mnt);
23325+extern int gr_handle_fifo(const struct dentry *dentry,
23326+ const struct vfsmount *mnt,
23327+ const struct dentry *dir, const int flag,
23328+ const int acc_mode);
23329+extern int gr_handle_hardlink(const struct dentry *dentry,
23330+ const struct vfsmount *mnt,
23331+ struct inode *inode,
23332+ const int mode, const char *to);
23333+
23334+extern int gr_task_is_capable(struct task_struct *task, const int cap);
23335+extern int gr_is_capable_nolog(const int cap);
23336+extern void gr_learn_resource(const struct task_struct *task, const int limit,
23337+ const unsigned long wanted, const int gt);
23338+extern void gr_copy_label(struct task_struct *tsk);
23339+extern void gr_handle_crash(struct task_struct *task, const int sig);
23340+extern int gr_handle_signal(const struct task_struct *p, const int sig);
23341+extern int gr_check_crash_uid(const uid_t uid);
23342+extern int gr_check_protected_task(const struct task_struct *task);
23343+extern int gr_acl_handle_mmap(const struct file *file,
23344+ const unsigned long prot);
23345+extern int gr_acl_handle_mprotect(const struct file *file,
23346+ const unsigned long prot);
23347+extern int gr_check_hidden_task(const struct task_struct *tsk);
23348+extern __u32 gr_acl_handle_truncate(const struct dentry *dentry,
23349+ const struct vfsmount *mnt);
23350+extern __u32 gr_acl_handle_utime(const struct dentry *dentry,
23351+ const struct vfsmount *mnt);
23352+extern __u32 gr_acl_handle_access(const struct dentry *dentry,
23353+ const struct vfsmount *mnt, const int fmode);
23354+extern __u32 gr_acl_handle_fchmod(const struct dentry *dentry,
23355+ const struct vfsmount *mnt, mode_t mode);
23356+extern __u32 gr_acl_handle_chmod(const struct dentry *dentry,
23357+ const struct vfsmount *mnt, mode_t mode);
23358+extern __u32 gr_acl_handle_chown(const struct dentry *dentry,
23359+ const struct vfsmount *mnt);
23360+extern int gr_handle_ptrace(struct task_struct *task, const long request);
23361+extern int gr_handle_proc_ptrace(struct task_struct *task);
23362+extern __u32 gr_acl_handle_execve(const struct dentry *dentry,
23363+ const struct vfsmount *mnt);
23364+extern int gr_check_crash_exec(const struct file *filp);
23365+extern int gr_acl_is_enabled(void);
23366+extern void gr_set_kernel_label(struct task_struct *task);
23367+extern void gr_set_role_label(struct task_struct *task, const uid_t uid,
23368+ const gid_t gid);
23369+extern int gr_set_proc_label(const struct dentry *dentry,
23370+ const struct vfsmount *mnt);
23371+extern __u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
23372+ const struct vfsmount *mnt);
23373+extern __u32 gr_acl_handle_open(const struct dentry *dentry,
23374+ const struct vfsmount *mnt, const int fmode);
23375+extern __u32 gr_acl_handle_creat(const struct dentry *dentry,
23376+ const struct dentry *p_dentry,
23377+ const struct vfsmount *p_mnt, const int fmode,
23378+ const int imode);
23379+extern void gr_handle_create(const struct dentry *dentry,
23380+ const struct vfsmount *mnt);
23381+extern __u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
23382+ const struct dentry *parent_dentry,
23383+ const struct vfsmount *parent_mnt,
23384+ const int mode);
23385+extern __u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
23386+ const struct dentry *parent_dentry,
23387+ const struct vfsmount *parent_mnt);
23388+extern __u32 gr_acl_handle_rmdir(const struct dentry *dentry,
23389+ const struct vfsmount *mnt);
23390+extern void gr_handle_delete(const ino_t ino, const dev_t dev);
23391+extern __u32 gr_acl_handle_unlink(const struct dentry *dentry,
23392+ const struct vfsmount *mnt);
23393+extern __u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
23394+ const struct dentry *parent_dentry,
23395+ const struct vfsmount *parent_mnt,
23396+ const char *from);
23397+extern __u32 gr_acl_handle_link(const struct dentry *new_dentry,
23398+ const struct dentry *parent_dentry,
23399+ const struct vfsmount *parent_mnt,
23400+ const struct dentry *old_dentry,
23401+ const struct vfsmount *old_mnt, const char *to);
23402+extern int gr_acl_handle_rename(struct dentry *new_dentry,
23403+ struct dentry *parent_dentry,
23404+ const struct vfsmount *parent_mnt,
23405+ struct dentry *old_dentry,
23406+ struct inode *old_parent_inode,
23407+ struct vfsmount *old_mnt, const char *newname);
23408+extern void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
23409+ struct dentry *old_dentry,
23410+ struct dentry *new_dentry,
23411+ struct vfsmount *mnt, const __u8 replace);
23412+extern __u32 gr_check_link(const struct dentry *new_dentry,
23413+ const struct dentry *parent_dentry,
23414+ const struct vfsmount *parent_mnt,
23415+ const struct dentry *old_dentry,
23416+ const struct vfsmount *old_mnt);
23417+extern int gr_acl_handle_filldir(const struct file *file, const char *name,
23418+ const unsigned int namelen, const ino_t ino);
23419+
23420+extern __u32 gr_acl_handle_unix(const struct dentry *dentry,
23421+ const struct vfsmount *mnt);
23422+extern void gr_acl_handle_exit(void);
23423+extern void gr_acl_handle_psacct(struct task_struct *task, const long code);
23424+extern int gr_acl_handle_procpidmem(const struct task_struct *task);
23425+extern __u32 gr_cap_rtnetlink(void);
23426+
23427+#ifdef CONFIG_SYSVIPC
23428+extern void gr_shm_exit(struct task_struct *task);
23429+#else
23430+static inline void gr_shm_exit(struct task_struct *task)
23431+{
23432+ return;
23433+}
23434+#endif
23435+
23436+#ifdef CONFIG_GRKERNSEC
23437+extern void gr_handle_mem_write(void);
23438+extern void gr_handle_kmem_write(void);
23439+extern void gr_handle_open_port(void);
23440+extern int gr_handle_mem_mmap(const unsigned long offset,
23441+ struct vm_area_struct *vma);
23442+
23443+extern unsigned long pax_get_random_long(void);
23444+#define get_random_long() pax_get_random_long()
23445+
23446+extern int grsec_enable_dmesg;
23447+extern int grsec_enable_randsrc;
23448+extern int grsec_enable_shm;
23449+#endif
23450+
23451+#endif
23452diff -urNp linux-2.6.18/include/linux/highmem.h linux-2.6.18/include/linux/highmem.h
23453--- linux-2.6.18/include/linux/highmem.h 2006-09-19 23:42:06.000000000 -0400
23454+++ linux-2.6.18/include/linux/highmem.h 2006-09-22 20:45:04.000000000 -0400
23455@@ -69,9 +69,9 @@ alloc_zeroed_user_highpage(struct vm_are
23456
23457 static inline void clear_highpage(struct page *page)
23458 {
23459- void *kaddr = kmap_atomic(page, KM_USER0);
23460+ void *kaddr = kmap_atomic(page, KM_CLEARPAGE);
23461 clear_page(kaddr);
23462- kunmap_atomic(kaddr, KM_USER0);
23463+ kunmap_atomic(kaddr, KM_CLEARPAGE);
23464 }
23465
23466 /*
23467diff -urNp linux-2.6.18/include/linux/jbd.h linux-2.6.18/include/linux/jbd.h
23468--- linux-2.6.18/include/linux/jbd.h 2006-09-19 23:42:06.000000000 -0400
23469+++ linux-2.6.18/include/linux/jbd.h 2006-09-22 20:45:04.000000000 -0400
23470@@ -68,7 +68,7 @@ extern int journal_enable_debug;
23471 } \
23472 } while (0)
23473 #else
23474-#define jbd_debug(f, a...) /**/
23475+#define jbd_debug(f, a...) do {} while (0)
23476 #endif
23477
23478 extern void * __jbd_kmalloc (const char *where, size_t size, gfp_t flags, int retry);
23479diff -urNp linux-2.6.18/include/linux/mman.h linux-2.6.18/include/linux/mman.h
23480--- linux-2.6.18/include/linux/mman.h 2006-09-19 23:42:06.000000000 -0400
23481+++ linux-2.6.18/include/linux/mman.h 2006-09-22 20:45:04.000000000 -0400
23482@@ -61,6 +61,11 @@ static inline unsigned long
23483 calc_vm_flag_bits(unsigned long flags)
23484 {
23485 return _calc_vm_trans(flags, MAP_GROWSDOWN, VM_GROWSDOWN ) |
23486+
23487+#ifdef CONFIG_PAX_SEGMEXEC
23488+ _calc_vm_trans(flags, MAP_MIRROR, VM_MIRROR) |
23489+#endif
23490+
23491 _calc_vm_trans(flags, MAP_DENYWRITE, VM_DENYWRITE ) |
23492 _calc_vm_trans(flags, MAP_EXECUTABLE, VM_EXECUTABLE) |
23493 _calc_vm_trans(flags, MAP_LOCKED, VM_LOCKED );
23494diff -urNp linux-2.6.18/include/linux/mm.h linux-2.6.18/include/linux/mm.h
23495--- linux-2.6.18/include/linux/mm.h 2006-09-19 23:42:06.000000000 -0400
23496+++ linux-2.6.18/include/linux/mm.h 2006-09-22 20:45:04.000000000 -0400
23497@@ -37,6 +37,7 @@ extern int sysctl_legacy_va_layout;
23498 #include <asm/page.h>
23499 #include <asm/pgtable.h>
23500 #include <asm/processor.h>
23501+#include <asm/mman.h>
23502
23503 #define nth_page(page,n) pfn_to_page(page_to_pfn((page)) + (n))
23504
23505@@ -110,8 +111,43 @@ struct vm_area_struct {
23506 #ifdef CONFIG_NUMA
23507 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
23508 #endif
23509+
23510+ unsigned long vm_mirror; /* PaX: mirror distance */
23511 };
23512
23513+#ifdef CONFIG_PAX_SOFTMODE
23514+extern unsigned int pax_softmode;
23515+#endif
23516+
23517+extern int pax_check_flags(unsigned long *);
23518+
23519+/* if tsk != current then task_lock must be held on it */
23520+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
23521+static inline unsigned long pax_get_flags(struct task_struct *tsk)
23522+{
23523+ if (likely(tsk->mm))
23524+ return tsk->mm->pax_flags;
23525+ else
23526+ return 0UL;
23527+}
23528+
23529+/* if tsk != current then task_lock must be held on it */
23530+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
23531+{
23532+ if (likely(tsk->mm)) {
23533+ tsk->mm->pax_flags = flags;
23534+ return 0;
23535+ }
23536+ return -EINVAL;
23537+}
23538+#endif
23539+
23540+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
23541+extern void pax_set_initial_flags(struct linux_binprm * bprm);
23542+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
23543+extern void (*pax_set_initial_flags_func)(struct linux_binprm * bprm);
23544+#endif
23545+
23546 /*
23547 * This struct defines the per-mm list of VMAs for uClinux. If CONFIG_MMU is
23548 * disabled, then there's a single shared list of VMAs maintained by the
23549@@ -165,6 +201,18 @@ extern unsigned int kobjsize(const void
23550 #define VM_MAPPED_COPY 0x01000000 /* T if mapped copy of data (nommu mmap) */
23551 #define VM_INSERTPAGE 0x02000000 /* The vma has had "vm_insert_page()" done on it */
23552
23553+#ifdef CONFIG_PAX_SEGMEXEC
23554+#define VM_MIRROR 0x04000000 /* vma is mirroring another */
23555+#endif
23556+
23557+#ifdef CONFIG_PAX_MPROTECT
23558+#define VM_MAYNOTWRITE 0x08000000 /* vma cannot be granted VM_WRITE any more */
23559+#endif
23560+
23561+#ifdef __VM_STACK_FLAGS
23562+#define VM_STACK_DEFAULT_FLAGS (0x00000033 | __VM_STACK_FLAGS)
23563+#endif
23564+
23565 #ifndef VM_STACK_DEFAULT_FLAGS /* arch can override this */
23566 #define VM_STACK_DEFAULT_FLAGS VM_DATA_DEFAULT_FLAGS
23567 #endif
23568@@ -1073,5 +1121,11 @@ extern int randomize_va_space;
23569
23570 const char *arch_vma_name(struct vm_area_struct *vma);
23571
23572+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
23573+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
23574+#else
23575+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
23576+#endif
23577+
23578 #endif /* __KERNEL__ */
23579 #endif /* _LINUX_MM_H */
23580diff -urNp linux-2.6.18/include/linux/module.h linux-2.6.18/include/linux/module.h
23581--- linux-2.6.18/include/linux/module.h 2006-09-19 23:42:06.000000000 -0400
23582+++ linux-2.6.18/include/linux/module.h 2006-09-22 20:45:04.000000000 -0400
23583@@ -292,16 +292,16 @@ struct module
23584 int (*init)(void);
23585
23586 /* If this is non-NULL, vfree after init() returns */
23587- void *module_init;
23588+ void *module_init_rx, *module_init_rw;
23589
23590 /* Here is the actual code + data, vfree'd on unload. */
23591- void *module_core;
23592+ void *module_core_rx, *module_core_rw;
23593
23594 /* Here are the sizes of the init and core sections */
23595- unsigned long init_size, core_size;
23596+ unsigned long init_size_rw, core_size_rw;
23597
23598 /* The size of the executable code in each section. */
23599- unsigned long init_text_size, core_text_size;
23600+ unsigned long init_size_rx, core_size_rx;
23601
23602 /* The handle returned from unwind_add_table. */
23603 void *unwind_info;
23604diff -urNp linux-2.6.18/include/linux/moduleloader.h linux-2.6.18/include/linux/moduleloader.h
23605--- linux-2.6.18/include/linux/moduleloader.h 2006-09-19 23:42:06.000000000 -0400
23606+++ linux-2.6.18/include/linux/moduleloader.h 2006-09-22 20:45:04.000000000 -0400
23607@@ -17,9 +17,21 @@ int module_frob_arch_sections(Elf_Ehdr *
23608 sections. Returns NULL on failure. */
23609 void *module_alloc(unsigned long size);
23610
23611+#ifdef CONFIG_PAX_KERNEXEC
23612+void *module_alloc_exec(unsigned long size);
23613+#else
23614+#define module_alloc_exec(x) module_alloc(x)
23615+#endif
23616+
23617 /* Free memory returned from module_alloc. */
23618 void module_free(struct module *mod, void *module_region);
23619
23620+#ifdef CONFIG_PAX_KERNEXEC
23621+void module_free_exec(struct module *mod, void *module_region);
23622+#else
23623+#define module_free_exec(x, y) module_free(x, y)
23624+#endif
23625+
23626 /* Apply the given relocation to the (simplified) ELF. Return -error
23627 or 0. */
23628 int apply_relocate(Elf_Shdr *sechdrs,
23629diff -urNp linux-2.6.18/include/linux/random.h linux-2.6.18/include/linux/random.h
23630--- linux-2.6.18/include/linux/random.h 2006-09-19 23:42:06.000000000 -0400
23631+++ linux-2.6.18/include/linux/random.h 2006-09-22 20:45:04.000000000 -0400
23632@@ -62,6 +62,8 @@ extern __u32 secure_tcpv6_sequence_numbe
23633 extern u64 secure_dccp_sequence_number(__u32 saddr, __u32 daddr,
23634 __u16 sport, __u16 dport);
23635
23636+extern unsigned long pax_get_random_long(void);
23637+
23638 #ifndef MODULE
23639 extern struct file_operations random_fops, urandom_fops;
23640 #endif
23641diff -urNp linux-2.6.18/include/linux/sched.h linux-2.6.18/include/linux/sched.h
23642--- linux-2.6.18/include/linux/sched.h 2006-09-19 23:42:06.000000000 -0400
23643+++ linux-2.6.18/include/linux/sched.h 2006-09-22 20:45:04.000000000 -0400
23644@@ -85,6 +85,7 @@ struct sched_param {
23645
23646 struct exec_domain;
23647 struct futex_pi_state;
23648+struct linux_binprm;
23649
23650 /*
23651 * List of flags we want to share for kernel threads,
23652@@ -353,8 +354,34 @@ struct mm_struct {
23653 /* aio bits */
23654 rwlock_t ioctx_list_lock;
23655 struct kioctx *ioctx_list;
23656+
23657+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
23658+ unsigned long pax_flags;
23659+#endif
23660+
23661+#ifdef CONFIG_PAX_DLRESOLVE
23662+ unsigned long call_dl_resolve;
23663+#endif
23664+
23665+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
23666+ unsigned long call_syscall;
23667+#endif
23668+
23669+#ifdef CONFIG_PAX_ASLR
23670+ unsigned long delta_mmap; /* randomized offset */
23671+ unsigned long delta_exec; /* randomized offset */
23672+ unsigned long delta_stack; /* randomized offset */
23673+#endif
23674+
23675 };
23676
23677+#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
23678+#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
23679+#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
23680+#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
23681+/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
23682+#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
23683+
23684 struct sighand_struct {
23685 atomic_t count;
23686 struct k_sigaction action[_NSIG];
23687@@ -467,6 +494,15 @@ struct signal_struct {
23688 spinlock_t stats_lock;
23689 struct taskstats *stats;
23690 #endif
23691+
23692+#ifdef CONFIG_GRKERNSEC
23693+ u32 curr_ip;
23694+ u32 gr_saddr;
23695+ u32 gr_daddr;
23696+ u16 gr_sport;
23697+ u16 gr_dport;
23698+ u8 used_accept:1;
23699+#endif
23700 };
23701
23702 /* Context switch must be unlocked if interrupts are to be enabled */
23703@@ -986,6 +1022,17 @@ struct task_struct {
23704 struct list_head pi_state_list;
23705 struct futex_pi_state *pi_state_cache;
23706
23707+#ifdef CONFIG_GRKERNSEC
23708+ /* grsecurity */
23709+ struct acl_subject_label *acl;
23710+ struct acl_role_label *role;
23711+ struct file *exec_file;
23712+ u16 acl_role_id;
23713+ u8 acl_sp_role:1;
23714+ u8 is_writable:1;
23715+ u8 brute:1;
23716+#endif
23717+
23718 atomic_t fs_excl; /* holding fs exclusive resources */
23719 struct rcu_head rcu;
23720
23721@@ -1515,6 +1562,12 @@ extern void arch_pick_mmap_layout(struct
23722 static inline void arch_pick_mmap_layout(struct mm_struct *mm)
23723 {
23724 mm->mmap_base = TASK_UNMAPPED_BASE;
23725+
23726+#ifdef CONFIG_PAX_RANDMMAP
23727+ if (mm->pax_flags & MF_PAX_RANDMMAP)
23728+ mm->mmap_base += mm->delta_mmap;
23729+#endif
23730+
23731 mm->get_unmapped_area = arch_get_unmapped_area;
23732 mm->unmap_area = arch_unmap_area;
23733 }
23734diff -urNp linux-2.6.18/include/linux/shm.h linux-2.6.18/include/linux/shm.h
23735--- linux-2.6.18/include/linux/shm.h 2006-09-19 23:42:06.000000000 -0400
23736+++ linux-2.6.18/include/linux/shm.h 2006-09-22 20:04:35.000000000 -0400
23737@@ -86,6 +86,10 @@ struct shmid_kernel /* private to the ke
23738 pid_t shm_cprid;
23739 pid_t shm_lprid;
23740 struct user_struct *mlock_user;
23741+#ifdef CONFIG_GRKERNSEC
23742+ time_t shm_createtime;
23743+ pid_t shm_lapid;
23744+#endif
23745 };
23746
23747 /* shm_mode upper byte flags */
23748diff -urNp linux-2.6.18/include/linux/skbuff.h linux-2.6.18/include/linux/skbuff.h
23749--- linux-2.6.18/include/linux/skbuff.h 2006-09-19 23:42:06.000000000 -0400
23750+++ linux-2.6.18/include/linux/skbuff.h 2006-09-22 20:45:04.000000000 -0400
23751@@ -371,7 +371,7 @@ extern void skb_truesize_bug(struc
23752
23753 static inline void skb_truesize_check(struct sk_buff *skb)
23754 {
23755- if (unlikely((int)skb->truesize < sizeof(struct sk_buff) + skb->len))
23756+ if (unlikely(skb->truesize < sizeof(struct sk_buff) + skb->len))
23757 skb_truesize_bug(skb);
23758 }
23759
23760diff -urNp linux-2.6.18/include/linux/sysctl.h linux-2.6.18/include/linux/sysctl.h
23761--- linux-2.6.18/include/linux/sysctl.h 2006-09-19 23:42:06.000000000 -0400
23762+++ linux-2.6.18/include/linux/sysctl.h 2006-09-22 20:45:04.000000000 -0400
23763@@ -150,9 +150,21 @@ enum
23764 KERN_IA64_UNALIGNED=72, /* int: ia64 unaligned userland trap enable */
23765 KERN_COMPAT_LOG=73, /* int: print compat layer messages */
23766 KERN_MAX_LOCK_DEPTH=74,
23767-};
23768+#ifdef CONFIG_GRKERNSEC
23769+ KERN_GRSECURITY=98, /* grsecurity */
23770+#endif
23771+
23772+#ifdef CONFIG_PAX_SOFTMODE
23773+ KERN_PAX=99, /* PaX control */
23774+#endif
23775
23776+};
23777
23778+#ifdef CONFIG_PAX_SOFTMODE
23779+enum {
23780+ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
23781+};
23782+#endif
23783
23784 /* CTL_VM names: */
23785 enum
23786diff -urNp linux-2.6.18/include/linux/udf_fs.h linux-2.6.18/include/linux/udf_fs.h
23787--- linux-2.6.18/include/linux/udf_fs.h 2006-09-19 23:42:06.000000000 -0400
23788+++ linux-2.6.18/include/linux/udf_fs.h 2006-09-22 20:45:04.000000000 -0400
23789@@ -45,7 +45,7 @@
23790 printk (f, ##a); \
23791 }
23792 #else
23793-#define udf_debug(f, a...) /**/
23794+#define udf_debug(f, a...) do {} while (0)
23795 #endif
23796
23797 #define udf_info(f, a...) \
23798diff -urNp linux-2.6.18/include/net/sctp/sctp.h linux-2.6.18/include/net/sctp/sctp.h
23799--- linux-2.6.18/include/net/sctp/sctp.h 2006-09-19 23:42:06.000000000 -0400
23800+++ linux-2.6.18/include/net/sctp/sctp.h 2006-09-22 20:45:04.000000000 -0400
23801@@ -250,8 +250,8 @@ extern int sctp_debug_flag;
23802
23803 #else /* SCTP_DEBUG */
23804
23805-#define SCTP_DEBUG_PRINTK(whatever...)
23806-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
23807+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
23808+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
23809 #define SCTP_ENABLE_DEBUG
23810 #define SCTP_DISABLE_DEBUG
23811 #define SCTP_ASSERT(expr, str, func)
23812diff -urNp linux-2.6.18/include/sound/core.h linux-2.6.18/include/sound/core.h
23813--- linux-2.6.18/include/sound/core.h 2006-09-19 23:42:06.000000000 -0400
23814+++ linux-2.6.18/include/sound/core.h 2006-09-22 20:45:04.000000000 -0400
23815@@ -349,9 +349,9 @@ void snd_verbose_printd(const char *file
23816
23817 #else /* !CONFIG_SND_DEBUG */
23818
23819-#define snd_printd(fmt, args...) /* nothing */
23820+#define snd_printd(fmt, args...) do {} while (0)
23821 #define snd_assert(expr, args...) (void)(expr)
23822-#define snd_BUG() /* nothing */
23823+#define snd_BUG() do {} while (0)
23824
23825 #endif /* CONFIG_SND_DEBUG */
23826
23827diff -urNp linux-2.6.18/init/Kconfig linux-2.6.18/init/Kconfig
23828--- linux-2.6.18/init/Kconfig 2006-09-19 23:42:06.000000000 -0400
23829+++ linux-2.6.18/init/Kconfig 2006-09-22 20:04:35.000000000 -0400
23830@@ -292,6 +292,7 @@ config SYSCTL
23831 config KALLSYMS
23832 bool "Load all symbols for debugging/kksymoops" if EMBEDDED
23833 default y
23834+ depends on !GRKERNSEC_HIDESYM
23835 help
23836 Say Y here to let the kernel print out symbolic crash information and
23837 symbolic stack backtraces. This increases the size of the kernel
23838diff -urNp linux-2.6.18/init/main.c linux-2.6.18/init/main.c
23839--- linux-2.6.18/init/main.c 2006-09-19 23:42:06.000000000 -0400
23840+++ linux-2.6.18/init/main.c 2006-09-22 20:45:04.000000000 -0400
23841@@ -103,6 +103,7 @@ static inline void mark_rodata_ro(void)
23842 #ifdef CONFIG_TC
23843 extern void tc_init(void);
23844 #endif
23845+extern void grsecurity_init(void);
23846
23847 enum system_states system_state;
23848 EXPORT_SYMBOL(system_state);
23849@@ -153,6 +154,15 @@ static int __init maxcpus(char *str)
23850
23851 __setup("maxcpus=", maxcpus);
23852
23853+#ifdef CONFIG_PAX_SOFTMODE
23854+static int __init setup_pax_softmode(char *str)
23855+{
23856+ get_option(&str, &pax_softmode);
23857+ return 1;
23858+}
23859+__setup("pax_softmode=", setup_pax_softmode);
23860+#endif
23861+
23862 static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
23863 char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
23864 static const char *panic_later, *panic_param;
23865@@ -729,6 +739,8 @@ static int init(void * unused)
23866 prepare_namespace();
23867 }
23868
23869+ grsecurity_init();
23870+
23871 /*
23872 * Ok, we have completed the initial bootup, and
23873 * we're essentially up and running. Get rid of the
23874diff -urNp linux-2.6.18/ipc/msg.c linux-2.6.18/ipc/msg.c
23875--- linux-2.6.18/ipc/msg.c 2006-09-19 23:42:06.000000000 -0400
23876+++ linux-2.6.18/ipc/msg.c 2006-09-22 20:08:16.000000000 -0400
23877@@ -31,6 +31,7 @@
23878 #include <linux/audit.h>
23879 #include <linux/seq_file.h>
23880 #include <linux/mutex.h>
23881+#include <linux/grsecurity.h>
23882
23883 #include <asm/current.h>
23884 #include <asm/uaccess.h>
23885@@ -239,6 +240,8 @@ asmlinkage long sys_msgget(key_t key, in
23886 }
23887 mutex_unlock(&msg_ids.mutex);
23888
23889+ gr_log_msgget(ret, msgflg);
23890+
23891 return ret;
23892 }
23893
23894@@ -503,6 +506,7 @@ asmlinkage long sys_msgctl(int msqid, in
23895 break;
23896 }
23897 case IPC_RMID:
23898+ gr_log_msgrm(ipcp->uid, ipcp->cuid);
23899 freeque(msq, msqid);
23900 break;
23901 }
23902diff -urNp linux-2.6.18/ipc/sem.c linux-2.6.18/ipc/sem.c
23903--- linux-2.6.18/ipc/sem.c 2006-09-19 23:42:06.000000000 -0400
23904+++ linux-2.6.18/ipc/sem.c 2006-09-22 20:04:35.000000000 -0400
23905@@ -78,6 +78,7 @@
23906 #include <linux/capability.h>
23907 #include <linux/seq_file.h>
23908 #include <linux/mutex.h>
23909+#include <linux/grsecurity.h>
23910
23911 #include <asm/uaccess.h>
23912 #include "util.h"
23913@@ -246,6 +247,9 @@ asmlinkage long sys_semget (key_t key, i
23914 }
23915
23916 mutex_unlock(&sem_ids.mutex);
23917+
23918+ gr_log_semget(err, semflg);
23919+
23920 return err;
23921 }
23922
23923@@ -844,6 +848,8 @@ static int semctl_down(int semid, int se
23924
23925 switch(cmd){
23926 case IPC_RMID:
23927+ gr_log_semrm(ipcp->uid, ipcp->cuid);
23928+
23929 freeary(sma, semid);
23930 err = 0;
23931 break;
23932diff -urNp linux-2.6.18/ipc/shm.c linux-2.6.18/ipc/shm.c
23933--- linux-2.6.18/ipc/shm.c 2006-09-19 23:42:06.000000000 -0400
23934+++ linux-2.6.18/ipc/shm.c 2006-09-22 20:04:35.000000000 -0400
23935@@ -32,6 +32,7 @@
23936 #include <linux/ptrace.h>
23937 #include <linux/seq_file.h>
23938 #include <linux/mutex.h>
23939+#include <linux/grsecurity.h>
23940
23941 #include <asm/uaccess.h>
23942
23943@@ -55,6 +56,14 @@ static void shm_close (struct vm_area_st
23944 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
23945 #endif
23946
23947+#ifdef CONFIG_GRKERNSEC
23948+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
23949+ const time_t shm_createtime, const uid_t cuid,
23950+ const int shmid);
23951+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
23952+ const time_t shm_createtime);
23953+#endif
23954+
23955 size_t shm_ctlmax = SHMMAX;
23956 size_t shm_ctlall = SHMALL;
23957 int shm_ctlmni = SHMMNI;
23958@@ -148,6 +157,17 @@ static void shm_close (struct vm_area_st
23959 shp->shm_lprid = current->tgid;
23960 shp->shm_dtim = get_seconds();
23961 shp->shm_nattch--;
23962+#ifdef CONFIG_GRKERNSEC_SHM
23963+ if (grsec_enable_shm) {
23964+ if (shp->shm_nattch == 0) {
23965+ shp->shm_perm.mode |= SHM_DEST;
23966+ shm_destroy(shp);
23967+ } else
23968+ shm_unlock(shp);
23969+ mutex_unlock(&shm_ids.mutex);
23970+ return;
23971+ }
23972+#endif
23973 if(shp->shm_nattch == 0 &&
23974 shp->shm_perm.mode & SHM_DEST)
23975 shm_destroy (shp);
23976@@ -247,6 +267,9 @@ static int newseg (key_t key, int shmflg
23977 shp->shm_lprid = 0;
23978 shp->shm_atim = shp->shm_dtim = 0;
23979 shp->shm_ctim = get_seconds();
23980+#ifdef CONFIG_GRKERNSEC
23981+ shp->shm_createtime = get_seconds();
23982+#endif
23983 shp->shm_segsz = size;
23984 shp->shm_nattch = 0;
23985 shp->id = shm_buildid(id,shp->shm_perm.seq);
23986@@ -301,6 +324,8 @@ asmlinkage long sys_shmget (key_t key, s
23987 }
23988 mutex_unlock(&shm_ids.mutex);
23989
23990+ gr_log_shmget(err, shmflg, size);
23991+
23992 return err;
23993 }
23994
23995@@ -614,6 +639,8 @@ asmlinkage long sys_shmctl (int shmid, i
23996 if (err)
23997 goto out_unlock_up;
23998
23999+ gr_log_shmrm(shp->shm_perm.uid, shp->shm_perm.cuid);
24000+
24001 if (shp->shm_nattch){
24002 shp->shm_perm.mode |= SHM_DEST;
24003 /* Do not find it any more */
24004@@ -759,9 +786,27 @@ long do_shmat(int shmid, char __user *sh
24005 return err;
24006 }
24007
24008+#ifdef CONFIG_GRKERNSEC
24009+ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
24010+ shp->shm_perm.cuid, shmid)) {
24011+ shm_unlock(shp);
24012+ return -EACCES;
24013+ }
24014+
24015+ if (!gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
24016+ shm_unlock(shp);
24017+ return -EACCES;
24018+ }
24019+#endif
24020+
24021 file = shp->shm_file;
24022 size = i_size_read(file->f_dentry->d_inode);
24023 shp->shm_nattch++;
24024+
24025+#ifdef CONFIG_GRKERNSEC
24026+ shp->shm_lapid = current->pid;
24027+#endif
24028+
24029 shm_unlock(shp);
24030
24031 down_write(&current->mm->mmap_sem);
24032@@ -931,3 +976,24 @@ static int sysvipc_shm_proc_show(struct
24033 shp->shm_ctim);
24034 }
24035 #endif
24036+
24037+void gr_shm_exit(struct task_struct *task)
24038+{
24039+#ifdef CONFIG_GRKERNSEC_SHM
24040+ int i;
24041+ struct shmid_kernel *shp;
24042+
24043+ if (!grsec_enable_shm)
24044+ return;
24045+
24046+ for (i = 0; i <= shm_ids.max_id; i++) {
24047+ shp = shm_get(i);
24048+ if (shp && (shp->shm_cprid == task->pid) &&
24049+ (shp->shm_nattch <= 0)) {
24050+ shp->shm_perm.mode |= SHM_DEST;
24051+ shm_destroy(shp);
24052+ }
24053+ }
24054+#endif
24055+ return;
24056+}
24057diff -urNp linux-2.6.18/kernel/capability.c linux-2.6.18/kernel/capability.c
24058--- linux-2.6.18/kernel/capability.c 2006-09-19 23:42:06.000000000 -0400
24059+++ linux-2.6.18/kernel/capability.c 2006-09-22 20:04:35.000000000 -0400
24060@@ -12,6 +12,7 @@
24061 #include <linux/module.h>
24062 #include <linux/security.h>
24063 #include <linux/syscalls.h>
24064+#include <linux/grsecurity.h>
24065 #include <asm/uaccess.h>
24066
24067 unsigned securebits = SECUREBITS_DEFAULT; /* systemwide security settings */
24068@@ -234,14 +235,25 @@ out:
24069 return ret;
24070 }
24071
24072+extern int gr_task_is_capable(struct task_struct *task, const int cap);
24073+extern int gr_is_capable_nolog(const int cap);
24074+
24075 int __capable(struct task_struct *t, int cap)
24076 {
24077- if (security_capable(t, cap) == 0) {
24078+ if ((security_capable(t, cap) == 0) && gr_task_is_capable(t, cap)) {
24079 t->flags |= PF_SUPERPRIV;
24080 return 1;
24081 }
24082 return 0;
24083 }
24084+int capable_nolog(int cap)
24085+{
24086+ if ((security_capable(current, cap) == 0) && gr_is_capable_nolog(cap)) {
24087+ current->flags |= PF_SUPERPRIV;
24088+ return 1;
24089+ }
24090+ return 0;
24091+}
24092 EXPORT_SYMBOL(__capable);
24093
24094 int capable(int cap)
24095@@ -249,3 +261,4 @@ int capable(int cap)
24096 return __capable(current, cap);
24097 }
24098 EXPORT_SYMBOL(capable);
24099+EXPORT_SYMBOL(capable_nolog);
24100diff -urNp linux-2.6.18/kernel/configs.c linux-2.6.18/kernel/configs.c
24101--- linux-2.6.18/kernel/configs.c 2006-09-19 23:42:06.000000000 -0400
24102+++ linux-2.6.18/kernel/configs.c 2006-09-22 20:04:35.000000000 -0400
24103@@ -88,8 +88,16 @@ static int __init ikconfig_init(void)
24104 struct proc_dir_entry *entry;
24105
24106 /* create the current config file */
24107+#ifdef CONFIG_GRKERNSEC_PROC_ADD
24108+#ifdef CONFIG_GRKERNSEC_PROC_USER
24109+ entry = create_proc_entry("config.gz", S_IFREG | S_IRUSR, &proc_root);
24110+#elif CONFIG_GRKERNSEC_PROC_USERGROUP
24111+ entry = create_proc_entry("config.gz", S_IFREG | S_IRUSR | S_IRGRP, &proc_root);
24112+#endif
24113+#else
24114 entry = create_proc_entry("config.gz", S_IFREG | S_IRUGO,
24115 &proc_root);
24116+#endif
24117 if (!entry)
24118 return -ENOMEM;
24119
24120diff -urNp linux-2.6.18/kernel/exit.c linux-2.6.18/kernel/exit.c
24121--- linux-2.6.18/kernel/exit.c 2006-09-19 23:42:06.000000000 -0400
24122+++ linux-2.6.18/kernel/exit.c 2006-09-22 20:21:45.000000000 -0400
24123@@ -38,6 +38,11 @@
24124 #include <linux/pipe_fs_i.h>
24125 #include <linux/audit.h> /* for audit_free() */
24126 #include <linux/resource.h>
24127+#include <linux/grsecurity.h>
24128+
24129+#ifdef CONFIG_GRKERNSEC
24130+extern rwlock_t grsec_exec_file_lock;
24131+#endif
24132
24133 #include <asm/uaccess.h>
24134 #include <asm/unistd.h>
24135@@ -115,6 +120,7 @@ static void __exit_signal(struct task_st
24136
24137 __unhash_process(tsk);
24138
24139+ gr_del_task_from_ip_table(tsk);
24140 tsk->signal = NULL;
24141 tsk->sighand = NULL;
24142 spin_unlock(&sighand->siglock);
24143@@ -282,6 +288,15 @@ static void reparent_to_init(void)
24144 {
24145 write_lock_irq(&tasklist_lock);
24146
24147+#ifdef CONFIG_GRKERNSEC
24148+ write_lock(&grsec_exec_file_lock);
24149+ if (current->exec_file) {
24150+ fput(current->exec_file);
24151+ current->exec_file = NULL;
24152+ }
24153+ write_unlock(&grsec_exec_file_lock);
24154+#endif
24155+
24156 ptrace_unlink(current);
24157 /* Reparent to init */
24158 remove_parent(current);
24159@@ -289,6 +304,8 @@ static void reparent_to_init(void)
24160 current->real_parent = child_reaper;
24161 add_parent(current);
24162
24163+ gr_set_kernel_label(current);
24164+
24165 /* Set the exit signal to SIGCHLD so we signal init on exit */
24166 current->exit_signal = SIGCHLD;
24167
24168@@ -385,6 +402,17 @@ void daemonize(const char *name, ...)
24169 vsnprintf(current->comm, sizeof(current->comm), name, args);
24170 va_end(args);
24171
24172+#ifdef CONFIG_GRKERNSEC
24173+ write_lock(&grsec_exec_file_lock);
24174+ if (current->exec_file) {
24175+ fput(current->exec_file);
24176+ current->exec_file = NULL;
24177+ }
24178+ write_unlock(&grsec_exec_file_lock);
24179+#endif
24180+
24181+ gr_set_kernel_label(current);
24182+
24183 /*
24184 * If we were started as result of loading a module, close all of the
24185 * user space pages. We don't need them, and if we didn't close them
24186@@ -909,11 +937,15 @@ fastcall NORET_TYPE void do_exit(long co
24187 taskstats_exit_send(tsk, tidstats, group_dead, mycpu);
24188 taskstats_exit_free(tidstats);
24189
24190+ gr_acl_handle_psacct(tsk, code);
24191+ gr_acl_handle_exit();
24192+
24193 exit_mm(tsk);
24194
24195 if (group_dead)
24196 acct_process();
24197 exit_sem(tsk);
24198+ gr_shm_exit(tsk);
24199 __exit_files(tsk);
24200 __exit_fs(tsk);
24201 exit_namespace(tsk);
24202diff -urNp linux-2.6.18/kernel/fork.c linux-2.6.18/kernel/fork.c
24203--- linux-2.6.18/kernel/fork.c 2006-09-19 23:42:06.000000000 -0400
24204+++ linux-2.6.18/kernel/fork.c 2006-09-22 20:45:04.000000000 -0400
24205@@ -45,6 +45,7 @@
24206 #include <linux/cn_proc.h>
24207 #include <linux/delayacct.h>
24208 #include <linux/taskstats_kern.h>
24209+#include <linux/grsecurity.h>
24210
24211 #include <asm/pgtable.h>
24212 #include <asm/pgalloc.h>
24213@@ -202,8 +203,8 @@ static inline int dup_mmap(struct mm_str
24214 mm->locked_vm = 0;
24215 mm->mmap = NULL;
24216 mm->mmap_cache = NULL;
24217- mm->free_area_cache = oldmm->mmap_base;
24218- mm->cached_hole_size = ~0UL;
24219+ mm->free_area_cache = oldmm->free_area_cache;
24220+ mm->cached_hole_size = oldmm->cached_hole_size;
24221 mm->map_count = 0;
24222 cpus_clear(mm->cpu_vm_mask);
24223 mm->mm_rb = RB_ROOT;
24224@@ -328,7 +329,7 @@ static struct mm_struct * mm_init(struct
24225 spin_lock_init(&mm->page_table_lock);
24226 rwlock_init(&mm->ioctx_list_lock);
24227 mm->ioctx_list = NULL;
24228- mm->free_area_cache = TASK_UNMAPPED_BASE;
24229+ mm->free_area_cache = ~0UL;
24230 mm->cached_hole_size = ~0UL;
24231
24232 if (likely(!mm_alloc_pgd(mm))) {
24233@@ -980,6 +981,9 @@ static struct task_struct *copy_process(
24234 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
24235 #endif
24236 retval = -EAGAIN;
24237+
24238+ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->user->processes), 0);
24239+
24240 if (atomic_read(&p->user->processes) >=
24241 p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
24242 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
24243@@ -1110,6 +1114,8 @@ static struct task_struct *copy_process(
24244 if (retval)
24245 goto bad_fork_cleanup_namespace;
24246
24247+ gr_copy_label(p);
24248+
24249 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
24250 /*
24251 * Clear TID on mm_release()?
24252@@ -1291,6 +1297,8 @@ bad_fork_cleanup_count:
24253 bad_fork_free:
24254 free_task(p);
24255 fork_out:
24256+ gr_log_forkfail(retval);
24257+
24258 return ERR_PTR(retval);
24259 }
24260
24261@@ -1364,6 +1372,8 @@ long do_fork(unsigned long clone_flags,
24262 if (!IS_ERR(p)) {
24263 struct completion vfork;
24264
24265+ gr_handle_brute_check();
24266+
24267 if (clone_flags & CLONE_VFORK) {
24268 p->vfork_done = &vfork;
24269 init_completion(&vfork);
24270diff -urNp linux-2.6.18/kernel/futex.c linux-2.6.18/kernel/futex.c
24271--- linux-2.6.18/kernel/futex.c 2006-09-19 23:42:06.000000000 -0400
24272+++ linux-2.6.18/kernel/futex.c 2006-09-22 20:45:04.000000000 -0400
24273@@ -183,6 +183,11 @@ static int get_futex_key(u32 __user *uad
24274 struct page *page;
24275 int err;
24276
24277+#ifdef CONFIG_PAX_SEGMEXEC
24278+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((unsigned long)uaddr >= SEGMEXEC_TASK_SIZE))
24279+ return -EFAULT;
24280+#endif
24281+
24282 /*
24283 * The futex address must be "naturally" aligned.
24284 */
24285diff -urNp linux-2.6.18/kernel/kallsyms.c linux-2.6.18/kernel/kallsyms.c
24286--- linux-2.6.18/kernel/kallsyms.c 2006-09-19 23:42:06.000000000 -0400
24287+++ linux-2.6.18/kernel/kallsyms.c 2006-09-22 20:45:04.000000000 -0400
24288@@ -301,7 +301,6 @@ static unsigned long get_ksymbol_core(st
24289
24290 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
24291 {
24292- iter->name[0] = '\0';
24293 iter->nameoff = get_symbol_offset(new_pos);
24294 iter->pos = new_pos;
24295 }
24296@@ -380,7 +379,7 @@ static int kallsyms_open(struct inode *i
24297 struct kallsym_iter *iter;
24298 int ret;
24299
24300- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
24301+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
24302 if (!iter)
24303 return -ENOMEM;
24304 reset_iter(iter, 0);
24305@@ -411,7 +410,15 @@ static int __init kallsyms_init(void)
24306 {
24307 struct proc_dir_entry *entry;
24308
24309+#ifdef CONFIG_GRKERNSEC_PROC_ADD
24310+#ifdef CONFIG_GRKERNSEC_PROC_USER
24311+ entry = create_proc_entry("kallsyms", S_IFREG | S_IRUSR, NULL);
24312+#elif CONFIG_GRKERNSEC_PROC_USERGROUP
24313+ entry = create_proc_entry("kallsyms", S_IFREG | S_IRUSR | S_IRGRP, NULL);
24314+#endif
24315+#else
24316 entry = create_proc_entry("kallsyms", 0444, NULL);
24317+#endif
24318 if (entry)
24319 entry->proc_fops = &kallsyms_operations;
24320 return 0;
24321diff -urNp linux-2.6.18/kernel/kprobes.c linux-2.6.18/kernel/kprobes.c
24322--- linux-2.6.18/kernel/kprobes.c 2006-09-19 23:42:06.000000000 -0400
24323+++ linux-2.6.18/kernel/kprobes.c 2006-09-22 20:45:04.000000000 -0400
24324@@ -112,7 +112,7 @@ kprobe_opcode_t __kprobes *get_insn_slot
24325 * kernel image and loaded module images reside. This is required
24326 * so x86_64 can correctly handle the %rip-relative fixups.
24327 */
24328- kip->insns = module_alloc(PAGE_SIZE);
24329+ kip->insns = module_alloc_exec(PAGE_SIZE);
24330 if (!kip->insns) {
24331 kfree(kip);
24332 return NULL;
24333diff -urNp linux-2.6.18/kernel/module.c linux-2.6.18/kernel/module.c
24334--- linux-2.6.18/kernel/module.c 2006-09-19 23:42:06.000000000 -0400
24335+++ linux-2.6.18/kernel/module.c 2006-09-22 20:45:04.000000000 -0400
24336@@ -43,6 +43,11 @@
24337 #include <asm/uaccess.h>
24338 #include <asm/semaphore.h>
24339 #include <asm/cacheflush.h>
24340+
24341+#ifdef CONFIG_PAX_KERNEXEC
24342+#include <asm/desc.h>
24343+#endif
24344+
24345 #include <linux/license.h>
24346
24347 #if 0
24348@@ -67,6 +72,8 @@ static LIST_HEAD(modules);
24349
24350 static BLOCKING_NOTIFIER_HEAD(module_notify_list);
24351
24352+extern int gr_check_modstop(void);
24353+
24354 int register_module_notifier(struct notifier_block * nb)
24355 {
24356 return blocking_notifier_chain_register(&module_notify_list, nb);
24357@@ -650,6 +657,9 @@ sys_delete_module(const char __user *nam
24358 char name[MODULE_NAME_LEN];
24359 int ret, forced = 0;
24360
24361+ if (gr_check_modstop())
24362+ return -EPERM;
24363+
24364 if (!capable(CAP_SYS_MODULE))
24365 return -EPERM;
24366
24367@@ -1116,7 +1126,8 @@ static void free_module(struct module *m
24368 module_unload_free(mod);
24369
24370 /* This may be NULL, but that's OK */
24371- module_free(mod, mod->module_init);
24372+ module_free(mod, mod->module_init_rw);
24373+ module_free_exec(mod, mod->module_init_rx);
24374 kfree(mod->args);
24375 if (mod->percpu)
24376 percpu_modfree(mod->percpu);
24377@@ -1125,7 +1136,8 @@ static void free_module(struct module *m
24378 lockdep_free_key_range(mod->module_core, mod->core_size);
24379
24380 /* Finally, free the core (containing the module structure) */
24381- module_free(mod, mod->module_core);
24382+ module_free_exec(mod, mod->module_core_rx);
24383+ module_free(mod, mod->module_core_rw);
24384 }
24385
24386 void *__symbol_get(const char *symbol)
24387@@ -1282,11 +1294,14 @@ static void layout_sections(struct modul
24388 || strncmp(secstrings + s->sh_name,
24389 ".init", 5) == 0)
24390 continue;
24391- s->sh_entsize = get_offset(&mod->core_size, s);
24392+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
24393+ s->sh_entsize = get_offset(&mod->core_size_rw, s);
24394+ else
24395+ s->sh_entsize = get_offset(&mod->core_size_rx, s);
24396 DEBUGP("\t%s\n", secstrings + s->sh_name);
24397 }
24398 if (m == 0)
24399- mod->core_text_size = mod->core_size;
24400+ mod->core_size_rx = mod->core_size_rx;
24401 }
24402
24403 DEBUGP("Init section allocation order:\n");
24404@@ -1300,12 +1315,15 @@ static void layout_sections(struct modul
24405 || strncmp(secstrings + s->sh_name,
24406 ".init", 5) != 0)
24407 continue;
24408- s->sh_entsize = (get_offset(&mod->init_size, s)
24409- | INIT_OFFSET_MASK);
24410+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
24411+ s->sh_entsize = get_offset(&mod->init_size_rw, s);
24412+ else
24413+ s->sh_entsize = get_offset(&mod->init_size_rx, s);
24414+ s->sh_entsize |= INIT_OFFSET_MASK;
24415 DEBUGP("\t%s\n", secstrings + s->sh_name);
24416 }
24417 if (m == 0)
24418- mod->init_text_size = mod->init_size;
24419+ mod->init_size_rx = mod->init_size_rx;
24420 }
24421 }
24422
24423@@ -1487,6 +1505,10 @@ static struct module *load_module(void _
24424 struct exception_table_entry *extable;
24425 mm_segment_t old_fs;
24426
24427+#ifdef CONFIG_PAX_KERNEXEC
24428+ unsigned long cr0;
24429+#endif
24430+
24431 DEBUGP("load_module: umod=%p, len=%lu, uargs=%p\n",
24432 umod, len, uargs);
24433 if (len < sizeof(*hdr))
24434@@ -1645,21 +1667,57 @@ static struct module *load_module(void _
24435 layout_sections(mod, hdr, sechdrs, secstrings);
24436
24437 /* Do the allocs. */
24438- ptr = module_alloc(mod->core_size);
24439+ ptr = module_alloc(mod->core_size_rw);
24440 if (!ptr) {
24441 err = -ENOMEM;
24442 goto free_percpu;
24443 }
24444- memset(ptr, 0, mod->core_size);
24445- mod->module_core = ptr;
24446+ memset(ptr, 0, mod->core_size_rw);
24447+ mod->module_core_rw = ptr;
24448+
24449+ ptr = module_alloc(mod->init_size_rw);
24450+ if (!ptr && mod->init_size_rw) {
24451+ err = -ENOMEM;
24452+ goto free_core_rw;
24453+ }
24454+ memset(ptr, 0, mod->init_size_rw);
24455+ mod->module_init_rw = ptr;
24456+
24457+ ptr = module_alloc_exec(mod->core_size_rx);
24458+ if (!ptr) {
24459+ err = -ENOMEM;
24460+ goto free_init_rw;
24461+ }
24462
24463- ptr = module_alloc(mod->init_size);
24464- if (!ptr && mod->init_size) {
24465+#ifdef CONFIG_PAX_KERNEXEC
24466+ pax_open_kernel(cr0);
24467+#endif
24468+
24469+ memset(ptr, 0, mod->core_size_rx);
24470+
24471+#ifdef CONFIG_PAX_KERNEXEC
24472+ pax_close_kernel(cr0);
24473+#endif
24474+
24475+ mod->module_core_rx = ptr;
24476+
24477+ ptr = module_alloc_exec(mod->init_size_rx);
24478+ if (!ptr && mod->init_size_rx) {
24479 err = -ENOMEM;
24480- goto free_core;
24481+ goto free_core_rx;
24482 }
24483- memset(ptr, 0, mod->init_size);
24484- mod->module_init = ptr;
24485+
24486+#ifdef CONFIG_PAX_KERNEXEC
24487+ pax_open_kernel(cr0);
24488+#endif
24489+
24490+ memset(ptr, 0, mod->init_size_rx);
24491+
24492+#ifdef CONFIG_PAX_KERNEXEC
24493+ pax_close_kernel(cr0);
24494+#endif
24495+
24496+ mod->module_init_rx = ptr;
24497
24498 /* Transfer each section which specifies SHF_ALLOC */
24499 DEBUGP("final section addresses:\n");
24500@@ -1669,17 +1727,44 @@ static struct module *load_module(void _
24501 if (!(sechdrs[i].sh_flags & SHF_ALLOC))
24502 continue;
24503
24504- if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
24505- dest = mod->module_init
24506- + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
24507- else
24508- dest = mod->module_core + sechdrs[i].sh_entsize;
24509+ if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
24510+ if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
24511+ dest = mod->module_init_rw
24512+ + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
24513+ else
24514+ dest = mod->module_init_rx
24515+ + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
24516+ } else {
24517+ if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
24518+ dest = mod->module_core_rw + sechdrs[i].sh_entsize;
24519+ else
24520+ dest = mod->module_core_rx + sechdrs[i].sh_entsize;
24521+ }
24522+
24523+ if (sechdrs[i].sh_type != SHT_NOBITS) {
24524
24525- if (sechdrs[i].sh_type != SHT_NOBITS)
24526- memcpy(dest, (void *)sechdrs[i].sh_addr,
24527- sechdrs[i].sh_size);
24528+#ifdef CONFIG_PAX_KERNEXEC
24529+ if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC))
24530+ pax_open_kernel(cr0);
24531+#endif
24532+
24533+ memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
24534+
24535+#ifdef CONFIG_PAX_KERNEXEC
24536+ if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC))
24537+ pax_close_kernel(cr0);
24538+#endif
24539+
24540+ }
24541 /* Update sh_addr to point to copy in image. */
24542- sechdrs[i].sh_addr = (unsigned long)dest;
24543+
24544+#ifdef CONFIG_PAX_KERNEXEC
24545+ if (sechdrs[i].sh_flags & SHF_EXECINSTR)
24546+ sechdrs[i].sh_addr = (unsigned long)dest - __KERNEL_TEXT_OFFSET;
24547+ else
24548+#endif
24549+
24550+ sechdrs[i].sh_addr = (unsigned long)dest;
24551 DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
24552 }
24553 /* Module has been moved. */
24554@@ -1700,8 +1785,18 @@ static struct module *load_module(void _
24555 setup_modinfo(mod, sechdrs, infoindex);
24556
24557 /* Fix up syms, so that st_value is a pointer to location. */
24558+
24559+#ifdef CONFIG_PAX_KERNEXEC
24560+ pax_open_kernel(cr0);
24561+#endif
24562+
24563 err = simplify_symbols(sechdrs, symindex, strtab, versindex, pcpuindex,
24564 mod);
24565+
24566+#ifdef CONFIG_PAX_KERNEXEC
24567+ pax_close_kernel(cr0);
24568+#endif
24569+
24570 if (err < 0)
24571 goto cleanup;
24572
24573@@ -1756,11 +1851,20 @@ static struct module *load_module(void _
24574 if (!(sechdrs[info].sh_flags & SHF_ALLOC))
24575 continue;
24576
24577+#ifdef CONFIG_PAX_KERNEXEC
24578+ pax_open_kernel(cr0);
24579+#endif
24580+
24581 if (sechdrs[i].sh_type == SHT_REL)
24582 err = apply_relocate(sechdrs, strtab, symindex, i,mod);
24583 else if (sechdrs[i].sh_type == SHT_RELA)
24584 err = apply_relocate_add(sechdrs, strtab, symindex, i,
24585 mod);
24586+
24587+#ifdef CONFIG_PAX_KERNEXEC
24588+ pax_close_kernel(cr0);
24589+#endif
24590+
24591 if (err < 0)
24592 goto cleanup;
24593 }
24594@@ -1774,14 +1878,31 @@ static struct module *load_module(void _
24595 /* Set up and sort exception table */
24596 mod->num_exentries = sechdrs[exindex].sh_size / sizeof(*mod->extable);
24597 mod->extable = extable = (void *)sechdrs[exindex].sh_addr;
24598+
24599+#ifdef CONFIG_PAX_KERNEXEC
24600+ pax_open_kernel(cr0);
24601+#endif
24602+
24603 sort_extable(extable, extable + mod->num_exentries);
24604
24605+#ifdef CONFIG_PAX_KERNEXEC
24606+ pax_close_kernel(cr0);
24607+#endif
24608+
24609 /* Finally, copy percpu area over. */
24610 percpu_modcopy(mod->percpu, (void *)sechdrs[pcpuindex].sh_addr,
24611 sechdrs[pcpuindex].sh_size);
24612
24613+#ifdef CONFIG_PAX_KERNEXEC
24614+ pax_open_kernel(cr0);
24615+#endif
24616+
24617 add_kallsyms(mod, sechdrs, symindex, strindex, secstrings);
24618
24619+#ifdef CONFIG_PAX_KERNEXEC
24620+ pax_close_kernel(cr0);
24621+#endif
24622+
24623 err = module_finalize(hdr, sechdrs, mod);
24624 if (err < 0)
24625 goto cleanup;
24626@@ -1795,12 +1916,12 @@ static struct module *load_module(void _
24627 * Do it before processing of module parameters, so the module
24628 * can provide parameter accessor functions of its own.
24629 */
24630- if (mod->module_init)
24631- flush_icache_range((unsigned long)mod->module_init,
24632- (unsigned long)mod->module_init
24633- + mod->init_size);
24634- flush_icache_range((unsigned long)mod->module_core,
24635- (unsigned long)mod->module_core + mod->core_size);
24636+ if (mod->module_init_rx)
24637+ flush_icache_range((unsigned long)mod->module_init_rx,
24638+ (unsigned long)mod->module_init_rx
24639+ + mod->init_size_rx);
24640+ flush_icache_range((unsigned long)mod->module_core_rx,
24641+ (unsigned long)mod->module_core_rx + mod->core_size_rx);
24642
24643 set_fs(old_fs);
24644
24645@@ -1843,9 +1964,13 @@ static struct module *load_module(void _
24646 module_arch_cleanup(mod);
24647 cleanup:
24648 module_unload_free(mod);
24649- module_free(mod, mod->module_init);
24650- free_core:
24651- module_free(mod, mod->module_core);
24652+ module_free_exec(mod, mod->module_init_rx);
24653+ free_core_rx:
24654+ module_free_exec(mod, mod->module_core_rx);
24655+ free_init_rw:
24656+ module_free(mod, mod->module_init_rw);
24657+ free_core_rw:
24658+ module_free(mod, mod->module_core_rw);
24659 free_percpu:
24660 if (percpu)
24661 percpu_modfree(percpu);
24662@@ -1881,6 +2006,9 @@ sys_init_module(void __user *umod,
24663 struct module *mod;
24664 int ret = 0;
24665
24666+ if (gr_check_modstop())
24667+ return -EPERM;
24668+
24669 /* Must have permission */
24670 if (!capable(CAP_SYS_MODULE))
24671 return -EPERM;
24672@@ -1932,10 +2060,12 @@ sys_init_module(void __user *umod,
24673 /* Drop initial reference. */
24674 module_put(mod);
24675 unwind_remove_table(mod->unwind_info, 1);
24676- module_free(mod, mod->module_init);
24677- mod->module_init = NULL;
24678- mod->init_size = 0;
24679- mod->init_text_size = 0;
24680+ module_free(mod, mod->module_init_rw);
24681+ module_free_exec(mod, mod->module_init_rx);
24682+ mod->module_init_rw = NULL;
24683+ mod->module_init_rx = NULL;
24684+ mod->init_size_rw = 0;
24685+ mod->init_size_rx = 0;
24686 mutex_unlock(&module_mutex);
24687
24688 return 0;
24689@@ -1966,10 +2096,14 @@ static const char *get_ksymbol(struct mo
24690 unsigned long nextval;
24691
24692 /* At worse, next value is at end of module */
24693- if (within(addr, mod->module_init, mod->init_size))
24694- nextval = (unsigned long)mod->module_init+mod->init_text_size;
24695- else
24696- nextval = (unsigned long)mod->module_core+mod->core_text_size;
24697+ if (within(addr, mod->module_init_rx, mod->init_size_rx))
24698+ nextval = (unsigned long)mod->module_init_rw;
24699+ else if (within(addr, mod->module_init_rw, mod->init_size_rw))
24700+ nextval = (unsigned long)mod->module_core_rx;
24701+ else if (within(addr, mod->module_core_rx, mod->core_size_rx))
24702+ nextval = (unsigned long)mod->module_core_rw;
24703+ else
24704+ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
24705
24706 /* Scan for closest preceeding symbol, and next symbol. (ELF
24707 starts real symbols at 1). */
24708@@ -2010,8 +2144,10 @@ const char *module_address_lookup(unsign
24709 struct module *mod;
24710
24711 list_for_each_entry(mod, &modules, list) {
24712- if (within(addr, mod->module_init, mod->init_size)
24713- || within(addr, mod->module_core, mod->core_size)) {
24714+ if (within(addr, mod->module_init_rx, mod->init_size_rx)
24715+ || within(addr, mod->module_init_rw, mod->init_size_rw)
24716+ || within(addr, mod->module_core_rx, mod->core_size_rx)
24717+ || within(addr, mod->module_core_rw, mod->core_size_rw)) {
24718 *modname = mod->name;
24719 return get_ksymbol(mod, addr, size, offset);
24720 }
24721@@ -2107,7 +2243,7 @@ static int m_show(struct seq_file *m, vo
24722 {
24723 struct module *mod = list_entry(p, struct module, list);
24724 seq_printf(m, "%s %lu",
24725- mod->name, mod->init_size + mod->core_size);
24726+ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
24727 print_unload_info(m, mod);
24728
24729 /* Informative for users. */
24730@@ -2116,7 +2252,7 @@ static int m_show(struct seq_file *m, vo
24731 mod->state == MODULE_STATE_COMING ? "Loading":
24732 "Live");
24733 /* Used by oprofile and other similar tools. */
24734- seq_printf(m, " 0x%p", mod->module_core);
24735+ seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
24736
24737 seq_printf(m, "\n");
24738 return 0;
24739@@ -2170,7 +2306,8 @@ int is_module_address(unsigned long addr
24740 spin_lock_irqsave(&modlist_lock, flags);
24741
24742 list_for_each_entry(mod, &modules, list) {
24743- if (within(addr, mod->module_core, mod->core_size)) {
24744+ if (within(addr, mod->module_core_rx, mod->core_size_rx) ||
24745+ within(addr, mod->module_core_rw, mod->core_size_rw)) {
24746 spin_unlock_irqrestore(&modlist_lock, flags);
24747 return 1;
24748 }
24749@@ -2188,8 +2325,8 @@ struct module *__module_text_address(uns
24750 struct module *mod;
24751
24752 list_for_each_entry(mod, &modules, list)
24753- if (within(addr, mod->module_init, mod->init_text_size)
24754- || within(addr, mod->module_core, mod->core_text_size))
24755+ if (within(addr, mod->module_init_rx, mod->init_size_rx)
24756+ || within(addr, mod->module_core_rx, mod->core_size_rx))
24757 return mod;
24758 return NULL;
24759 }
24760diff -urNp linux-2.6.18/kernel/mutex.c linux-2.6.18/kernel/mutex.c
24761--- linux-2.6.18/kernel/mutex.c 2006-09-19 23:42:06.000000000 -0400
24762+++ linux-2.6.18/kernel/mutex.c 2006-09-22 20:45:04.000000000 -0400
24763@@ -81,7 +81,7 @@ __mutex_lock_slowpath(atomic_t *lock_cou
24764 *
24765 * This function is similar to (but not equivalent to) down().
24766 */
24767-void inline fastcall __sched mutex_lock(struct mutex *lock)
24768+inline void fastcall __sched mutex_lock(struct mutex *lock)
24769 {
24770 might_sleep();
24771 /*
24772diff -urNp linux-2.6.18/kernel/pid.c linux-2.6.18/kernel/pid.c
24773--- linux-2.6.18/kernel/pid.c 2006-09-19 23:42:06.000000000 -0400
24774+++ linux-2.6.18/kernel/pid.c 2006-09-22 22:23:55.000000000 -0400
24775@@ -26,6 +26,7 @@
24776 #include <linux/init.h>
24777 #include <linux/bootmem.h>
24778 #include <linux/hash.h>
24779+#include <linux/grsecurity.h>
24780
24781 #define pid_hashfn(nr) hash_long((unsigned long)nr, pidhash_shift)
24782 static struct hlist_head *pid_hash;
24783@@ -90,7 +91,9 @@ static int alloc_pidmap(void)
24784 int i, offset, max_scan, pid, last = last_pid;
24785 pidmap_t *map;
24786
24787- pid = last + 1;
24788+ pid = gr_random_pid();
24789+ if (!pid)
24790+ pid = last_pid + 1;
24791 if (pid >= pid_max)
24792 pid = RESERVED_PIDS;
24793 offset = pid & BITS_PER_PAGE_MASK;
24794@@ -269,7 +272,14 @@ struct task_struct * fastcall pid_task(s
24795 */
24796 struct task_struct *find_task_by_pid_type(int type, int nr)
24797 {
24798- return pid_task(find_pid(nr), type);
24799+ struct task_struct *task;
24800+
24801+ task = pid_task(find_pid(nr), type);
24802+
24803+ if (gr_pid_is_chrooted(task))
24804+ return NULL;
24805+
24806+ return task;
24807 }
24808
24809 EXPORT_SYMBOL(find_task_by_pid_type);
24810@@ -279,6 +289,8 @@ struct task_struct *fastcall get_pid_tas
24811 struct task_struct *result;
24812 rcu_read_lock();
24813 result = pid_task(pid, type);
24814+ if (gr_pid_is_chrooted(result))
24815+ result = NULL;
24816 if (result)
24817 get_task_struct(result);
24818 rcu_read_unlock();
24819diff -urNp linux-2.6.18/kernel/posix-cpu-timers.c linux-2.6.18/kernel/posix-cpu-timers.c
24820--- linux-2.6.18/kernel/posix-cpu-timers.c 2006-09-19 23:42:06.000000000 -0400
24821+++ linux-2.6.18/kernel/posix-cpu-timers.c 2006-09-22 20:04:35.000000000 -0400
24822@@ -6,6 +6,7 @@
24823 #include <linux/posix-timers.h>
24824 #include <asm/uaccess.h>
24825 #include <linux/errno.h>
24826+#include <linux/grsecurity.h>
24827
24828 static int check_clock(const clockid_t which_clock)
24829 {
24830@@ -1125,6 +1126,7 @@ static void check_process_timers(struct
24831 __group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
24832 return;
24833 }
24834+ gr_learn_resource(tsk, RLIMIT_CPU, psecs, 1);
24835 if (psecs >= sig->rlim[RLIMIT_CPU].rlim_cur) {
24836 /*
24837 * At the soft limit, send a SIGXCPU every second.
24838diff -urNp linux-2.6.18/kernel/printk.c linux-2.6.18/kernel/printk.c
24839--- linux-2.6.18/kernel/printk.c 2006-09-19 23:42:06.000000000 -0400
24840+++ linux-2.6.18/kernel/printk.c 2006-09-22 20:04:35.000000000 -0400
24841@@ -31,6 +31,7 @@
24842 #include <linux/security.h>
24843 #include <linux/bootmem.h>
24844 #include <linux/syscalls.h>
24845+#include <linux/grsecurity.h>
24846
24847 #include <asm/uaccess.h>
24848
24849@@ -186,6 +187,11 @@ int do_syslog(int type, char __user *buf
24850 char c;
24851 int error = 0;
24852
24853+#ifdef CONFIG_GRKERNSEC_DMESG
24854+ if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
24855+ return -EPERM;
24856+#endif
24857+
24858 error = security_syslog(type);
24859 if (error)
24860 return error;
24861diff -urNp linux-2.6.18/kernel/ptrace.c linux-2.6.18/kernel/ptrace.c
24862--- linux-2.6.18/kernel/ptrace.c 2006-09-19 23:42:06.000000000 -0400
24863+++ linux-2.6.18/kernel/ptrace.c 2006-09-22 20:19:31.000000000 -0400
24864@@ -18,6 +18,7 @@
24865 #include <linux/ptrace.h>
24866 #include <linux/security.h>
24867 #include <linux/signal.h>
24868+#include <linux/grsecurity.h>
24869
24870 #include <asm/pgtable.h>
24871 #include <asm/uaccess.h>
24872@@ -137,12 +138,12 @@ static int may_attach(struct task_struct
24873 (current->uid != task->uid) ||
24874 (current->gid != task->egid) ||
24875 (current->gid != task->sgid) ||
24876- (current->gid != task->gid)) && !capable(CAP_SYS_PTRACE))
24877+ (current->gid != task->gid)) && !capable_nolog(CAP_SYS_PTRACE))
24878 return -EPERM;
24879 smp_rmb();
24880 if (task->mm)
24881 dumpable = task->mm->dumpable;
24882- if (!dumpable && !capable(CAP_SYS_PTRACE))
24883+ if (!dumpable && !capable_nolog(CAP_SYS_PTRACE))
24884 return -EPERM;
24885
24886 return security_ptrace(current, task);
24887@@ -530,6 +531,11 @@ asmlinkage long sys_ptrace(long request,
24888 if (ret < 0)
24889 goto out_put_task_struct;
24890
24891+ if (gr_handle_ptrace(child, request)) {
24892+ ret = -EPERM;
24893+ goto out_put_task_struct;
24894+ }
24895+
24896 ret = arch_ptrace(child, request, addr, data);
24897 if (ret < 0)
24898 goto out_put_task_struct;
24899diff -urNp linux-2.6.18/kernel/resource.c linux-2.6.18/kernel/resource.c
24900--- linux-2.6.18/kernel/resource.c 2006-09-19 23:42:06.000000000 -0400
24901+++ linux-2.6.18/kernel/resource.c 2006-09-22 20:04:35.000000000 -0400
24902@@ -133,10 +133,27 @@ static int __init ioresources_init(void)
24903 {
24904 struct proc_dir_entry *entry;
24905
24906+#ifdef CONFIG_GRKERNSEC_PROC_ADD
24907+#ifdef CONFIG_GRKERNSEC_PROC_USER
24908+ entry = create_proc_entry("ioports", S_IRUSR, NULL);
24909+#elif CONFIG_GRKERNSEC_PROC_USERGROUP
24910+ entry = create_proc_entry("ioports", S_IRUSR | S_IRGRP, NULL);
24911+#endif
24912+#else
24913 entry = create_proc_entry("ioports", 0, NULL);
24914+#endif
24915 if (entry)
24916 entry->proc_fops = &proc_ioports_operations;
24917+
24918+#ifdef CONFIG_GRKERNSEC_PROC_ADD
24919+#ifdef CONFIG_GRKERNSEC_PROC_USER
24920+ entry = create_proc_entry("iomem", S_IRUSR, NULL);
24921+#elif CONFIG_GRKERNSEC_PROC_USERGROUP
24922+ entry = create_proc_entry("iomem", S_IRUSR | S_IRGRP, NULL);
24923+#endif
24924+#else
24925 entry = create_proc_entry("iomem", 0, NULL);
24926+#endif
24927 if (entry)
24928 entry->proc_fops = &proc_iomem_operations;
24929 return 0;
24930diff -urNp linux-2.6.18/kernel/sched.c linux-2.6.18/kernel/sched.c
24931--- linux-2.6.18/kernel/sched.c 2006-09-19 23:42:06.000000000 -0400
24932+++ linux-2.6.18/kernel/sched.c 2006-09-22 20:18:35.000000000 -0400
24933@@ -52,6 +52,7 @@
24934 #include <linux/acct.h>
24935 #include <linux/kprobes.h>
24936 #include <linux/delayacct.h>
24937+#include <linux/grsecurity.h>
24938 #include <asm/tlb.h>
24939
24940 #include <asm/unistd.h>
24941@@ -3956,7 +3957,8 @@ asmlinkage long sys_nice(int increment)
24942 if (nice > 19)
24943 nice = 19;
24944
24945- if (increment < 0 && !can_nice(current, nice))
24946+ if (increment < 0 && (!can_nice(current, nice) ||
24947+ gr_handle_chroot_nice()))
24948 return -EPERM;
24949
24950 retval = security_task_setnice(current, nice);
24951diff -urNp linux-2.6.18/kernel/signal.c linux-2.6.18/kernel/signal.c
24952--- linux-2.6.18/kernel/signal.c 2006-09-19 23:42:06.000000000 -0400
24953+++ linux-2.6.18/kernel/signal.c 2006-09-22 20:25:59.000000000 -0400
24954@@ -23,6 +23,7 @@
24955 #include <linux/ptrace.h>
24956 #include <linux/signal.h>
24957 #include <linux/capability.h>
24958+#include <linux/grsecurity.h>
24959 #include <asm/param.h>
24960 #include <asm/uaccess.h>
24961 #include <asm/unistd.h>
24962@@ -576,16 +577,18 @@ static int check_kill_permission(int sig
24963 return error;
24964 error = -EPERM;
24965 if ((info == SEND_SIG_NOINFO || (!is_si_special(info) && SI_FROMUSER(info)))
24966- && ((sig != SIGCONT) ||
24967+ && ((((sig != SIGCONT) ||
24968 (current->signal->session != t->signal->session))
24969 && (current->euid ^ t->suid) && (current->euid ^ t->uid)
24970 && (current->uid ^ t->suid) && (current->uid ^ t->uid)
24971- && !capable(CAP_KILL))
24972+ && !capable(CAP_KILL)) || gr_handle_signal(t, sig)))
24973 return error;
24974
24975 error = security_task_kill(t, info, sig, 0);
24976- if (!error)
24977+ if (!error) {
24978 audit_signal_info(sig, t); /* Let audit system see the signal */
24979+ gr_log_signal(sig, t);
24980+ }
24981 return error;
24982 }
24983
24984@@ -763,7 +766,7 @@ out_set:
24985 (((sig) < SIGRTMIN) && sigismember(&(sigptr)->signal, (sig)))
24986
24987
24988-static int
24989+int
24990 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
24991 {
24992 int ret = 0;
24993@@ -817,6 +820,10 @@ force_sig_info(int sig, struct siginfo *
24994 }
24995 }
24996 ret = specific_send_sig_info(sig, info, t);
24997+
24998+ gr_log_signal(sig, t);
24999+ gr_handle_crash(t, sig);
25000+
25001 spin_unlock_irqrestore(&t->sighand->siglock, flags);
25002
25003 return ret;
25004diff -urNp linux-2.6.18/kernel/sys.c linux-2.6.18/kernel/sys.c
25005--- linux-2.6.18/kernel/sys.c 2006-09-19 23:42:06.000000000 -0400
25006+++ linux-2.6.18/kernel/sys.c 2006-09-22 20:45:04.000000000 -0400
25007@@ -28,6 +28,7 @@
25008 #include <linux/tty.h>
25009 #include <linux/signal.h>
25010 #include <linux/cn_proc.h>
25011+#include <linux/grsecurity.h>
25012
25013 #include <linux/compat.h>
25014 #include <linux/syscalls.h>
25015@@ -447,6 +448,12 @@ static int set_one_prio(struct task_stru
25016 error = -EACCES;
25017 goto out;
25018 }
25019+
25020+ if (gr_handle_chroot_setpriority(p, niceval)) {
25021+ error = -EACCES;
25022+ goto out;
25023+ }
25024+
25025 no_nice = security_task_setnice(p, niceval);
25026 if (no_nice) {
25027 error = no_nice;
25028@@ -835,6 +842,9 @@ asmlinkage long sys_setregid(gid_t rgid,
25029 if (rgid != (gid_t) -1 ||
25030 (egid != (gid_t) -1 && egid != old_rgid))
25031 current->sgid = new_egid;
25032+
25033+ gr_set_role_label(current, current->uid, new_rgid);
25034+
25035 current->fsgid = new_egid;
25036 current->egid = new_egid;
25037 current->gid = new_rgid;
25038@@ -864,6 +874,9 @@ asmlinkage long sys_setgid(gid_t gid)
25039 current->mm->dumpable = suid_dumpable;
25040 smp_wmb();
25041 }
25042+
25043+ gr_set_role_label(current, current->uid, gid);
25044+
25045 current->gid = current->egid = current->sgid = current->fsgid = gid;
25046 }
25047 else if ((gid == current->gid) || (gid == current->sgid))
25048@@ -905,6 +918,9 @@ static int set_user(uid_t new_ruid, int
25049 current->mm->dumpable = suid_dumpable;
25050 smp_wmb();
25051 }
25052+
25053+ gr_set_role_label(current, new_ruid, current->gid);
25054+
25055 current->uid = new_ruid;
25056 return 0;
25057 }
25058@@ -1008,6 +1024,9 @@ asmlinkage long sys_setuid(uid_t uid)
25059 } else if ((uid != current->uid) && (uid != new_suid))
25060 return -EPERM;
25061
25062+ if (gr_check_crash_uid(uid))
25063+ return -EPERM;
25064+
25065 if (old_euid != uid)
25066 {
25067 current->mm->dumpable = suid_dumpable;
25068@@ -1113,8 +1132,10 @@ asmlinkage long sys_setresgid(gid_t rgid
25069 current->egid = egid;
25070 }
25071 current->fsgid = current->egid;
25072- if (rgid != (gid_t) -1)
25073+ if (rgid != (gid_t) -1) {
25074+ gr_set_role_label(current, current->uid, rgid);
25075 current->gid = rgid;
25076+ }
25077 if (sgid != (gid_t) -1)
25078 current->sgid = sgid;
25079
25080@@ -1983,7 +2004,7 @@ asmlinkage long sys_prctl(int option, un
25081 error = current->mm->dumpable;
25082 break;
25083 case PR_SET_DUMPABLE:
25084- if (arg2 < 0 || arg2 > 1) {
25085+ if (arg2 > 1) {
25086 error = -EINVAL;
25087 break;
25088 }
25089diff -urNp linux-2.6.18/kernel/sysctl.c linux-2.6.18/kernel/sysctl.c
25090--- linux-2.6.18/kernel/sysctl.c 2006-09-19 23:42:06.000000000 -0400
25091+++ linux-2.6.18/kernel/sysctl.c 2006-09-23 00:26:32.000000000 -0400
25092@@ -53,6 +53,14 @@ extern int proc_nr_files(ctl_table *tabl
25093 void __user *buffer, size_t *lenp, loff_t *ppos);
25094
25095 #if defined(CONFIG_SYSCTL)
25096+#include <linux/grsecurity.h>
25097+#include <linux/grinternal.h>
25098+
25099+extern __u32 gr_handle_sysctl(const ctl_table *table, const void *oldval,
25100+ const void *newval);
25101+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
25102+ const int op);
25103+extern int gr_handle_chroot_sysctl(const int op);
25104
25105 /* External variables not in a header file. */
25106 extern int C_A_D;
25107@@ -161,6 +169,22 @@ extern ctl_table inotify_table[];
25108 #ifdef HAVE_ARCH_PICK_MMAP_LAYOUT
25109 int sysctl_legacy_va_layout;
25110 #endif
25111+extern ctl_table grsecurity_table[];
25112+
25113+#ifdef CONFIG_PAX_SOFTMODE
25114+static ctl_table pax_table[] = {
25115+ {
25116+ .ctl_name = PAX_SOFTMODE,
25117+ .procname = "softmode",
25118+ .data = &pax_softmode,
25119+ .maxlen = sizeof(unsigned int),
25120+ .mode = 0600,
25121+ .proc_handler = &proc_dointvec,
25122+ },
25123+
25124+ { .ctl_name = 0 }
25125+};
25126+#endif
25127
25128 /* /proc declarations: */
25129
25130@@ -702,6 +726,24 @@ static ctl_table kern_table[] = {
25131 },
25132 #endif
25133
25134+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_MODSTOP)
25135+ {
25136+ .ctl_name = KERN_GRSECURITY,
25137+ .procname = "grsecurity",
25138+ .mode = 0500,
25139+ .child = grsecurity_table,
25140+ },
25141+#endif
25142+
25143+#ifdef CONFIG_PAX_SOFTMODE
25144+ {
25145+ .ctl_name = KERN_PAX,
25146+ .procname = "pax",
25147+ .mode = 0500,
25148+ .child = pax_table,
25149+ },
25150+#endif
25151+
25152 { .ctl_name = 0 }
25153 };
25154
25155@@ -1217,6 +1259,10 @@ static int test_perm(int mode, int op)
25156 static inline int ctl_perm(ctl_table *table, int op)
25157 {
25158 int error;
25159+ if (table->de && gr_handle_sysctl_mod(table->de->parent->name, table->de->name, op))
25160+ return -EACCES;
25161+ if (gr_handle_chroot_sysctl(op))
25162+ return -EACCES;
25163 error = security_sysctl(table, op);
25164 if (error)
25165 return error;
25166@@ -1253,6 +1299,10 @@ repeat:
25167 table = table->child;
25168 goto repeat;
25169 }
25170+
25171+ if (!gr_handle_sysctl(table, oldval, newval))
25172+ return -EPERM;
25173+
25174 error = do_sysctl_strategy(table, name, nlen,
25175 oldval, oldlenp,
25176 newval, newlen, context);
25177diff -urNp linux-2.6.18/kernel/time.c linux-2.6.18/kernel/time.c
25178--- linux-2.6.18/kernel/time.c 2006-09-19 23:42:06.000000000 -0400
25179+++ linux-2.6.18/kernel/time.c 2006-09-22 20:04:35.000000000 -0400
25180@@ -36,6 +36,7 @@
25181 #include <linux/security.h>
25182 #include <linux/fs.h>
25183 #include <linux/module.h>
25184+#include <linux/grsecurity.h>
25185
25186 #include <asm/uaccess.h>
25187 #include <asm/unistd.h>
25188@@ -93,6 +94,9 @@ asmlinkage long sys_stime(time_t __user
25189 return err;
25190
25191 do_settimeofday(&tv);
25192+
25193+ gr_log_timechange();
25194+
25195 return 0;
25196 }
25197
25198@@ -199,6 +203,8 @@ asmlinkage long sys_settimeofday(struct
25199 return -EFAULT;
25200 }
25201
25202+ gr_log_timechange();
25203+
25204 return do_sys_settimeofday(tv ? &new_ts : NULL, tz ? &new_tz : NULL);
25205 }
25206
25207diff -urNp linux-2.6.18/kernel/unwind.c linux-2.6.18/kernel/unwind.c
25208--- linux-2.6.18/kernel/unwind.c 2006-09-19 23:42:06.000000000 -0400
25209+++ linux-2.6.18/kernel/unwind.c 2006-09-22 20:45:04.000000000 -0400
25210@@ -189,8 +189,8 @@ void *unwind_add_table(struct module *mo
25211 return NULL;
25212
25213 init_unwind_table(table, module->name,
25214- module->module_core, module->core_size,
25215- module->module_init, module->init_size,
25216+ module->module_core_rx, module->core_size_rx,
25217+ module->module_init_rx, module->init_size_rx,
25218 table_start, table_size);
25219
25220 if (last_table)
25221diff -urNp linux-2.6.18/localversion-grsec linux-2.6.18/localversion-grsec
25222--- linux-2.6.18/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
25223+++ linux-2.6.18/localversion-grsec 2006-09-22 20:04:35.000000000 -0400
25224@@ -0,0 +1 @@
25225+-grsec
25226diff -urNp linux-2.6.18/Makefile linux-2.6.18/Makefile
25227--- linux-2.6.18/Makefile 2006-09-19 23:42:06.000000000 -0400
25228+++ linux-2.6.18/Makefile 2006-09-22 20:45:03.000000000 -0400
25229@@ -307,7 +307,7 @@ LINUXINCLUDE := -Iinclude \
25230
25231 CPPFLAGS := -D__KERNEL__ $(LINUXINCLUDE)
25232
25233-CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
25234+CFLAGS := -Wall -Wextra -Wno-unused -Wno-sign-compare -Wundef -Wstrict-prototypes -Wno-trigraphs \
25235 -fno-strict-aliasing -fno-common
25236 AFLAGS := -D__ASSEMBLY__
25237
25238@@ -552,7 +552,7 @@ export mod_strip_cmd
25239
25240
25241 ifeq ($(KBUILD_EXTMOD),)
25242-core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
25243+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
25244
25245 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
25246 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
25247diff -urNp linux-2.6.18/mm/filemap.c linux-2.6.18/mm/filemap.c
25248--- linux-2.6.18/mm/filemap.c 2006-09-19 23:42:06.000000000 -0400
25249+++ linux-2.6.18/mm/filemap.c 2006-09-22 20:45:04.000000000 -0400
25250@@ -30,6 +30,7 @@
25251 #include <linux/security.h>
25252 #include <linux/syscalls.h>
25253 #include <linux/cpuset.h>
25254+#include <linux/grsecurity.h>
25255 #include "filemap.h"
25256 #include "internal.h"
25257
25258@@ -1737,7 +1738,13 @@ int generic_file_mmap(struct file * file
25259 struct address_space *mapping = file->f_mapping;
25260
25261 if (!mapping->a_ops->readpage)
25262- return -ENOEXEC;
25263+ return -ENODEV;
25264+
25265+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
25266+ if ((vma->vm_mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_EXEC))
25267+ vma->vm_page_prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(vma->vm_page_prot)))));
25268+#endif
25269+
25270 file_accessed(file);
25271 vma->vm_ops = &generic_file_vm_ops;
25272 return 0;
25273@@ -1960,6 +1967,7 @@ inline int generic_write_checks(struct f
25274 *pos = i_size_read(inode);
25275
25276 if (limit != RLIM_INFINITY) {
25277+ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
25278 if (*pos >= limit) {
25279 send_sig(SIGXFSZ, current, 0);
25280 return -EFBIG;
25281diff -urNp linux-2.6.18/mm/madvise.c linux-2.6.18/mm/madvise.c
25282--- linux-2.6.18/mm/madvise.c 2006-09-19 23:42:06.000000000 -0400
25283+++ linux-2.6.18/mm/madvise.c 2006-09-22 20:45:04.000000000 -0400
25284@@ -15,9 +15,46 @@
25285 * We can potentially split a vm area into separate
25286 * areas, each area with its own behavior.
25287 */
25288+
25289+#ifdef CONFIG_PAX_SEGMEXEC
25290+static long __madvise_behavior(struct vm_area_struct * vma,
25291+ struct vm_area_struct **prev,
25292+ unsigned long start, unsigned long end, int behavior);
25293+
25294+static long madvise_behavior(struct vm_area_struct * vma,
25295+ struct vm_area_struct **prev,
25296+ unsigned long start, unsigned long end, int behavior)
25297+{
25298+ if (vma->vm_flags & VM_MIRROR) {
25299+ struct vm_area_struct * vma_m, * prev_m;
25300+ unsigned long start_m, end_m;
25301+ int error;
25302+
25303+ start_m = vma->vm_start + vma->vm_mirror;
25304+ vma_m = find_vma_prev(vma->vm_mm, start_m, &prev_m);
25305+ if (vma_m && vma_m->vm_start == start_m && (vma_m->vm_flags & VM_MIRROR)) {
25306+ start_m = start + vma->vm_mirror;
25307+ end_m = end + vma->vm_mirror;
25308+ error = __madvise_behavior(vma_m, &prev_m, start_m, end_m, behavior);
25309+ if (error)
25310+ return error;
25311+ } else {
25312+ printk("PAX: VMMIRROR: madvise bug in %s, %08lx\n", current->comm, vma->vm_start);
25313+ return -ENOMEM;
25314+ }
25315+ }
25316+
25317+ return __madvise_behavior(vma, prev, start, end, behavior);
25318+}
25319+
25320+static long __madvise_behavior(struct vm_area_struct * vma,
25321+ struct vm_area_struct **prev,
25322+ unsigned long start, unsigned long end, int behavior)
25323+#else
25324 static long madvise_behavior(struct vm_area_struct * vma,
25325 struct vm_area_struct **prev,
25326 unsigned long start, unsigned long end, int behavior)
25327+#endif
25328 {
25329 struct mm_struct * mm = vma->vm_mm;
25330 int error = 0;
25331diff -urNp linux-2.6.18/mm/memory.c linux-2.6.18/mm/memory.c
25332--- linux-2.6.18/mm/memory.c 2006-09-19 23:42:06.000000000 -0400
25333+++ linux-2.6.18/mm/memory.c 2006-09-22 20:45:04.000000000 -0400
25334@@ -49,6 +49,7 @@
25335 #include <linux/module.h>
25336 #include <linux/delayacct.h>
25337 #include <linux/init.h>
25338+#include <linux/grsecurity.h>
25339
25340 #include <asm/pgalloc.h>
25341 #include <asm/uaccess.h>
25342@@ -321,6 +322,11 @@ int __pte_alloc(struct mm_struct *mm, pm
25343
25344 int __pte_alloc_kernel(pmd_t *pmd, unsigned long address)
25345 {
25346+
25347+#ifdef CONFIG_PAX_KERNEXEC
25348+ unsigned long cr0;
25349+#endif
25350+
25351 pte_t *new = pte_alloc_one_kernel(&init_mm, address);
25352 if (!new)
25353 return -ENOMEM;
25354@@ -328,8 +334,19 @@ int __pte_alloc_kernel(pmd_t *pmd, unsig
25355 spin_lock(&init_mm.page_table_lock);
25356 if (pmd_present(*pmd)) /* Another has populated it */
25357 pte_free_kernel(new);
25358- else
25359+ else {
25360+
25361+#ifdef CONFIG_PAX_KERNEXEC
25362+ pax_open_kernel(cr0);
25363+#endif
25364+
25365 pmd_populate_kernel(&init_mm, pmd, new);
25366+
25367+#ifdef CONFIG_PAX_KERNEXEC
25368+ pax_close_kernel(cr0);
25369+#endif
25370+
25371+ }
25372 spin_unlock(&init_mm.page_table_lock);
25373 return 0;
25374 }
25375@@ -1434,6 +1451,88 @@ static inline void cow_user_page(struct
25376 copy_user_highpage(dst, src, va);
25377 }
25378
25379+#ifdef CONFIG_PAX_SEGMEXEC
25380+/* PaX: if vma is mirrored, synchronize the mirror's PTE
25381+ *
25382+ * the ptl of the lower mapped page is held on entry and is not released on exit
25383+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
25384+ */
25385+static void pax_mirror_fault(struct vm_area_struct *vma, unsigned long address, pte_t *pte)
25386+{
25387+ struct mm_struct *mm = vma->vm_mm;
25388+ unsigned long address_m, pfn_m;
25389+ struct vm_area_struct * vma_m = NULL;
25390+ pte_t * pte_m, entry_m;
25391+ struct page * page_m = NULL;
25392+
25393+ address_m = vma->vm_start + vma->vm_mirror;
25394+ vma_m = find_vma(mm, address_m);
25395+ BUG_ON(!vma_m || vma_m->vm_start != address_m);
25396+
25397+ address_m = address + vma->vm_mirror;
25398+ pte_m = pte_offset_map_nested(pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m), address_m);
25399+
25400+ if (pte_same(*pte, *pte_m)) {
25401+ pte_unmap_nested(pte_m);
25402+ return;
25403+ }
25404+
25405+ pfn_m = pte_pfn(*pte);
25406+ if (pte_present(*pte_m)) {
25407+ page_m = vm_normal_page(vma_m, address_m, *pte_m);
25408+ if (page_m) {
25409+ flush_cache_page(vma_m, address_m, pfn_m);
25410+ flush_icache_page(vma_m, page_m);
25411+ }
25412+ }
25413+
25414+ if (pte_present(*pte_m))
25415+ entry_m = ptep_clear_flush(vma_m, address_m, pte_m);
25416+ else
25417+ entry_m = ptep_get_and_clear(mm, address_m, pte_m);
25418+
25419+ if (pte_none(entry_m)) {
25420+ } else if (pte_present(entry_m)) {
25421+ if (page_m) {
25422+ page_remove_rmap(page_m);
25423+ if (PageAnon(page_m))
25424+ dec_mm_counter(mm, anon_rss);
25425+ else
25426+ dec_mm_counter(mm, file_rss);
25427+ page_cache_release(page_m);
25428+ }
25429+ } else if (!pte_file(entry_m)) {
25430+ free_swap_and_cache(pte_to_swp_entry(entry_m));
25431+ } else {
25432+ printk(KERN_ERR "PAX: VMMIRROR: bug in mirror_fault: %08lx, %08lx, %08lx, %08lx\n",
25433+ address, vma->vm_start, address_m, vma_m->vm_start);
25434+ }
25435+
25436+ page_m = vm_normal_page(vma, address, *pte);
25437+ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
25438+ if (pte_write(*pte))
25439+ entry_m = maybe_mkwrite(pte_mkdirty(entry_m), vma_m);
25440+ if (page_m) {
25441+ page_cache_get(page_m);
25442+ /*
25443+ * we can test PAGE_MAPPING_ANON without holding page_map_lock because
25444+ * we hold the page table lock and have a reference to page_m
25445+ */
25446+ if (PageAnon(page_m)) {
25447+ page_add_anon_rmap(page_m, vma_m, address_m);
25448+ inc_mm_counter(mm, anon_rss);
25449+ } else {
25450+ page_add_file_rmap(page_m);
25451+ inc_mm_counter(mm, file_rss);
25452+ }
25453+ }
25454+ set_pte_at(mm, address_m, pte_m, entry_m);
25455+ update_mmu_cache(vma_m, address_m, entry_m);
25456+ lazy_mmu_prot_update(entry_m);
25457+ pte_unmap_nested(pte_m);
25458+}
25459+#endif
25460+
25461 /*
25462 * This routine handles present pages, when users try to write
25463 * to a shared page. It is done by copying the page to a new address
25464@@ -1559,6 +1658,12 @@ gotten:
25465 /* Free the old page.. */
25466 new_page = old_page;
25467 ret |= VM_FAULT_WRITE;
25468+
25469+#ifdef CONFIG_PAX_SEGMEXEC
25470+ if (vma->vm_flags & VM_MIRROR)
25471+ pax_mirror_fault(vma, address, page_table);
25472+#endif
25473+
25474 }
25475 if (new_page)
25476 page_cache_release(new_page);
25477@@ -1813,6 +1918,7 @@ int vmtruncate(struct inode * inode, lof
25478
25479 do_expand:
25480 limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
25481+ gr_learn_resource(current, RLIMIT_FSIZE, offset, 1);
25482 if (limit != RLIM_INFINITY && offset > limit)
25483 goto out_sig;
25484 if (offset > inode->i_sb->s_maxbytes)
25485@@ -2002,6 +2108,12 @@ static int do_swap_page(struct mm_struct
25486 /* No need to invalidate - it was non-present before */
25487 update_mmu_cache(vma, address, pte);
25488 lazy_mmu_prot_update(pte);
25489+
25490+#ifdef CONFIG_PAX_SEGMEXEC
25491+ if (vma->vm_flags & VM_MIRROR)
25492+ pax_mirror_fault(vma, address, page_table);
25493+#endif
25494+
25495 unlock:
25496 pte_unmap_unlock(page_table, ptl);
25497 out:
25498@@ -2064,6 +2176,12 @@ static int do_anonymous_page(struct mm_s
25499 /* No need to invalidate - it was non-present before */
25500 update_mmu_cache(vma, address, entry);
25501 lazy_mmu_prot_update(entry);
25502+
25503+#ifdef CONFIG_PAX_SEGMEXEC
25504+ if (vma->vm_flags & VM_MIRROR)
25505+ pax_mirror_fault(vma, address, page_table);
25506+#endif
25507+
25508 unlock:
25509 pte_unmap_unlock(page_table, ptl);
25510 return VM_FAULT_MINOR;
25511@@ -2202,6 +2320,12 @@ retry:
25512 /* no need to invalidate: a not-present page shouldn't be cached */
25513 update_mmu_cache(vma, address, entry);
25514 lazy_mmu_prot_update(entry);
25515+
25516+#ifdef CONFIG_PAX_SEGMEXEC
25517+ if (vma->vm_flags & VM_MIRROR)
25518+ pax_mirror_fault(vma, address, page_table);
25519+#endif
25520+
25521 unlock:
25522 pte_unmap_unlock(page_table, ptl);
25523 return ret;
25524@@ -2311,6 +2435,12 @@ static inline int handle_pte_fault(struc
25525 flush_tlb_page(vma, address);
25526 }
25527 unlock:
25528+
25529+#ifdef CONFIG_PAX_SEGMEXEC
25530+ if (vma->vm_flags & VM_MIRROR)
25531+ pax_mirror_fault(vma, address, pte);
25532+#endif
25533+
25534 pte_unmap_unlock(pte, ptl);
25535 return VM_FAULT_MINOR;
25536 }
25537@@ -2333,6 +2463,49 @@ int __handle_mm_fault(struct mm_struct *
25538 if (unlikely(is_vm_hugetlb_page(vma)))
25539 return hugetlb_fault(mm, vma, address, write_access);
25540
25541+#ifdef CONFIG_PAX_SEGMEXEC
25542+ if (vma->vm_flags & VM_MIRROR) {
25543+ unsigned long address_m;
25544+ struct vm_area_struct * vma_m;
25545+ pgd_t *pgd_m;
25546+ pud_t *pud_m;
25547+ pmd_t *pmd_m;
25548+
25549+ address_m = vma->vm_start + vma->vm_mirror;
25550+ vma_m = find_vma(mm, address_m);
25551+
25552+ /* PaX: sanity checks */
25553+ if (!vma_m) {
25554+ printk(KERN_ERR "PAX: VMMIRROR: fault bug, %08lx, %p, %08lx, %p\n",
25555+ address, vma, address_m, vma_m);
25556+ return VM_FAULT_SIGBUS;
25557+ } else if (!(vma_m->vm_flags & VM_MIRROR) ||
25558+ vma_m->vm_start != address_m ||
25559+ vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start)
25560+ {
25561+ printk(KERN_ERR "PAX: VMMIRROR: fault bug2, %08lx, %08lx, %08lx, %08lx, %08lx\n",
25562+ address, vma->vm_start, vma_m->vm_start, vma->vm_end, vma_m->vm_end);
25563+ return VM_FAULT_SIGBUS;
25564+ }
25565+
25566+ if (address_m < address) {
25567+ address += vma->vm_mirror;
25568+ vma = vma_m;
25569+ }
25570+
25571+ address_m = address + vma->vm_mirror;
25572+ pgd_m = pgd_offset(mm, address_m);
25573+ pud_m = pud_alloc(mm, pgd_m, address_m);
25574+ if (!pud_m)
25575+ return VM_FAULT_OOM;
25576+ pmd_m = pmd_alloc(mm, pud_m, address_m);
25577+ if (!pmd_m)
25578+ return VM_FAULT_OOM;
25579+ if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
25580+ return VM_FAULT_OOM;
25581+ }
25582+#endif
25583+
25584 pgd = pgd_offset(mm, address);
25585 pud = pud_alloc(mm, pgd, address);
25586 if (!pud)
25587diff -urNp linux-2.6.18/mm/mempolicy.c linux-2.6.18/mm/mempolicy.c
25588--- linux-2.6.18/mm/mempolicy.c 2006-09-19 23:42:06.000000000 -0400
25589+++ linux-2.6.18/mm/mempolicy.c 2006-09-22 20:45:04.000000000 -0400
25590@@ -348,6 +348,12 @@ check_range(struct mm_struct *mm, unsign
25591 if (prev && prev->vm_end < vma->vm_start)
25592 return ERR_PTR(-EFAULT);
25593 }
25594+
25595+#ifdef CONFIG_PAX_SEGMEXEC
25596+ if (vma->vm_flags & VM_MIRROR)
25597+ return ERR_PTR(-EFAULT);
25598+#endif
25599+
25600 if (!is_vm_hugetlb_page(vma) &&
25601 ((flags & MPOL_MF_STRICT) ||
25602 ((flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) &&
25603diff -urNp linux-2.6.18/mm/mlock.c linux-2.6.18/mm/mlock.c
25604--- linux-2.6.18/mm/mlock.c 2006-09-19 23:42:06.000000000 -0400
25605+++ linux-2.6.18/mm/mlock.c 2006-09-22 20:45:04.000000000 -0400
25606@@ -10,14 +10,85 @@
25607 #include <linux/mm.h>
25608 #include <linux/mempolicy.h>
25609 #include <linux/syscalls.h>
25610+#include <linux/grsecurity.h>
25611
25612+static int __mlock_fixup(struct vm_area_struct *vma, struct vm_area_struct **prev,
25613+ unsigned long start, unsigned long end, unsigned int newflags);
25614
25615 static int mlock_fixup(struct vm_area_struct *vma, struct vm_area_struct **prev,
25616 unsigned long start, unsigned long end, unsigned int newflags)
25617 {
25618 struct mm_struct * mm = vma->vm_mm;
25619- pgoff_t pgoff;
25620 int pages;
25621+ int ret;
25622+
25623+#ifdef CONFIG_PAX_SEGMEXEC
25624+ struct vm_area_struct * vma_m = NULL, *prev_m;
25625+ unsigned long start_m = 0UL, end_m = 0UL, newflags_m = 0UL;
25626+
25627+ if (vma->vm_flags & VM_MIRROR) {
25628+ start_m = vma->vm_start + vma->vm_mirror;
25629+ vma_m = find_vma_prev(mm, start_m, &prev_m);
25630+ if (!vma_m || vma_m->vm_start != start_m || !(vma_m->vm_flags & VM_MIRROR)) {
25631+ printk("PAX: VMMIRROR: mlock bug in %s, %08lx\n", current->comm, vma->vm_start);
25632+ return -ENOMEM;
25633+ }
25634+
25635+ start_m = start + vma->vm_mirror;
25636+ end_m = end + vma->vm_mirror;
25637+ if (newflags & VM_LOCKED)
25638+ newflags_m = vma_m->vm_flags | VM_LOCKED;
25639+ else
25640+ newflags_m = vma_m->vm_flags & ~VM_LOCKED;
25641+ ret = __mlock_fixup(vma_m, &prev_m, start_m, end_m, newflags_m);
25642+ if (ret)
25643+ return ret;
25644+ }
25645+#endif
25646+
25647+ ret = __mlock_fixup(vma, prev, start, end, newflags);
25648+ if (ret)
25649+ return ret;
25650+
25651+ /*
25652+ * vm_flags is protected by the mmap_sem held in write mode.
25653+ * It's okay if try_to_unmap_one unmaps a page just after we
25654+ * set VM_LOCKED, make_pages_present below will bring it back.
25655+ */
25656+ vma->vm_flags = newflags;
25657+
25658+#ifdef CONFIG_PAX_SEGMEXEC
25659+ if (vma->vm_flags & VM_MIRROR)
25660+ vma_m->vm_flags = newflags_m;
25661+#endif
25662+
25663+ /*
25664+ * Keep track of amount of locked VM.
25665+ */
25666+ pages = (end - start) >> PAGE_SHIFT;
25667+ if (newflags & VM_LOCKED) {
25668+ pages = -pages;
25669+ if (!(newflags & VM_IO))
25670+ ret = make_pages_present(start, end);
25671+ }
25672+
25673+ mm->locked_vm -= pages;
25674+
25675+#ifdef CONFIG_PAX_SEGMEXEC
25676+ if (vma->vm_flags & VM_MIRROR)
25677+ mm->locked_vm -= pages;
25678+#endif
25679+
25680+ if (ret == -ENOMEM)
25681+ ret = -EAGAIN;
25682+ return ret;
25683+}
25684+
25685+static int __mlock_fixup(struct vm_area_struct *vma, struct vm_area_struct **prev,
25686+ unsigned long start, unsigned long end, unsigned int newflags)
25687+{
25688+ struct mm_struct * mm = vma->vm_mm;
25689+ pgoff_t pgoff;
25690 int ret = 0;
25691
25692 if (newflags == vma->vm_flags) {
25693@@ -30,7 +101,7 @@ static int mlock_fixup(struct vm_area_st
25694 vma->vm_file, pgoff, vma_policy(vma));
25695 if (*prev) {
25696 vma = *prev;
25697- goto success;
25698+ goto out;
25699 }
25700
25701 *prev = vma;
25702@@ -41,31 +112,9 @@ static int mlock_fixup(struct vm_area_st
25703 goto out;
25704 }
25705
25706- if (end != vma->vm_end) {
25707+ if (end != vma->vm_end)
25708 ret = split_vma(mm, vma, end, 0);
25709- if (ret)
25710- goto out;
25711- }
25712
25713-success:
25714- /*
25715- * vm_flags is protected by the mmap_sem held in write mode.
25716- * It's okay if try_to_unmap_one unmaps a page just after we
25717- * set VM_LOCKED, make_pages_present below will bring it back.
25718- */
25719- vma->vm_flags = newflags;
25720-
25721- /*
25722- * Keep track of amount of locked VM.
25723- */
25724- pages = (end - start) >> PAGE_SHIFT;
25725- if (newflags & VM_LOCKED) {
25726- pages = -pages;
25727- if (!(newflags & VM_IO))
25728- ret = make_pages_present(start, end);
25729- }
25730-
25731- vma->vm_mm->locked_vm -= pages;
25732 out:
25733 if (ret == -ENOMEM)
25734 ret = -EAGAIN;
25735@@ -84,6 +133,17 @@ static int do_mlock(unsigned long start,
25736 return -EINVAL;
25737 if (end == start)
25738 return 0;
25739+
25740+#ifdef CONFIG_PAX_SEGMEXEC
25741+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
25742+ if (end > SEGMEXEC_TASK_SIZE)
25743+ return -EINVAL;
25744+ } else
25745+#endif
25746+
25747+ if (end > TASK_SIZE)
25748+ return -EINVAL;
25749+
25750 vma = find_vma_prev(current->mm, start, &prev);
25751 if (!vma || vma->vm_start > start)
25752 return -ENOMEM;
25753@@ -141,6 +201,7 @@ asmlinkage long sys_mlock(unsigned long
25754 lock_limit >>= PAGE_SHIFT;
25755
25756 /* check against resource limits */
25757+ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
25758 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
25759 error = do_mlock(start, len, 1);
25760 up_write(&current->mm->mmap_sem);
25761@@ -173,6 +234,16 @@ static int do_mlockall(int flags)
25762 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
25763 unsigned int newflags;
25764
25765+#ifdef CONFIG_PAX_SEGMEXEC
25766+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
25767+ if (vma->vm_end > SEGMEXEC_TASK_SIZE)
25768+ break;
25769+ } else
25770+#endif
25771+
25772+ if (vma->vm_end > TASK_SIZE)
25773+ break;
25774+
25775 newflags = vma->vm_flags | VM_LOCKED;
25776 if (!(flags & MCL_CURRENT))
25777 newflags &= ~VM_LOCKED;
25778@@ -202,6 +273,7 @@ asmlinkage long sys_mlockall(int flags)
25779 lock_limit >>= PAGE_SHIFT;
25780
25781 ret = -ENOMEM;
25782+ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm, 1);
25783 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
25784 capable(CAP_IPC_LOCK))
25785 ret = do_mlockall(flags);
25786diff -urNp linux-2.6.18/mm/mmap.c linux-2.6.18/mm/mmap.c
25787--- linux-2.6.18/mm/mmap.c 2006-09-19 23:42:06.000000000 -0400
25788+++ linux-2.6.18/mm/mmap.c 2006-09-22 20:45:04.000000000 -0400
25789@@ -25,6 +25,7 @@
25790 #include <linux/mount.h>
25791 #include <linux/mempolicy.h>
25792 #include <linux/rmap.h>
25793+#include <linux/grsecurity.h>
25794
25795 #include <asm/uaccess.h>
25796 #include <asm/cacheflush.h>
25797@@ -244,6 +245,7 @@ asmlinkage unsigned long sys_brk(unsigne
25798 * not page aligned -Ram Gupta
25799 */
25800 rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
25801+ gr_learn_resource(current, RLIMIT_DATA, brk - mm->start_data, 1);
25802 if (rlim < RLIM_INFINITY && brk - mm->start_data > rlim)
25803 goto out;
25804
25805@@ -632,11 +634,17 @@ again: remove_next = 1 + (end > next->
25806 * If the vma has a ->close operation then the driver probably needs to release
25807 * per-vma resources, so we don't attempt to merge those.
25808 */
25809+#ifdef CONFIG_PAX_SEGMEXEC
25810+#define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_PFNMAP | VM_MIRROR)
25811+#else
25812 #define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_PFNMAP)
25813+#endif
25814
25815 static inline int is_mergeable_vma(struct vm_area_struct *vma,
25816 struct file *file, unsigned long vm_flags)
25817 {
25818+ if ((vma->vm_flags | vm_flags) & VM_SPECIAL)
25819+ return 0;
25820 if (vma->vm_flags != vm_flags)
25821 return 0;
25822 if (vma->vm_file != file)
25823@@ -861,14 +869,11 @@ none:
25824 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
25825 struct file *file, long pages)
25826 {
25827- const unsigned long stack_flags
25828- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
25829-
25830 if (file) {
25831 mm->shared_vm += pages;
25832 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
25833 mm->exec_vm += pages;
25834- } else if (flags & stack_flags)
25835+ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
25836 mm->stack_vm += pages;
25837 if (flags & (VM_RESERVED|VM_IO))
25838 mm->reserved_vm += pages;
25839@@ -879,9 +884,54 @@ void vm_stat_account(struct mm_struct *m
25840 * The caller must hold down_write(current->mm->mmap_sem).
25841 */
25842
25843+#ifdef CONFIG_PAX_SEGMEXEC
25844+static unsigned long __do_mmap_pgoff(struct file * file, unsigned long addr,
25845+ unsigned long len, unsigned long prot,
25846+ unsigned long flags, unsigned long pgoff);
25847+
25848+unsigned long do_mmap_pgoff(struct file * file, unsigned long addr,
25849+ unsigned long len, unsigned long prot,
25850+ unsigned long flags, unsigned long pgoff)
25851+{
25852+ unsigned long ret = -EINVAL;
25853+
25854+ if (flags & MAP_MIRROR)
25855+ return ret;
25856+
25857+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) &&
25858+ (len > SEGMEXEC_TASK_SIZE || (addr > SEGMEXEC_TASK_SIZE-len)))
25859+ return ret;
25860+
25861+ ret = __do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
25862+
25863+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && ret < TASK_SIZE && ((flags & MAP_TYPE) == MAP_PRIVATE)
25864+
25865+#ifdef CONFIG_PAX_MPROTECT
25866+ && (!(current->mm->pax_flags & MF_PAX_MPROTECT) || ((prot & PROT_EXEC) && file && !(prot & PROT_WRITE)))
25867+#endif
25868+
25869+ )
25870+ {
25871+ unsigned long ret_m;
25872+ prot = prot & PROT_EXEC ? prot & ~PROT_WRITE : PROT_NONE;
25873+ ret_m = __do_mmap_pgoff(NULL, ret + SEGMEXEC_TASK_SIZE, 0UL, prot, flags | MAP_MIRROR | MAP_FIXED, ret);
25874+ if (ret_m >= TASK_SIZE) {
25875+ do_munmap(current->mm, ret, len);
25876+ ret = ret_m;
25877+ }
25878+ }
25879+
25880+ return ret;
25881+}
25882+
25883+static unsigned long __do_mmap_pgoff(struct file * file, unsigned long addr,
25884+ unsigned long len, unsigned long prot,
25885+ unsigned long flags, unsigned long pgoff)
25886+#else
25887 unsigned long do_mmap_pgoff(struct file * file, unsigned long addr,
25888 unsigned long len, unsigned long prot,
25889 unsigned long flags, unsigned long pgoff)
25890+#endif
25891 {
25892 struct mm_struct * mm = current->mm;
25893 struct vm_area_struct * vma, * prev;
25894@@ -893,6 +943,28 @@ unsigned long do_mmap_pgoff(struct file
25895 int accountable = 1;
25896 unsigned long charged = 0, reqprot = prot;
25897
25898+#ifdef CONFIG_PAX_SEGMEXEC
25899+ struct vm_area_struct * vma_m = NULL;
25900+
25901+ if (flags & MAP_MIRROR) {
25902+ /* PaX: sanity checks, to be removed when proved to be stable */
25903+ if (file || len || ((flags & MAP_TYPE) != MAP_PRIVATE))
25904+ return -EINVAL;
25905+
25906+ vma_m = find_vma(mm, pgoff);
25907+
25908+ if (!vma_m || is_vm_hugetlb_page(vma_m) ||
25909+ vma_m->vm_start != pgoff ||
25910+ (vma_m->vm_flags & VM_SPECIAL) ||
25911+ (prot & PROT_WRITE))
25912+ return -EINVAL;
25913+
25914+ file = vma_m->vm_file;
25915+ pgoff = vma_m->vm_pgoff;
25916+ len = vma_m->vm_end - vma_m->vm_start;
25917+ }
25918+#endif
25919+
25920 if (file) {
25921 if (is_file_hugepages(file))
25922 accountable = 0;
25923@@ -910,7 +982,7 @@ unsigned long do_mmap_pgoff(struct file
25924 * (the exception is when the underlying filesystem is noexec
25925 * mounted, in which case we dont add PROT_EXEC.)
25926 */
25927- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
25928+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
25929 if (!(file && (file->f_vfsmnt->mnt_flags & MNT_NOEXEC)))
25930 prot |= PROT_EXEC;
25931
25932@@ -937,7 +1009,7 @@ unsigned long do_mmap_pgoff(struct file
25933 /* Obtain the address to map to. we verify (or select) it and ensure
25934 * that it represents a valid section of the address space.
25935 */
25936- addr = get_unmapped_area(file, addr, len, pgoff, flags);
25937+ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
25938 if (addr & ~PAGE_MASK)
25939 return addr;
25940
25941@@ -948,6 +1020,24 @@ unsigned long do_mmap_pgoff(struct file
25942 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
25943 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
25944
25945+ if (file && (file->f_vfsmnt->mnt_flags & MNT_NOEXEC))
25946+ vm_flags &= ~VM_MAYEXEC;
25947+
25948+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
25949+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
25950+
25951+#ifdef CONFIG_PAX_MPROTECT
25952+ if (mm->pax_flags & MF_PAX_MPROTECT) {
25953+ if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
25954+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
25955+ else
25956+ vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
25957+ }
25958+#endif
25959+
25960+ }
25961+#endif
25962+
25963 if (flags & MAP_LOCKED) {
25964 if (!can_do_mlock())
25965 return -EPERM;
25966@@ -960,6 +1050,7 @@ unsigned long do_mmap_pgoff(struct file
25967 locked += mm->locked_vm;
25968 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
25969 lock_limit >>= PAGE_SHIFT;
25970+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
25971 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
25972 return -EAGAIN;
25973 }
25974@@ -1007,6 +1098,11 @@ unsigned long do_mmap_pgoff(struct file
25975 /*
25976 * Set pgoff according to addr for anon_vma.
25977 */
25978+
25979+#ifdef CONFIG_PAX_SEGMEXEC
25980+ if (!(flags & MAP_MIRROR))
25981+#endif
25982+
25983 pgoff = addr >> PAGE_SHIFT;
25984 break;
25985 default:
25986@@ -1018,14 +1114,17 @@ unsigned long do_mmap_pgoff(struct file
25987 if (error)
25988 return error;
25989
25990+ if (!gr_acl_handle_mmap(file, prot))
25991+ return -EACCES;
25992+
25993 /* Clear old maps */
25994 error = -ENOMEM;
25995-munmap_back:
25996 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
25997 if (vma && vma->vm_start < addr + len) {
25998 if (do_munmap(mm, addr, len))
25999 return -ENOMEM;
26000- goto munmap_back;
26001+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
26002+ BUG_ON(vma && vma->vm_start < addr + len);
26003 }
26004
26005 /* Check against address space limit. */
26006@@ -1073,6 +1172,13 @@ munmap_back:
26007 vma->vm_start = addr;
26008 vma->vm_end = addr + len;
26009 vma->vm_flags = vm_flags;
26010+
26011+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
26012+ if ((file || !(mm->pax_flags & MF_PAX_PAGEEXEC)) && (vm_flags & (VM_READ|VM_WRITE)))
26013+ vma->vm_page_prot = protection_map[(vm_flags | VM_EXEC) & (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)];
26014+ else
26015+#endif
26016+
26017 vma->vm_page_prot = protection_map[vm_flags &
26018 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)];
26019 vma->vm_pgoff = pgoff;
26020@@ -1100,9 +1206,25 @@ munmap_back:
26021
26022 /* Don't make the VMA automatically writable if it's shared, but the
26023 * backer wishes to know when pages are first written to */
26024- if (vma->vm_ops && vma->vm_ops->page_mkwrite)
26025+ if (vma->vm_ops && vma->vm_ops->page_mkwrite) {
26026+
26027+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
26028+ if ((file || !(mm->pax_flags & MF_PAX_PAGEEXEC)) && (vm_flags & (VM_READ|VM_WRITE)))
26029+ vma->vm_page_prot = protection_map[(vm_flags | VM_EXEC) & (VM_READ|VM_WRITE|VM_EXEC)];
26030+ else
26031+#endif
26032+
26033 vma->vm_page_prot =
26034 protection_map[vm_flags & (VM_READ|VM_WRITE|VM_EXEC)];
26035+ }
26036+
26037+#ifdef CONFIG_PAX_SEGMEXEC
26038+ if (flags & MAP_MIRROR) {
26039+ vma_m->vm_flags |= VM_MIRROR;
26040+ vma_m->vm_mirror = vma->vm_start - vma_m->vm_start;
26041+ vma->vm_mirror = vma_m->vm_start - vma->vm_start;
26042+ }
26043+#endif
26044
26045 /* We set VM_ACCOUNT in a shared mapping's vm_flags, to inform
26046 * shmem_zero_setup (perhaps called through /dev/zero's ->mmap)
26047@@ -1139,6 +1261,7 @@ munmap_back:
26048 out:
26049 mm->total_vm += len >> PAGE_SHIFT;
26050 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
26051+ track_exec_limit(mm, addr, addr + len, vm_flags);
26052 if (vm_flags & VM_LOCKED) {
26053 mm->locked_vm += len >> PAGE_SHIFT;
26054 make_pages_present(addr, addr + len);
26055@@ -1193,6 +1316,10 @@ arch_get_unmapped_area(struct file *filp
26056 if (len > TASK_SIZE)
26057 return -ENOMEM;
26058
26059+#ifdef CONFIG_PAX_RANDMMAP
26060+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
26061+#endif
26062+
26063 if (addr) {
26064 addr = PAGE_ALIGN(addr);
26065 vma = find_vma(mm, addr);
26066@@ -1203,7 +1330,7 @@ arch_get_unmapped_area(struct file *filp
26067 if (len > mm->cached_hole_size) {
26068 start_addr = addr = mm->free_area_cache;
26069 } else {
26070- start_addr = addr = TASK_UNMAPPED_BASE;
26071+ start_addr = addr = mm->mmap_base;
26072 mm->cached_hole_size = 0;
26073 }
26074
26075@@ -1215,9 +1342,8 @@ full_search:
26076 * Start a new search - just in case we missed
26077 * some holes.
26078 */
26079- if (start_addr != TASK_UNMAPPED_BASE) {
26080- addr = TASK_UNMAPPED_BASE;
26081- start_addr = addr;
26082+ if (start_addr != mm->mmap_base) {
26083+ start_addr = addr = mm->mmap_base;
26084 mm->cached_hole_size = 0;
26085 goto full_search;
26086 }
26087@@ -1242,7 +1368,7 @@ void arch_unmap_area(struct mm_struct *m
26088 /*
26089 * Is this a new hole at the lowest possible address?
26090 */
26091- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
26092+ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
26093 mm->free_area_cache = addr;
26094 mm->cached_hole_size = ~0UL;
26095 }
26096@@ -1260,12 +1386,16 @@ arch_get_unmapped_area_topdown(struct fi
26097 {
26098 struct vm_area_struct *vma;
26099 struct mm_struct *mm = current->mm;
26100- unsigned long addr = addr0;
26101+ unsigned long base = mm->mmap_base, addr = addr0;
26102
26103 /* requested length too big for entire address space */
26104 if (len > TASK_SIZE)
26105 return -ENOMEM;
26106
26107+#ifdef CONFIG_PAX_RANDMMAP
26108+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
26109+#endif
26110+
26111 /* requesting a specific address */
26112 if (addr) {
26113 addr = PAGE_ALIGN(addr);
26114@@ -1323,13 +1453,21 @@ bottomup:
26115 * can happen with large stack limits and large mmap()
26116 * allocations.
26117 */
26118+ mm->mmap_base = TASK_UNMAPPED_BASE;
26119+
26120+#ifdef CONFIG_PAX_RANDMMAP
26121+ if (mm->pax_flags & MF_PAX_RANDMMAP)
26122+ mm->mmap_base += mm->delta_mmap;
26123+#endif
26124+
26125+ mm->free_area_cache = mm->mmap_base;
26126 mm->cached_hole_size = ~0UL;
26127- mm->free_area_cache = TASK_UNMAPPED_BASE;
26128 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
26129 /*
26130 * Restore the topdown base:
26131 */
26132- mm->free_area_cache = mm->mmap_base;
26133+ mm->mmap_base = base;
26134+ mm->free_area_cache = base;
26135 mm->cached_hole_size = ~0UL;
26136
26137 return addr;
26138@@ -1345,8 +1483,10 @@ void arch_unmap_area_topdown(struct mm_s
26139 mm->free_area_cache = addr;
26140
26141 /* dont allow allocations above current base */
26142- if (mm->free_area_cache > mm->mmap_base)
26143+ if (mm->free_area_cache > mm->mmap_base) {
26144 mm->free_area_cache = mm->mmap_base;
26145+ mm->cached_hole_size = ~0UL;
26146+ }
26147 }
26148
26149 unsigned long
26150@@ -1479,6 +1619,7 @@ static int acct_stack_growth(struct vm_a
26151 return -ENOMEM;
26152
26153 /* Stack limit test */
26154+ gr_learn_resource(current, RLIMIT_STACK, size, 1);
26155 if (size > rlim[RLIMIT_STACK].rlim_cur)
26156 return -ENOMEM;
26157
26158@@ -1488,6 +1629,7 @@ static int acct_stack_growth(struct vm_a
26159 unsigned long limit;
26160 locked = mm->locked_vm + grow;
26161 limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
26162+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
26163 if (locked > limit && !capable(CAP_IPC_LOCK))
26164 return -ENOMEM;
26165 }
26166@@ -1605,13 +1747,49 @@ int expand_stack(struct vm_area_struct *
26167 if (address < vma->vm_start) {
26168 unsigned long size, grow;
26169
26170+#ifdef CONFIG_PAX_SEGMEXEC
26171+ struct vm_area_struct *vma_m = NULL;
26172+ unsigned long address_m = 0UL;
26173+
26174+ if (vma->vm_flags & VM_MIRROR) {
26175+ address_m = vma->vm_start + vma->vm_mirror;
26176+ vma_m = find_vma(vma->vm_mm, address_m);
26177+ if (!vma_m || vma_m->vm_start != address_m ||
26178+ !(vma_m->vm_flags & VM_MIRROR) ||
26179+ vma->vm_end - vma->vm_start !=
26180+ vma_m->vm_end - vma_m->vm_start ||
26181+ vma->anon_vma != vma_m->anon_vma) {
26182+ printk(KERN_ERR "PAX: VMMIRROR: expand bug, %08lx, %08lx, %08lx, %08lx, %08lx\n",
26183+ address, vma->vm_start, vma_m->vm_start, vma->vm_end, vma_m->vm_end);
26184+ anon_vma_unlock(vma);
26185+ return -EFAULT;
26186+ }
26187+ address_m = address + vma->vm_mirror;
26188+ }
26189+#endif
26190+
26191 size = vma->vm_end - address;
26192 grow = (vma->vm_start - address) >> PAGE_SHIFT;
26193
26194+#ifdef CONFIG_PAX_SEGMEXEC
26195+ if (vma_m)
26196+ error = acct_stack_growth(vma, size, 2*grow);
26197+ else
26198+#endif
26199+
26200 error = acct_stack_growth(vma, size, grow);
26201 if (!error) {
26202 vma->vm_start = address;
26203 vma->vm_pgoff -= grow;
26204+ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
26205+
26206+#ifdef CONFIG_PAX_SEGMEXEC
26207+ if (vma_m) {
26208+ vma_m->vm_start = address_m;
26209+ vma_m->vm_pgoff -= grow;
26210+ }
26211+#endif
26212+
26213 }
26214 }
26215 anon_vma_unlock(vma);
26216@@ -1773,7 +1951,24 @@ int split_vma(struct mm_struct * mm, str
26217 * work. This now handles partial unmappings.
26218 * Jeremy Fitzhardinge <jeremy@goop.org>
26219 */
26220+#ifdef CONFIG_PAX_SEGMEXEC
26221+static int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len);
26222+
26223+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
26224+{
26225+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
26226+ int ret = __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
26227+ if (ret)
26228+ return ret;
26229+ }
26230+
26231+ return __do_munmap(mm, start, len);
26232+}
26233+
26234+static int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
26235+#else
26236 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
26237+#endif
26238 {
26239 unsigned long end;
26240 struct vm_area_struct *vma, *prev, *last;
26241@@ -1827,6 +2022,8 @@ int do_munmap(struct mm_struct *mm, unsi
26242 /* Fix up all other VM information */
26243 remove_vma_list(mm, vma);
26244
26245+ track_exec_limit(mm, start, end, 0UL);
26246+
26247 return 0;
26248 }
26249
26250@@ -1839,6 +2036,12 @@ asmlinkage long sys_munmap(unsigned long
26251
26252 profile_munmap(addr);
26253
26254+#ifdef CONFIG_PAX_SEGMEXEC
26255+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
26256+ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
26257+ return -EINVAL;
26258+#endif
26259+
26260 down_write(&mm->mmap_sem);
26261 ret = do_munmap(mm, addr, len);
26262 up_write(&mm->mmap_sem);
26263@@ -1860,11 +2063,35 @@ static inline void verify_mm_writelocked
26264 * anonymous maps. eventually we may be able to do some
26265 * brk-specific accounting here.
26266 */
26267+#ifdef CONFIG_PAX_SEGMEXEC
26268+static unsigned long __do_brk(unsigned long addr, unsigned long len);
26269+
26270+unsigned long do_brk(unsigned long addr, unsigned long len)
26271+{
26272+ unsigned long ret;
26273+
26274+ ret = __do_brk(addr, len);
26275+ if (ret == addr && (current->mm->pax_flags & (MF_PAX_SEGMEXEC | MF_PAX_MPROTECT)) == MF_PAX_SEGMEXEC) {
26276+ unsigned long ret_m;
26277+
26278+ ret_m = __do_mmap_pgoff(NULL, addr + SEGMEXEC_TASK_SIZE, 0UL, PROT_NONE, MAP_PRIVATE | MAP_FIXED | MAP_MIRROR, addr);
26279+ if (ret_m > TASK_SIZE) {
26280+ do_munmap(current->mm, addr, len);
26281+ ret = ret_m;
26282+ }
26283+ }
26284+
26285+ return ret;
26286+}
26287+
26288+static unsigned long __do_brk(unsigned long addr, unsigned long len)
26289+#else
26290 unsigned long do_brk(unsigned long addr, unsigned long len)
26291+#endif
26292 {
26293 struct mm_struct * mm = current->mm;
26294 struct vm_area_struct * vma, * prev;
26295- unsigned long flags;
26296+ unsigned long flags, task_size = TASK_SIZE;
26297 struct rb_node ** rb_link, * rb_parent;
26298 pgoff_t pgoff = addr >> PAGE_SHIFT;
26299 int error;
26300@@ -1873,11 +2100,28 @@ unsigned long do_brk(unsigned long addr,
26301 if (!len)
26302 return addr;
26303
26304- if ((addr + len) > TASK_SIZE || (addr + len) < addr)
26305+#ifdef CONFIG_PAX_SEGMEXEC
26306+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
26307+ task_size = SEGMEXEC_TASK_SIZE;
26308+#endif
26309+
26310+ if ((addr + len) > task_size || (addr + len) < addr)
26311 return -EINVAL;
26312
26313 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
26314
26315+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
26316+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
26317+ flags &= ~VM_EXEC;
26318+
26319+#ifdef CONFIG_PAX_MPROTECT
26320+ if (mm->pax_flags & MF_PAX_MPROTECT)
26321+ flags &= ~VM_MAYEXEC;
26322+#endif
26323+
26324+ }
26325+#endif
26326+
26327 error = arch_mmap_check(addr, len, flags);
26328 if (error)
26329 return error;
26330@@ -1891,6 +2135,7 @@ unsigned long do_brk(unsigned long addr,
26331 locked += mm->locked_vm;
26332 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
26333 lock_limit >>= PAGE_SHIFT;
26334+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
26335 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
26336 return -EAGAIN;
26337 }
26338@@ -1904,12 +2149,12 @@ unsigned long do_brk(unsigned long addr,
26339 /*
26340 * Clear old maps. this also does some error checking for us
26341 */
26342- munmap_back:
26343 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
26344 if (vma && vma->vm_start < addr + len) {
26345 if (do_munmap(mm, addr, len))
26346 return -ENOMEM;
26347- goto munmap_back;
26348+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
26349+ BUG_ON(vma && vma->vm_start < addr + len);
26350 }
26351
26352 /* Check against address space limits *after* clearing old maps... */
26353@@ -1941,6 +2186,13 @@ unsigned long do_brk(unsigned long addr,
26354 vma->vm_end = addr + len;
26355 vma->vm_pgoff = pgoff;
26356 vma->vm_flags = flags;
26357+
26358+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
26359+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC))
26360+ vma->vm_page_prot = protection_map[(flags | VM_EXEC) & (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)];
26361+ else
26362+#endif
26363+
26364 vma->vm_page_prot = protection_map[flags &
26365 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)];
26366 vma_link(mm, vma, prev, rb_link, rb_parent);
26367@@ -1950,6 +2202,7 @@ out:
26368 mm->locked_vm += len >> PAGE_SHIFT;
26369 make_pages_present(addr, addr + len);
26370 }
26371+ track_exec_limit(mm, addr, addr + len, flags);
26372 return addr;
26373 }
26374
26375@@ -2082,7 +2335,7 @@ int may_expand_vm(struct mm_struct *mm,
26376 unsigned long lim;
26377
26378 lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
26379-
26380+ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
26381 if (cur + npages > lim)
26382 return 0;
26383 return 1;
26384diff -urNp linux-2.6.18/mm/mprotect.c linux-2.6.18/mm/mprotect.c
26385--- linux-2.6.18/mm/mprotect.c 2006-09-19 23:42:06.000000000 -0400
26386+++ linux-2.6.18/mm/mprotect.c 2006-09-22 21:54:23.000000000 -0400
26387@@ -21,10 +21,18 @@
26388 #include <linux/syscalls.h>
26389 #include <linux/swap.h>
26390 #include <linux/swapops.h>
26391+#include <linux/grsecurity.h>
26392+
26393+#ifdef CONFIG_PAX_MPROTECT
26394+#include <linux/elf.h>
26395+#include <linux/fs.h>
26396+#endif
26397+
26398 #include <asm/uaccess.h>
26399 #include <asm/pgtable.h>
26400 #include <asm/cacheflush.h>
26401 #include <asm/tlbflush.h>
26402+#include <asm/mmu_context.h>
26403
26404 static void change_pte_range(struct mm_struct *mm, pmd_t *pmd,
26405 unsigned long addr, unsigned long end, pgprot_t newprot)
26406@@ -115,6 +123,95 @@ static void change_protection(struct vm_
26407 flush_tlb_range(vma, start, end);
26408 }
26409
26410+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
26411+/* called while holding the mmap semaphor for writing */
26412+static inline void establish_user_cs_limit(struct mm_struct *mm, unsigned long start, unsigned long end)
26413+{
26414+ struct vm_area_struct *vma = find_vma(mm, start);
26415+
26416+ for (; vma && vma->vm_start < end; vma = vma->vm_next)
26417+ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
26418+
26419+}
26420+
26421+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
26422+{
26423+ unsigned long oldlimit, newlimit = 0UL;
26424+
26425+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC))
26426+ return;
26427+
26428+ spin_lock(&mm->page_table_lock);
26429+ oldlimit = mm->context.user_cs_limit;
26430+ if ((prot & VM_EXEC) && oldlimit < end)
26431+ /* USER_CS limit moved up */
26432+ newlimit = end;
26433+ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
26434+ /* USER_CS limit moved down */
26435+ newlimit = start;
26436+
26437+ if (newlimit) {
26438+ mm->context.user_cs_limit = newlimit;
26439+
26440+#ifdef CONFIG_SMP
26441+ wmb();
26442+ cpus_clear(mm->context.cpu_user_cs_mask);
26443+ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
26444+#endif
26445+
26446+ set_user_cs(mm, smp_processor_id());
26447+ }
26448+ spin_unlock(&mm->page_table_lock);
26449+ if (newlimit == end)
26450+ establish_user_cs_limit(mm, oldlimit, end);
26451+}
26452+#endif
26453+
26454+#ifdef CONFIG_PAX_SEGMEXEC
26455+static int __mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
26456+ unsigned long start, unsigned long end, unsigned int newflags);
26457+
26458+static int mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
26459+ unsigned long start, unsigned long end, unsigned int newflags)
26460+{
26461+ if (vma->vm_flags & VM_MIRROR) {
26462+ struct vm_area_struct * vma_m, * prev_m;
26463+ unsigned long start_m, end_m;
26464+ int error;
26465+
26466+ start_m = vma->vm_start + vma->vm_mirror;
26467+ vma_m = find_vma_prev(vma->vm_mm, start_m, &prev_m);
26468+ if (vma_m && vma_m->vm_start == start_m && (vma_m->vm_flags & VM_MIRROR)) {
26469+ start_m = start + vma->vm_mirror;
26470+ end_m = end + vma->vm_mirror;
26471+
26472+ if (vma_m->vm_start >= SEGMEXEC_TASK_SIZE && !(newflags & VM_EXEC))
26473+ error = __mprotect_fixup(vma_m, &prev_m, start_m, end_m, vma_m->vm_flags & ~(VM_READ | VM_WRITE | VM_EXEC));
26474+ else
26475+ error = __mprotect_fixup(vma_m, &prev_m, start_m, end_m, newflags);
26476+ if (error)
26477+ return error;
26478+ } else {
26479+ printk("PAX: VMMIRROR: mprotect bug in %s, %08lx\n", current->comm, vma->vm_start);
26480+ return -ENOMEM;
26481+ }
26482+ }
26483+
26484+ return __mprotect_fixup(vma, pprev, start, end, newflags);
26485+}
26486+
26487+static int __mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
26488+ unsigned long start, unsigned long end, unsigned int newflags)
26489+{
26490+ struct mm_struct * mm = vma->vm_mm;
26491+ unsigned long oldflags = vma->vm_flags;
26492+ long nrpages = (end - start) >> PAGE_SHIFT;
26493+ unsigned long charged = 0;
26494+ unsigned int mask;
26495+ pgprot_t newprot;
26496+ pgoff_t pgoff;
26497+ int error;
26498+#else
26499 static int
26500 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
26501 unsigned long start, unsigned long end, unsigned long newflags)
26502@@ -132,6 +229,7 @@ mprotect_fixup(struct vm_area_struct *vm
26503 *pprev = vma;
26504 return 0;
26505 }
26506+#endif
26507
26508 /*
26509 * If we make a private mapping writable we increase our commit;
26510@@ -182,6 +280,12 @@ success:
26511 if (vma->vm_ops && vma->vm_ops->page_mkwrite)
26512 mask &= ~VM_SHARED;
26513
26514+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
26515+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) && (newflags & (VM_READ|VM_WRITE)))
26516+ newprot = protection_map[(newflags | VM_EXEC) & mask];
26517+ else
26518+#endif
26519+
26520 newprot = protection_map[newflags & mask];
26521
26522 /*
26523@@ -203,6 +307,69 @@ fail:
26524 return error;
26525 }
26526
26527+#ifdef CONFIG_PAX_MPROTECT
26528+/* PaX: non-PIC ELF libraries need relocations on their executable segments
26529+ * therefore we'll grant them VM_MAYWRITE once during their life.
26530+ *
26531+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
26532+ * basis because we want to allow the common case and not the special ones.
26533+ */
26534+static inline void pax_handle_maywrite(struct vm_area_struct * vma, unsigned long start)
26535+{
26536+ struct elfhdr elf_h;
26537+ struct elf_phdr elf_p, p_dyn;
26538+ elf_dyn dyn;
26539+ unsigned long i, j = 65536UL / sizeof(struct elf_phdr);
26540+
26541+#ifndef CONFIG_PAX_NOELFRELOCS
26542+ if ((vma->vm_start != start) ||
26543+ !vma->vm_file ||
26544+ !(vma->vm_flags & VM_MAYEXEC) ||
26545+ (vma->vm_flags & VM_MAYNOTWRITE))
26546+#endif
26547+
26548+ return;
26549+
26550+ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char*)&elf_h, sizeof(elf_h)) ||
26551+ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
26552+
26553+#ifdef CONFIG_PAX_ETEXECRELOCS
26554+ (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC) ||
26555+#else
26556+ elf_h.e_type != ET_DYN ||
26557+#endif
26558+
26559+ !elf_check_arch(&elf_h) ||
26560+ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
26561+ elf_h.e_phnum > j)
26562+ return;
26563+
26564+ for (i = 0UL; i < elf_h.e_phnum; i++) {
26565+ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char*)&elf_p, sizeof(elf_p)))
26566+ return;
26567+ if (elf_p.p_type == PT_DYNAMIC) {
26568+ p_dyn = elf_p;
26569+ j = i;
26570+ }
26571+ }
26572+ if (elf_h.e_phnum <= j)
26573+ return;
26574+
26575+ i = 0UL;
26576+ do {
26577+ if (sizeof(dyn) != kernel_read(vma->vm_file, p_dyn.p_offset + i*sizeof(dyn), (char*)&dyn, sizeof(dyn)))
26578+ return;
26579+ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
26580+ vma->vm_flags |= VM_MAYWRITE | VM_MAYNOTWRITE;
26581+ gr_log_textrel(vma);
26582+ return;
26583+ }
26584+ i++;
26585+ } while (dyn.d_tag != DT_NULL);
26586+ return;
26587+}
26588+#endif
26589+
26590 asmlinkage long
26591 sys_mprotect(unsigned long start, size_t len, unsigned long prot)
26592 {
26593@@ -222,6 +389,17 @@ sys_mprotect(unsigned long start, size_t
26594 end = start + len;
26595 if (end <= start)
26596 return -ENOMEM;
26597+
26598+#ifdef CONFIG_PAX_SEGMEXEC
26599+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
26600+ if (end > SEGMEXEC_TASK_SIZE)
26601+ return -EINVAL;
26602+ } else
26603+#endif
26604+
26605+ if (end > TASK_SIZE)
26606+ return -EINVAL;
26607+
26608 if (prot & ~(PROT_READ | PROT_WRITE | PROT_EXEC | PROT_SEM))
26609 return -EINVAL;
26610
26611@@ -229,7 +407,7 @@ sys_mprotect(unsigned long start, size_t
26612 /*
26613 * Does the application expect PROT_READ to imply PROT_EXEC:
26614 */
26615- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
26616+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
26617 prot |= PROT_EXEC;
26618
26619 vm_flags = calc_vm_prot_bits(prot);
26620@@ -261,6 +439,16 @@ sys_mprotect(unsigned long start, size_t
26621 if (start > vma->vm_start)
26622 prev = vma;
26623
26624+ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
26625+ error = -EACCES;
26626+ goto out;
26627+ }
26628+
26629+#ifdef CONFIG_PAX_MPROTECT
26630+ if ((vma->vm_mm->pax_flags & MF_PAX_MPROTECT) && (prot & PROT_WRITE))
26631+ pax_handle_maywrite(vma, start);
26632+#endif
26633+
26634 for (nstart = start ; ; ) {
26635 unsigned long newflags;
26636
26637@@ -274,6 +462,12 @@ sys_mprotect(unsigned long start, size_t
26638 goto out;
26639 }
26640
26641+#ifdef CONFIG_PAX_MPROTECT
26642+ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
26643+ if ((vma->vm_mm->pax_flags & MF_PAX_MPROTECT) && !(prot & PROT_WRITE) && (vma->vm_flags & VM_MAYNOTWRITE))
26644+ newflags &= ~VM_MAYWRITE;
26645+#endif
26646+
26647 error = security_file_mprotect(vma, reqprot, prot);
26648 if (error)
26649 goto out;
26650@@ -297,6 +491,9 @@ sys_mprotect(unsigned long start, size_t
26651 goto out;
26652 }
26653 }
26654+
26655+ track_exec_limit(current->mm, start, end, vm_flags);
26656+
26657 out:
26658 up_write(&current->mm->mmap_sem);
26659 return error;
26660diff -urNp linux-2.6.18/mm/mremap.c linux-2.6.18/mm/mremap.c
26661--- linux-2.6.18/mm/mremap.c 2006-09-19 23:42:06.000000000 -0400
26662+++ linux-2.6.18/mm/mremap.c 2006-09-22 20:45:04.000000000 -0400
26663@@ -106,6 +106,12 @@ static void move_ptes(struct vm_area_str
26664 pte = ptep_clear_flush(vma, old_addr, old_pte);
26665 /* ZERO_PAGE can be dependant on virtual addr */
26666 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
26667+
26668+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
26669+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_EXEC))
26670+ pte_exprotect(pte);
26671+#endif
26672+
26673 set_pte_at(mm, new_addr, new_pte, pte);
26674 }
26675
26676@@ -253,6 +259,7 @@ unsigned long do_mremap(unsigned long ad
26677 struct vm_area_struct *vma;
26678 unsigned long ret = -EINVAL;
26679 unsigned long charged = 0;
26680+ unsigned long task_size = TASK_SIZE;
26681
26682 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
26683 goto out;
26684@@ -271,6 +278,15 @@ unsigned long do_mremap(unsigned long ad
26685 if (!new_len)
26686 goto out;
26687
26688+#ifdef CONFIG_PAX_SEGMEXEC
26689+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
26690+ task_size = SEGMEXEC_TASK_SIZE;
26691+#endif
26692+
26693+ if (new_len > task_size || addr > task_size-new_len ||
26694+ old_len > task_size || addr > task_size-old_len)
26695+ goto out;
26696+
26697 /* new_addr is only valid if MREMAP_FIXED is specified */
26698 if (flags & MREMAP_FIXED) {
26699 if (new_addr & ~PAGE_MASK)
26700@@ -278,16 +294,13 @@ unsigned long do_mremap(unsigned long ad
26701 if (!(flags & MREMAP_MAYMOVE))
26702 goto out;
26703
26704- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
26705+ if (new_addr > task_size - new_len)
26706 goto out;
26707
26708 /* Check if the location we're moving into overlaps the
26709 * old location at all, and fail if it does.
26710 */
26711- if ((new_addr <= addr) && (new_addr+new_len) > addr)
26712- goto out;
26713-
26714- if ((addr <= new_addr) && (addr+old_len) > new_addr)
26715+ if (addr + old_len > new_addr && new_addr + new_len > addr)
26716 goto out;
26717
26718 ret = do_munmap(mm, new_addr, new_len);
26719@@ -321,6 +334,14 @@ unsigned long do_mremap(unsigned long ad
26720 ret = -EINVAL;
26721 goto out;
26722 }
26723+
26724+#ifdef CONFIG_PAX_SEGMEXEC
26725+ if (vma->vm_flags & VM_MIRROR) {
26726+ ret = -EINVAL;
26727+ goto out;
26728+ }
26729+#endif
26730+
26731 /* We can't remap across vm area boundaries */
26732 if (old_len > vma->vm_end - addr)
26733 goto out;
26734@@ -354,7 +375,7 @@ unsigned long do_mremap(unsigned long ad
26735 if (old_len == vma->vm_end - addr &&
26736 !((flags & MREMAP_FIXED) && (addr != new_addr)) &&
26737 (old_len != new_len || !(flags & MREMAP_MAYMOVE))) {
26738- unsigned long max_addr = TASK_SIZE;
26739+ unsigned long max_addr = task_size;
26740 if (vma->vm_next)
26741 max_addr = vma->vm_next->vm_start;
26742 /* can we just expand the current mapping? */
26743@@ -372,6 +393,7 @@ unsigned long do_mremap(unsigned long ad
26744 addr + new_len);
26745 }
26746 ret = addr;
26747+ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
26748 goto out;
26749 }
26750 }
26751@@ -382,8 +404,8 @@ unsigned long do_mremap(unsigned long ad
26752 */
26753 ret = -ENOMEM;
26754 if (flags & MREMAP_MAYMOVE) {
26755+ unsigned long map_flags = 0;
26756 if (!(flags & MREMAP_FIXED)) {
26757- unsigned long map_flags = 0;
26758 if (vma->vm_flags & VM_MAYSHARE)
26759 map_flags |= MAP_SHARED;
26760
26761@@ -393,7 +415,12 @@ unsigned long do_mremap(unsigned long ad
26762 if (new_addr & ~PAGE_MASK)
26763 goto out;
26764 }
26765+ map_flags = vma->vm_flags;
26766 ret = move_vma(vma, addr, old_len, new_len, new_addr);
26767+ if (!(ret & ~PAGE_MASK)) {
26768+ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
26769+ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
26770+ }
26771 }
26772 out:
26773 if (ret & ~PAGE_MASK)
26774diff -urNp linux-2.6.18/mm/page_alloc.c linux-2.6.18/mm/page_alloc.c
26775--- linux-2.6.18/mm/page_alloc.c 2006-09-19 23:42:06.000000000 -0400
26776+++ linux-2.6.18/mm/page_alloc.c 2006-09-22 20:45:04.000000000 -0400
26777@@ -339,7 +339,7 @@ static inline int page_is_buddy(struct p
26778 static inline void __free_one_page(struct page *page,
26779 struct zone *zone, unsigned int order)
26780 {
26781- unsigned long page_idx;
26782+ unsigned long page_idx, index;
26783 int order_size = 1 << order;
26784
26785 if (unlikely(PageCompound(page)))
26786@@ -350,6 +350,11 @@ static inline void __free_one_page(struc
26787 BUG_ON(page_idx & (order_size - 1));
26788 BUG_ON(bad_range(zone, page));
26789
26790+#ifdef CONFIG_PAX_MEMORY_SANITIZE
26791+ for (index = order_size; index; --index)
26792+ clear_highpage(page + index - 1);
26793+#endif
26794+
26795 zone->free_pages += order_size;
26796 while (order < MAX_ORDER-1) {
26797 unsigned long combined_idx;
26798diff -urNp linux-2.6.18/mm/rmap.c linux-2.6.18/mm/rmap.c
26799--- linux-2.6.18/mm/rmap.c 2006-09-19 23:42:06.000000000 -0400
26800+++ linux-2.6.18/mm/rmap.c 2006-09-22 20:45:04.000000000 -0400
26801@@ -106,6 +106,19 @@ int anon_vma_prepare(struct vm_area_stru
26802 list_add_tail(&vma->anon_vma_node, &anon_vma->head);
26803 allocated = NULL;
26804 }
26805+
26806+#ifdef CONFIG_PAX_SEGMEXEC
26807+ if (vma->vm_flags & VM_MIRROR) {
26808+ struct vm_area_struct *vma_m;
26809+
26810+ vma_m = find_vma(vma->vm_mm, vma->vm_start + vma->vm_mirror);
26811+ BUG_ON(!vma_m || vma_m->vm_start != vma->vm_start + vma->vm_mirror);
26812+ BUG_ON(vma_m->anon_vma || vma->vm_pgoff != vma_m->vm_pgoff);
26813+ vma_m->anon_vma = anon_vma;
26814+ __anon_vma_link(vma_m);
26815+ }
26816+#endif
26817+
26818 spin_unlock(&mm->page_table_lock);
26819
26820 if (locked)
26821diff -urNp linux-2.6.18/mm/shmem.c linux-2.6.18/mm/shmem.c
26822--- linux-2.6.18/mm/shmem.c 2006-09-19 23:42:06.000000000 -0400
26823+++ linux-2.6.18/mm/shmem.c 2006-09-22 20:04:35.000000000 -0400
26824@@ -2235,7 +2235,7 @@ static struct file_system_type tmpfs_fs_
26825 .get_sb = shmem_get_sb,
26826 .kill_sb = kill_litter_super,
26827 };
26828-static struct vfsmount *shm_mnt;
26829+struct vfsmount *shm_mnt;
26830
26831 static int __init init_tmpfs(void)
26832 {
26833diff -urNp linux-2.6.18/mm/slab.c linux-2.6.18/mm/slab.c
26834--- linux-2.6.18/mm/slab.c 2006-09-19 23:42:06.000000000 -0400
26835+++ linux-2.6.18/mm/slab.c 2006-09-22 20:45:04.000000000 -0400
26836@@ -1613,6 +1613,11 @@ static void store_stackinfo(struct kmem_
26837
26838 while (!kstack_end(sptr)) {
26839 svalue = *sptr++;
26840+
26841+#ifdef CONFIG_PAX_KERNEXEC
26842+ svalue += __KERNEL_TEXT_OFFSET;
26843+#endif
26844+
26845 if (kernel_text_address(svalue)) {
26846 *addr++ = svalue;
26847 size -= sizeof(unsigned long);
26848diff -urNp linux-2.6.18/mm/tiny-shmem.c linux-2.6.18/mm/tiny-shmem.c
26849--- linux-2.6.18/mm/tiny-shmem.c 2006-09-19 23:42:06.000000000 -0400
26850+++ linux-2.6.18/mm/tiny-shmem.c 2006-09-22 20:04:35.000000000 -0400
26851@@ -26,7 +26,7 @@ static struct file_system_type tmpfs_fs_
26852 .kill_sb = kill_litter_super,
26853 };
26854
26855-static struct vfsmount *shm_mnt;
26856+struct vfsmount *shm_mnt;
26857
26858 static int __init init_tmpfs(void)
26859 {
26860diff -urNp linux-2.6.18/mm/vmalloc.c linux-2.6.18/mm/vmalloc.c
26861--- linux-2.6.18/mm/vmalloc.c 2006-09-19 23:42:06.000000000 -0400
26862+++ linux-2.6.18/mm/vmalloc.c 2006-09-22 20:45:04.000000000 -0400
26863@@ -193,6 +193,8 @@ struct vm_struct *__get_vm_area_node(uns
26864
26865 write_lock(&vmlist_lock);
26866 for (p = &vmlist; (tmp = *p) != NULL ;p = &tmp->next) {
26867+ if (addr > end - size)
26868+ goto out;
26869 if ((unsigned long)tmp->addr < addr) {
26870 if((unsigned long)tmp->addr + tmp->size >= addr)
26871 addr = ALIGN(tmp->size +
26872@@ -204,8 +206,6 @@ struct vm_struct *__get_vm_area_node(uns
26873 if (size + addr <= (unsigned long)tmp->addr)
26874 goto found;
26875 addr = ALIGN(tmp->size + (unsigned long)tmp->addr, align);
26876- if (addr > end - size)
26877- goto out;
26878 }
26879
26880 found:
26881diff -urNp linux-2.6.18/net/core/sock.c linux-2.6.18/net/core/sock.c
26882--- linux-2.6.18/net/core/sock.c 2006-09-19 23:42:06.000000000 -0400
26883+++ linux-2.6.18/net/core/sock.c 2006-09-22 20:45:04.000000000 -0400
26884@@ -808,7 +808,7 @@ lenout:
26885 *
26886 * (We also register the sk_lock with the lock validator.)
26887 */
26888-static void inline sock_lock_init(struct sock *sk)
26889+static inline void sock_lock_init(struct sock *sk)
26890 {
26891 spin_lock_init(&sk->sk_lock.slock);
26892 sk->sk_lock.owner = NULL;
26893diff -urNp linux-2.6.18/net/dccp/ccids/ccid3.c linux-2.6.18/net/dccp/ccids/ccid3.c
26894--- linux-2.6.18/net/dccp/ccids/ccid3.c 2006-09-19 23:42:06.000000000 -0400
26895+++ linux-2.6.18/net/dccp/ccids/ccid3.c 2006-09-22 20:45:04.000000000 -0400
26896@@ -68,7 +68,7 @@ static int ccid3_debug;
26897 printk(KERN_DEBUG "%s: " format, __FUNCTION__, ##a); \
26898 } while (0)
26899 #else
26900-#define ccid3_pr_debug(format, a...)
26901+#define ccid3_pr_debug(format, a...) do {} while (0)
26902 #endif
26903
26904 static struct dccp_tx_hist *ccid3_tx_hist;
26905diff -urNp linux-2.6.18/net/dccp/dccp.h linux-2.6.18/net/dccp/dccp.h
26906--- linux-2.6.18/net/dccp/dccp.h 2006-09-19 23:42:06.000000000 -0400
26907+++ linux-2.6.18/net/dccp/dccp.h 2006-09-22 20:45:04.000000000 -0400
26908@@ -28,8 +28,8 @@ extern int dccp_debug;
26909 #define dccp_pr_debug_cat(format, a...) do { if (dccp_debug) \
26910 printk(format, ##a); } while (0)
26911 #else
26912-#define dccp_pr_debug(format, a...)
26913-#define dccp_pr_debug_cat(format, a...)
26914+#define dccp_pr_debug(format, a...) do {} while (0)
26915+#define dccp_pr_debug_cat(format, a...) do {} while (0)
26916 #endif
26917
26918 extern struct inet_hashinfo dccp_hashinfo;
26919diff -urNp linux-2.6.18/net/ipv4/inet_connection_sock.c linux-2.6.18/net/ipv4/inet_connection_sock.c
26920--- linux-2.6.18/net/ipv4/inet_connection_sock.c 2006-09-19 23:42:06.000000000 -0400
26921+++ linux-2.6.18/net/ipv4/inet_connection_sock.c 2006-09-22 20:04:35.000000000 -0400
26922@@ -15,6 +15,7 @@
26923
26924 #include <linux/module.h>
26925 #include <linux/jhash.h>
26926+#include <linux/grsecurity.h>
26927
26928 #include <net/inet_connection_sock.h>
26929 #include <net/inet_hashtables.h>
26930diff -urNp linux-2.6.18/net/ipv4/inet_hashtables.c linux-2.6.18/net/ipv4/inet_hashtables.c
26931--- linux-2.6.18/net/ipv4/inet_hashtables.c 2006-09-19 23:42:06.000000000 -0400
26932+++ linux-2.6.18/net/ipv4/inet_hashtables.c 2006-09-22 20:04:35.000000000 -0400
26933@@ -18,11 +18,14 @@
26934 #include <linux/sched.h>
26935 #include <linux/slab.h>
26936 #include <linux/wait.h>
26937+#include <linux/grsecurity.h>
26938
26939 #include <net/inet_connection_sock.h>
26940 #include <net/inet_hashtables.h>
26941 #include <net/ip.h>
26942
26943+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
26944+
26945 /*
26946 * Allocate and initialize a new local port bind bucket.
26947 * The bindhash mutex for snum's hash chain must be held here.
26948@@ -309,6 +312,8 @@ ok:
26949 }
26950 spin_unlock(&head->lock);
26951
26952+ gr_update_task_in_ip_table(current, inet_sk(sk));
26953+
26954 if (tw) {
26955 inet_twsk_deschedule(tw, death_row);
26956 inet_twsk_put(tw);
26957diff -urNp linux-2.6.18/net/ipv4/netfilter/ipt_stealth.c linux-2.6.18/net/ipv4/netfilter/ipt_stealth.c
26958--- linux-2.6.18/net/ipv4/netfilter/ipt_stealth.c 1969-12-31 19:00:00.000000000 -0500
26959+++ linux-2.6.18/net/ipv4/netfilter/ipt_stealth.c 2006-09-22 20:04:35.000000000 -0400
26960@@ -0,0 +1,116 @@
26961+/* Kernel module to add stealth support.
26962+ *
26963+ * Copyright (C) 2002,2005 Brad Spengler <spender@grsecurity.net>
26964+ *
26965+ */
26966+
26967+#include <linux/kernel.h>
26968+#include <linux/module.h>
26969+#include <linux/skbuff.h>
26970+#include <linux/net.h>
26971+#include <linux/sched.h>
26972+#include <linux/inet.h>
26973+#include <linux/stddef.h>
26974+
26975+#include <net/ip.h>
26976+#include <net/sock.h>
26977+#include <net/tcp.h>
26978+#include <net/udp.h>
26979+#include <net/route.h>
26980+#include <net/inet_common.h>
26981+
26982+#include <linux/netfilter_ipv4/ip_tables.h>
26983+
26984+MODULE_LICENSE("GPL");
26985+
26986+extern struct sock *udp_v4_lookup(u32 saddr, u16 sport, u32 daddr, u16 dport, int dif);
26987+
26988+static int
26989+match(const struct sk_buff *skb,
26990+ const struct net_device *in,
26991+ const struct net_device *out,
26992+ const struct xt_match *match,
26993+ const void *matchinfo,
26994+ int offset,
26995+ unsigned int protoff,
26996+ int *hotdrop)
26997+{
26998+ struct iphdr *ip = skb->nh.iph;
26999+ struct tcphdr th;
27000+ struct udphdr uh;
27001+ struct sock *sk = NULL;
27002+
27003+ if (!ip || offset) return 0;
27004+
27005+ switch(ip->protocol) {
27006+ case IPPROTO_TCP:
27007+ if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &th, sizeof(th)) < 0) {
27008+ *hotdrop = 1;
27009+ return 0;
27010+ }
27011+ if (!(th.syn && !th.ack)) return 0;
27012+ sk = inet_lookup_listener(&tcp_hashinfo, ip->daddr, ntohs(th.dest), ((struct rtable*)skb->dst)->rt_iif);
27013+ break;
27014+ case IPPROTO_UDP:
27015+ if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &uh, sizeof(uh)) < 0) {
27016+ *hotdrop = 1;
27017+ return 0;
27018+ }
27019+ sk = udp_v4_lookup(ip->saddr, uh.source, ip->daddr, uh.dest, skb->dev->ifindex);
27020+ break;
27021+ default:
27022+ return 0;
27023+ }
27024+
27025+ if(!sk) // port is being listened on, match this
27026+ return 1;
27027+ else {
27028+ sock_put(sk);
27029+ return 0;
27030+ }
27031+}
27032+
27033+/* Called when user tries to insert an entry of this type. */
27034+static int
27035+checkentry(const char *tablename,
27036+ const void *nip,
27037+ const struct xt_match *match,
27038+ void *matchinfo,
27039+ unsigned int matchsize,
27040+ unsigned int hook_mask)
27041+{
27042+ const struct ipt_ip *ip = (const struct ipt_ip *)nip;
27043+ if (matchsize != IPT_ALIGN(0))
27044+ return 0;
27045+
27046+ if(((ip->proto == IPPROTO_TCP && !(ip->invflags & IPT_INV_PROTO)) ||
27047+ ((ip->proto == IPPROTO_UDP) && !(ip->invflags & IPT_INV_PROTO)))
27048+ && (hook_mask & (1 << NF_IP_LOCAL_IN)))
27049+ return 1;
27050+
27051+ printk("stealth: Only works on TCP and UDP for the INPUT chain.\n");
27052+
27053+ return 0;
27054+}
27055+
27056+
27057+static struct ipt_match stealth_match = {
27058+ .name = "stealth",
27059+ .match = match,
27060+ .checkentry = checkentry,
27061+ .destroy = NULL,
27062+ .me = THIS_MODULE
27063+};
27064+
27065+static int __init init(void)
27066+{
27067+ return ipt_register_match(&stealth_match);
27068+}
27069+
27070+static void __exit fini(void)
27071+{
27072+ ipt_unregister_match(&stealth_match);
27073+}
27074+
27075+module_init(init);
27076+module_exit(fini);
27077diff -urNp linux-2.6.18/net/ipv4/netfilter/Kconfig linux-2.6.18/net/ipv4/netfilter/Kconfig
27078--- linux-2.6.18/net/ipv4/netfilter/Kconfig 2006-09-19 23:42:06.000000000 -0400
27079+++ linux-2.6.18/net/ipv4/netfilter/Kconfig 2006-09-22 20:04:35.000000000 -0400
27080@@ -340,6 +340,21 @@ config IP_NF_MATCH_HASHLIMIT
27081 destination IP' or `500pps from any given source IP' with a single
27082 IPtables rule.
27083
27084+config IP_NF_MATCH_STEALTH
27085+ tristate "stealth match support"
27086+ depends on IP_NF_IPTABLES
27087+ help
27088+ Enabling this option will drop all syn packets coming to unserved tcp
27089+ ports as well as all packets coming to unserved udp ports. If you
27090+ are using your system to route any type of packets (ie. via NAT)
27091+ you should put this module at the end of your ruleset, since it will
27092+ drop packets that aren't going to ports that are listening on your
27093+ machine itself, it doesn't take into account that the packet might be
27094+ destined for someone on your internal network if you're using NAT for
27095+ instance.
27096+
27097+ To compile it as a module, choose M here. If unsure, say N.
27098+
27099 # `filter', generic and specific targets
27100 config IP_NF_FILTER
27101 tristate "Packet filtering"
27102@@ -646,4 +661,3 @@ config IP_NF_ARP_MANGLE
27103 hardware and network addresses.
27104
27105 endmenu
27106-
27107diff -urNp linux-2.6.18/net/ipv4/netfilter/Makefile linux-2.6.18/net/ipv4/netfilter/Makefile
27108--- linux-2.6.18/net/ipv4/netfilter/Makefile 2006-09-19 23:42:06.000000000 -0400
27109+++ linux-2.6.18/net/ipv4/netfilter/Makefile 2006-09-22 20:04:35.000000000 -0400
27110@@ -63,6 +63,7 @@ obj-$(CONFIG_IP_NF_MATCH_DSCP) += ipt_ds
27111 obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
27112 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
27113 obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
27114+obj-$(CONFIG_IP_NF_MATCH_STEALTH) += ipt_stealth.o
27115
27116 # targets
27117 obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
27118diff -urNp linux-2.6.18/net/ipv4/tcp_ipv4.c linux-2.6.18/net/ipv4/tcp_ipv4.c
27119--- linux-2.6.18/net/ipv4/tcp_ipv4.c 2006-09-19 23:42:06.000000000 -0400
27120+++ linux-2.6.18/net/ipv4/tcp_ipv4.c 2006-09-22 20:04:35.000000000 -0400
27121@@ -61,6 +61,7 @@
27122 #include <linux/jhash.h>
27123 #include <linux/init.h>
27124 #include <linux/times.h>
27125+#include <linux/grsecurity.h>
27126
27127 #include <net/icmp.h>
27128 #include <net/inet_hashtables.h>
27129diff -urNp linux-2.6.18/net/ipv4/tcp_lp.c linux-2.6.18/net/ipv4/tcp_lp.c
27130--- linux-2.6.18/net/ipv4/tcp_lp.c 2006-09-19 23:42:06.000000000 -0400
27131+++ linux-2.6.18/net/ipv4/tcp_lp.c 2006-09-22 20:45:04.000000000 -0400
27132@@ -165,7 +165,7 @@ static u32 tcp_lp_remote_hz_estimator(st
27133
27134 out:
27135 /* record time for successful remote HZ calc */
27136- if (rhz > 0)
27137+ if (rhz > 63)
27138 lp->flag |= LP_VALID_RHZ;
27139 else
27140 lp->flag &= ~LP_VALID_RHZ;
27141diff -urNp linux-2.6.18/net/ipv4/udp.c linux-2.6.18/net/ipv4/udp.c
27142--- linux-2.6.18/net/ipv4/udp.c 2006-09-19 23:42:06.000000000 -0400
27143+++ linux-2.6.18/net/ipv4/udp.c 2006-09-22 20:04:35.000000000 -0400
27144@@ -101,6 +101,7 @@
27145 #include <linux/skbuff.h>
27146 #include <linux/proc_fs.h>
27147 #include <linux/seq_file.h>
27148+#include <linux/grsecurity.h>
27149 #include <net/sock.h>
27150 #include <net/udp.h>
27151 #include <net/icmp.h>
27152@@ -109,6 +110,12 @@
27153 #include <net/checksum.h>
27154 #include <net/xfrm.h>
27155
27156+extern int gr_search_udp_recvmsg(const struct sock *sk,
27157+ const struct sk_buff *skb);
27158+extern int gr_search_udp_sendmsg(const struct sock *sk,
27159+ const struct sockaddr_in *addr);
27160+
27161+
27162 /*
27163 * Snmp MIB for the UDP layer
27164 */
27165@@ -265,8 +272,7 @@ static struct sock *udp_v4_lookup_longwa
27166 return result;
27167 }
27168
27169-static __inline__ struct sock *udp_v4_lookup(u32 saddr, u16 sport,
27170- u32 daddr, u16 dport, int dif)
27171+struct sock *udp_v4_lookup(u32 saddr, u16 sport, u32 daddr, u16 dport, int dif)
27172 {
27173 struct sock *sk;
27174
27175@@ -541,9 +547,16 @@ int udp_sendmsg(struct kiocb *iocb, stru
27176 dport = usin->sin_port;
27177 if (dport == 0)
27178 return -EINVAL;
27179+
27180+ if (!gr_search_udp_sendmsg(sk, usin))
27181+ return -EPERM;
27182 } else {
27183 if (sk->sk_state != TCP_ESTABLISHED)
27184 return -EDESTADDRREQ;
27185+
27186+ if (!gr_search_udp_sendmsg(sk, NULL))
27187+ return -EPERM;
27188+
27189 daddr = inet->daddr;
27190 dport = inet->dport;
27191 /* Open fast path for connected socket.
27192@@ -797,6 +810,11 @@ try_again:
27193 if (!skb)
27194 goto out;
27195
27196+ if (!gr_search_udp_recvmsg(sk, skb)) {
27197+ err = -EPERM;
27198+ goto out_free;
27199+ }
27200+
27201 copied = skb->len - sizeof(struct udphdr);
27202 if (copied > len) {
27203 copied = len;
27204diff -urNp linux-2.6.18/net/ipv6/addrconf.c linux-2.6.18/net/ipv6/addrconf.c
27205--- linux-2.6.18/net/ipv6/addrconf.c 2006-09-19 23:42:06.000000000 -0400
27206+++ linux-2.6.18/net/ipv6/addrconf.c 2006-09-22 20:45:04.000000000 -0400
27207@@ -861,7 +861,7 @@ struct ipv6_saddr_score {
27208 #define IPV6_SADDR_SCORE_LABEL 0x0020
27209 #define IPV6_SADDR_SCORE_PRIVACY 0x0040
27210
27211-static int inline ipv6_saddr_preferred(int type)
27212+static inline int ipv6_saddr_preferred(int type)
27213 {
27214 if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|
27215 IPV6_ADDR_LOOPBACK|IPV6_ADDR_RESERVED))
27216@@ -870,7 +870,7 @@ static int inline ipv6_saddr_preferred(i
27217 }
27218
27219 /* static matching label */
27220-static int inline ipv6_saddr_label(const struct in6_addr *addr, int type)
27221+static inline int ipv6_saddr_label(const struct in6_addr *addr, int type)
27222 {
27223 /*
27224 * prefix (longest match) label
27225@@ -3297,7 +3297,7 @@ static void inet6_ifa_notify(int event,
27226 netlink_broadcast(rtnl, skb, 0, RTNLGRP_IPV6_IFADDR, GFP_ATOMIC);
27227 }
27228
27229-static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
27230+static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
27231 __s32 *array, int bytes)
27232 {
27233 memset(array, 0, bytes);
27234diff -urNp linux-2.6.18/net/ipv6/raw.c linux-2.6.18/net/ipv6/raw.c
27235--- linux-2.6.18/net/ipv6/raw.c 2006-09-19 23:42:06.000000000 -0400
27236+++ linux-2.6.18/net/ipv6/raw.c 2006-09-22 20:45:04.000000000 -0400
27237@@ -522,7 +522,7 @@ out:
27238 return err;
27239 }
27240
27241-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
27242+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
27243 struct flowi *fl, struct rt6_info *rt,
27244 unsigned int flags)
27245 {
27246@@ -644,7 +644,7 @@ static int rawv6_sendmsg(struct kiocb *i
27247 /* Rough check on arithmetic overflow,
27248 better check is made in ip6_build_xmit
27249 */
27250- if (len < 0)
27251+ if ((ssize_t)len < 0)
27252 return -EMSGSIZE;
27253
27254 /* Mirror BSD error message compatibility */
27255diff -urNp linux-2.6.18/net/ipv6/route.c linux-2.6.18/net/ipv6/route.c
27256--- linux-2.6.18/net/ipv6/route.c 2006-09-19 23:42:06.000000000 -0400
27257+++ linux-2.6.18/net/ipv6/route.c 2006-09-22 20:45:04.000000000 -0400
27258@@ -265,7 +265,7 @@ static inline void rt6_probe(struct rt6_
27259 /*
27260 * Default Router Selection (RFC 2461 6.3.6)
27261 */
27262-static int inline rt6_check_dev(struct rt6_info *rt, int oif)
27263+static inline int rt6_check_dev(struct rt6_info *rt, int oif)
27264 {
27265 struct net_device *dev = rt->rt6i_dev;
27266 if (!oif || dev->ifindex == oif)
27267@@ -276,7 +276,7 @@ static int inline rt6_check_dev(struct r
27268 return 0;
27269 }
27270
27271-static int inline rt6_check_neigh(struct rt6_info *rt)
27272+static inline int rt6_check_neigh(struct rt6_info *rt)
27273 {
27274 struct neighbour *neigh = rt->rt6i_nexthop;
27275 int m = 0;
27276diff -urNp linux-2.6.18/net/ipv6/xfrm6_tunnel.c linux-2.6.18/net/ipv6/xfrm6_tunnel.c
27277--- linux-2.6.18/net/ipv6/xfrm6_tunnel.c 2006-09-19 23:42:06.000000000 -0400
27278+++ linux-2.6.18/net/ipv6/xfrm6_tunnel.c 2006-09-22 20:45:04.000000000 -0400
27279@@ -58,7 +58,7 @@ static kmem_cache_t *xfrm6_tunnel_spi_km
27280 static struct hlist_head xfrm6_tunnel_spi_byaddr[XFRM6_TUNNEL_SPI_BYADDR_HSIZE];
27281 static struct hlist_head xfrm6_tunnel_spi_byspi[XFRM6_TUNNEL_SPI_BYSPI_HSIZE];
27282
27283-static unsigned inline xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
27284+static inline unsigned xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
27285 {
27286 unsigned h;
27287
27288@@ -70,7 +70,7 @@ static unsigned inline xfrm6_tunnel_spi_
27289 return h;
27290 }
27291
27292-static unsigned inline xfrm6_tunnel_spi_hash_byspi(u32 spi)
27293+static inline unsigned xfrm6_tunnel_spi_hash_byspi(u32 spi)
27294 {
27295 return spi % XFRM6_TUNNEL_SPI_BYSPI_HSIZE;
27296 }
27297diff -urNp linux-2.6.18/net/sctp/sm_statetable.c linux-2.6.18/net/sctp/sm_statetable.c
27298--- linux-2.6.18/net/sctp/sm_statetable.c 2006-09-19 23:42:06.000000000 -0400
27299+++ linux-2.6.18/net/sctp/sm_statetable.c 2006-09-22 20:45:04.000000000 -0400
27300@@ -986,7 +986,7 @@ static const sctp_sm_table_entry_t *sctp
27301 if (state > SCTP_STATE_MAX)
27302 return &bug;
27303
27304- if (cid >= 0 && cid <= SCTP_CID_BASE_MAX)
27305+ if (cid <= SCTP_CID_BASE_MAX)
27306 return &chunk_event_table[cid][state];
27307
27308 if (sctp_prsctp_enable) {
27309diff -urNp linux-2.6.18/net/socket.c linux-2.6.18/net/socket.c
27310--- linux-2.6.18/net/socket.c 2006-09-19 23:42:06.000000000 -0400
27311+++ linux-2.6.18/net/socket.c 2006-09-22 20:04:35.000000000 -0400
27312@@ -85,6 +85,7 @@
27313 #include <linux/kmod.h>
27314 #include <linux/audit.h>
27315 #include <linux/wireless.h>
27316+#include <linux/in.h>
27317
27318 #include <asm/uaccess.h>
27319 #include <asm/unistd.h>
27320@@ -94,6 +95,21 @@
27321 #include <net/sock.h>
27322 #include <linux/netfilter.h>
27323
27324+extern void gr_attach_curr_ip(const struct sock *sk);
27325+extern int gr_handle_sock_all(const int family, const int type,
27326+ const int protocol);
27327+extern int gr_handle_sock_server(const struct sockaddr *sck);
27328+extern int gr_handle_sock_server_other(const struct socket *sck);
27329+extern int gr_handle_sock_client(const struct sockaddr *sck);
27330+extern int gr_search_connect(const struct socket * sock,
27331+ const struct sockaddr_in * addr);
27332+extern int gr_search_bind(const struct socket * sock,
27333+ const struct sockaddr_in * addr);
27334+extern int gr_search_listen(const struct socket * sock);
27335+extern int gr_search_accept(const struct socket * sock);
27336+extern int gr_search_socket(const int domain, const int type,
27337+ const int protocol);
27338+
27339 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
27340 static ssize_t sock_aio_read(struct kiocb *iocb, char __user *buf,
27341 size_t size, loff_t pos);
27342@@ -341,7 +357,7 @@ static int sockfs_get_sb(struct file_sys
27343 mnt);
27344 }
27345
27346-static struct vfsmount *sock_mnt __read_mostly;
27347+struct vfsmount *sock_mnt __read_mostly;
27348
27349 static struct file_system_type sock_fs_type = {
27350 .name = "sockfs",
27351@@ -1241,6 +1257,16 @@ asmlinkage long sys_socket(int family, i
27352 int retval;
27353 struct socket *sock;
27354
27355+ if(!gr_search_socket(family, type, protocol)) {
27356+ retval = -EACCES;
27357+ goto out;
27358+ }
27359+
27360+ if (gr_handle_sock_all(family, type, protocol)) {
27361+ retval = -EACCES;
27362+ goto out;
27363+ }
27364+
27365 retval = sock_create(family, type, protocol, &sock);
27366 if (retval < 0)
27367 goto out;
27368@@ -1336,16 +1362,25 @@ asmlinkage long sys_bind(int fd, struct
27369 {
27370 struct socket *sock;
27371 char address[MAX_SOCK_ADDR];
27372+ struct sockaddr *sck;
27373 int err, fput_needed;
27374
27375 if((sock = sockfd_lookup_light(fd, &err, &fput_needed))!=NULL)
27376 {
27377 if((err=move_addr_to_kernel(umyaddr,addrlen,address))>=0) {
27378+ sck = (struct sockaddr *)address;
27379+ if (!gr_search_bind(sock, (struct sockaddr_in *)sck) ||
27380+ gr_handle_sock_server(sck)) {
27381+ err = -EACCES;
27382+ goto error;
27383+ }
27384+
27385 err = security_socket_bind(sock, (struct sockaddr *)address, addrlen);
27386 if (!err)
27387 err = sock->ops->bind(sock,
27388 (struct sockaddr *)address, addrlen);
27389 }
27390+error:
27391 fput_light(sock->file, fput_needed);
27392 }
27393 return err;
27394@@ -1369,10 +1404,17 @@ asmlinkage long sys_listen(int fd, int b
27395 if ((unsigned) backlog > sysctl_somaxconn)
27396 backlog = sysctl_somaxconn;
27397
27398+ if (gr_handle_sock_server_other(sock) ||
27399+ !gr_search_listen(sock)) {
27400+ err = -EPERM;
27401+ goto error;
27402+ }
27403+
27404 err = security_socket_listen(sock, backlog);
27405 if (!err)
27406 err = sock->ops->listen(sock, backlog);
27407
27408+error:
27409 fput_light(sock->file, fput_needed);
27410 }
27411 return err;
27412@@ -1409,6 +1451,13 @@ asmlinkage long sys_accept(int fd, struc
27413 newsock->type = sock->type;
27414 newsock->ops = sock->ops;
27415
27416+ if (gr_handle_sock_server_other(sock) ||
27417+ !gr_search_accept(sock)) {
27418+ err = -EPERM;
27419+ sock_release(newsock);
27420+ goto out_put;
27421+ }
27422+
27423 /*
27424 * We don't need try_module_get here, as the listening socket (sock)
27425 * has the protocol module (sock->ops->owner) held.
27426@@ -1450,6 +1499,7 @@ asmlinkage long sys_accept(int fd, struc
27427 err = newfd;
27428
27429 security_socket_post_accept(sock, newsock);
27430+ gr_attach_curr_ip(newsock->sk);
27431
27432 out_put:
27433 fput_light(sock->file, fput_needed);
27434@@ -1478,6 +1528,7 @@ asmlinkage long sys_connect(int fd, stru
27435 {
27436 struct socket *sock;
27437 char address[MAX_SOCK_ADDR];
27438+ struct sockaddr *sck;
27439 int err, fput_needed;
27440
27441 sock = sockfd_lookup_light(fd, &err, &fput_needed);
27442@@ -1487,6 +1538,13 @@ asmlinkage long sys_connect(int fd, stru
27443 if (err < 0)
27444 goto out_put;
27445
27446+ sck = (struct sockaddr *)address;
27447+ if (!gr_search_connect(sock, (struct sockaddr_in *)sck) ||
27448+ gr_handle_sock_client(sck)) {
27449+ err = -EACCES;
27450+ goto out_put;
27451+ }
27452+
27453 err = security_socket_connect(sock, (struct sockaddr *)address, addrlen);
27454 if (err)
27455 goto out_put;
27456@@ -1741,6 +1799,7 @@ asmlinkage long sys_shutdown(int fd, int
27457 err = sock->ops->shutdown(sock, how);
27458 fput_light(sock->file, fput_needed);
27459 }
27460+
27461 return err;
27462 }
27463
27464diff -urNp linux-2.6.18/net/unix/af_unix.c linux-2.6.18/net/unix/af_unix.c
27465--- linux-2.6.18/net/unix/af_unix.c 2006-09-19 23:42:06.000000000 -0400
27466+++ linux-2.6.18/net/unix/af_unix.c 2006-09-22 20:04:35.000000000 -0400
27467@@ -116,6 +116,7 @@
27468 #include <linux/mount.h>
27469 #include <net/checksum.h>
27470 #include <linux/security.h>
27471+#include <linux/grsecurity.h>
27472
27473 int sysctl_unix_max_dgram_qlen = 10;
27474
27475@@ -706,6 +707,11 @@ static struct sock *unix_find_other(stru
27476 if (err)
27477 goto put_fail;
27478
27479+ if (!gr_acl_handle_unix(nd.dentry, nd.mnt)) {
27480+ err = -EACCES;
27481+ goto put_fail;
27482+ }
27483+
27484 err = -ECONNREFUSED;
27485 if (!S_ISSOCK(nd.dentry->d_inode->i_mode))
27486 goto put_fail;
27487@@ -729,6 +735,13 @@ static struct sock *unix_find_other(stru
27488 if (u) {
27489 struct dentry *dentry;
27490 dentry = unix_sk(u)->dentry;
27491+
27492+ if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
27493+ err = -EPERM;
27494+ sock_put(u);
27495+ goto fail;
27496+ }
27497+
27498 if (dentry)
27499 touch_atime(unix_sk(u)->mnt, dentry);
27500 } else
27501@@ -807,9 +820,18 @@ static int unix_bind(struct socket *sock
27502 */
27503 mode = S_IFSOCK |
27504 (SOCK_INODE(sock)->i_mode & ~current->fs->umask);
27505+
27506+ if (!gr_acl_handle_mknod(dentry, nd.dentry, nd.mnt, mode)) {
27507+ err = -EACCES;
27508+ goto out_mknod_dput;
27509+ }
27510+
27511 err = vfs_mknod(nd.dentry->d_inode, dentry, mode, 0);
27512 if (err)
27513 goto out_mknod_dput;
27514+
27515+ gr_handle_create(dentry, nd.mnt);
27516+
27517 mutex_unlock(&nd.dentry->d_inode->i_mutex);
27518 dput(nd.dentry);
27519 nd.dentry = dentry;
27520@@ -827,6 +849,10 @@ static int unix_bind(struct socket *sock
27521 goto out_unlock;
27522 }
27523
27524+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
27525+ sk->sk_peercred.pid = current->pid;
27526+#endif
27527+
27528 list = &unix_socket_table[addr->hash];
27529 } else {
27530 list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
27531diff -urNp linux-2.6.18/net/xfrm/xfrm_user.c linux-2.6.18/net/xfrm/xfrm_user.c
27532--- linux-2.6.18/net/xfrm/xfrm_user.c 2006-09-19 23:42:06.000000000 -0400
27533+++ linux-2.6.18/net/xfrm/xfrm_user.c 2006-09-22 20:45:04.000000000 -0400
27534@@ -1584,7 +1584,7 @@ nlmsg_failure:
27535 return -1;
27536 }
27537
27538-static int inline xfrm_sa_len(struct xfrm_state *x)
27539+static inline int xfrm_sa_len(struct xfrm_state *x)
27540 {
27541 int l = 0;
27542 if (x->aalg)
27543diff -urNp linux-2.6.18/security/commoncap.c linux-2.6.18/security/commoncap.c
27544--- linux-2.6.18/security/commoncap.c 2006-09-19 23:42:06.000000000 -0400
27545+++ linux-2.6.18/security/commoncap.c 2006-09-22 20:04:35.000000000 -0400
27546@@ -23,6 +23,7 @@
27547 #include <linux/ptrace.h>
27548 #include <linux/xattr.h>
27549 #include <linux/hugetlb.h>
27550+#include <linux/grsecurity.h>
27551
27552 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
27553 {
27554@@ -44,7 +45,15 @@ EXPORT_SYMBOL(cap_netlink_recv);
27555 int cap_capable (struct task_struct *tsk, int cap)
27556 {
27557 /* Derived from include/linux/sched.h:capable. */
27558- if (cap_raised(tsk->cap_effective, cap))
27559+ if (cap_raised (tsk->cap_effective, cap) && gr_task_is_capable(tsk, cap))
27560+ return 0;
27561+ return -EPERM;
27562+}
27563+
27564+int cap_capable_nolog (struct task_struct *tsk, int cap)
27565+{
27566+ /* Derived from include/linux/sched.h:capable. */
27567+ if (cap_raised (tsk->cap_effective, cap))
27568 return 0;
27569 return -EPERM;
27570 }
27571@@ -163,8 +172,11 @@ void cap_bprm_apply_creds (struct linux_
27572 }
27573 }
27574
27575- current->suid = current->euid = current->fsuid = bprm->e_uid;
27576- current->sgid = current->egid = current->fsgid = bprm->e_gid;
27577+ if (!gr_check_user_change(-1, bprm->e_uid, bprm->e_uid))
27578+ current->suid = current->euid = current->fsuid = bprm->e_uid;
27579+
27580+ if (!gr_check_group_change(-1, bprm->e_gid, bprm->e_gid))
27581+ current->sgid = current->egid = current->fsgid = bprm->e_gid;
27582
27583 /* For init, we want to retain the capabilities set
27584 * in the init_task struct. Thus we skip the usual
27585@@ -175,6 +187,8 @@ void cap_bprm_apply_creds (struct linux_
27586 cap_intersect (new_permitted, bprm->cap_effective);
27587 }
27588
27589+ gr_handle_chroot_caps(current);
27590+
27591 /* AUD: Audit candidate if current->cap_effective is set */
27592
27593 current->keep_capabilities = 0;
27594@@ -320,12 +334,13 @@ int cap_vm_enough_memory(long pages)
27595 {
27596 int cap_sys_admin = 0;
27597
27598- if (cap_capable(current, CAP_SYS_ADMIN) == 0)
27599+ if (cap_capable_nolog(current, CAP_SYS_ADMIN) == 0)
27600 cap_sys_admin = 1;
27601 return __vm_enough_memory(pages, cap_sys_admin);
27602 }
27603
27604 EXPORT_SYMBOL(cap_capable);
27605+EXPORT_SYMBOL(cap_capable_nolog);
27606 EXPORT_SYMBOL(cap_settime);
27607 EXPORT_SYMBOL(cap_ptrace);
27608 EXPORT_SYMBOL(cap_capget);
27609diff -urNp linux-2.6.18/security/dummy.c linux-2.6.18/security/dummy.c
27610--- linux-2.6.18/security/dummy.c 2006-09-19 23:42:06.000000000 -0400
27611+++ linux-2.6.18/security/dummy.c 2006-09-22 20:04:35.000000000 -0400
27612@@ -28,6 +28,7 @@
27613 #include <linux/hugetlb.h>
27614 #include <linux/ptrace.h>
27615 #include <linux/file.h>
27616+#include <linux/grsecurity.h>
27617
27618 static int dummy_ptrace (struct task_struct *parent, struct task_struct *child)
27619 {
27620@@ -138,8 +139,11 @@ static void dummy_bprm_apply_creds (stru
27621 }
27622 }
27623
27624- current->suid = current->euid = current->fsuid = bprm->e_uid;
27625- current->sgid = current->egid = current->fsgid = bprm->e_gid;
27626+ if (!gr_check_user_change(-1, bprm->e_uid, bprm->e_uid))
27627+ current->suid = current->euid = current->fsuid = bprm->e_uid;
27628+
27629+ if (!gr_check_group_change(-1, bprm->e_gid, bprm->e_gid))
27630+ current->sgid = current->egid = current->fsgid = bprm->e_gid;
27631
27632 dummy_capget(current, &current->cap_effective, &current->cap_inheritable, &current->cap_permitted);
27633 }
27634diff -urNp linux-2.6.18/security/Kconfig linux-2.6.18/security/Kconfig
27635--- linux-2.6.18/security/Kconfig 2006-09-19 23:42:06.000000000 -0400
27636+++ linux-2.6.18/security/Kconfig 2006-09-22 20:49:25.000000000 -0400
27637@@ -4,6 +4,432 @@
27638
27639 menu "Security options"
27640
27641+menu "PaX"
27642+
27643+config PAX
27644+ bool "Enable various PaX features"
27645+ depends on GRKERNSEC && (ALPHA || ARM || IA64 || MIPS32 || MIPS64 || PARISC || PPC32 || PPC64 || SPARC32 || SPARC64 || X86 || X86_64)
27646+ help
27647+ This allows you to enable various PaX features. PaX adds
27648+ intrusion prevention mechanisms to the kernel that reduce
27649+ the risks posed by exploitable memory corruption bugs.
27650+
27651+menu "PaX Control"
27652+ depends on PAX
27653+
27654+config PAX_SOFTMODE
27655+ bool 'Support soft mode'
27656+ help
27657+ Enabling this option will allow you to run PaX in soft mode, that
27658+ is, PaX features will not be enforced by default, only on executables
27659+ marked explicitly. You must also enable PT_PAX_FLAGS support as it
27660+ is the only way to mark executables for soft mode use.
27661+
27662+ Soft mode can be activated by using the "pax_softmode=1" kernel command
27663+ line option on boot. Furthermore you can control various PaX features
27664+ at runtime via the entries in /proc/sys/kernel/pax.
27665+
27666+config PAX_EI_PAX
27667+ bool 'Use legacy ELF header marking'
27668+ help
27669+ Enabling this option will allow you to control PaX features on
27670+ a per executable basis via the 'chpax' utility available at
27671+ http://pax.grsecurity.net/. The control flags will be read from
27672+ an otherwise reserved part of the ELF header. This marking has
27673+ numerous drawbacks (no support for soft-mode, toolchain does not
27674+ know about the non-standard use of the ELF header) therefore it
27675+ has been deprecated in favour of PT_PAX_FLAGS support.
27676+
27677+ If you have applications not marked by the PT_PAX_FLAGS ELF
27678+ program header then you MUST enable this option otherwise they
27679+ will not get any protection.
27680+
27681+ Note that if you enable PT_PAX_FLAGS marking support as well,
27682+ the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
27683+
27684+config PAX_PT_PAX_FLAGS
27685+ bool 'Use ELF program header marking'
27686+ help
27687+ Enabling this option will allow you to control PaX features on
27688+ a per executable basis via the 'paxctl' utility available at
27689+ http://pax.grsecurity.net/. The control flags will be read from
27690+ a PaX specific ELF program header (PT_PAX_FLAGS). This marking
27691+ has the benefits of supporting both soft mode and being fully
27692+ integrated into the toolchain (the binutils patch is available
27693+ from http://pax.grsecurity.net).
27694+
27695+ If you have applications not marked by the PT_PAX_FLAGS ELF
27696+ program header then you MUST enable the EI_PAX marking support
27697+ otherwise they will not get any protection.
27698+
27699+ Note that if you enable the legacy EI_PAX marking support as well,
27700+ the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
27701+
27702+choice
27703+ prompt 'MAC system integration'
27704+ default PAX_NO_ACL_FLAGS
27705+ help
27706+ Mandatory Access Control systems have the option of controlling
27707+ PaX flags on a per executable basis, choose the method supported
27708+ by your particular system.
27709+
27710+ - "none": if your MAC system does not interact with PaX,
27711+ - "direct": if your MAC system defines pax_set_flags() itself,
27712+ - "hook": if your MAC system uses the pax_set_flags_func callback.
27713+
27714+ NOTE: this option is for developers/integrators only.
27715+
27716+config PAX_NO_ACL_FLAGS
27717+ bool 'none'
27718+
27719+config PAX_HAVE_ACL_FLAGS
27720+ bool 'direct'
27721+
27722+config PAX_HOOK_ACL_FLAGS
27723+ bool 'hook'
27724+endchoice
27725+
27726+endmenu
27727+
27728+menu "Non-executable pages"
27729+ depends on PAX
27730+
27731+config PAX_NOEXEC
27732+ bool "Enforce non-executable pages"
27733+ depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || IA64 || MIPS32 || MIPS64 || PARISC || PPC32 || PPC64 || SPARC32 || SPARC64 || X86 || X86_64)
27734+ help
27735+ By design some architectures do not allow for protecting memory
27736+ pages against execution or even if they do, Linux does not make
27737+ use of this feature. In practice this means that if a page is
27738+ readable (such as the stack or heap) it is also executable.
27739+
27740+ There is a well known exploit technique that makes use of this
27741+ fact and a common programming mistake where an attacker can
27742+ introduce code of his choice somewhere in the attacked program's
27743+ memory (typically the stack or the heap) and then execute it.
27744+
27745+ If the attacked program was running with different (typically
27746+ higher) privileges than that of the attacker, then he can elevate
27747+ his own privilege level (e.g. get a root shell, write to files for
27748+ which he does not have write access to, etc).
27749+
27750+ Enabling this option will let you choose from various features
27751+ that prevent the injection and execution of 'foreign' code in
27752+ a program.
27753+
27754+ This will also break programs that rely on the old behaviour and
27755+ expect that dynamically allocated memory via the malloc() family
27756+ of functions is executable (which it is not). Notable examples
27757+ are the XFree86 4.x server, the java runtime and wine.
27758+
27759+config PAX_PAGEEXEC
27760+ bool "Paging based non-executable pages"
27761+ depends on !COMPAT_VDSO && PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MPENTIUM4 || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2)
27762+ help
27763+ This implementation is based on the paging feature of the CPU.
27764+ On i386 and ppc there is a variable but usually low performance
27765+ impact on applications. On alpha, ia64, parisc, sparc, sparc64
27766+ and x86_64 there is no performance impact.
27767+
27768+config PAX_SEGMEXEC
27769+ bool "Segmentation based non-executable pages"
27770+ depends on !COMPAT_VDSO && PAX_NOEXEC && X86_32
27771+ help
27772+ This implementation is based on the segmentation feature of the
27773+ CPU and has little performance impact, however applications will
27774+ be limited to a 1.5 GB address space instead of the normal 3 GB.
27775+
27776+choice
27777+ prompt "Default non-executable page method"
27778+ depends on PAX_PAGEEXEC && PAX_SEGMEXEC
27779+ default PAX_DEFAULT_SEGMEXEC
27780+ help
27781+ Select the default non-executable page method applied to applications
27782+ that do not select one themselves.
27783+
27784+config PAX_DEFAULT_PAGEEXEC
27785+ bool "PAGEEXEC"
27786+
27787+config PAX_DEFAULT_SEGMEXEC
27788+ bool "SEGMEXEC"
27789+endchoice
27790+
27791+config PAX_EMUTRAMP
27792+ bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || PPC32 || X86_32)
27793+ default y if PARISC || PPC32
27794+ help
27795+ There are some programs and libraries that for one reason or
27796+ another attempt to execute special small code snippets from
27797+ non-executable memory pages. Most notable examples are the
27798+ signal handler return code generated by the kernel itself and
27799+ the GCC trampolines.
27800+
27801+ If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
27802+ such programs will no longer work under your kernel.
27803+
27804+ As a remedy you can say Y here and use the 'chpax' or 'paxctl'
27805+ utilities to enable trampoline emulation for the affected programs
27806+ yet still have the protection provided by the non-executable pages.
27807+
27808+ On parisc and ppc you MUST enable this option and EMUSIGRT as
27809+ well, otherwise your system will not even boot.
27810+
27811+ Alternatively you can say N here and use the 'chpax' or 'paxctl'
27812+ utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
27813+ for the affected files.
27814+
27815+ NOTE: enabling this feature *may* open up a loophole in the
27816+ protection provided by non-executable pages that an attacker
27817+ could abuse. Therefore the best solution is to not have any
27818+ files on your system that would require this option. This can
27819+ be achieved by not using libc5 (which relies on the kernel
27820+ signal handler return code) and not using or rewriting programs
27821+ that make use of the nested function implementation of GCC.
27822+ Skilled users can just fix GCC itself so that it implements
27823+ nested function calls in a way that does not interfere with PaX.
27824+
27825+config PAX_EMUSIGRT
27826+ bool "Automatically emulate sigreturn trampolines"
27827+ depends on PAX_EMUTRAMP && (PARISC || PPC32)
27828+ default y
27829+ help
27830+ Enabling this option will have the kernel automatically detect
27831+ and emulate signal return trampolines executing on the stack
27832+ that would otherwise lead to task termination.
27833+
27834+ This solution is intended as a temporary one for users with
27835+ legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
27836+ Modula-3 runtime, etc) or executables linked to such, basically
27837+ everything that does not specify its own SA_RESTORER function in
27838+ normal executable memory like glibc 2.1+ does.
27839+
27840+ On parisc and ppc you MUST enable this option, otherwise your
27841+ system will not even boot.
27842+
27843+ NOTE: this feature cannot be disabled on a per executable basis
27844+ and since it *does* open up a loophole in the protection provided
27845+ by non-executable pages, the best solution is to not have any
27846+ files on your system that would require this option.
27847+
27848+config PAX_MPROTECT
27849+ bool "Restrict mprotect()"
27850+ depends on (PAX_PAGEEXEC || PAX_SEGMEXEC) && !PPC64
27851+ help
27852+ Enabling this option will prevent programs from
27853+ - changing the executable status of memory pages that were
27854+ not originally created as executable,
27855+ - making read-only executable pages writable again,
27856+ - creating executable pages from anonymous memory.
27857+
27858+ You should say Y here to complete the protection provided by
27859+ the enforcement of non-executable pages.
27860+
27861+ NOTE: you can use the 'chpax' or 'paxctl' utilities to control
27862+ this feature on a per file basis.
27863+
27864+config PAX_NOELFRELOCS
27865+ bool "Disallow ELF text relocations"
27866+ depends on PAX_MPROTECT && !PAX_ETEXECRELOCS && (IA64 || X86 || X86_64)
27867+ help
27868+ Non-executable pages and mprotect() restrictions are effective
27869+ in preventing the introduction of new executable code into an
27870+ attacked task's address space. There remain only two venues
27871+ for this kind of attack: if the attacker can execute already
27872+ existing code in the attacked task then he can either have it
27873+ create and mmap() a file containing his code or have it mmap()
27874+ an already existing ELF library that does not have position
27875+ independent code in it and use mprotect() on it to make it
27876+ writable and copy his code there. While protecting against
27877+ the former approach is beyond PaX, the latter can be prevented
27878+ by having only PIC ELF libraries on one's system (which do not
27879+ need to relocate their code). If you are sure this is your case,
27880+ then enable this option otherwise be careful as you may not even
27881+ be able to boot or log on your system (for example, some PAM
27882+ modules are erroneously compiled as non-PIC by default).
27883+
27884+ NOTE: if you are using dynamic ELF executables (as suggested
27885+ when using ASLR) then you must have made sure that you linked
27886+ your files using the PIC version of crt1 (the et_dyn.tar.gz package
27887+ referenced there has already been updated to support this).
27888+
27889+config PAX_ETEXECRELOCS
27890+ bool "Allow ELF ET_EXEC text relocations"
27891+ depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
27892+ default y
27893+ help
27894+ On some architectures there are incorrectly created applications
27895+ that require text relocations and would not work without enabling
27896+ this option. If you are an alpha, ia64 or parisc user, you should
27897+ enable this option and disable it once you have made sure that
27898+ none of your applications need it.
27899+
27900+config PAX_EMUPLT
27901+ bool "Automatically emulate ELF PLT"
27902+ depends on PAX_MPROTECT && (ALPHA || PARISC || PPC32 || SPARC32 || SPARC64)
27903+ default y
27904+ help
27905+ Enabling this option will have the kernel automatically detect
27906+ and emulate the Procedure Linkage Table entries in ELF files.
27907+ On some architectures such entries are in writable memory, and
27908+ become non-executable leading to task termination. Therefore
27909+ it is mandatory that you enable this option on alpha, parisc, ppc,
27910+ sparc and sparc64, otherwise your system would not even boot.
27911+
27912+ NOTE: this feature *does* open up a loophole in the protection
27913+ provided by the non-executable pages, therefore the proper
27914+ solution is to modify the toolchain to produce a PLT that does
27915+ not need to be writable.
27916+
27917+config PAX_DLRESOLVE
27918+ bool
27919+ depends on PAX_EMUPLT && (SPARC32 || SPARC64)
27920+ default y
27921+
27922+config PAX_SYSCALL
27923+ bool
27924+ depends on PAX_PAGEEXEC && PPC32
27925+ default y
27926+
27927+config PAX_KERNEXEC
27928+ bool "Enforce non-executable kernel pages"
27929+ depends on PAX_NOEXEC && X86_32 && !HOTPLUG_PCI_COMPAQ_NVRAM && !PCI_BIOS && !EFI && !DEBUG_RODATA && !COMPAT_VDSO
27930+ help
27931+ This is the kernel land equivalent of PAGEEXEC and MPROTECT,
27932+ that is, enabling this option will make it harder to inject
27933+ and execute 'foreign' code in kernel memory itself.
27934+
27935+endmenu
27936+
27937+menu "Address Space Layout Randomization"
27938+ depends on PAX
27939+
27940+config PAX_ASLR
27941+ bool "Address Space Layout Randomization"
27942+ depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
27943+ help
27944+ Many if not most exploit techniques rely on the knowledge of
27945+ certain addresses in the attacked program. The following options
27946+ will allow the kernel to apply a certain amount of randomization
27947+ to specific parts of the program thereby forcing an attacker to
27948+ guess them in most cases. Any failed guess will most likely crash
27949+ the attacked program which allows the kernel to detect such attempts
27950+ and react on them. PaX itself provides no reaction mechanisms,
27951+ instead it is strongly encouraged that you make use of Nergal's
27952+ segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
27953+ (http://www.grsecurity.net/) built-in crash detection features or
27954+ develop one yourself.
27955+
27956+ By saying Y here you can choose to randomize the following areas:
27957+ - top of the task's kernel stack
27958+ - top of the task's userland stack
27959+ - base address for mmap() requests that do not specify one
27960+ (this includes all libraries)
27961+ - base address of the main executable
27962+
27963+ It is strongly recommended to say Y here as address space layout
27964+ randomization has negligible impact on performance yet it provides
27965+ a very effective protection.
27966+
27967+ NOTE: you can use the 'chpax' or 'paxctl' utilities to control
27968+ this feature on a per file basis.
27969+
27970+config PAX_RANDKSTACK
27971+ bool "Randomize kernel stack base"
27972+ depends on PAX_ASLR && X86_TSC && X86_32
27973+ help
27974+ By saying Y here the kernel will randomize every task's kernel
27975+ stack on every system call. This will not only force an attacker
27976+ to guess it but also prevent him from making use of possible
27977+ leaked information about it.
27978+
27979+ Since the kernel stack is a rather scarce resource, randomization
27980+ may cause unexpected stack overflows, therefore you should very
27981+ carefully test your system. Note that once enabled in the kernel
27982+ configuration, this feature cannot be disabled on a per file basis.
27983+
27984+config PAX_RANDUSTACK
27985+ bool "Randomize user stack base"
27986+ depends on PAX_ASLR
27987+ help
27988+ By saying Y here the kernel will randomize every task's userland
27989+ stack. The randomization is done in two steps where the second
27990+ one may apply a big amount of shift to the top of the stack and
27991+ cause problems for programs that want to use lots of memory (more
27992+ than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
27993+ For this reason the second step can be controlled by 'chpax' or
27994+ 'paxctl' on a per file basis.
27995+
27996+config PAX_RANDMMAP
27997+ bool "Randomize mmap() base"
27998+ depends on PAX_ASLR
27999+ help
28000+ By saying Y here the kernel will use a randomized base address for
28001+ mmap() requests that do not specify one themselves. As a result
28002+ all dynamically loaded libraries will appear at random addresses
28003+ and therefore be harder to exploit by a technique where an attacker
28004+ attempts to execute library code for his purposes (e.g. spawn a
28005+ shell from an exploited program that is running at an elevated
28006+ privilege level).
28007+
28008+ Furthermore, if a program is relinked as a dynamic ELF file, its
28009+ base address will be randomized as well, completing the full
28010+ randomization of the address space layout. Attacking such programs
28011+ becomes a guess game. You can find an example of doing this at
28012+ http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
28013+ http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
28014+
28015+ NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
28016+ feature on a per file basis.
28017+
28018+endmenu
28019+
28020+menu "Miscellaneous hardening features"
28021+
28022+config PAX_MEMORY_SANITIZE
28023+ bool "Sanitize all freed memory"
28024+ help
28025+ By saying Y here the kernel will erase memory pages as soon as they
28026+ are freed. This in turn reduces the lifetime of data stored in the
28027+ pages, making it less likely that sensitive information such as
28028+ passwords, cryptographic secrets, etc stay in memory for too long.
28029+
28030+ This is especially useful for programs whose runtime is short, long
28031+ lived processes and the kernel itself benefit from this as long as
28032+ they operate on whole memory pages and ensure timely freeing of pages
28033+ that may hold sensitive information.
28034+
28035+ The tradeoff is performance impact, on a single CPU system kernel
28036+ compilation sees a 3% slowdown, other systems and workloads may vary
28037+ and you are advised to test this feature on your expected workload
28038+ before deploying it.
28039+
28040+ Note that this feature does not protect data stored in live pages,
28041+ e.g., process memory swapped to disk may stay there for a long time.
28042+
28043+config PAX_MEMORY_UDEREF
28044+ bool "Prevent invalid userland pointer dereference"
28045+ depends on X86_32 && !COMPAT_VDSO
28046+ help
28047+ By saying Y here the kernel will be prevented from dereferencing
28048+ userland pointers in contexts where the kernel expects only kernel
28049+ pointers. This is both a useful runtime debugging feature and a
28050+ security measure that prevents exploiting a class of kernel bugs.
28051+
28052+ The tradeoff is that some virtualization solutions may experience
28053+ a huge slowdown and therefore you should not enable this feature
28054+ for kernels meant to run in such environments. Whether a given VM
28055+ solution is affected or not is best determined by simply trying it
28056+ out, the performance impact will be obvious right on boot as this
28057+ mechanism engages from very early on. A good rule of thumb is that
28058+ VMs running on CPUs without hardware virtualization support (i.e.,
28059+ the majority of IA-32 CPUs) will likely experience the slowdown.
28060+
28061+endmenu
28062+
28063+endmenu
28064+
28065+source grsecurity/Kconfig
28066+
28067 config KEYS
28068 bool "Enable access key retention support"
28069 help
28070diff -urNp linux-2.6.18/sound/core/oss/pcm_oss.c linux-2.6.18/sound/core/oss/pcm_oss.c
28071--- linux-2.6.18/sound/core/oss/pcm_oss.c 2006-09-19 23:42:06.000000000 -0400
28072+++ linux-2.6.18/sound/core/oss/pcm_oss.c 2006-09-22 20:45:04.000000000 -0400
28073@@ -2854,8 +2854,8 @@ static void snd_pcm_oss_proc_done(struct
28074 }
28075 }
28076 #else /* !CONFIG_SND_VERBOSE_PROCFS */
28077-#define snd_pcm_oss_proc_init(pcm)
28078-#define snd_pcm_oss_proc_done(pcm)
28079+#define snd_pcm_oss_proc_init(pcm) do {} while (0)
28080+#define snd_pcm_oss_proc_done(pcm) do {} while (0)
28081 #endif /* CONFIG_SND_VERBOSE_PROCFS */
28082
28083 /*
The Linux kernel (the core of the Linux operating system)
This page took 3.107505 seconds and 4 git commands to generate.