]> git.pld-linux.org Git - packages/kernel.git/blame - kernel-grsec-minimal.patch
projects / packages / kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- don't use CONFIG_STRICT_DEVMEM for rescue
[packages/kernel.git] / kernel-grsec-minimal.patch
CommitLineData
2380c486
JR		 1diff -urNp linux-2.6.26.orig/arch/sparc/Makefile linux-2.6.26/arch/sparc/Makefile
2--- linux-2.6.26.orig/arch/sparc/Makefile 2008-09-01 11:44:21.000000000 +0200
3+++ linux-2.6.26/arch/sparc/Makefile 2008-09-02 12:17:21.000000000 +0200
4@@ -36,7 +36,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
5 # Renaming is done to avoid confusing pattern matching rules in 2.5.45 (multy-)
6 INIT_Y := $(patsubst %/, %/built-in.o, $(init-y))
7 CORE_Y := $(core-y)
8-CORE_Y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
9+CORE_Y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
10 CORE_Y := $(patsubst %/, %/built-in.o, $(CORE_Y))
11 DRIVERS_Y := $(patsubst %/, %/built-in.o, $(drivers-y))
12 NET_Y := $(patsubst %/, %/built-in.o, $(net-y))
13diff -urNp linux-2.6.26.orig/drivers/char/keyboard.c linux-2.6.26/drivers/char/keyboard.c
14--- linux-2.6.26.orig/drivers/char/keyboard.c 2008-09-01 11:43:37.000000000 +0200
15+++ linux-2.6.26/drivers/char/keyboard.c 2008-09-02 12:17:21.000000000 +0200
16@@ -633,6 +633,16 @@ static void k_spec(struct vc_data *vc, u
17 kbd->kbdmode == VC_MEDIUMRAW) &&
18 value != KVAL(K_SAK))
19 return; /* SAK is allowed even in raw mode */
20+
21+#if defined(CONFIG_GRKERNSEC_PROC)
22+ {
23+ void *func = fn_handler[value];
24+ if (func == fn_show_state || func == fn_show_ptregs ||
25+ func == fn_show_mem)
26+ return;
27+ }
28+#endif
29+
30 fn_handler[value](vc);
31 }
32
33diff -urNp linux-2.6.26.orig/drivers/pci/proc.c linux-2.6.26/drivers/pci/proc.c
34--- linux-2.6.26.orig/drivers/pci/proc.c 2008-09-01 11:43:47.000000000 +0200
35+++ linux-2.6.26/drivers/pci/proc.c 2008-09-02 12:17:21.000000000 +0200
36@@ -472,7 +472,16 @@ static const struct file_operations proc
37 static int __init pci_proc_init(void)
38 {
39 struct pci_dev *dev = NULL;
40+
41+#ifdef CONFIG_GRKERNSEC_PROC_ADD
42+#ifdef CONFIG_GRKERNSEC_PROC_USER
43+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
44+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
46+#endif
47+#else
48 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
49+#endif
50 proc_create("devices", 0, proc_bus_pci_dir,
51 &proc_bus_pci_dev_operations);
52 proc_initialized = 1;
53diff -urNp linux-2.6.26.orig/fs/Kconfig linux-2.6.26/fs/Kconfig
54--- linux-2.6.26.orig/fs/proc/Kconfig 2008-09-01 11:43:58.000000000 +0200
55+++ linux-2.6.26/fs/proc/Kconfig 2008-09-02 12:17:21.000000000 +0200
56@@ -926,12 +926,12 @@ config PROC_FS
57
58 config PROC_KCORE
59 bool "/proc/kcore support" if !ARM
60- depends on PROC_FS && MMU
61+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
62
63 config PROC_VMCORE
64 bool "/proc/vmcore support (EXPERIMENTAL)"
65- depends on PROC_FS && CRASH_DUMP
66- default y
67+ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
68+ default n
69 help
70 Exports the dump image of crashed kernel in ELF format.
71
72diff -urNp linux-2.6.26.orig/fs/namei.c linux-2.6.26/fs/namei.c
73--- linux-2.6.26.orig/fs/namei.c 2008-09-01 11:43:59.000000000 +0200
74+++ linux-2.6.26/fs/namei.c 2008-09-02 12:17:21.000000000 +0200
75@@ -38,6 +38,7 @@
76 #include <linux/vs_cowbl.h>
77 #include <linux/vs_device.h>
78 #include <linux/vs_context.h>
79+#include <linux/grsecurity.h>
80 #include <linux/pid_namespace.h>
81 #include <asm/uaccess.h>
82
83@@ -740,6 +741,13 @@ static inline int do_follow_link(struct
84 err = security_inode_follow_link(path->dentry, nd);
85 if (err)
86 goto loop;
87+
88+ if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
89+ path->dentry->d_inode, path->dentry)) {
90+ err = -EACCES;
91+ goto loop;
92+ }
93+
94 current->link_count++;
95 current->total_link_count++;
96 nd->depth++;
97@@ -1925,6 +1933,12 @@ do_last:
98 /*
99 * It already exists.
100 */
101+
102+ if (gr_handle_fifo(path.dentry, dir, flag, acc_mode)) {
103+ error = -EACCES;
104+ goto exit_mutex_unlock;
105+ }
106+
107 mutex_unlock(&dir->d_inode->i_mutex);
108 audit_inode(pathname, path.dentry);
109
110@@ -2028,6 +2042,13 @@ do_link:
111 error = security_inode_follow_link(path.dentry, &nd);
112 if (error)
113 goto exit_dput;
114+
115+ if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
116+ path.dentry)) {
117+ error = -EACCES;
118+ goto exit_dput;
119+ }
120+
121 error = __do_follow_link(&path, &nd);
122 if (error) {
123 /* Does someone understand code flow here? Or it is only
124@@ -2669,6 +2690,13 @@ asmlinkage long sys_linkat(int olddfd, c
125 error = PTR_ERR(new_dentry);
126 if (IS_ERR(new_dentry))
127 goto out_unlock;
128+
129+ if (gr_handle_hardlink(old_path.dentry, old_path.dentry->d_inode,
130+ old_path.dentry->d_inode->i_mode, to)) {
131+ error = -EACCES;
132+ goto out_dput;
133+ }
134+
135 error = mnt_want_write(nd.path.mnt);
136 if (error)
137 goto out_dput;
138diff -urNp linux-2.6.26.orig/fs/proc/array.c linux-2.6.26/fs/proc/array.c
139--- linux-2.6.26.orig/fs/proc/array.c 2008-09-01 11:43:59.000000000 +0200
140+++ linux-2.6.26/fs/proc/array.c 2008-09-02 12:17:21.000000000 +0200
141@@ -639,3 +639,10 @@ int proc_pid_statm(struct seq_file *m, s
142
143 return 0;
144 }
145+
146+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
147+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
148+{
149+ return sprintf(buffer, "%u.%u.%u.%u\n", NIPQUAD(task->signal->curr_ip));
150+}
151+#endif
152diff -urNp linux-2.6.26.orig/fs/proc/base.c linux-2.6.26/fs/proc/base.c
153--- linux-2.6.26.orig/fs/proc/base.c 2008-09-01 11:43:59.000000000 +0200
154+++ linux-2.6.26/fs/proc/base.c 2008-09-02 12:23:45.000000000 +0200
155@@ -79,6 +79,8 @@
156 #include <linux/pid_namespace.h>
157 #include <linux/vs_context.h>
158 #include <linux/vs_network.h>
159+#include <linux/grsecurity.h>
160+
161 #include "internal.h"
162
163 /* NOTE:
164@@ -307,9 +312,9 @@ static int proc_pid_auxv(struct task_str
165 struct mm_struct *mm = get_task_mm(task);
166 if (mm) {
167 unsigned int nwords = 0;
168- do
169+ do {
170 nwords += 2;
171- while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
172+ } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
173 res = nwords * sizeof(mm->saved_auxv[0]);
174 if (res > PAGE_SIZE)
175 res = PAGE_SIZE;
176@@ -1412,7 +1417,11 @@ static struct inode *proc_pid_make_inode
177 inode->i_gid = 0;
178 if (task_dumpable(task)) {
179 inode->i_uid = task->euid;
180+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
181+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
182+#else
183 inode->i_gid = task->egid;
184+#endif
185 }
186 /* procfs is xid tagged */
187 inode->i_tag = (tag_t)vx_task_xid(task);
188@@ -1430,17 +1439,39 @@ static int pid_getattr(struct vfsmount *
189 {
190 struct inode *inode = dentry->d_inode;
191 struct task_struct *task;
192+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
193+ struct task_struct *tmp = current;
194+#endif
195+
196 generic_fillattr(inode, stat);
197
198 rcu_read_lock();
199 stat->uid = 0;
200 stat->gid = 0;
201 task = pid_task(proc_pid(inode), PIDTYPE_PID);
202- if (task) {
203+
204+ if (task
205+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
206+ && (!tmp->uid || (tmp->uid == task->uid)
207+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
208+ || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
209+#endif
210+ )
211+#endif
212+ ) {
213 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
214+#ifdef CONFIG_GRKERNSEC_PROC_USER
215+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
216+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
217+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
218+#endif
219 task_dumpable(task)) {
220 stat->uid = task->euid;
221+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
222+ stat->gid = CONFIG_GRKERNSEC_PROC_GID;
223+#else
224 stat->gid = task->egid;
225+#endif
226 }
227 }
228 rcu_read_unlock();
229@@ -1468,11 +1505,21 @@ static int pid_revalidate(struct dentry
230 {
231 struct inode *inode = dentry->d_inode;
232 struct task_struct *task = get_proc_task(inode);
233+
234 if (task) {
235 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
236+#ifdef CONFIG_GRKERNSEC_PROC_USER
237+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
238+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
239+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
240+#endif
241 task_dumpable(task)) {
242 inode->i_uid = task->euid;
243+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
244+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
245+#else
246 inode->i_gid = task->egid;
247+#endif
248 } else {
249 inode->i_uid = 0;
250 inode->i_gid = 0;
251@@ -1841,12 +1888,19 @@ static int proc_fd_permission(struct ino
252 struct nameidata *nd)
253 {
254 int rv;
255+ struct task_struct *task;
256
257 rv = generic_permission(inode, mask, NULL);
258- if (rv == 0)
259- return 0;
260+
261 if (task_pid(current) == proc_pid(inode))
262 rv = 0;
263+
264+ task = get_proc_task(inode);
265+ if (task == NULL)
266+ return rv;
267+
268+ put_task_struct(task);
269+
270 return rv;
271 }
272
273@@ -2617,7 +2683,14 @@ static struct dentry *proc_pid_instantia
274 if (!inode)
275 goto out;
276
277+#ifdef CONFIG_GRKERNSEC_PROC_USER
278+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
279+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
280+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
281+ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
282+#else
283 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
284+#endif
285 inode->i_op = &proc_tgid_base_inode_operations;
286 inode->i_fop = &proc_tgid_base_operations;
287 inode->i_flags|=S_IMMUTABLE;
288@@ -2724,6 +2801,9 @@ int proc_pid_readdir(struct file * filp,
289 {
290 unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
291 struct task_struct *reaper = get_proc_task_real(filp->f_path.dentry->d_inode);
292+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
293+ struct task_struct *tmp = current;
294+#endif
295 struct tgid_iter iter;
296 struct pid_namespace *ns;
297
298@@ -2742,6 +2822,15 @@ int proc_pid_readdir(struct file * filp,
299 for (iter = next_tgid(ns, iter);
300 iter.task;
301 iter.tgid += 1, iter = next_tgid(ns, iter)) {
302+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
303+ if (tmp->uid && (iter.task->uid != tmp->uid)
304+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
305+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
306+#endif
307+ )
308+#endif
309+ continue;
310+
311 filp->f_pos = iter.tgid + TGID_OFFSET;
312 if (!vx_proc_task_visible(iter.task))
313 continue;
314@@ -2815,6 +2906,9 @@ static const struct pid_entry tid_base_s
315 #ifdef CONFIG_FAULT_INJECTION
316 REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
317 #endif
318+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
319+ INF("ipaddr", S_IRUSR, pid_ipaddr),
320+#endif
321 };
322
323 static int proc_tid_base_readdir(struct file * filp,
324diff -urNp linux-2.6.26.orig/fs/proc/inode.c linux-2.6.26/fs/proc/inode.c
325--- linux-2.6.26.orig/fs/proc/inode.c 2008-09-01 11:43:59.000000000 +0200
326+++ linux-2.6.26/fs/proc/inode.c 2008-09-02 12:17:21.000000000 +0200
327@@ -403,7 +403,11 @@ struct inode *proc_get_inode(struct supe
328 if (de->mode) {
329 inode->i_mode = de->mode;
330 inode->i_uid = de->uid;
331+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
332+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
333+#else
334 inode->i_gid = de->gid;
335+#endif
336 }
337 if (de->vx_flags)
338 PROC_I(inode)->vx_flags = de->vx_flags;
339diff -urNp linux-2.6.26.orig/fs/proc/internal.h linux-2.6.26/fs/proc/internal.h
340--- linux-2.6.26.orig/fs/proc/internal.h 2008-09-01 11:43:59.000000000 +0200
341+++ linux-2.6.26/fs/proc/internal.h 2008-09-02 12:17:21.000000000 +0200
342@@ -58,6 +58,9 @@ extern int proc_pid_statm(struct seq_fil
343 struct pid *pid, struct task_struct *task);
344 extern int proc_pid_nsproxy(struct seq_file *m, struct pid_namespace *ns,
345 struct pid *pid, struct task_struct *task);
346+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
347+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
348+#endif
349
350 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
351
352--- linux-2.6.26.orig/fs/proc/cmdline.c 2008-12-25 00:26:37.000000000 +0100
353+++ linux-2.6.26/fs/proc/cmdline.c 2009-01-02 17:46:34.278247774 +0100
354@@ -23,7 +23,15 @@
355
356 static int __init proc_cmdline_init(void)
357 {
358- proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
359+ int gr_mode = 0;
360+#ifdef CONFIG_GRKERNSEC_PROC_USER
361+ gr_mode = S_IRUSR;
362+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
363+ gr_mode = S_IRUSR | S_IRGRP;
364+#endif
365+#ifdef CONFIG_GRKERNSEC_PROC_ADD
366+ proc_create("cmdline", gr_mode, NULL, &cmdline_proc_fops);
367+#endif
368 return 0;
369 }
370 module_init(proc_cmdline_init);
371--- linux-2.6.26.orig/fs/proc/devices.c 2008-12-25 00:26:37.000000000 +0100
372+++ linux-2.6.26/fs/proc/devices.c 2009-01-02 17:43:00.758269666 +0100
373@@ -64,7 +64,13 @@
374
375 static int __init proc_devices_init(void)
376 {
377- proc_create("devices", 0, NULL, &proc_devinfo_operations);
378+ int gr_mode = 0;
379+#ifdef CONFIG_GRKERNSEC_PROC_USER
380+ gr_mode = S_IRUSR;
381+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
382+ gr_mode = S_IRUSR | S_IRGRP;
383+#endif
384+ proc_create("devices", gr_mode, NULL, &proc_devinfo_operations);
385 return 0;
386 }
387 module_init(proc_devices_init);
388--- linux-2.6.26.orig/fs/proc/kcore.c 2008-12-25 00:26:37.000000000 +0100
389+++ linux-2.6.26/fs/proc/kcore.c 2009-01-02 17:45:03.714922801 +0100
390@@ -404,10 +404,12 @@
391
392 static int __init proc_kcore_init(void)
393 {
394+#if defined(CONFIG_PROC_KCORE) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
395 proc_root_kcore = proc_create("kcore", S_IRUSR, NULL, &proc_kcore_operations);
396 if (proc_root_kcore)
397 proc_root_kcore->size =
398 (size_t)high_memory - PAGE_OFFSET + PAGE_SIZE;
399+#endif
400 return 0;
401 }
402 module_init(proc_kcore_init);
403diff -urNp linux-2.6.26.orig/fs/proc/root.c linux-2.6.26/fs/proc/root.c
404--- linux-2.6.26.orig/fs/proc/root.c 2008-09-01 11:43:59.000000000 +0200
405+++ linux-2.6.26/fs/proc/root.c 2008-09-02 12:17:21.000000000 +0200
406@@ -139,7 +139,15 @@ void __init proc_root_init(void)
407 #ifdef CONFIG_PROC_DEVICETREE
408 proc_device_tree_init();
409 #endif
410+#ifdef CONFIG_GRKERNSEC_PROC_ADD
411+#ifdef CONFIG_GRKERNSEC_PROC_USER
412+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
413+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
414+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
415+#endif
416+#else
417 proc_mkdir("bus", NULL);
418+#endif
419 proc_sys_init();
420 proc_vx_init();
421 }
422diff -urNp linux-2.6.26.orig/grsecurity/grsec_disabled.c linux-2.6.26/grsecurity/grsec_disabled.c
423--- linux-2.6.26.orig/grsecurity/grsec_disabled.c 1970-01-01 01:00:00.000000000 +0100
424+++ linux-2.6.26/grsecurity/grsec_disabled.c 2008-09-02 12:17:21.000000000 +0200
425@@ -0,0 +1,6 @@
426+void
427+grsecurity_init(void)
428+{
429+ return;
430+}
431+
432diff -urNp linux-2.6.26.orig/grsecurity/grsec_fifo.c linux-2.6.26/grsecurity/grsec_fifo.c
433--- linux-2.6.26.orig/grsecurity/grsec_fifo.c 1970-01-01 01:00:00.000000000 +0100
434+++ linux-2.6.26/grsecurity/grsec_fifo.c 2008-09-02 12:17:21.000000000 +0200
435@@ -0,0 +1,20 @@
436+#include <linux/kernel.h>
437+#include <linux/sched.h>
438+#include <linux/fs.h>
439+#include <linux/file.h>
440+#include <linux/grinternal.h>
441+
442+int
443+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
444+ const struct dentry *dir, const int flag, const int acc_mode)
445+{
446+#ifdef CONFIG_GRKERNSEC_FIFO
447+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
448+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
449+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
450+ (current->fsuid != dentry->d_inode->i_uid)) {
451+ return -EACCES;
452+ }
453+#endif
454+ return 0;
455+}
456diff -urNp linux-2.6.26.orig/grsecurity/grsec_init.c linux-2.6.26/grsecurity/grsec_init.c
457--- linux-2.6.26.orig/grsecurity/grsec_init.c 1970-01-01 01:00:00.000000000 +0100
458+++ linux-2.6.26/grsecurity/grsec_init.c 2008-09-02 12:17:21.000000000 +0200
459@@ -0,0 +1,29 @@
460+#include <linux/kernel.h>
461+#include <linux/sched.h>
462+#include <linux/mm.h>
463+#include <linux/smp_lock.h>
464+#include <linux/slab.h>
465+#include <linux/vmalloc.h>
466+#include <linux/percpu.h>
467+
468+int grsec_enable_link;
469+int grsec_enable_fifo;
470+int grsec_lock;
471+
472+void
473+grsecurity_init(void)
474+{
475+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
476+#ifndef CONFIG_GRKERNSEC_SYSCTL
477+ grsec_lock = 1;
478+#endif
479+#ifdef CONFIG_GRKERNSEC_LINK
480+ grsec_enable_link = 1;
481+#endif
482+#ifdef CONFIG_GRKERNSEC_FIFO
483+ grsec_enable_fifo = 1;
484+#endif
485+#endif
486+
487+ return;
488+}
489diff -urNp linux-2.6.26.orig/grsecurity/grsec_link.c linux-2.6.26/grsecurity/grsec_link.c
490--- linux-2.6.26.orig/grsecurity/grsec_link.c 1970-01-01 01:00:00.000000000 +0100
491+++ linux-2.6.26/grsecurity/grsec_link.c 2008-09-02 12:17:21.000000000 +0200
492@@ -0,0 +1,37 @@
493+#include <linux/kernel.h>
494+#include <linux/sched.h>
495+#include <linux/fs.h>
496+#include <linux/file.h>
497+#include <linux/grinternal.h>
498+
499+int
500+gr_handle_follow_link(const struct inode *parent,
501+ const struct inode *inode,
502+ const struct dentry *dentry, const struct vfsmount *mnt)
503+{
504+#ifdef CONFIG_GRKERNSEC_LINK
505+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
506+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
507+ (parent->i_mode & S_IWOTH) && (current->fsuid != inode->i_uid)) {
508+ return -EACCES;
509+ }
510+#endif
511+ return 0;
512+}
513+
514+int
515+gr_handle_hardlink(const struct dentry *dentry,
516+ const struct vfsmount *mnt,
517+ struct inode *inode, const int mode, const char *to)
518+{
519+#ifdef CONFIG_GRKERNSEC_LINK
520+ if (grsec_enable_link && current->fsuid != inode->i_uid &&
521+ (!S_ISREG(mode) || (mode & S_ISUID) ||
522+ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
523+ (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
524+ !capable(CAP_FOWNER) && current->uid) {
525+ return -EPERM;
526+ }
527+#endif
528+ return 0;
529+}
530diff -urNp linux-2.6.26.orig/grsecurity/grsec_sock.c linux-2.6.26/grsecurity/grsec_sock.c
531--- linux-2.6.26.orig/grsecurity/grsec_sock.c 1970-01-01 01:00:00.000000000 +0100
532+++ linux-2.6.26/grsecurity/grsec_sock.c 2008-09-02 12:17:21.000000000 +0200
533@@ -0,0 +1,170 @@
534+#include <linux/kernel.h>
535+#include <linux/module.h>
536+#include <linux/sched.h>
537+#include <linux/file.h>
538+#include <linux/net.h>
539+#include <linux/in.h>
540+#include <linux/ip.h>
541+#include <net/sock.h>
542+#include <net/inet_sock.h>
543+#include <linux/grsecurity.h>
544+#include <linux/grinternal.h>
545+
546+#ifdef CONFIG_GRKERNSEC
547+#define gr_conn_table_size 32749
548+struct conn_table_entry {
549+ struct conn_table_entry *next;
550+ struct signal_struct *sig;
551+};
552+
553+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
554+spinlock_t gr_conn_table_lock = SPIN_LOCK_UNLOCKED;
555+
556+extern const char * gr_socktype_to_name(unsigned char type);
557+extern const char * gr_proto_to_name(unsigned char proto);
558+
559+static __inline__ int
560+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
561+{
562+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
563+}
564+
565+static __inline__ int
566+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
567+ __u16 sport, __u16 dport)
568+{
569+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
570+ sig->gr_sport == sport && sig->gr_dport == dport))
571+ return 1;
572+ else
573+ return 0;
574+}
575+
576+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
577+{
578+ struct conn_table_entry **match;
579+ unsigned int index;
580+
581+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
582+ sig->gr_sport, sig->gr_dport,
583+ gr_conn_table_size);
584+
585+ newent->sig = sig;
586+
587+ match = &gr_conn_table[index];
588+ newent->next = *match;
589+ *match = newent;
590+
591+ return;
592+}
593+
594+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
595+{
596+ struct conn_table_entry *match, *last = NULL;
597+ unsigned int index;
598+
599+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
600+ sig->gr_sport, sig->gr_dport,
601+ gr_conn_table_size);
602+
603+ match = gr_conn_table[index];
604+ while (match && !conn_match(match->sig,
605+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
606+ sig->gr_dport)) {
607+ last = match;
608+ match = match->next;
609+ }
610+
611+ if (match) {
612+ if (last)
613+ last->next = match->next;
614+ else
615+ gr_conn_table[index] = NULL;
616+ kfree(match);
617+ }
618+
619+ return;
620+}
621+
622+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
623+ __u16 sport, __u16 dport)
624+{
625+ struct conn_table_entry *match;
626+ unsigned int index;
627+
628+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
629+
630+ match = gr_conn_table[index];
631+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
632+ match = match->next;
633+
634+ if (match)
635+ return match->sig;
636+ else
637+ return NULL;
638+}
639+
640+#endif
641+
642+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
643+{
644+#ifdef CONFIG_GRKERNSEC
645+ struct signal_struct *sig = task->signal;
646+ struct conn_table_entry *newent;
647+
648+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
649+ if (newent == NULL)
650+ return;
651+ /* no bh lock needed since we are called with bh disabled */
652+ spin_lock(&gr_conn_table_lock);
653+ gr_del_task_from_ip_table_nolock(sig);
654+ sig->gr_saddr = inet->rcv_saddr;
655+ sig->gr_daddr = inet->daddr;
656+ sig->gr_sport = inet->sport;
657+ sig->gr_dport = inet->dport;
658+ gr_add_to_task_ip_table_nolock(sig, newent);
659+ spin_unlock(&gr_conn_table_lock);
660+#endif
661+ return;
662+}
663+
664+void gr_del_task_from_ip_table(struct task_struct *task)
665+{
666+#ifdef CONFIG_GRKERNSEC
667+ spin_lock(&gr_conn_table_lock);
668+ gr_del_task_from_ip_table_nolock(task->signal);
669+ spin_unlock(&gr_conn_table_lock);
670+#endif
671+ return;
672+}
673+
674+void
675+gr_attach_curr_ip(const struct sock *sk)
676+{
677+#ifdef CONFIG_GRKERNSEC
678+ struct signal_struct *p, *set;
679+ const struct inet_sock *inet = inet_sk(sk);
680+
681+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
682+ return;
683+
684+ set = current->signal;
685+
686+ spin_lock_bh(&gr_conn_table_lock);
687+ p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
688+ inet->dport, inet->sport);
689+ if (unlikely(p != NULL)) {
690+ set->curr_ip = p->curr_ip;
691+ set->used_accept = 1;
692+ gr_del_task_from_ip_table_nolock(p);
693+ spin_unlock_bh(&gr_conn_table_lock);
694+ return;
695+ }
696+ spin_unlock_bh(&gr_conn_table_lock);
697+
698+ set->curr_ip = inet->daddr;
699+ set->used_accept = 1;
700+#endif
701+ return;
702+}
703+
704diff -urNp linux-2.6.26.orig/grsecurity/grsec_sysctl.c linux-2.6.26/grsecurity/grsec_sysctl.c
705--- linux-2.6.26.orig/grsecurity/grsec_sysctl.c 1970-01-01 01:00:00.000000000 +0100
706+++ linux-2.6.26/grsecurity/grsec_sysctl.c 2008-09-02 12:17:21.000000000 +0200
707@@ -0,0 +1,52 @@
708+#include <linux/kernel.h>
709+#include <linux/sched.h>
710+#include <linux/sysctl.h>
711+#include <linux/grsecurity.h>
712+#include <linux/grinternal.h>
713+
714+int
715+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
716+{
717+#ifdef CONFIG_GRKERNSEC_SYSCTL
718+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & 002)) {
719+ return -EACCES;
720+ }
721+#endif
722+ return 0;
723+}
724+
725+#if defined(CONFIG_GRKERNSEC_SYSCTL)
726+ctl_table grsecurity_table[] = {
727+#ifdef CONFIG_GRKERNSEC_SYSCTL
728+#ifdef CONFIG_GRKERNSEC_LINK
729+ {
730+ .ctl_name = CTL_UNNUMBERED,
731+ .procname = "linking_restrictions",
732+ .data = &grsec_enable_link,
733+ .maxlen = sizeof(int),
734+ .mode = 0600,
735+ .proc_handler = &proc_dointvec,
736+ },
737+#endif
738+#ifdef CONFIG_GRKERNSEC_FIFO
739+ {
740+ .ctl_name = CTL_UNNUMBERED,
741+ .procname = "fifo_restrictions",
742+ .data = &grsec_enable_fifo,
743+ .maxlen = sizeof(int),
744+ .mode = 0600,
745+ .proc_handler = &proc_dointvec,
746+ },
747+#endif
748+ {
749+ .ctl_name = CTL_UNNUMBERED,
750+ .procname = "grsec_lock",
751+ .data = &grsec_lock,
752+ .maxlen = sizeof(int),
753+ .mode = 0600,
754+ .proc_handler = &proc_dointvec,
755+ },
756+#endif
757+ { .ctl_name = 0 }
758+};
759+#endif
760diff -urNp linux-2.6.26.orig/grsecurity/Kconfig linux-2.6.26/grsecurity/Kconfig
761--- linux-2.6.26.orig/grsecurity/Kconfig 1970-01-01 01:00:00.000000000 +0100
762+++ linux-2.6.26/grsecurity/Kconfig 2008-09-02 12:17:21.000000000 +0200
763@@ -0,0 +1,123 @@
764+#
765+# grecurity configuration
766+#
767+
768+menu "Grsecurity"
769+
770+config GRKERNSEC
771+ bool "Grsecurity"
772+ select CRYPTO
773+ select CRYPTO_SHA256
774+ select SECURITY
775+ select SECURITY_CAPABILITIES
776+ help
777+ If you say Y here, you will be able to configure many features
778+ that will enhance the security of your system. It is highly
779+ recommended that you say Y here and read through the help
780+ for each option so that you fully understand the features and
781+ can evaluate their usefulness for your machine.
782+
783+menu "Filesystem Protections"
784+depends on GRKERNSEC
785+
786+config GRKERNSEC_PROC
787+ bool "Proc restrictions"
788+ help
789+ If you say Y here, the permissions of the /proc filesystem
790+ will be altered to enhance system security and privacy. You MUST
791+ choose either a user only restriction or a user and group restriction.
792+ Depending upon the option you choose, you can either restrict users to
793+ see only the processes they themselves run, or choose a group that can
794+ view all processes and files normally restricted to root if you choose
795+ the "restrict to user only" option. NOTE: If you're running identd as
796+ a non-root user, you will have to run it as the group you specify here.
797+
798+config GRKERNSEC_PROC_USER
799+ bool "Restrict /proc to user only"
800+ depends on GRKERNSEC_PROC
801+ help
802+ If you say Y here, non-root users will only be able to view their own
803+ processes, and restricts them from viewing network-related information,
804+ and viewing kernel symbol and module information.
805+
806+config GRKERNSEC_PROC_USERGROUP
807+ bool "Allow special group"
808+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
809+ help
810+ If you say Y here, you will be able to select a group that will be
811+ able to view all processes, network-related information, and
812+ kernel and symbol information. This option is useful if you want
813+ to run identd as a non-root user.
814+
815+config GRKERNSEC_PROC_GID
816+ int "GID for special group"
817+ depends on GRKERNSEC_PROC_USERGROUP
818+ default 1001
819+
820+config GRKERNSEC_PROC_ADD
821+ bool "Additional restrictions"
822+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
823+ help
824+ If you say Y here, additional restrictions will be placed on
825+ /proc that keep normal users from viewing device information and
826+ slabinfo information that could be useful for exploits.
827+
828+config GRKERNSEC_LINK
829+ bool "Linking restrictions"
830+ help
831+ If you say Y here, /tmp race exploits will be prevented, since users
832+ will no longer be able to follow symlinks owned by other users in
833+ world-writable +t directories (i.e. /tmp), unless the owner of the
834+ symlink is the owner of the directory. users will also not be
835+ able to hardlink to files they do not own. If the sysctl option is
836+ enabled, a sysctl option with name "linking_restrictions" is created.
837+
838+config GRKERNSEC_FIFO
839+ bool "FIFO restrictions"
840+ help
841+ If you say Y here, users will not be able to write to FIFOs they don't
842+ own in world-writable +t directories (i.e. /tmp), unless the owner of
843+ the FIFO is the same owner of the directory it's held in. If the sysctl
844+ option is enabled, a sysctl option with name "fifo_restrictions" is
845+ created.
846+
847+config GRKERNSEC_PROC_IPADDR
848+ bool "/proc/<pid>/ipaddr support"
849+ help
850+ If you say Y here, a new entry will be added to each /proc/<pid>
851+ directory that contains the IP address of the person using the task.
852+ The IP is carried across local TCP and AF_UNIX stream sockets.
853+ This information can be useful for IDS/IPSes to perform remote response
854+ to a local attack. The entry is readable by only the owner of the
855+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
856+ the RBAC system), and thus does not create privacy concerns.
857+
858+endmenu
859+
860+config GRKERNSEC_SYSCTL
861+ bool "Sysctl support"
862+ help
863+ If you say Y here, you will be able to change the options that
864+ grsecurity runs with at bootup, without having to recompile your
865+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
866+ to enable (1) or disable (0) various features. All the sysctl entries
867+ are mutable until the "grsec_lock" entry is set to a non-zero value.
868+ All features enabled in the kernel configuration are disabled at boot
869+ if you do not say Y to the "Turn on features by default" option.
870+ All options should be set at startup, and the grsec_lock entry should
871+ be set to a non-zero value after all the options are set.
872+ *THIS IS EXTREMELY IMPORTANT*
873+
874+config GRKERNSEC_SYSCTL_ON
875+ bool "Turn on features by default"
876+ depends on GRKERNSEC_SYSCTL
877+ help
878+ If you say Y here, instead of having all features enabled in the
879+ kernel configuration disabled at boot time, the features will be
880+ enabled at boot time. It is recommended you say Y here unless
881+ there is some reason you would want all sysctl-tunable features to
882+ be disabled by default. As mentioned elsewhere, it is important
883+ to enable the grsec_lock entry once you have finished modifying
884+ the sysctl entries.
885+
886+endmenu
887diff -urNp linux-2.6.26.orig/grsecurity/Makefile linux-2.6.26/grsecurity/Makefile
888--- linux-2.6.26.orig/grsecurity/Makefile 1970-01-01 01:00:00.000000000 +0100
889+++ linux-2.6.26/grsecurity/Makefile 2008-09-02 12:17:21.000000000 +0200
890@@ -0,0 +1,11 @@
891+# All code in this directory and various hooks inserted throughout the kernel
892+# are copyright Brad Spengler, and released under the GPL v2 or higher
893+
894+obj-y = grsec_fifo.o grsec_sock.o grsec_sysctl.o grsec_link.o
895+
896+obj-$(CONFIG_GRKERNSEC) += grsec_init.o
897+
898+ifndef CONFIG_GRKERNSEC
899+obj-y += grsec_disabled.o
900+endif
901+
902diff -urNp linux-2.6.26.orig/include/linux/grinternal.h linux-2.6.26/include/linux/grinternal.h
903--- linux-2.6.26.orig/include/linux/grinternal.h 1970-01-01 01:00:00.000000000 +0100
904+++ linux-2.6.26/include/linux/grinternal.h 2008-09-02 12:17:21.000000000 +0200
905@@ -0,0 +1,14 @@
906+#ifndef __GRINTERNAL_H
907+#define __GRINTERNAL_H
908+
909+#ifdef CONFIG_GRKERNSEC
910+
911+#include <linux/fs.h>
912+
913+extern int grsec_enable_link;
914+extern int grsec_enable_fifo;
915+extern int grsec_lock;
916+
917+#endif
918+
919+#endif
920diff -urNp linux-2.6.26.orig/include/linux/grsecurity.h linux-2.6.26/include/linux/grsecurity.h
921--- linux-2.6.26.orig/include/linux/grsecurity.h 1970-01-01 01:00:00.000000000 +0100
922+++ linux-2.6.26/include/linux/grsecurity.h 2008-09-02 12:17:21.000000000 +0200
923@@ -0,0 +1,18 @@
924+#ifndef GR_SECURITY_H
925+#define GR_SECURITY_H
926+#include <linux/fs.h>
927+#include <linux/binfmts.h>
928+
929+void gr_del_task_from_ip_table(struct task_struct *p);
930+
931+int gr_handle_follow_link(const struct inode *parent,
932+ const struct inode *inode,
933+ const struct dentry *dentry);
934+int gr_handle_fifo(const struct dentry *dentry,
935+ const struct dentry *dir, const int flag,
936+ const int acc_mode);
937+int gr_handle_hardlink(const struct dentry *dentry,
938+ struct inode *inode,
939+ const int mode, const char *to);
940+
941+#endif
942diff -urNp linux-2.6.26.orig/include/linux/sched.h linux-2.6.26/include/linux/sched.h
943--- linux-2.6.26.orig/include/linux/sched.h 2008-09-01 11:43:34.000000000 +0200
944+++ linux-2.6.26/include/linux/sched.h 2008-09-02 12:17:21.000000000 +0200
945@@ -544,6 +544,15 @@ struct signal_struct {
946 unsigned audit_tty;
947 struct tty_audit_buf *tty_audit_buf;
948 #endif
949+
950+#ifdef CONFIG_GRKERNSEC
951+ u32 curr_ip;
952+ u32 gr_saddr;
953+ u32 gr_daddr;
954+ u16 gr_sport;
955+ u16 gr_dport;
956+ u8 used_accept:1;
957+#endif
958 };
959
960 /* Context switch must be unlocked if interrupts are to be enabled */
961diff -urNp linux-2.6.26.orig/include/linux/sysctl.h linux-2.6.26/include/linux/sysctl.h
962--- linux-2.6.26.orig/include/linux/sysctl.h 2008-09-01 11:43:34.000000000 +0200
963+++ linux-2.6.26/include/linux/sysctl.h 2008-09-02 12:17:21.000000000 +0200
964@@ -165,8 +165,11 @@ enum
965 KERN_MAX_LOCK_DEPTH=74,
966 KERN_NMI_WATCHDOG=75, /* int: enable/disable nmi watchdog */
967 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
968-};
969+#ifdef CONFIG_GRKERNSEC
970+ KERN_GRSECURITY=98, /* grsecurity */
971+#endif
972
973+};
974
975
976 /* CTL_VM names: */
977diff -urNp linux-2.6.26.orig/kernel/configs.c linux-2.6.26/kernel/configs.c
978--- linux-2.6.26.orig/kernel/configs.c 2008-09-01 11:43:58.000000000 +0200
979+++ linux-2.6.26/kernel/configs.c 2008-09-02 12:17:21.000000000 +0200
980@@ -79,8 +79,19 @@ static int __init ikconfig_init(void)
981 struct proc_dir_entry *entry;
982
983 /* create the current config file */
984+#ifdef CONFIG_GRKERNSEC_PROC_ADD
985+#ifdef CONFIG_GRKERNSEC_PROC_USER
986+ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
987+ &ikconfig_file_ops);
988+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
989+ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
990+ &ikconfig_file_ops);
991+#endif
992+#else
993 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
994 &ikconfig_file_ops);
995+#endif
996+
997 if (!entry)
998 return -ENOMEM;
999
1000diff -urNp linux-2.6.26.orig/kernel/exit.c linux-2.6.26/kernel/exit.c
1001--- linux-2.6.26.orig/kernel/exit.c 2008-09-01 11:43:58.000000000 +0200
1002+++ linux-2.6.26/kernel/exit.c 2008-09-02 12:17:21.000000000 +0200
1003@@ -50,6 +50,7 @@
1004 #include <linux/vs_pid.h>
1005 #include <linux/vserver/global.h>
1006 #include <trace/sched.h>
1007+#include <linux/grsecurity.h>
1008
1009 #include <asm/uaccess.h>
1010 #include <asm/unistd.h>
1011@@ -137,6 +138,7 @@ static void __exit_signal(struct task_st
1012 */
1013 flush_sigqueue(&tsk->pending);
1014
1015+ gr_del_task_from_ip_table(tsk);
1016 tsk->signal = NULL;
1017 tsk->sighand = NULL;
1018 spin_unlock(&sighand->siglock);
1019diff -urNp linux-2.6.26.orig/kernel/kallsyms.c linux-2.6.26/kernel/kallsyms.c
1020--- linux-2.6.26.orig/kernel/kallsyms.c 2008-09-01 11:43:58.000000000 +0200
1021+++ linux-2.6.26/kernel/kallsyms.c 2008-09-02 12:17:21.000000000 +0200
1022@@ -472,7 +472,15 @@ static const struct file_operations kall
1023
1024 static int __init kallsyms_init(void)
1025 {
1026+#ifdef CONFIG_GRKERNSEC_PROC_ADD
1027+#ifdef CONFIG_GRKERNSEC_PROC_USER
1028+ proc_create("kallsyms", S_IFREG | S_IRUSR, NULL, &kallsyms_operations);
1029+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1030+ proc_create("kallsyms", S_IFREG | S_IRUSR | S_IRGRP, NULL, &kallsyms_operations);
1031+#endif
1032+#else
1033 proc_create("kallsyms", 0444, NULL, &kallsyms_operations);
1034+#endif
1035 return 0;
1036 }
1037 __initcall(kallsyms_init);
1038diff -urNp linux-2.6.26.orig/kernel/resource.c linux-2.6.26/kernel/resource.c
1039--- linux-2.6.26.orig/kernel/resource.c 2008-09-01 11:43:58.000000000 +0200
1040+++ linux-2.6.26/kernel/resource.c 2008-09-02 12:17:21.000000000 +0200
1041@@ -131,8 +131,18 @@ static const struct file_operations proc
1042
1043 static int __init ioresources_init(void)
1044 {
1045+#ifdef CONFIG_GRKERNSEC_PROC_ADD
1046+#ifdef CONFIG_GRKERNSEC_PROC_USER
1047+ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
1048+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
1049+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1050+ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
1051+ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
1052+#endif
1053+#else
1054 proc_create("ioports", 0, NULL, &proc_ioports_operations);
1055 proc_create("iomem", 0, NULL, &proc_iomem_operations);
1056+#endif
1057 return 0;
1058 }
1059 __initcall(ioresources_init);
1060diff -urNp linux-2.6.26.orig/kernel/sysctl.c linux-2.6.26/kernel/sysctl.c
1061--- linux-2.6.26.orig/kernel/sysctl.c 2008-09-01 11:43:58.000000000 +0200
1062+++ linux-2.6.26/kernel/sysctl.c 2008-09-02 12:17:21.000000000 +0200
1063@@ -59,6 +59,11 @@
1064 static int deprecated_sysctl_warning(struct __sysctl_args *args);
1065
1066 #if defined(CONFIG_SYSCTL)
1067+#include <linux/grsecurity.h>
1068+#include <linux/grinternal.h>
1069+
1070+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
1071+ const int op);
1072
1073 /* External variables not in a header file. */
1074 extern int C_A_D;
1075@@ -153,6 +158,7 @@ static int proc_do_cad_pid(struct ctl_ta
1076 static int proc_dointvec_taint(struct ctl_table *table, int write, struct file *filp,
1077 void __user *buffer, size_t *lenp, loff_t *ppos);
1078 #endif
1079+extern ctl_table grsecurity_table[];
1080
1081 static struct ctl_table root_table[];
1082 static struct ctl_table_root sysctl_table_root;
1083@@ -823,6 +829,15 @@ static struct ctl_table kern_table[] = {
1084 .child = key_sysctls,
1085 },
1086 #endif
1087+
1088+#if defined(CONFIG_GRKERNSEC_SYSCTL)
1089+ {
1090+ .ctl_name = CTL_UNNUMBERED,
1091+ .procname = "grsecurity",
1092+ .mode = 0500,
1093+ .child = grsecurity_table,
1094+ },
1095+#endif
1096 /*
1097 * NOTE: do not add new entries to this table unless you have read
1098 * Documentation/sysctl/ctl_unnumbered.txt
1099@@ -1585,6 +1600,10 @@ int sysctl_perm(struct ctl_table_root *r
1100 int error;
1101 int mode;
1102
1103+ if (table->parent != NULL && table->parent->procname != NULL &&
1104+ table->procname != NULL &&
1105+ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
1106+ return -EACCES;
1107 error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
1108 if (error)
1109 return error;
1110diff -urNp linux-2.6.26.orig/Makefile linux-2.6.26/Makefile
1111--- linux-2.6.26.orig/Makefile 2008-09-01 11:44:01.000000000 +0200
1112+++ linux-2.6.26/Makefile 2008-09-02 12:17:21.000000000 +0200
1113@@ -607,7 +607,7 @@ export mod_strip_cmd
1114
1115
1116 ifeq ($(KBUILD_EXTMOD),)
1117-core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
1118+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
1119
1120 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
1121 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
1122diff -urNp linux-2.6.26.orig/net/ipv4/inet_hashtables.c linux-2.6.26/net/ipv4/inet_hashtables.c
1123--- linux-2.6.26.orig/net/ipv4/inet_hashtables.c 2008-09-01 11:43:37.000000000 +0200
1124+++ linux-2.6.26/net/ipv4/inet_hashtables.c 2008-09-02 12:17:21.000000000 +0200
1125@@ -18,12 +18,15 @@
1126 #include <linux/sched.h>
1127 #include <linux/slab.h>
1128 #include <linux/wait.h>
1129+#include <linux/grsecurity.h>
1130
1131 #include <net/inet_connection_sock.h>
1132 #include <net/inet_hashtables.h>
1133 #include <net/route.h>
1134 #include <net/ip.h>
1135
1136+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
1137+
1138 /*
1139 * Allocate and initialize a new local port bind bucket.
1140 * The bindhash mutex for snum's hash chain must be held here.
1141@@ -484,6 +487,8 @@ ok:
1142 }
1143 spin_unlock(&head->lock);
1144
1145+ gr_update_task_in_ip_table(current, inet_sk(sk));
1146+
1147 if (tw) {
1148 inet_twsk_deschedule(tw, death_row);
1149 inet_twsk_put(tw);
1150diff -urNp linux-2.6.26.orig/net/socket.c linux-2.6.26/net/socket.c
1151--- linux-2.6.26.orig/net/socket.c 2008-09-01 11:43:36.000000000 +0200
1152+++ linux-2.6.26/net/socket.c 2008-09-02 12:17:21.000000000 +0200
1153@@ -85,6 +85,7 @@
1154 #include <linux/audit.h>
1155 #include <linux/wireless.h>
1156 #include <linux/nsproxy.h>
1157+#include <linux/in.h>
1158
1159 #include <asm/uaccess.h>
1160 #include <asm/unistd.h>
1161@@ -98,6 +99,8 @@
1162 #include <linux/vs_inet.h>
1163 #include <linux/vs_inet6.h>
1164
1165+extern void gr_attach_curr_ip(const struct sock *sk);
1166+
1167 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
1168 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
1169 unsigned long nr_segs, loff_t pos);
1170@@ -1502,6 +1505,7 @@ asmlinkage long sys_accept(int fd, struc
1171 err = newfd;
1172
1173 security_socket_post_accept(sock, newsock);
1174+ gr_attach_curr_ip(newsock->sk);
1175
1176 out_put:
1177 fput_light(sock->file, fput_needed);
1178diff -urNp linux-2.6.26.orig/security/Kconfig linux-2.6.26/security/Kconfig
1179--- linux-2.6.26.orig/security/Kconfig 2008-09-01 11:43:58.000000000 +0200
1180+++ linux-2.6.26/security/Kconfig 2008-09-02 12:17:21.000000000 +0200
1181@@ -4,6 +4,8 @@
1182
1183 menu "Security options"
1184
1185+source grsecurity/Kconfig
1186+
1187 config KEYS
1188 bool "Enable access key retention support"
1189 help
The Linux kernel (the core of the Linux operating system)
This page took 0.1591 seconds and 4 git commands to generate.