]> git.pld-linux.org Git - packages/kernel.git/blame - linux-2.6-grsec-minimal.patch
projects / packages / kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- converted to utf8
[packages/kernel.git] / linux-2.6-grsec-minimal.patch
CommitLineData
c6410bf7 1diff -urNp linux-2.6.16.2/arch/sparc/Makefile linux-2.6.16.2/arch/sparc/Makefile
2--- linux-2.6.16.2/arch/sparc/Makefile 2006-04-07 12:56:47.000000000 -0400
3+++ linux-2.6.16.2/arch/sparc/Makefile 2006-04-09 21:23:54.000000000 -0400
4@@ -34,7 +34,7 @@ libs-y += arch/sparc/prom/ arch/sparc/li
5 # Renaming is done to avoid confusing pattern matching rules in 2.5.45 (multy-)
6 INIT_Y := $(patsubst %/, %/built-in.o, $(init-y))
7 CORE_Y := $(core-y)
8-CORE_Y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
9+CORE_Y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
10 CORE_Y := $(patsubst %/, %/built-in.o, $(CORE_Y))
11 DRIVERS_Y := $(patsubst %/, %/built-in.o, $(drivers-y))
12 NET_Y := $(patsubst %/, %/built-in.o, $(net-y))
13diff -urN linux-2.6.16.2/Makefile linux-2.6.16.2-grsec/Makefile
14--- linux-2.6.16.2/Makefile 2006-04-07 18:56:47.000000000 +0200
15+++ linux-2.6.16.2-grsec/Makefile 2006-04-11 17:44:40.069707000 +0200
16@@ -556,7 +556,7 @@
17
18
19 ifeq ($(KBUILD_EXTMOD),)
20-core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
21+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
22
23 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
24 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
25diff -urN linux-2.6.16.2/drivers/char/keyboard.c linux-2.6.16.2-grsec/drivers/char/keyboard.c
26--- linux-2.6.16.2/drivers/char/keyboard.c 2006-04-07 18:56:47.000000000 +0200
27+++ linux-2.6.16.2-grsec/drivers/char/keyboard.c 2006-04-11 17:44:40.073707250 +0200
28@@ -607,6 +607,16 @@
29 kbd->kbdmode == VC_MEDIUMRAW) &&
30 value != KVAL(K_SAK))
31 return; /* SAK is allowed even in raw mode */
32+
33+#if defined(CONFIG_GRKERNSEC_PROC)
34+ {
35+ void *func = fn_handler[value];
36+ if (func == fn_show_state || func == fn_show_ptregs ||
37+ func == fn_show_mem)
38+ return;
39+ }
40+#endif
41+
42 fn_handler[value](vc, regs);
43 }
44
45diff -urN linux-2.6.16.2/drivers/pci/proc.c linux-2.6.16.2-grsec/drivers/pci/proc.c
46--- linux-2.6.16.2/drivers/pci/proc.c 2006-04-07 18:56:47.000000000 +0200
47+++ linux-2.6.16.2-grsec/drivers/pci/proc.c 2006-04-11 17:44:40.073707250 +0200
48@@ -569,7 +569,15 @@
49
50 static void legacy_proc_init(void)
51 {
52+#ifdef CONFIG_GRKERNSEC_PROC_ADD
53+#ifdef CONFIG_GRKERNSEC_PROC_USER
54+ struct proc_dir_entry * entry = create_proc_entry("pci", S_IRUSR, NULL);
55+#elif CONFIG_GRKERNSEC_PROC_USERGROUP
56+ struct proc_dir_entry * entry = create_proc_entry("pci", S_IRUSR | S_IRGRP, NULL);
57+#endif
58+#else
59 struct proc_dir_entry * entry = create_proc_entry("pci", 0, NULL);
60+#endif
61 if (entry)
62 entry->proc_fops = &proc_pci_operations;
63 }
64@@ -598,7 +606,15 @@
65 {
66 struct proc_dir_entry *entry;
67 struct pci_dev *dev = NULL;
68+#ifdef CONFIG_GRKERNSEC_PROC_ADD
69+#ifdef CONFIG_GRKERNSEC_PROC_USER
70+ proc_bus_pci_dir = proc_mkdir_mode("pci", S_IRUSR | S_IXUSR, proc_bus);
71+#elif CONFIG_GRKERNSEC_PROC_USERGROUP
72+ proc_bus_pci_dir = proc_mkdir_mode("pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, proc_bus);
73+#endif
74+#else
75 proc_bus_pci_dir = proc_mkdir("pci", proc_bus);
76+#endif
77 entry = create_proc_entry("devices", 0, proc_bus_pci_dir);
78 if (entry)
79 entry->proc_fops = &proc_bus_pci_dev_operations;
80diff -urN linux-2.6.16.2/fs/Kconfig linux-2.6.16.2-grsec/fs/Kconfig
81--- linux-2.6.16.2/fs/Kconfig 2006-04-07 18:56:47.000000000 +0200
82+++ linux-2.6.16.2-grsec/fs/Kconfig 2006-04-11 17:44:40.073707250 +0200
83@@ -794,7 +794,7 @@
84
85 config PROC_KCORE
86 bool "/proc/kcore support" if !ARM
87- depends on PROC_FS && MMU
88+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
89
90 config PROC_VMCORE
91 bool "/proc/vmcore support (EXPERIMENTAL)"
92diff -urN linux-2.6.16.2/fs/namei.c linux-2.6.16.2-grsec/fs/namei.c
93--- linux-2.6.16.2/fs/namei.c 2006-04-07 18:56:47.000000000 +0200
94+++ linux-2.6.16.2-grsec/fs/namei.c 2006-04-11 18:10:35.961452750 +0200
95@@ -32,6 +32,7 @@
96 #include <linux/vserver/inode.h>
97 #include <linux/vs_tag.h>
98 #include <linux/vserver/debug.h>
99+#include <linux/grsecurity.h>
100 #include <asm/namei.h>
101 #include <asm/uaccess.h>
102
103@@ -608,6 +609,13 @@
104 err = security_inode_follow_link(path->dentry, nd);
105 if (err)
106 goto loop;
107+
108+ if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
109+ path->dentry->d_inode, path->dentry, nd->mnt)) {
110+ err = -EACCES;
111+ goto loop;
112+ }
113+
114 current->link_count++;
115 current->total_link_count++;
116 nd->depth++;
117@@ -1647,6 +1655,13 @@
118 /*
119 * It already exists.
120 */
121+
122+ if (gr_handle_fifo(path.dentry, nd->mnt, dir, flag, acc_mode)) {
123+ mutex_unlock(&dir->d_inode->i_mutex);
124+ error = -EACCES;
125+ goto exit_dput;
126+ }
127+
128 mutex_unlock(&dir->d_inode->i_mutex);
129
130 error = -EEXIST;
131@@ -1700,6 +1715,13 @@
132 error = security_inode_follow_link(path.dentry, nd);
133 if (error)
134 goto exit_dput;
135+
136+ if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
137+ path.dentry, nd->mnt)) {
138+ error = -EACCES;
139+ goto exit_dput;
140+ }
141+
142 error = __do_follow_link(&path, nd);
143 if (error)
144 return error;
145@@ -2251,8 +2273,14 @@
146 new_dentry = lookup_create(&nd, 0);
147 error = PTR_ERR(new_dentry);
148 if (!IS_ERR(new_dentry)) {
149- error = vfs_link(old_nd.dentry, nd.dentry->d_inode,
150- new_dentry, &nd);
151+ error = 0;
152+ if (gr_handle_hardlink(old_nd.dentry, old_nd.mnt,
153+ old_nd.dentry->d_inode,
154+ old_nd.dentry->d_inode->i_mode, to))
155+ error = -EPERM;
156+ if (!error)
157+ error = vfs_link(old_nd.dentry, nd.dentry->d_inode,
158+ new_dentry, &nd);
159 dput(new_dentry);
160 }
161 mutex_unlock(&nd.dentry->d_inode->i_mutex);
162diff -urN linux-2.6.16.2/fs/proc/array.c linux-2.6.16.2-grsec/fs/proc/array.c
163--- linux-2.6.16.2/fs/proc/array.c 2006-04-07 18:56:47.000000000 +0200
164+++ linux-2.6.16.2-grsec/fs/proc/array.c 2006-04-11 17:44:40.077707500 +0200
165@@ -488,3 +488,14 @@
166 return sprintf(buffer,"%d %d %d %d %d %d %d\n",
167 size, resident, shared, text, lib, data, 0);
168 }
169+
170+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
171+int proc_pid_ipaddr(struct task_struct *task, char * buffer)
172+{
173+ int len;
174+
175+ len = sprintf(buffer, "%u.%u.%u.%u\n", NIPQUAD(task->signal->curr_ip));
176+ return len;
177+}
178+#endif
179+
180diff -urN linux-2.6.16.2/fs/proc/base.c linux-2.6.16.2-grsec/fs/proc/base.c
181--- linux-2.6.16.2/fs/proc/base.c 2006-04-07 18:56:47.000000000 +0200
182+++ linux-2.6.16.2-grsec/fs/proc/base.c 2006-04-11 17:44:40.077707500 +0200
183@@ -124,6 +124,9 @@
184 #ifdef CONFIG_AUDITSYSCALL
185 PROC_TGID_LOGINUID,
186 #endif
187+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
188+ PROC_TGID_IPADDR,
189+#endif
190 PROC_TGID_OOM_SCORE,
191 PROC_TGID_OOM_ADJUST,
192 PROC_TID_INO,
193@@ -201,6 +204,9 @@
194 E(PROC_TGID_ROOT, "root", S_IFLNK|S_IRWXUGO),
195 E(PROC_TGID_EXE, "exe", S_IFLNK|S_IRWXUGO),
196 E(PROC_TGID_MOUNTS, "mounts", S_IFREG|S_IRUGO),
197+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
198+ E(PROC_TGID_IPADDR, "ipaddr", S_IFREG|S_IRUSR),
199+#endif
200 #ifdef CONFIG_MMU
201 E(PROC_TGID_SMAPS, "smaps", S_IFREG|S_IRUGO),
202 #endif
203@@ -1330,6 +1336,9 @@
204 }
205 /* procfs is xid tagged */
206 inode->i_tag = (tag_t)vx_task_xid(task);
207+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
208+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
209+#endif
210 security_task_to_inode(task, inode);
211
212 out:
213@@ -1358,7 +1367,9 @@
214 if (pid_alive(task)) {
215 if (proc_type(inode) == PROC_TGID_INO || proc_type(inode) == PROC_TID_INO || task_dumpable(task)) {
216 inode->i_uid = task->euid;
217+#ifndef CONFIG_GRKERNSEC_PROC_USERGROUP
218 inode->i_gid = task->egid;
219+#endif
220 } else {
221 inode->i_uid = 0;
222 inode->i_gid = 0;
223@@ -1681,6 +1692,12 @@
224 inode->i_fop = &proc_info_file_operations;
225 ei->op.proc_read = proc_pid_status;
226 break;
227+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
228+ case PROC_TGID_IPADDR:
229+ inode->i_fop = &proc_info_file_operations;
230+ ei->op.proc_read = proc_pid_ipaddr;
231+ break;
232+#endif
233 case PROC_TID_STAT:
234 inode->i_fop = &proc_info_file_operations;
235 ei->op.proc_read = proc_tid_stat;
236@@ -1985,11 +2002,29 @@
237 if (!proc_pid_visible(task, tgid))
238 goto out_drop_task;
239
240+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
241+ if (current->uid && (task->uid != current->uid)
242+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
243+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
244+#endif
245+ ) {
246+ put_task_struct(task);
247+ goto out;
248+ }
249+#endif
250+
251 inode = proc_pid_make_inode(dir->i_sb, task, PROC_TGID_INO);
252 if (!inode)
253 goto out_drop_task;
254
255+#ifdef CONFIG_GRKERNSEC_PROC_USER
256+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
257+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
258+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR|S_IRGRP|S_IXGRP;
259+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
260+#else
261 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
262+#endif
263 inode->i_op = &proc_tgid_base_inode_operations;
264 inode->i_fop = &proc_tgid_base_operations;
265 inode->i_flags|=S_IMMUTABLE;
266@@ -2084,6 +2120,9 @@
267 static int get_tgid_list(int index, unsigned long version, unsigned int *tgids)
268 {
269 struct task_struct *p;
270+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
271+ struct task_struct *tmp = current;
272+#endif
273 int nr_tgids = 0;
274
275 index--;
276@@ -2104,6 +2143,14 @@
277 /* check for context visibility */
278 if (!proc_pid_visible(p, tgid))
279 continue;
280+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
281+ if (tmp->uid && (p->uid != tmp->uid)
282+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
283+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
284+#endif
285+ )
286+ continue;
287+#endif
288 if (--index >= 0)
289 continue;
290 tgids[nr_tgids] = vx_map_tgid(tgid);
291diff -urN linux-2.6.16.2/fs/proc/inode.c linux-2.6.16.2-grsec/fs/proc/inode.c
292--- linux-2.6.16.2/fs/proc/inode.c 2006-04-07 18:56:47.000000000 +0200
293+++ linux-2.6.16.2-grsec/fs/proc/inode.c 2006-04-11 17:44:40.077707500 +0200
294@@ -168,7 +168,11 @@
295 if (de->mode) {
296 inode->i_mode = de->mode;
297 inode->i_uid = de->uid;
298+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
299+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
300+#else
301 inode->i_gid = de->gid;
302+#endif
303 }
304 if (de->vx_flags)
305 PROC_I(inode)->vx_flags = de->vx_flags;
306diff -urN linux-2.6.16.2/fs/proc/internal.h linux-2.6.16.2-grsec/fs/proc/internal.h
307--- linux-2.6.16.2/fs/proc/internal.h 2006-04-07 18:56:47.000000000 +0200
308+++ linux-2.6.16.2-grsec/fs/proc/internal.h 2006-04-11 17:44:40.077707500 +0200
309@@ -36,6 +36,9 @@
310 extern int proc_tgid_stat(struct task_struct *, char *);
311 extern int proc_pid_status(struct task_struct *, char *);
312 extern int proc_pid_statm(struct task_struct *, char *);
313+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
314+extern int proc_pid_ipaddr(struct task_struct*,char*);
315+#endif
316
317 void free_proc_entry(struct proc_dir_entry *de);
318
319diff -urN linux-2.6.16.2/fs/proc/proc_misc.c linux-2.6.16.2-grsec/fs/proc/proc_misc.c
320--- linux-2.6.16.2/fs/proc/proc_misc.c 2006-04-07 18:56:47.000000000 +0200
321+++ linux-2.6.16.2-grsec/fs/proc/proc_misc.c 2006-04-11 17:44:40.109709500 +0200
322@@ -708,6 +708,8 @@
323 void __init proc_misc_init(void)
324 {
325 struct proc_dir_entry *entry;
326+ int gr_mode = 0;
327+
328 static struct {
329 char *name;
330 int (*read_proc)(char*,char**,off_t,int,int*,void*);
331@@ -723,7 +725,9 @@
332 {"stram", stram_read_proc},
333 #endif
334 {"filesystems", filesystems_read_proc},
335+#ifndef CONFIG_GRKERNSEC_PROC_ADD
336 {"cmdline", cmdline_read_proc},
337+#endif
338 {"locks", locks_read_proc},
339 {"execdomains", execdomains_read_proc},
340 {NULL,}
341@@ -731,31 +735,49 @@
342 for (p = simple_ones; p->name; p++)
343 create_proc_read_entry(p->name, 0, NULL, p->read_proc, NULL);
344
345+#ifdef CONFIG_GRKERNSEC_PROC_USER
346+ gr_mode = S_IRUSR;
347+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
348+ gr_mode = S_IRUSR | S_IRGRP;
349+#endif
350+#ifdef CONFIG_GRKERNSEC_PROC_ADD
351+ create_proc_read_entry("cmdline", gr_mode, NULL, &cmdline_read_proc, NULL);
352+#endif
353+
354 proc_symlink("mounts", NULL, "self/mounts");
355
356 /* And now for trickier ones */
357 entry = create_proc_entry("kmsg", S_IRUSR, &proc_root);
358 if (entry)
359 entry->proc_fops = &proc_kmsg_operations;
360+
361+#ifdef CONFIG_GRKERNSEC_PROC_ADD
362+ create_seq_entry("devices", gr_mode, &proc_devinfo_operations);
363+#else
364 create_seq_entry("devices", 0, &proc_devinfo_operations);
365+#endif
366 create_seq_entry("cpuinfo", 0, &proc_cpuinfo_operations);
367 create_seq_entry("partitions", 0, &proc_partitions_operations);
368 create_seq_entry("stat", 0, &proc_stat_operations);
369 create_seq_entry("interrupts", 0, &proc_interrupts_operations);
370 #ifdef CONFIG_SLAB
371+#ifdef CONFIG_GRKERNSEC_PROC_ADD
372+ create_seq_entry("slabinfo",S_IWUSR|gr_mode,&proc_slabinfo_operations);
373+#else
374 create_seq_entry("slabinfo",S_IWUSR|S_IRUGO,&proc_slabinfo_operations);
375 #endif
376+#endif
377 create_seq_entry("buddyinfo",S_IRUGO, &fragmentation_file_operations);
378 create_seq_entry("vmstat",S_IRUGO, &proc_vmstat_file_operations);
379 create_seq_entry("zoneinfo",S_IRUGO, &proc_zoneinfo_file_operations);
380 create_seq_entry("diskstats", 0, &proc_diskstats_operations);
381 #ifdef CONFIG_MODULES
382- create_seq_entry("modules", 0, &proc_modules_operations);
383+ create_seq_entry("modules", gr_mode, &proc_modules_operations);
384 #endif
385 #ifdef CONFIG_SCHEDSTATS
386 create_seq_entry("schedstat", 0, &proc_schedstat_operations);
387 #endif
388-#ifdef CONFIG_PROC_KCORE
389+#if defined(CONFIG_PROC_KCORE) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
390 proc_root_kcore = create_proc_entry("kcore", S_IRUSR, NULL);
391 if (proc_root_kcore) {
392 proc_root_kcore->proc_fops = &proc_kcore_operations;
393diff -urN linux-2.6.16.2/fs/proc/root.c linux-2.6.16.2-grsec/fs/proc/root.c
394--- linux-2.6.16.2/fs/proc/root.c 2006-04-07 18:56:47.000000000 +0200
395+++ linux-2.6.16.2-grsec/fs/proc/root.c 2006-04-11 17:44:40.113709750 +0200
396@@ -53,7 +53,13 @@
397 return;
398 }
399 proc_misc_init();
400+#ifdef CONFIG_GRKERNSEC_PROC_USER
401+ proc_net = proc_mkdir_mode("net", S_IRUSR | S_IXUSR, NULL);
402+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
403+ proc_net = proc_mkdir_mode("net", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
404+#else
405 proc_net = proc_mkdir("net", NULL);
406+#endif
407 proc_net_stat = proc_mkdir("net/stat", NULL);
408
409 #ifdef CONFIG_SYSVIPC
410@@ -77,7 +83,15 @@
411 #ifdef CONFIG_PROC_DEVICETREE
412 proc_device_tree_init();
413 #endif
414+#ifdef CONFIG_GRKERNSEC_PROC_ADD
415+#ifdef CONFIG_GRKERNSEC_PROC_USER
416+ proc_bus = proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
417+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
418+ proc_bus = proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
419+#endif
420+#else
421 proc_bus = proc_mkdir("bus", NULL);
422+#endif
423 proc_vx_init();
424 }
425
426diff -urN linux-2.6.16.2/grsecurity/Kconfig linux-2.6.16.2-grsec/grsecurity/Kconfig
427--- linux-2.6.16.2/grsecurity/Kconfig 1970-01-01 01:00:00.000000000 +0100
428+++ linux-2.6.16.2-grsec/grsecurity/Kconfig 2006-04-11 19:03:04.020561250 +0200
429@@ -0,0 +1,135 @@
430+#
431+# grecurity configuration
432+#
433+
434+menu "Grsecurity"
435+
436+config GRKERNSEC
437+ bool "Grsecurity"
438+ select CRYPTO
439+ select CRYPTO_SHA256
440+ help
441+ If you say Y here, you will be able to configure many features
442+ that will enhance the security of your system. It is highly
443+ recommended that you say Y here and read through the help
444+ for each option so that you fully understand the features and
445+ can evaluate their usefulness for your machine.
446+
447+menu "Filesystem Protections"
448+depends on GRKERNSEC
449+
450+config GRKERNSEC_PROC
451+ bool "Proc restrictions"
452+ help
453+ If you say Y here, the permissions of the /proc filesystem
454+ will be altered to enhance system security and privacy. You MUST
455+ choose either a user only restriction or a user and group restriction.
456+ Depending upon the option you choose, you can either restrict users to
457+ see only the processes they themselves run, or choose a group that can
458+ view all processes and files normally restricted to root if you choose
459+ the "restrict to user only" option. NOTE: If you're running identd as
460+ a non-root user, you will have to run it as the group you specify here.
461+
462+config GRKERNSEC_PROC_USER
463+ bool "Restrict /proc to user only"
464+ depends on GRKERNSEC_PROC
465+ help
466+ If you say Y here, non-root users will only be able to view their own
467+ processes, and restricts them from viewing network-related information,
468+ and viewing kernel symbol and module information.
469+
470+config GRKERNSEC_PROC_USERGROUP
471+ bool "Allow special group"
472+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
473+ help
474+ If you say Y here, you will be able to select a group that will be
475+ able to view all processes, network-related information, and
476+ kernel and symbol information. This option is useful if you want
477+ to run identd as a non-root user.
478+
479+config GRKERNSEC_PROC_GID
480+ int "GID for special group"
481+ depends on GRKERNSEC_PROC_USERGROUP
482+ default 1001
483+
484+config GRKERNSEC_PROC_ADD
485+ bool "Additional restrictions"
486+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
487+ help
488+ If you say Y here, additional restrictions will be placed on
489+ /proc that keep normal users from viewing device information and
490+ slabinfo information that could be useful for exploits.
491+
492+config GRKERNSEC_LINK
493+ bool "Linking restrictions"
494+ help
495+ If you say Y here, /tmp race exploits will be prevented, since users
496+ will no longer be able to follow symlinks owned by other users in
497+ world-writable +t directories (i.e. /tmp), unless the owner of the
498+ symlink is the owner of the directory. users will also not be
499+ able to hardlink to files they do not own. If the sysctl option is
500+ enabled, a sysctl option with name "linking_restrictions" is created.
501+
502+config GRKERNSEC_FIFO
503+ bool "FIFO restrictions"
504+ help
505+ If you say Y here, users will not be able to write to FIFOs they don't
506+ own in world-writable +t directories (i.e. /tmp), unless the owner of
507+ the FIFO is the same owner of the directory it's held in. If the sysctl
508+ option is enabled, a sysctl option with name "fifo_restrictions" is
509+ created.
510+
511+endmenu
512+
513+config GRKERNSEC_PROC_IPADDR
514+ depends on GRKERNSEC
515+ bool "/proc/<pid>/ipaddr support"
516+ help
517+ If you say Y here, a new entry will be added to each /proc/<pid>
518+ directory that contains the IP address of the person using the task.
519+ The IP is carried across local TCP and AF_UNIX stream sockets.
520+ This information can be useful for IDS/IPSes to perform remote response
521+ to a local attack. The entry is readable by only the owner of the
522+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
523+ the RBAC system), and thus does not create privacy concerns.
524+
525+config GRKERNSEC_SHM
526+ depends on GRKERNSEC
527+ bool "Destroy unused shared memory"
528+ depends on SYSVIPC
529+ help
530+ If you say Y here, shared memory will be destroyed when no one is
531+ attached to it. Otherwise, resources involved with the shared
532+ memory can be used up and not be associated with any process (as the
533+ shared memory still exists, and the creating process has exited). If
534+ the sysctl option is enabled, a sysctl option with name
535+ "destroy_unused_shm" is created.
536+
537+config GRKERNSEC_SYSCTL
538+ depends on GRKERNSEC && SYSCTL
539+ bool "Sysctl support"
540+ help
541+ If you say Y here, you will be able to change the options that
542+ grsecurity runs with at bootup, without having to recompile your
543+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
544+ to enable (1) or disable (0) various features. All the sysctl entries
545+ are mutable until the "grsec_lock" entry is set to a non-zero value.
546+ All features enabled in the kernel configuration are disabled at boot
547+ if you do not say Y to the "Turn on features by default" option.
548+ All options should be set at startup, and the grsec_lock entry should
549+ be set to a non-zero value after all the options are set.
550+ *THIS IS EXTREMELY IMPORTANT*
551+
552+config GRKERNSEC_SYSCTL_ON
553+ bool "Turn on features by default"
554+ depends on GRKERNSEC_SYSCTL
555+ help
556+ If you say Y here, instead of having all features enabled in the
557+ kernel configuration disabled at boot time, the features will be
558+ enabled at boot time. It is recommended you say Y here unless
559+ there is some reason you would want all sysctl-tunable features to
560+ be disabled by default. As mentioned elsewhere, it is important
561+ to enable the grsec_lock entry once you have finished modifying
562+ the sysctl entries.
563+
564+endmenu
565diff -urN linux-2.6.16.2/grsecurity/Makefile linux-2.6.16.2-grsec/grsecurity/Makefile
566--- linux-2.6.16.2/grsecurity/Makefile 1970-01-01 01:00:00.000000000 +0100
567+++ linux-2.6.16.2-grsec/grsecurity/Makefile 2006-04-11 19:03:17.509404250 +0200
568@@ -0,0 +1,11 @@
569+# All code in this directory and various hooks inserted throughout the kernel
570+# are copyright Brad Spengler, and released under the GPL v2 or higher
571+
572+obj-y = grsec_fifo.o grsec_sock.o grsec_sysctl.o grsec_link.o
573+
574+obj-$(CONFIG_GRKERNSEC) += grsec_init.o
575+
576+ifndef CONFIG_GRKERNSEC
577+obj-y += grsec_disabled.o
578+endif
579+
580diff -urN linux-2.6.16.2/grsecurity/grsec_disabled.c linux-2.6.16.2-grsec/grsecurity/grsec_disabled.c
581--- linux-2.6.16.2/grsecurity/grsec_disabled.c 1970-01-01 01:00:00.000000000 +0100
582+++ linux-2.6.16.2-grsec/grsecurity/grsec_disabled.c 2006-04-11 17:44:40.113709750 +0200
583@@ -0,0 +1,63 @@
584+#include <linux/kernel.h>
585+#include <linux/module.h>
586+#include <linux/config.h>
587+#include <linux/sched.h>
588+#include <linux/file.h>
589+#include <linux/fs.h>
590+#include <linux/kdev_t.h>
591+#include <linux/net.h>
592+#include <linux/in.h>
593+#include <linux/ip.h>
594+#include <linux/skbuff.h>
595+#include <linux/sysctl.h>
596+
597+#ifdef CONFIG_SYSCTL
598+__u32
599+gr_handle_sysctl(const struct ctl_table * table, __u32 mode)
600+{
601+ return mode;
602+}
603+#endif
604+
605+void
606+grsecurity_init(void)
607+{
608+ return;
609+}
610+
611+__u32
612+gr_acl_handle_symlink(const struct dentry * new_dentry,
613+ const struct dentry * parent_dentry,
614+ const struct vfsmount * parent_mnt, const char *from)
615+{
616+ return 1;
617+}
618+
619+__u32
620+gr_acl_handle_link(const struct dentry * new_dentry,
621+ const struct dentry * parent_dentry,
622+ const struct vfsmount * parent_mnt,
623+ const struct dentry * old_dentry,
624+ const struct vfsmount * old_mnt, const char *to)
625+{
626+ return 1;
627+}
628+
629+int
630+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
631+ const time_t shm_createtime, const uid_t cuid, const int shmid)
632+{
633+ return 1;
634+}
635+
636+int
637+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
638+{
639+ return 1;
640+}
641+
642+int
643+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
644+{
645+ return 1;
646+}
647diff -urN linux-2.6.16.2/grsecurity/grsec_fifo.c linux-2.6.16.2-grsec/grsecurity/grsec_fifo.c
648--- linux-2.6.16.2/grsecurity/grsec_fifo.c 1970-01-01 01:00:00.000000000 +0100
649+++ linux-2.6.16.2-grsec/grsecurity/grsec_fifo.c 2006-04-11 19:04:02.872239250 +0200
650@@ -0,0 +1,20 @@
651+#include <linux/kernel.h>
652+#include <linux/sched.h>
653+#include <linux/fs.h>
654+#include <linux/file.h>
655+#include <linux/grinternal.h>
656+
657+int
658+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
659+ const struct dentry *dir, const int flag, const int acc_mode)
660+{
661+#ifdef CONFIG_GRKERNSEC_FIFO
662+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
663+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
664+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
665+ (current->fsuid != dentry->d_inode->i_uid)) {
666+ return -EACCES;
667+ }
668+#endif
669+ return 0;
670+}
671diff -urN linux-2.6.16.2/grsecurity/grsec_init.c linux-2.6.16.2-grsec/grsecurity/grsec_init.c
672--- linux-2.6.16.2/grsecurity/grsec_init.c 1970-01-01 01:00:00.000000000 +0100
673+++ linux-2.6.16.2-grsec/grsecurity/grsec_init.c 2006-04-11 19:04:24.693603000 +0200
674@@ -0,0 +1,33 @@
675+#include <linux/kernel.h>
676+#include <linux/sched.h>
677+#include <linux/mm.h>
678+#include <linux/smp_lock.h>
679+#include <linux/slab.h>
680+#include <linux/vmalloc.h>
681+#include <linux/percpu.h>
682+
683+int grsec_enable_shm;
684+int grsec_enable_link;
685+int grsec_enable_fifo;
686+int grsec_lock;
687+
688+void
689+grsecurity_init(void)
690+{
691+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
692+#ifndef CONFIG_GRKERNSEC_SYSCTL
693+ grsec_lock = 1;
694+#endif
695+#ifdef CONFIG_GRKERNSEC_SHM
696+ grsec_enable_shm = 1;
697+#endif
698+#ifdef CONFIG_GRKERNSEC_LINK
699+ grsec_enable_link = 1;
700+#endif
701+#ifdef CONFIG_GRKERNSEC_FIFO
702+ grsec_enable_fifo = 1;
703+#endif
704+#endif
705+
706+ return;
707+}
708diff -urN linux-2.6.16.2/grsecurity/grsec_link.c linux-2.6.16.2-grsec/grsecurity/grsec_link.c
709--- linux-2.6.16.2/grsecurity/grsec_link.c 1970-01-01 01:00:00.000000000 +0100
710+++ linux-2.6.16.2-grsec/grsecurity/grsec_link.c 2006-04-11 19:04:40.258575750 +0200
711@@ -0,0 +1,37 @@
712+#include <linux/kernel.h>
713+#include <linux/sched.h>
714+#include <linux/fs.h>
715+#include <linux/file.h>
716+#include <linux/grinternal.h>
717+
718+int
719+gr_handle_follow_link(const struct inode *parent,
720+ const struct inode *inode,
721+ const struct dentry *dentry, const struct vfsmount *mnt)
722+{
723+#ifdef CONFIG_GRKERNSEC_LINK
724+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
725+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
726+ (parent->i_mode & S_IWOTH) && (current->fsuid != inode->i_uid)) {
727+ return -EACCES;
728+ }
729+#endif
730+ return 0;
731+}
732+
733+int
734+gr_handle_hardlink(const struct dentry *dentry,
735+ const struct vfsmount *mnt,
736+ struct inode *inode, const int mode, const char *to)
737+{
738+#ifdef CONFIG_GRKERNSEC_LINK
739+ if (grsec_enable_link && current->fsuid != inode->i_uid &&
740+ (!S_ISREG(mode) || (mode & S_ISUID) ||
741+ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
742+ (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
743+ !capable(CAP_FOWNER) && current->uid) {
744+ return -EPERM;
745+ }
746+#endif
747+ return 0;
748+}
749diff -urN linux-2.6.16.2/grsecurity/grsec_sock.c linux-2.6.16.2-grsec/grsecurity/grsec_sock.c
750--- linux-2.6.16.2/grsecurity/grsec_sock.c 1970-01-01 01:00:00.000000000 +0100
751+++ linux-2.6.16.2-grsec/grsecurity/grsec_sock.c 2006-04-11 19:20:18.301199750 +0200
752@@ -0,0 +1,164 @@
753+#include <linux/kernel.h>
754+#include <linux/module.h>
755+#include <linux/sched.h>
756+#include <linux/file.h>
757+#include <linux/net.h>
758+#include <linux/in.h>
759+#include <linux/ip.h>
760+#include <net/sock.h>
761+#include <net/inet_sock.h>
762+#include <linux/grsecurity.h>
763+#include <linux/grinternal.h>
764+
765+#ifdef CONFIG_GRKERNSEC
766+#define gr_conn_table_size 32749
767+struct conn_table_entry {
768+ struct conn_table_entry *next;
769+ struct signal_struct *sig;
770+};
771+
772+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
773+spinlock_t gr_conn_table_lock = SPIN_LOCK_UNLOCKED;
774+
775+static __inline__ int
776+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
777+{
778+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
779+}
780+
781+static __inline__ int
782+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
783+ __u16 sport, __u16 dport)
784+{
785+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
786+ sig->gr_sport == sport && sig->gr_dport == dport))
787+ return 1;
788+ else
789+ return 0;
790+}
791+
792+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
793+{
794+ struct conn_table_entry **match;
795+ unsigned int index;
796+
797+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
798+ sig->gr_sport, sig->gr_dport,
799+ gr_conn_table_size);
800+
801+ newent->sig = sig;
802+
803+ match = &gr_conn_table[index];
804+ newent->next = *match;
805+ *match = newent;
806+
807+ return;
808+}
809+
810+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
811+{
812+ struct conn_table_entry *match, *last = NULL;
813+ unsigned int index;
814+
815+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
816+ sig->gr_sport, sig->gr_dport,
817+ gr_conn_table_size);
818+
819+ match = gr_conn_table[index];
820+ while (match && !conn_match(match->sig,
821+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
822+ sig->gr_dport)) {
823+ last = match;
824+ match = match->next;
825+ }
826+
827+ if (match) {
828+ if (last)
829+ last->next = match->next;
830+ else
831+ gr_conn_table[index] = NULL;
832+ kfree(match);
833+ }
834+
835+ return;
836+}
837+
838+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
839+ __u16 sport, __u16 dport)
840+{
841+ struct conn_table_entry *match;
842+ unsigned int index;
843+
844+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
845+
846+ match = gr_conn_table[index];
847+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
848+ match = match->next;
849+
850+ if (match)
851+ return match->sig;
852+ else
853+ return NULL;
854+}
855+
856+#endif
857+
858+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
859+{
860+#ifdef CONFIG_GRKERNSEC
861+ struct signal_struct *sig = task->signal;
862+ struct conn_table_entry *newent;
863+
864+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
865+ if (newent == NULL)
866+ return;
867+
868+ spin_lock(&gr_conn_table_lock);
869+ gr_del_task_from_ip_table_nolock(sig);
870+ sig->gr_saddr = inet->rcv_saddr;
871+ sig->gr_daddr = inet->daddr;
872+ sig->gr_sport = inet->sport;
873+ sig->gr_dport = inet->dport;
874+ gr_add_to_task_ip_table_nolock(sig, newent);
875+ spin_unlock(&gr_conn_table_lock);
876+#endif
877+ return;
878+}
879+
880+void gr_del_task_from_ip_table(struct task_struct *task)
881+{
882+#ifdef CONFIG_GRKERNSEC
883+ spin_lock(&gr_conn_table_lock);
884+ gr_del_task_from_ip_table_nolock(task->signal);
885+ spin_unlock(&gr_conn_table_lock);
886+#endif
887+ return;
888+}
889+
890+void
891+gr_attach_curr_ip(const struct sock *sk)
892+{
893+#ifdef CONFIG_GRKERNSEC
894+ struct signal_struct *p, *set;
895+ const struct inet_sock *inet = inet_sk(sk);
896+
897+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
898+ return;
899+
900+ set = current->signal;
901+
902+ spin_lock(&gr_conn_table_lock);
903+ p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
904+ inet->dport, inet->sport);
905+ if (unlikely(p != NULL)) {
906+ set->curr_ip = p->curr_ip;
907+ gr_del_task_from_ip_table_nolock(p);
908+ spin_unlock(&gr_conn_table_lock);
909+ return;
910+ }
911+ spin_unlock(&gr_conn_table_lock);
912+
913+ set->curr_ip = inet->daddr;
914+#endif
915+ return;
916+}
917diff -urN linux-2.6.16.2/grsecurity/grsec_sysctl.c linux-2.6.16.2-grsec/grsecurity/grsec_sysctl.c
918--- linux-2.6.16.2/grsecurity/grsec_sysctl.c 1970-01-01 01:00:00.000000000 +0100
919+++ linux-2.6.16.2-grsec/grsecurity/grsec_sysctl.c 2006-04-11 19:04:50.363207250 +0200
920@@ -0,0 +1,65 @@
921+#include <linux/kernel.h>
922+#include <linux/sched.h>
923+#include <linux/sysctl.h>
924+#include <linux/grsecurity.h>
925+#include <linux/grinternal.h>
926+
927+int
928+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
929+{
930+#ifdef CONFIG_GRKERNSEC_SYSCTL
931+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & 002)) {
932+ return -EACCES;
933+ }
934+#endif
935+ return 0;
936+}
937+
938+#if defined(CONFIG_GRKERNSEC_SYSCTL)
939+enum {GS_LINK=1, GS_FIFO, GS_SHM, GS_LOCK};
940+
941+
942+ctl_table grsecurity_table[] = {
943+#ifdef CONFIG_GRKERNSEC_SYSCTL
944+#ifdef CONFIG_GRKERNSEC_LINK
945+ {
946+ .ctl_name = GS_LINK,
947+ .procname = "linking_restrictions",
948+ .data = &grsec_enable_link,
949+ .maxlen = sizeof(int),
950+ .mode = 0600,
951+ .proc_handler = &proc_dointvec,
952+ },
953+#endif
954+#ifdef CONFIG_GRKERNSEC_FIFO
955+ {
956+ .ctl_name = GS_FIFO,
957+ .procname = "fifo_restrictions",
958+ .data = &grsec_enable_fifo,
959+ .maxlen = sizeof(int),
960+ .mode = 0600,
961+ .proc_handler = &proc_dointvec,
962+ },
963+#endif
964+#ifdef CONFIG_GRKERNSEC_SHM
965+ {
966+ .ctl_name = GS_SHM,
967+ .procname = "destroy_unused_shm",
968+ .data = &grsec_enable_shm,
969+ .maxlen = sizeof(int),
970+ .mode = 0600,
971+ .proc_handler = &proc_dointvec,
972+ },
973+#endif
974+ {
975+ .ctl_name = GS_LOCK,
976+ .procname = "grsec_lock",
977+ .data = &grsec_lock,
978+ .maxlen = sizeof(int),
979+ .mode = 0600,
980+ .proc_handler = &proc_dointvec,
981+ },
982+#endif
983+ { .ctl_name = 0 }
984+};
985+#endif
986diff -urN linux-2.6.16.2/include/linux/grinternal.h linux-2.6.16.2-grsec/include/linux/grinternal.h
987--- linux-2.6.16.2/include/linux/grinternal.h 1970-01-01 01:00:00.000000000 +0100
988+++ linux-2.6.16.2-grsec/include/linux/grinternal.h 2006-04-11 19:03:34.734480750 +0200
989@@ -0,0 +1,15 @@
990+#ifndef __GRINTERNAL_H
991+#define __GRINTERNAL_H
992+
993+#ifdef CONFIG_GRKERNSEC
994+
995+#include <linux/fs.h>
996+
997+extern int grsec_enable_link;
998+extern int grsec_enable_fifo;
999+extern int grsec_enable_shm;
1000+extern int grsec_lock;
1001+
1002+#endif
1003+
1004+#endif
1005diff -urN linux-2.6.16.2/include/linux/grsecurity.h linux-2.6.16.2-grsec/include/linux/grsecurity.h
1006--- linux-2.6.16.2/include/linux/grsecurity.h 1970-01-01 01:00:00.000000000 +0100
1007+++ linux-2.6.16.2-grsec/include/linux/grsecurity.h 2006-04-11 18:06:03.000000000 +0200
1008@@ -0,0 +1,34 @@
1009+#ifndef GR_SECURITY_H
1010+#define GR_SECURITY_H
1011+#include <linux/fs.h>
1012+#include <linux/binfmts.h>
1013+
1014+extern void gr_del_task_from_ip_table(struct task_struct *p);
1015+
1016+extern int gr_handle_follow_link(const struct inode *parent,
1017+ const struct inode *inode,
1018+ const struct dentry *dentry,
1019+ const struct vfsmount *mnt);
1020+extern int gr_handle_fifo(const struct dentry *dentry,
1021+ const struct vfsmount *mnt,
1022+ const struct dentry *dir, const int flag,
1023+ const int acc_mode);
1024+extern int gr_handle_hardlink(const struct dentry *dentry,
1025+ const struct vfsmount *mnt,
1026+ struct inode *inode,
1027+ const int mode, const char *to);
1028+
1029+#ifdef CONFIG_SYSVIPC
1030+extern void gr_shm_exit(struct task_struct *task);
1031+#else
1032+static inline void gr_shm_exit(struct task_struct *task)
1033+{
1034+ return;
1035+}
1036+#endif
1037+
1038+#ifdef CONFIG_GRKERNSEC
1039+extern int grsec_enable_shm;
1040+#endif
1041+
1042+#endif
1043diff -urN linux-2.6.16.2/include/linux/sched.h linux-2.6.16.2-grsec/include/linux/sched.h
1044--- linux-2.6.16.2/include/linux/sched.h 2006-04-07 18:56:47.000000000 +0200
1045+++ linux-2.6.16.2-grsec/include/linux/sched.h 2006-04-11 19:14:15.574530750 +0200
1046@@ -454,6 +454,13 @@
1047 struct key *session_keyring; /* keyring inherited over fork */
1048 struct key *process_keyring; /* keyring private to this process */
1049 #endif
1050+#ifdef CONFIG_GRKERNSEC
1051+ u32 curr_ip;
1052+ u32 gr_saddr;
1053+ u32 gr_daddr;
1054+ u16 gr_sport;
1055+ u16 gr_dport;
1056+#endif
1057 };
1058
1059 /* Context switch must be unlocked if interrupts are to be enabled */
1060diff -urN linux-2.6.16.2/include/linux/shm.h linux-2.6.16.2-grsec/include/linux/shm.h
1061--- linux-2.6.16.2/include/linux/shm.h 2006-04-07 18:56:47.000000000 +0200
1062+++ linux-2.6.16.2-grsec/include/linux/shm.h 2006-04-11 17:44:40.121710250 +0200
1063@@ -86,6 +86,10 @@
1064 pid_t shm_cprid;
1065 pid_t shm_lprid;
1066 struct user_struct *mlock_user;
1067+#ifdef CONFIG_GRKERNSEC
1068+ time_t shm_createtime;
1069+ pid_t shm_lapid;
1070+#endif
1071 };
1072
1073 /* shm_mode upper byte flags */
1074diff -urN linux-2.6.16.2/include/linux/sysctl.h linux-2.6.16.2-grsec/include/linux/sysctl.h
1075--- linux-2.6.16.2/include/linux/sysctl.h 2006-04-07 18:56:47.000000000 +0200
1076+++ linux-2.6.16.2-grsec/include/linux/sysctl.h 2006-04-11 18:09:09.244033250 +0200
1d66a7d1 1077@@ -81,6 +81,9 @@
1078 /* CTL_KERN names: */
1079 enum
1080 {
c6410bf7 1081+#ifdef CONFIG_GRKERNSEC
1082+ KERN_GRSECURITY=98, /* grsecurity */
1083+#endif
1d66a7d1 1084 KERN_OSTYPE=1, /* string: system version */
1085 KERN_OSRELEASE=2, /* string: system release */
1086 KERN_OSREV=3, /* int: system revision */
c6410bf7 1087diff -urN linux-2.6.16.2/ipc/shm.c linux-2.6.16.2-grsec/ipc/shm.c
1088--- linux-2.6.16.2/ipc/shm.c 2006-04-07 18:56:47.000000000 +0200
1089+++ linux-2.6.16.2-grsec/ipc/shm.c 2006-04-11 17:44:40.121710250 +0200
1090@@ -30,6 +30,7 @@
1091 #include <linux/seq_file.h>
1092 #include <linux/vs_context.h>
1093 #include <linux/vs_limit.h>
1094+#include <linux/grsecurity.h>
1095
1096 #include <asm/uaccess.h>
1097
1098@@ -146,6 +147,17 @@
1099 shp->shm_lprid = current->tgid;
1100 shp->shm_dtim = get_seconds();
1101 shp->shm_nattch--;
1102+#ifdef CONFIG_GRKERNSEC_SHM
1103+ if (grsec_enable_shm) {
1104+ if (shp->shm_nattch == 0) {
1105+ shp->shm_perm.mode |= SHM_DEST;
1106+ shm_destroy(shp);
1107+ } else
1108+ shm_unlock(shp);
1109+ up(&shm_ids.sem);
1110+ return;
1111+ }
1112+#endif
1113 if(shp->shm_nattch == 0 &&
1114 shp->shm_perm.mode & SHM_DEST)
1115 shm_destroy (shp);
1116@@ -243,6 +255,9 @@
1117 shp->shm_lprid = 0;
1118 shp->shm_atim = shp->shm_dtim = 0;
1119 shp->shm_ctim = get_seconds();
1120+#ifdef CONFIG_GRKERNSEC
1121+ shp->shm_createtime = get_seconds();
1122+#endif
1123 shp->shm_segsz = size;
1124 shp->shm_nattch = 0;
1125 shp->id = shm_buildid(id,shp->shm_perm.seq);
1126@@ -750,6 +765,11 @@
1127 file = shp->shm_file;
1128 size = i_size_read(file->f_dentry->d_inode);
1129 shp->shm_nattch++;
1130+
1131+#ifdef CONFIG_GRKERNSEC
1132+ shp->shm_lapid = current->pid;
1133+#endif
1134+
1135 shm_unlock(shp);
1136
1137 down_write(&current->mm->mmap_sem);
1138@@ -916,3 +936,24 @@
1139 shp->shm_ctim);
1140 }
1141 #endif
1142+
1143+void gr_shm_exit(struct task_struct *task)
1144+{
1145+#ifdef CONFIG_GRKERNSEC_SHM
1146+ int i;
1147+ struct shmid_kernel *shp;
1148+
1149+ if (!grsec_enable_shm)
1150+ return;
1151+
1152+ for (i = 0; i <= shm_ids.max_id; i++) {
1153+ shp = shm_get(i);
1154+ if (shp && (shp->shm_cprid == task->pid) &&
1155+ (shp->shm_nattch <= 0)) {
1156+ shp->shm_perm.mode |= SHM_DEST;
1157+ shm_destroy(shp);
1158+ }
1159+ }
1160+#endif
1161+ return;
1162+}
1163diff -urN linux-2.6.16.2/kernel/signal.c linux-2.6.16.2-grsec/kernel/signal.c
1164--- linux-2.6.16.2/kernel/signal.c 2006-04-07 18:56:47.000000000 +0200
1165+++ linux-2.6.16.2-grsec/kernel/signal.c 2006-04-11 17:44:40.125710500 +0200
1166@@ -26,6 +26,7 @@
1167 #include <linux/signal.h>
1168 #include <linux/audit.h>
1169 #include <linux/capability.h>
1170+#include <linux/grsecurity.h>
1171 #include <linux/vs_pid.h>
1172 #include <asm/param.h>
1173 #include <asm/uaccess.h>
1174@@ -380,6 +381,7 @@
1175 }
1176 if (tsk == sig->curr_target)
1177 sig->curr_target = next_thread(tsk);
1178+ gr_del_task_from_ip_table(tsk);
1179 tsk->signal = NULL;
1180 /*
1181 * Accumulate here the counters for all threads but the
1182diff -urN linux-2.6.16.2/kernel/sysctl.c linux-2.6.16.2-grsec/kernel/sysctl.c
1183--- linux-2.6.16.2/kernel/sysctl.c 2006-04-07 18:56:47.000000000 +0200
1184+++ linux-2.6.16.2-grsec/kernel/sysctl.c 2006-04-11 17:44:40.125710500 +0200
1185@@ -54,6 +54,11 @@
1186 void __user *buffer, size_t *lenp, loff_t *ppos);
1187
1188 #if defined(CONFIG_SYSCTL)
1189+#include <linux/grsecurity.h>
1190+#include <linux/grinternal.h>
1191+
1192+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
1193+ const int op);
1194
1195 /* External variables not in a header file. */
1196 extern int C_A_D;
1197@@ -157,6 +162,7 @@
1198 #ifdef HAVE_ARCH_PICK_MMAP_LAYOUT
1199 int sysctl_legacy_va_layout;
1200 #endif
1201+extern ctl_table grsecurity_table[];
1202
1203 /* /proc declarations: */
1204
1205@@ -683,6 +689,16 @@
1206 .proc_handler = &proc_dointvec,
1207 },
1208 #endif
1209+
1210+#if defined(CONFIG_GRKERNSEC_SYSCTL)
1211+ {
1212+ .ctl_name = KERN_GRSECURITY,
1213+ .procname = "grsecurity",
1214+ .mode = 0500,
1215+ .child = grsecurity_table,
1216+ },
1217+#endif
1218+
1219 { .ctl_name = 0 }
1220 };
1221
1222@@ -1181,6 +1197,8 @@
1223 static inline int ctl_perm(ctl_table *table, int op)
1224 {
1225 int error;
1226+ if (table->de && gr_handle_sysctl_mod(table->de->parent->name, table->de->name, op))
1227+ return -EACCES;
1228 error = security_sysctl(table, op);
1229 if (error)
1230 return error;
1231diff -urN linux-2.6.16.2/net/ipv4/inet_hashtables.c linux-2.6.16.2-grsec/net/ipv4/inet_hashtables.c
1232--- linux-2.6.16.2/net/ipv4/inet_hashtables.c 2006-04-07 18:56:47.000000000 +0200
1233+++ linux-2.6.16.2-grsec/net/ipv4/inet_hashtables.c 2006-04-11 17:44:40.125710500 +0200
1234@@ -19,11 +19,14 @@
1235 #include <linux/sched.h>
1236 #include <linux/slab.h>
1237 #include <linux/wait.h>
1238+#include <linux/grsecurity.h>
1239
1240 #include <net/inet_connection_sock.h>
1241 #include <net/inet_hashtables.h>
1242 #include <net/ip.h>
1243
1244+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
1245+
1246 /*
1247 * Allocate and initialize a new local port bind bucket.
1248 * The bindhash mutex for snum's hash chain must be held here.
1249@@ -314,6 +317,8 @@
1250 }
1251 spin_unlock(&head->lock);
1252
1253+ gr_update_task_in_ip_table(current, inet_sk(sk));
1254+
1255 if (tw) {
1256 inet_twsk_deschedule(tw, death_row);;
1257 inet_twsk_put(tw);
1258diff -urN linux-2.6.16.2/net/socket.c linux-2.6.16.2-grsec/net/socket.c
1259--- linux-2.6.16.2/net/socket.c 2006-04-07 18:56:47.000000000 +0200
1260+++ linux-2.6.16.2-grsec/net/socket.c 2006-04-11 17:44:40.125710500 +0200
1261@@ -84,6 +84,7 @@
1262 #include <linux/compat.h>
1263 #include <linux/kmod.h>
1264 #include <linux/audit.h>
1265+#include <linux/in.h>
1266
1267 #ifdef CONFIG_NET_RADIO
1268 #include <linux/wireless.h> /* Note : will define WIRELESS_EXT */
1269@@ -97,6 +98,7 @@
1270 #include <linux/netfilter.h>
1271 #include <linux/vs_socket.h>
1272
1273+extern void gr_attach_curr_ip(const struct sock *sk);
1274 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
1275 static ssize_t sock_aio_read(struct kiocb *iocb, char __user *buf,
1276 size_t size, loff_t pos);
1277@@ -1396,6 +1398,7 @@
1278 goto out_release;
1279
1280 security_socket_post_accept(sock, newsock);
1281+ gr_attach_curr_ip(newsock->sk);
1282
1283 out_put:
1284 sockfd_put(sock);
1285diff -urN linux-2.6.16.2/security/Kconfig linux-2.6.16.2-grsec/security/Kconfig
1286--- linux-2.6.16.2/security/Kconfig 2006-04-07 18:56:47.000000000 +0200
1287+++ linux-2.6.16.2-grsec/security/Kconfig 2006-04-11 17:44:40.129710750 +0200
1288@@ -4,6 +4,8 @@
1289
1290 menu "Security options"
1291
1292+source grsecurity/Kconfig
1293+
1294 config KEYS
1295 bool "Enable access key retention support"
1296 help
The Linux kernel (the core of the Linux operating system)
This page took 0.178269 seconds and 4 git commands to generate.