kernel-grsec-minimal.patch

   1 diff -urNp linux-2.6.16.2/arch/sparc/Makefile linux-2.6.16.2/arch/sparc/Makefile
   2 --- linux-2.6.16.2/arch/sparc/Makefile  2006-04-07 12:56:47.000000000 -0400
   3 +++ linux-2.6.16.2/arch/sparc/Makefile  2006-04-09 21:23:54.000000000 -0400
   4 @@ -34,7 +34,7 @@ libs-y += arch/sparc/prom/ arch/sparc/li
   5  # Renaming is done to avoid confusing pattern matching rules in 2.5.45 (multy-)
   6  INIT_Y         := $(patsubst %/, %/built-in.o, $(init-y))
   7  CORE_Y         := $(core-y)
   8 -CORE_Y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
   9 +CORE_Y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
  10  CORE_Y         := $(patsubst %/, %/built-in.o, $(CORE_Y))
  11  DRIVERS_Y      := $(patsubst %/, %/built-in.o, $(drivers-y))
  12  NET_Y          := $(patsubst %/, %/built-in.o, $(net-y))
  13 diff -urN linux-2.6.16.2/Makefile linux-2.6.16.2-grsec/Makefile
  14 --- linux-2.6.16.2/Makefile     2006-04-07 18:56:47.000000000 +0200
  15 +++ linux-2.6.16.2-grsec/Makefile       2006-04-11 17:44:40.069707000 +0200
  16 @@ -556,7 +556,7 @@
  17
  18
  19  ifeq ($(KBUILD_EXTMOD),)
  20 -core-y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
  21 +core-y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
  22
  23  vmlinux-dirs   := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
  24                      $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
  25 diff -urN linux-2.6.16.2/drivers/char/keyboard.c linux-2.6.16.2-grsec/drivers/char/keyboard.c
  26 --- linux-2.6.16.2/drivers/char/keyboard.c      2006-04-07 18:56:47.000000000 +0200
  27 +++ linux-2.6.16.2-grsec/drivers/char/keyboard.c        2006-04-11 17:44:40.073707250 +0200
  28 @@ -607,6 +607,16 @@
  29              kbd->kbdmode == VC_MEDIUMRAW) &&
  30              value != KVAL(K_SAK))
  31                 return;         /* SAK is allowed even in raw mode */
  32 +
  33 +#if defined(CONFIG_GRKERNSEC_PROC)
  34 +       {
  35 +               void *func = fn_handler[value];
  36 +               if (func == fn_show_state || func == fn_show_ptregs ||
  37 +                   func == fn_show_mem)
  38 +                       return;
  39 +       }
  40 +#endif
  41 +
  42         fn_handler[value](vc, regs);
  43  }
  44
  45 diff -urN linux-2.6.16.2/drivers/pci/proc.c linux-2.6.16.2-grsec/drivers/pci/proc.c
  46 --- linux-2.6.16.2/drivers/pci/proc.c   2006-04-07 18:56:47.000000000 +0200
  47 +++ linux-2.6.16.2-grsec/drivers/pci/proc.c     2006-04-11 17:44:40.073707250 +0200
  48 @@ -569,7 +569,15 @@
  49
  50  static void legacy_proc_init(void)
  51  {
  52 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
  53 +#ifdef CONFIG_GRKERNSEC_PROC_USER
  54 +       struct proc_dir_entry * entry = create_proc_entry("pci", S_IRUSR, NULL);
  55 +#elif CONFIG_GRKERNSEC_PROC_USERGROUP
  56 +       struct proc_dir_entry * entry = create_proc_entry("pci", S_IRUSR | S_IRGRP, NULL);
  57 +#endif
  58 +#else
  59         struct proc_dir_entry * entry = create_proc_entry("pci", 0, NULL);
  60 +#endif
  61         if (entry)
  62                 entry->proc_fops = &proc_pci_operations;
  63  }
  64 @@ -598,7 +606,15 @@
  65  {
  66         struct proc_dir_entry *entry;
  67         struct pci_dev *dev = NULL;
  68 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
  69 +#ifdef CONFIG_GRKERNSEC_PROC_USER
  70 +       proc_bus_pci_dir = proc_mkdir_mode("pci", S_IRUSR | S_IXUSR, proc_bus);
  71 +#elif CONFIG_GRKERNSEC_PROC_USERGROUP
  72 +       proc_bus_pci_dir = proc_mkdir_mode("pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, proc_bus);
  73 +#endif
  74 +#else
  75         proc_bus_pci_dir = proc_mkdir("pci", proc_bus);
  76 +#endif
  77         entry = create_proc_entry("devices", 0, proc_bus_pci_dir);
  78         if (entry)
  79                 entry->proc_fops = &proc_bus_pci_dev_operations;
  80 diff -urN linux-2.6.16.2/fs/Kconfig linux-2.6.16.2-grsec/fs/Kconfig
  81 --- linux-2.6.16.2/fs/Kconfig   2006-04-07 18:56:47.000000000 +0200
  82 +++ linux-2.6.16.2-grsec/fs/Kconfig     2006-04-11 17:44:40.073707250 +0200
  83 @@ -794,7 +794,7 @@
  84
  85  config PROC_KCORE
  86         bool "/proc/kcore support" if !ARM
  87 -       depends on PROC_FS && MMU
  88 +       depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
  89
  90  config PROC_VMCORE
  91          bool "/proc/vmcore support (EXPERIMENTAL)"
  92 diff -urN linux-2.6.16.2/fs/namei.c linux-2.6.16.2-grsec/fs/namei.c
  93 --- linux-2.6.16.2/fs/namei.c   2006-04-07 18:56:47.000000000 +0200
  94 +++ linux-2.6.16.2-grsec/fs/namei.c     2006-04-11 18:10:35.961452750 +0200
  95 @@ -32,6 +32,7 @@
  96  #include <linux/vserver/inode.h>
  97  #include <linux/vs_tag.h>
  98  #include <linux/vserver/debug.h>
  99 +#include <linux/grsecurity.h>
 100  #include <asm/namei.h>
 101  #include <asm/uaccess.h>
 102
 103 @@ -608,6 +609,13 @@
 104         err = security_inode_follow_link(path->dentry, nd);
 105         if (err)
 106                 goto loop;
 107 +
 108 +       if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
 109 +                                 path->dentry->d_inode, path->dentry, nd->mnt)) {
 110 +               err = -EACCES;
 111 +               goto loop;
 112 +       }
 113 +
 114         current->link_count++;
 115         current->total_link_count++;
 116         nd->depth++;
 117 @@ -1647,6 +1655,13 @@
 118         /*
 119          * It already exists.
 120          */
 121 +
 122 +       if (gr_handle_fifo(path.dentry, nd->mnt, dir, flag, acc_mode)) {
 123 +               mutex_unlock(&dir->d_inode->i_mutex);
 124 +               error = -EACCES;
 125 +               goto exit_dput;
 126 +       }
 127 +
 128         mutex_unlock(&dir->d_inode->i_mutex);
 129
 130         error = -EEXIST;
 131 @@ -1700,6 +1715,13 @@
 132         error = security_inode_follow_link(path.dentry, nd);
 133         if (error)
 134                 goto exit_dput;
 135 +
 136 +       if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
 137 +                                 path.dentry, nd->mnt)) {
 138 +               error = -EACCES;
 139 +               goto exit_dput;
 140 +       }
 141 +
 142         error = __do_follow_link(&path, nd);
 143         if (error)
 144                 return error;
 145 @@ -2251,8 +2273,14 @@
 146         new_dentry = lookup_create(&nd, 0);
 147         error = PTR_ERR(new_dentry);
 148         if (!IS_ERR(new_dentry)) {
 149 -               error = vfs_link(old_nd.dentry, nd.dentry->d_inode,
 150 -                       new_dentry, &nd);
 151 +               error = 0;
 152 +               if (gr_handle_hardlink(old_nd.dentry, old_nd.mnt,
 153 +                                      old_nd.dentry->d_inode,
 154 +                                      old_nd.dentry->d_inode->i_mode, to))
 155 +                       error = -EPERM;
 156 +               if (!error)
 157 +                       error = vfs_link(old_nd.dentry, nd.dentry->d_inode,
 158 +                               new_dentry, &nd);
 159                 dput(new_dentry);
 160         }
 161         mutex_unlock(&nd.dentry->d_inode->i_mutex);
 162 diff -urN linux-2.6.16.2/fs/proc/array.c linux-2.6.16.2-grsec/fs/proc/array.c
 163 --- linux-2.6.16.2/fs/proc/array.c      2006-04-07 18:56:47.000000000 +0200
 164 +++ linux-2.6.16.2-grsec/fs/proc/array.c        2006-04-11 17:44:40.077707500 +0200
 165 @@ -488,3 +488,14 @@
 166         return sprintf(buffer,"%d %d %d %d %d %d %d\n",
 167                        size, resident, shared, text, lib, data, 0);
 168  }
 169 +
 170 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 171 +int proc_pid_ipaddr(struct task_struct *task, char * buffer)
 172 +{
 173 +       int len;
 174 +
 175 +       len = sprintf(buffer, "%u.%u.%u.%u\n", NIPQUAD(task->signal->curr_ip));
 176 +       return len;
 177 +}
 178 +#endif
 179 +
 180 diff -urN linux-2.6.16.2/fs/proc/base.c linux-2.6.16.2-grsec/fs/proc/base.c
 181 --- linux-2.6.16.2/fs/proc/base.c       2006-04-07 18:56:47.000000000 +0200
 182 +++ linux-2.6.16.2-grsec/fs/proc/base.c 2006-04-11 17:44:40.077707500 +0200
 183 @@ -124,6 +124,9 @@
 184  #ifdef CONFIG_AUDITSYSCALL
 185         PROC_TGID_LOGINUID,
 186  #endif
 187 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 188 +       PROC_TGID_IPADDR,
 189 +#endif
 190         PROC_TGID_OOM_SCORE,
 191         PROC_TGID_OOM_ADJUST,
 192         PROC_TID_INO,
 193 @@ -201,6 +204,9 @@
 194         E(PROC_TGID_ROOT,      "root",    S_IFLNK|S_IRWXUGO),
 195         E(PROC_TGID_EXE,       "exe",     S_IFLNK|S_IRWXUGO),
 196         E(PROC_TGID_MOUNTS,    "mounts",  S_IFREG|S_IRUGO),
 197 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 198 +       E(PROC_TGID_IPADDR,     "ipaddr",  S_IFREG|S_IRUSR),
 199 +#endif
 200  #ifdef CONFIG_MMU
 201         E(PROC_TGID_SMAPS,     "smaps",   S_IFREG|S_IRUGO),
 202  #endif
 203 @@ -1330,6 +1336,9 @@
 204         }
 205         /* procfs is xid tagged */
 206         inode->i_tag = (tag_t)vx_task_xid(task);
 207 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 208 +       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
 209 +#endif
 210         security_task_to_inode(task, inode);
 211
 212  out:
 213 @@ -1358,7 +1367,9 @@
 214         if (pid_alive(task)) {
 215                 if (proc_type(inode) == PROC_TGID_INO || proc_type(inode) == PROC_TID_INO || task_dumpable(task)) {
 216                         inode->i_uid = task->euid;
 217 +#ifndef CONFIG_GRKERNSEC_PROC_USERGROUP
 218                         inode->i_gid = task->egid;
 219 +#endif
 220                 } else {
 221                         inode->i_uid = 0;
 222                         inode->i_gid = 0;
 223 @@ -1681,6 +1692,12 @@
 224                         inode->i_fop = &proc_info_file_operations;
 225                         ei->op.proc_read = proc_pid_status;
 226                         break;
 227 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 228 +               case PROC_TGID_IPADDR:
 229 +                       inode->i_fop = &proc_info_file_operations;
 230 +                       ei->op.proc_read = proc_pid_ipaddr;
 231 +                       break;
 232 +#endif
 233                 case PROC_TID_STAT:
 234                         inode->i_fop = &proc_info_file_operations;
 235                         ei->op.proc_read = proc_tid_stat;
 236 @@ -1985,11 +2002,29 @@
 237         if (!proc_pid_visible(task, tgid))
 238                 goto out_drop_task;
 239
 240 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 241 +       if (current->uid && (task->uid != current->uid)
 242 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 243 +           && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
 244 +#endif
 245 +       ) {
 246 +               put_task_struct(task);
 247 +               goto out;
 248 +       }
 249 +#endif
 250 +
 251         inode = proc_pid_make_inode(dir->i_sb, task, PROC_TGID_INO);
 252         if (!inode)
 253                 goto out_drop_task;
 254
 255 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 256 +       inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
 257 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 258 +       inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR|S_IRGRP|S_IXGRP;
 259 +       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
 260 +#else
 261         inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
 262 +#endif
 263         inode->i_op = &proc_tgid_base_inode_operations;
 264         inode->i_fop = &proc_tgid_base_operations;
 265         inode->i_flags|=S_IMMUTABLE;
 266 @@ -2084,6 +2120,9 @@
 267  static int get_tgid_list(int index, unsigned long version, unsigned int *tgids)
 268  {
 269         struct task_struct *p;
 270 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 271 +       struct task_struct *tmp = current;
 272 +#endif
 273         int nr_tgids = 0;
 274
 275         index--;
 276 @@ -2104,6 +2143,14 @@
 277                 /* check for context visibility */
 278                 if (!proc_pid_visible(p, tgid))
 279                         continue;
 280 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 281 +               if (tmp->uid && (p->uid != tmp->uid)
 282 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 283 +                   && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
 284 +#endif
 285 +               )
 286 +                       continue;
 287 +#endif
 288                 if (--index >= 0)
 289                         continue;
 290                 tgids[nr_tgids] = vx_map_tgid(tgid);
 291 diff -urN linux-2.6.16.2/fs/proc/inode.c linux-2.6.16.2-grsec/fs/proc/inode.c
 292 --- linux-2.6.16.2/fs/proc/inode.c      2006-04-07 18:56:47.000000000 +0200
 293 +++ linux-2.6.16.2-grsec/fs/proc/inode.c        2006-04-11 17:44:40.077707500 +0200
 294 @@ -168,7 +168,11 @@
 295                 if (de->mode) {
 296                         inode->i_mode = de->mode;
 297                         inode->i_uid = de->uid;
 298 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 299 +                       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
 300 +#else
 301                         inode->i_gid = de->gid;
 302 +#endif
 303                 }
 304                 if (de->vx_flags)
 305                         PROC_I(inode)->vx_flags = de->vx_flags;
 306 diff -urN linux-2.6.16.2/fs/proc/internal.h linux-2.6.16.2-grsec/fs/proc/internal.h
 307 --- linux-2.6.16.2/fs/proc/internal.h   2006-04-07 18:56:47.000000000 +0200
 308 +++ linux-2.6.16.2-grsec/fs/proc/internal.h     2006-04-11 17:44:40.077707500 +0200
 309 @@ -36,6 +36,9 @@
 310  extern int proc_tgid_stat(struct task_struct *, char *);
 311  extern int proc_pid_status(struct task_struct *, char *);
 312  extern int proc_pid_statm(struct task_struct *, char *);
 313 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 314 +extern int proc_pid_ipaddr(struct task_struct*,char*);
 315 +#endif
 316
 317  void free_proc_entry(struct proc_dir_entry *de);
 318
 319 diff -urN linux-2.6.16.2/fs/proc/proc_misc.c linux-2.6.16.2-grsec/fs/proc/proc_misc.c
 320 --- linux-2.6.16.2/fs/proc/proc_misc.c  2006-04-07 18:56:47.000000000 +0200
 321 +++ linux-2.6.16.2-grsec/fs/proc/proc_misc.c    2006-04-11 17:44:40.109709500 +0200
 322 @@ -708,6 +708,8 @@
 323  void __init proc_misc_init(void)
 324  {
 325         struct proc_dir_entry *entry;
 326 +       int gr_mode = 0;
 327 +
 328         static struct {
 329                 char *name;
 330                 int (*read_proc)(char*,char**,off_t,int,int*,void*);
 331 @@ -723,7 +725,9 @@
 332                 {"stram",       stram_read_proc},
 333  #endif
 334                 {"filesystems", filesystems_read_proc},
 335 +#ifndef CONFIG_GRKERNSEC_PROC_ADD
 336                 {"cmdline",     cmdline_read_proc},
 337 +#endif
 338                 {"locks",       locks_read_proc},
 339                 {"execdomains", execdomains_read_proc},
 340                 {NULL,}
 341 @@ -731,31 +735,49 @@
 342         for (p = simple_ones; p->name; p++)
 343                 create_proc_read_entry(p->name, 0, NULL, p->read_proc, NULL);
 344
 345 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 346 +       gr_mode = S_IRUSR;
 347 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 348 +       gr_mode = S_IRUSR | S_IRGRP;
 349 +#endif
 350 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 351 +       create_proc_read_entry("cmdline", gr_mode, NULL, &cmdline_read_proc, NULL);
 352 +#endif
 353 +
 354         proc_symlink("mounts", NULL, "self/mounts");
 355
 356         /* And now for trickier ones */
 357         entry = create_proc_entry("kmsg", S_IRUSR, &proc_root);
 358         if (entry)
 359                 entry->proc_fops = &proc_kmsg_operations;
 360 +
 361 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 362 +       create_seq_entry("devices", gr_mode, &proc_devinfo_operations);
 363 +#else
 364         create_seq_entry("devices", 0, &proc_devinfo_operations);
 365 +#endif
 366         create_seq_entry("cpuinfo", 0, &proc_cpuinfo_operations);
 367         create_seq_entry("partitions", 0, &proc_partitions_operations);
 368         create_seq_entry("stat", 0, &proc_stat_operations);
 369         create_seq_entry("interrupts", 0, &proc_interrupts_operations);
 370  #ifdef CONFIG_SLAB
 371 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 372 +       create_seq_entry("slabinfo",S_IWUSR|gr_mode,&proc_slabinfo_operations);
 373 +#else
 374         create_seq_entry("slabinfo",S_IWUSR|S_IRUGO,&proc_slabinfo_operations);
 375  #endif
 376 +#endif
 377         create_seq_entry("buddyinfo",S_IRUGO, &fragmentation_file_operations);
 378         create_seq_entry("vmstat",S_IRUGO, &proc_vmstat_file_operations);
 379         create_seq_entry("zoneinfo",S_IRUGO, &proc_zoneinfo_file_operations);
 380         create_seq_entry("diskstats", 0, &proc_diskstats_operations);
 381  #ifdef CONFIG_MODULES
 382 -       create_seq_entry("modules", 0, &proc_modules_operations);
 383 +       create_seq_entry("modules", gr_mode, &proc_modules_operations);
 384  #endif
 385  #ifdef CONFIG_SCHEDSTATS
 386         create_seq_entry("schedstat", 0, &proc_schedstat_operations);
 387  #endif
 388 -#ifdef CONFIG_PROC_KCORE
 389 +#if defined(CONFIG_PROC_KCORE) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
 390         proc_root_kcore = create_proc_entry("kcore", S_IRUSR, NULL);
 391         if (proc_root_kcore) {
 392                 proc_root_kcore->proc_fops = &proc_kcore_operations;
 393 diff -urN linux-2.6.16.2/fs/proc/root.c linux-2.6.16.2-grsec/fs/proc/root.c
 394 --- linux-2.6.16.2/fs/proc/root.c       2006-04-07 18:56:47.000000000 +0200
 395 +++ linux-2.6.16.2-grsec/fs/proc/root.c 2006-04-11 17:44:40.113709750 +0200
 396 @@ -53,7 +53,13 @@
 397                 return;
 398         }
 399         proc_misc_init();
 400 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 401 +       proc_net = proc_mkdir_mode("net", S_IRUSR | S_IXUSR, NULL);
 402 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 403 +       proc_net = proc_mkdir_mode("net", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
 404 +#else
 405         proc_net = proc_mkdir("net", NULL);
 406 +#endif
 407         proc_net_stat = proc_mkdir("net/stat", NULL);
 408
 409  #ifdef CONFIG_SYSVIPC
 410 @@ -77,7 +83,15 @@
 411  #ifdef CONFIG_PROC_DEVICETREE
 412         proc_device_tree_init();
 413  #endif
 414 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 415 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 416 +       proc_bus = proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
 417 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 418 +       proc_bus = proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
 419 +#endif
 420 +#else
 421         proc_bus = proc_mkdir("bus", NULL);
 422 +#endif
 423         proc_vx_init();
 424  }
 425
 426 diff -urN linux-2.6.16.2/grsecurity/Kconfig linux-2.6.16.2-grsec/grsecurity/Kconfig
 427 --- linux-2.6.16.2/grsecurity/Kconfig   1970-01-01 01:00:00.000000000 +0100
 428 +++ linux-2.6.16.2-grsec/grsecurity/Kconfig     2006-04-11 19:03:04.020561250 +0200
 429 @@ -0,0 +1,135 @@
 430 +#
 431 +# grecurity configuration
 432 +#
 433 +
 434 +menu "Grsecurity"
 435 +
 436 +config GRKERNSEC
 437 +       bool "Grsecurity"
 438 +       select CRYPTO
 439 +       select CRYPTO_SHA256
 440 +       help
 441 +         If you say Y here, you will be able to configure many features
 442 +         that will enhance the security of your system.  It is highly
 443 +         recommended that you say Y here and read through the help
 444 +         for each option so that you fully understand the features and
 445 +         can evaluate their usefulness for your machine.
 446 +
 447 +menu "Filesystem Protections"
 448 +depends on GRKERNSEC
 449 +
 450 +config GRKERNSEC_PROC
 451 +       bool "Proc restrictions"
 452 +       help
 453 +         If you say Y here, the permissions of the /proc filesystem
 454 +         will be altered to enhance system security and privacy.  You MUST
 455 +         choose either a user only restriction or a user and group restriction.
 456 +         Depending upon the option you choose, you can either restrict users to
 457 +         see only the processes they themselves run, or choose a group that can
 458 +         view all processes and files normally restricted to root if you choose
 459 +         the "restrict to user only" option.  NOTE: If you're running identd as
 460 +         a non-root user, you will have to run it as the group you specify here.
 461 +
 462 +config GRKERNSEC_PROC_USER
 463 +       bool "Restrict /proc to user only"
 464 +       depends on GRKERNSEC_PROC
 465 +       help
 466 +         If you say Y here, non-root users will only be able to view their own
 467 +         processes, and restricts them from viewing network-related information,
 468 +         and viewing kernel symbol and module information.
 469 +
 470 +config GRKERNSEC_PROC_USERGROUP
 471 +       bool "Allow special group"
 472 +       depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
 473 +       help
 474 +         If you say Y here, you will be able to select a group that will be
 475 +         able to view all processes, network-related information, and
 476 +         kernel and symbol information.  This option is useful if you want
 477 +         to run identd as a non-root user.
 478 +
 479 +config GRKERNSEC_PROC_GID
 480 +       int "GID for special group"
 481 +       depends on GRKERNSEC_PROC_USERGROUP
 482 +       default 1001
 483 +
 484 +config GRKERNSEC_PROC_ADD
 485 +       bool "Additional restrictions"
 486 +       depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
 487 +       help
 488 +         If you say Y here, additional restrictions will be placed on
 489 +         /proc that keep normal users from viewing device information and
 490 +         slabinfo information that could be useful for exploits.
 491 +
 492 +config GRKERNSEC_LINK
 493 +       bool "Linking restrictions"
 494 +       help
 495 +         If you say Y here, /tmp race exploits will be prevented, since users
 496 +         will no longer be able to follow symlinks owned by other users in
 497 +         world-writable +t directories (i.e. /tmp), unless the owner of the
 498 +         symlink is the owner of the directory. users will also not be
 499 +         able to hardlink to files they do not own.  If the sysctl option is
 500 +         enabled, a sysctl option with name "linking_restrictions" is created.
 501 +
 502 +config GRKERNSEC_FIFO
 503 +       bool "FIFO restrictions"
 504 +       help
 505 +         If you say Y here, users will not be able to write to FIFOs they don't
 506 +         own in world-writable +t directories (i.e. /tmp), unless the owner of
 507 +         the FIFO is the same owner of the directory it's held in.  If the sysctl
 508 +         option is enabled, a sysctl option with name "fifo_restrictions" is
 509 +         created.
 510 +
 511 +endmenu
 512 +
 513 +config GRKERNSEC_PROC_IPADDR
 514 +       depends on GRKERNSEC
 515 +       bool "/proc/<pid>/ipaddr support"
 516 +       help
 517 +         If you say Y here, a new entry will be added to each /proc/<pid>
 518 +         directory that contains the IP address of the person using the task.
 519 +         The IP is carried across local TCP and AF_UNIX stream sockets.
 520 +         This information can be useful for IDS/IPSes to perform remote response
 521 +         to a local attack.  The entry is readable by only the owner of the
 522 +         process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
 523 +         the RBAC system), and thus does not create privacy concerns.
 524 +
 525 +config GRKERNSEC_SHM
 526 +       depends on GRKERNSEC
 527 +       bool "Destroy unused shared memory"
 528 +       depends on SYSVIPC
 529 +       help
 530 +         If you say Y here, shared memory will be destroyed when no one is
 531 +         attached to it.  Otherwise, resources involved with the shared
 532 +         memory can be used up and not be associated with any process (as the
 533 +         shared memory still exists, and the creating process has exited).  If
 534 +         the sysctl option is enabled, a sysctl option with name
 535 +         "destroy_unused_shm" is created.
 536 +
 537 +config GRKERNSEC_SYSCTL
 538 +       depends on GRKERNSEC && SYSCTL
 539 +       bool "Sysctl support"
 540 +       help
 541 +         If you say Y here, you will be able to change the options that
 542 +         grsecurity runs with at bootup, without having to recompile your
 543 +         kernel.  You can echo values to files in /proc/sys/kernel/grsecurity
 544 +         to enable (1) or disable (0) various features.  All the sysctl entries
 545 +         are mutable until the "grsec_lock" entry is set to a non-zero value.
 546 +         All features enabled in the kernel configuration are disabled at boot
 547 +         if you do not say Y to the "Turn on features by default" option.
 548 +         All options should be set at startup, and the grsec_lock entry should
 549 +         be set to a non-zero value after all the options are set.
 550 +         *THIS IS EXTREMELY IMPORTANT*
 551 +
 552 +config GRKERNSEC_SYSCTL_ON
 553 +       bool "Turn on features by default"
 554 +       depends on GRKERNSEC_SYSCTL
 555 +       help
 556 +         If you say Y here, instead of having all features enabled in the
 557 +         kernel configuration disabled at boot time, the features will be
 558 +         enabled at boot time.  It is recommended you say Y here unless
 559 +         there is some reason you would want all sysctl-tunable features to
 560 +         be disabled by default.  As mentioned elsewhere, it is important
 561 +         to enable the grsec_lock entry once you have finished modifying
 562 +         the sysctl entries.
 563 +
 564 +endmenu
 565 diff -urN linux-2.6.16.2/grsecurity/Makefile linux-2.6.16.2-grsec/grsecurity/Makefile
 566 --- linux-2.6.16.2/grsecurity/Makefile  1970-01-01 01:00:00.000000000 +0100
 567 +++ linux-2.6.16.2-grsec/grsecurity/Makefile    2006-04-11 19:03:17.509404250 +0200
 568 @@ -0,0 +1,11 @@
 569 +# All code in this directory and various hooks inserted throughout the kernel
 570 +# are copyright Brad Spengler, and released under the GPL v2 or higher
 571 +
 572 +obj-y = grsec_fifo.o grsec_sock.o grsec_sysctl.o grsec_link.o
 573 +
 574 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o
 575 +
 576 +ifndef CONFIG_GRKERNSEC
 577 +obj-y += grsec_disabled.o
 578 +endif
 579 +
 580 diff -urN linux-2.6.16.2/grsecurity/grsec_disabled.c linux-2.6.16.2-grsec/grsecurity/grsec_disabled.c
 581 --- linux-2.6.16.2/grsecurity/grsec_disabled.c  1970-01-01 01:00:00.000000000 +0100
 582 +++ linux-2.6.16.2-grsec/grsecurity/grsec_disabled.c    2006-04-11 17:44:40.113709750 +0200
 583 @@ -0,0 +1,63 @@
 584 +#include <linux/kernel.h>
 585 +#include <linux/module.h>
 586 +#include <linux/config.h>
 587 +#include <linux/sched.h>
 588 +#include <linux/file.h>
 589 +#include <linux/fs.h>
 590 +#include <linux/kdev_t.h>
 591 +#include <linux/net.h>
 592 +#include <linux/in.h>
 593 +#include <linux/ip.h>
 594 +#include <linux/skbuff.h>
 595 +#include <linux/sysctl.h>
 596 +
 597 +#ifdef CONFIG_SYSCTL
 598 +__u32
 599 +gr_handle_sysctl(const struct ctl_table * table, __u32 mode)
 600 +{
 601 +       return mode;
 602 +}
 603 +#endif
 604 +
 605 +void
 606 +grsecurity_init(void)
 607 +{
 608 +       return;
 609 +}
 610 +
 611 +__u32
 612 +gr_acl_handle_symlink(const struct dentry * new_dentry,
 613 +                     const struct dentry * parent_dentry,
 614 +                     const struct vfsmount * parent_mnt, const char *from)
 615 +{
 616 +       return 1;
 617 +}
 618 +
 619 +__u32
 620 +gr_acl_handle_link(const struct dentry * new_dentry,
 621 +                  const struct dentry * parent_dentry,
 622 +                  const struct vfsmount * parent_mnt,
 623 +                  const struct dentry * old_dentry,
 624 +                  const struct vfsmount * old_mnt, const char *to)
 625 +{
 626 +       return 1;
 627 +}
 628 +
 629 +int
 630 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
 631 +               const time_t shm_createtime, const uid_t cuid, const int shmid)
 632 +{
 633 +       return 1;
 634 +}
 635 +
 636 +int
 637 +gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
 638 +{
 639 +       return 1;
 640 +}
 641 +
 642 +int
 643 +gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
 644 +{
 645 +       return 1;
 646 +}
 647 diff -urN linux-2.6.16.2/grsecurity/grsec_fifo.c linux-2.6.16.2-grsec/grsecurity/grsec_fifo.c
 648 --- linux-2.6.16.2/grsecurity/grsec_fifo.c      1970-01-01 01:00:00.000000000 +0100
 649 +++ linux-2.6.16.2-grsec/grsecurity/grsec_fifo.c        2006-04-11 19:04:02.872239250 +0200
 650 @@ -0,0 +1,20 @@
 651 +#include <linux/kernel.h>
 652 +#include <linux/sched.h>
 653 +#include <linux/fs.h>
 654 +#include <linux/file.h>
 655 +#include <linux/grinternal.h>
 656 +
 657 +int
 658 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
 659 +              const struct dentry *dir, const int flag, const int acc_mode)
 660 +{
 661 +#ifdef CONFIG_GRKERNSEC_FIFO
 662 +       if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
 663 +           !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
 664 +           (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
 665 +           (current->fsuid != dentry->d_inode->i_uid)) {
 666 +               return -EACCES;
 667 +       }
 668 +#endif
 669 +       return 0;
 670 +}
 671 diff -urN linux-2.6.16.2/grsecurity/grsec_init.c linux-2.6.16.2-grsec/grsecurity/grsec_init.c
 672 --- linux-2.6.16.2/grsecurity/grsec_init.c      1970-01-01 01:00:00.000000000 +0100
 673 +++ linux-2.6.16.2-grsec/grsecurity/grsec_init.c        2006-04-11 19:04:24.693603000 +0200
 674 @@ -0,0 +1,33 @@
 675 +#include <linux/kernel.h>
 676 +#include <linux/sched.h>
 677 +#include <linux/mm.h>
 678 +#include <linux/smp_lock.h>
 679 +#include <linux/slab.h>
 680 +#include <linux/vmalloc.h>
 681 +#include <linux/percpu.h>
 682 +
 683 +int grsec_enable_shm;
 684 +int grsec_enable_link;
 685 +int grsec_enable_fifo;
 686 +int grsec_lock;
 687 +
 688 +void
 689 +grsecurity_init(void)
 690 +{
 691 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
 692 +#ifndef CONFIG_GRKERNSEC_SYSCTL
 693 +       grsec_lock = 1;
 694 +#endif
 695 +#ifdef CONFIG_GRKERNSEC_SHM
 696 +       grsec_enable_shm = 1;
 697 +#endif
 698 +#ifdef CONFIG_GRKERNSEC_LINK
 699 +       grsec_enable_link = 1;
 700 +#endif
 701 +#ifdef CONFIG_GRKERNSEC_FIFO
 702 +       grsec_enable_fifo = 1;
 703 +#endif
 704 +#endif
 705 +
 706 +       return;
 707 +}
 708 diff -urN linux-2.6.16.2/grsecurity/grsec_link.c linux-2.6.16.2-grsec/grsecurity/grsec_link.c
 709 --- linux-2.6.16.2/grsecurity/grsec_link.c      1970-01-01 01:00:00.000000000 +0100
 710 +++ linux-2.6.16.2-grsec/grsecurity/grsec_link.c        2006-04-11 19:04:40.258575750 +0200
 711 @@ -0,0 +1,37 @@
 712 +#include <linux/kernel.h>
 713 +#include <linux/sched.h>
 714 +#include <linux/fs.h>
 715 +#include <linux/file.h>
 716 +#include <linux/grinternal.h>
 717 +
 718 +int
 719 +gr_handle_follow_link(const struct inode *parent,
 720 +                     const struct inode *inode,
 721 +                     const struct dentry *dentry, const struct vfsmount *mnt)
 722 +{
 723 +#ifdef CONFIG_GRKERNSEC_LINK
 724 +       if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
 725 +           (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
 726 +           (parent->i_mode & S_IWOTH) && (current->fsuid != inode->i_uid)) {
 727 +               return -EACCES;
 728 +       }
 729 +#endif
 730 +       return 0;
 731 +}
 732 +
 733 +int
 734 +gr_handle_hardlink(const struct dentry *dentry,
 735 +                  const struct vfsmount *mnt,
 736 +                  struct inode *inode, const int mode, const char *to)
 737 +{
 738 +#ifdef CONFIG_GRKERNSEC_LINK
 739 +       if (grsec_enable_link && current->fsuid != inode->i_uid &&
 740 +           (!S_ISREG(mode) || (mode & S_ISUID) ||
 741 +            ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
 742 +            (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
 743 +           !capable(CAP_FOWNER) && current->uid) {
 744 +               return -EPERM;
 745 +       }
 746 +#endif
 747 +       return 0;
 748 +}
 749 diff -urN linux-2.6.16.2/grsecurity/grsec_sock.c linux-2.6.16.2-grsec/grsecurity/grsec_sock.c
 750 --- linux-2.6.16.2/grsecurity/grsec_sock.c      1970-01-01 01:00:00.000000000 +0100
 751 +++ linux-2.6.16.2-grsec/grsecurity/grsec_sock.c        2006-04-11 19:20:18.301199750 +0200
 752 @@ -0,0 +1,164 @@
 753 +#include <linux/kernel.h>
 754 +#include <linux/module.h>
 755 +#include <linux/sched.h>
 756 +#include <linux/file.h>
 757 +#include <linux/net.h>
 758 +#include <linux/in.h>
 759 +#include <linux/ip.h>
 760 +#include <net/sock.h>
 761 +#include <net/inet_sock.h>
 762 +#include <linux/grsecurity.h>
 763 +#include <linux/grinternal.h>
 764 +
 765 +#ifdef CONFIG_GRKERNSEC
 766 +#define gr_conn_table_size 32749
 767 +struct conn_table_entry {
 768 +       struct conn_table_entry *next;
 769 +       struct signal_struct *sig;
 770 +};
 771 +
 772 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
 773 +spinlock_t gr_conn_table_lock = SPIN_LOCK_UNLOCKED;
 774 +
 775 +static __inline__ int
 776 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
 777 +{
 778 +       return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
 779 +}
 780 +
 781 +static __inline__ int
 782 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
 783 +          __u16 sport, __u16 dport)
 784 +{
 785 +       if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
 786 +                    sig->gr_sport == sport && sig->gr_dport == dport))
 787 +               return 1;
 788 +       else
 789 +               return 0;
 790 +}
 791 +
 792 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
 793 +{
 794 +       struct conn_table_entry **match;
 795 +       unsigned int index;
 796 +
 797 +       index = conn_hash(sig->gr_saddr, sig->gr_daddr,
 798 +                         sig->gr_sport, sig->gr_dport,
 799 +                         gr_conn_table_size);
 800 +
 801 +       newent->sig = sig;
 802 +
 803 +       match = &gr_conn_table[index];
 804 +       newent->next = *match;
 805 +       *match = newent;
 806 +
 807 +       return;
 808 +}
 809 +
 810 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
 811 +{
 812 +       struct conn_table_entry *match, *last = NULL;
 813 +       unsigned int index;
 814 +
 815 +       index = conn_hash(sig->gr_saddr, sig->gr_daddr,
 816 +                         sig->gr_sport, sig->gr_dport,
 817 +                         gr_conn_table_size);
 818 +
 819 +       match = gr_conn_table[index];
 820 +       while (match && !conn_match(match->sig,
 821 +               sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
 822 +               sig->gr_dport)) {
 823 +               last = match;
 824 +               match = match->next;
 825 +       }
 826 +
 827 +       if (match) {
 828 +               if (last)
 829 +                       last->next = match->next;
 830 +               else
 831 +                       gr_conn_table[index] = NULL;
 832 +               kfree(match);
 833 +       }
 834 +
 835 +       return;
 836 +}
 837 +
 838 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
 839 +                                            __u16 sport, __u16 dport)
 840 +{
 841 +       struct conn_table_entry *match;
 842 +       unsigned int index;
 843 +
 844 +       index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
 845 +
 846 +       match = gr_conn_table[index];
 847 +       while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
 848 +               match = match->next;
 849 +
 850 +       if (match)
 851 +               return match->sig;
 852 +       else
 853 +               return NULL;
 854 +}
 855 +
 856 +#endif
 857 +
 858 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
 859 +{
 860 +#ifdef CONFIG_GRKERNSEC
 861 +       struct signal_struct *sig = task->signal;
 862 +       struct conn_table_entry *newent;
 863 +
 864 +       newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
 865 +       if (newent == NULL)
 866 +               return;
 867 +
 868 +       spin_lock(&gr_conn_table_lock);
 869 +       gr_del_task_from_ip_table_nolock(sig);
 870 +       sig->gr_saddr = inet->rcv_saddr;
 871 +       sig->gr_daddr = inet->daddr;
 872 +       sig->gr_sport = inet->sport;
 873 +       sig->gr_dport = inet->dport;
 874 +       gr_add_to_task_ip_table_nolock(sig, newent);
 875 +       spin_unlock(&gr_conn_table_lock);
 876 +#endif
 877 +       return;
 878 +}
 879 +
 880 +void gr_del_task_from_ip_table(struct task_struct *task)
 881 +{
 882 +#ifdef CONFIG_GRKERNSEC
 883 +       spin_lock(&gr_conn_table_lock);
 884 +       gr_del_task_from_ip_table_nolock(task->signal);
 885 +       spin_unlock(&gr_conn_table_lock);
 886 +#endif
 887 +       return;
 888 +}
 889 +
 890 +void
 891 +gr_attach_curr_ip(const struct sock *sk)
 892 +{
 893 +#ifdef CONFIG_GRKERNSEC
 894 +       struct signal_struct *p, *set;
 895 +       const struct inet_sock *inet = inet_sk(sk);
 896 +
 897 +       if (unlikely(sk->sk_protocol != IPPROTO_TCP))
 898 +               return;
 899 +
 900 +       set = current->signal;
 901 +
 902 +       spin_lock(&gr_conn_table_lock);
 903 +       p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
 904 +                                   inet->dport, inet->sport);
 905 +       if (unlikely(p != NULL)) {
 906 +               set->curr_ip = p->curr_ip;
 907 +               gr_del_task_from_ip_table_nolock(p);
 908 +               spin_unlock(&gr_conn_table_lock);
 909 +               return;
 910 +       }
 911 +       spin_unlock(&gr_conn_table_lock);
 912 +
 913 +       set->curr_ip = inet->daddr;
 914 +#endif
 915 +       return;
 916 +}
 917 diff -urN linux-2.6.16.2/grsecurity/grsec_sysctl.c linux-2.6.16.2-grsec/grsecurity/grsec_sysctl.c
 918 --- linux-2.6.16.2/grsecurity/grsec_sysctl.c    1970-01-01 01:00:00.000000000 +0100
 919 +++ linux-2.6.16.2-grsec/grsecurity/grsec_sysctl.c      2006-04-11 19:04:50.363207250 +0200
 920 @@ -0,0 +1,65 @@
 921 +#include <linux/kernel.h>
 922 +#include <linux/sched.h>
 923 +#include <linux/sysctl.h>
 924 +#include <linux/grsecurity.h>
 925 +#include <linux/grinternal.h>
 926 +
 927 +int
 928 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
 929 +{
 930 +#ifdef CONFIG_GRKERNSEC_SYSCTL
 931 +       if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & 002)) {
 932 +               return -EACCES;
 933 +       }
 934 +#endif
 935 +       return 0;
 936 +}
 937 +
 938 +#if defined(CONFIG_GRKERNSEC_SYSCTL)
 939 +enum {GS_LINK=1, GS_FIFO, GS_SHM, GS_LOCK};
 940 +
 941 +
 942 +ctl_table grsecurity_table[] = {
 943 +#ifdef CONFIG_GRKERNSEC_SYSCTL
 944 +#ifdef CONFIG_GRKERNSEC_LINK
 945 +       {
 946 +               .ctl_name       = GS_LINK,
 947 +               .procname       = "linking_restrictions",
 948 +               .data           = &grsec_enable_link,
 949 +               .maxlen         = sizeof(int),
 950 +               .mode           = 0600,
 951 +               .proc_handler   = &proc_dointvec,
 952 +       },
 953 +#endif
 954 +#ifdef CONFIG_GRKERNSEC_FIFO
 955 +       {
 956 +               .ctl_name       = GS_FIFO,
 957 +               .procname       = "fifo_restrictions",
 958 +               .data           = &grsec_enable_fifo,
 959 +               .maxlen         = sizeof(int),
 960 +               .mode           = 0600,
 961 +               .proc_handler   = &proc_dointvec,
 962 +       },
 963 +#endif
 964 +#ifdef CONFIG_GRKERNSEC_SHM
 965 +       {
 966 +               .ctl_name       = GS_SHM,
 967 +               .procname       = "destroy_unused_shm",
 968 +               .data           = &grsec_enable_shm,
 969 +               .maxlen         = sizeof(int),
 970 +               .mode           = 0600,
 971 +               .proc_handler   = &proc_dointvec,
 972 +       },
 973 +#endif
 974 +       {
 975 +               .ctl_name       = GS_LOCK,
 976 +               .procname       = "grsec_lock",
 977 +               .data           = &grsec_lock,
 978 +               .maxlen         = sizeof(int),
 979 +               .mode           = 0600,
 980 +               .proc_handler   = &proc_dointvec,
 981 +       },
 982 +#endif
 983 +       { .ctl_name = 0 }
 984 +};
 985 +#endif
 986 diff -urN linux-2.6.16.2/include/linux/grinternal.h linux-2.6.16.2-grsec/include/linux/grinternal.h
 987 --- linux-2.6.16.2/include/linux/grinternal.h   1970-01-01 01:00:00.000000000 +0100
 988 +++ linux-2.6.16.2-grsec/include/linux/grinternal.h     2006-04-11 19:03:34.734480750 +0200
 989 @@ -0,0 +1,15 @@
 990 +#ifndef __GRINTERNAL_H
 991 +#define __GRINTERNAL_H
 992 +
 993 +#ifdef CONFIG_GRKERNSEC
 994 +
 995 +#include <linux/fs.h>
 996 +
 997 +extern int grsec_enable_link;
 998 +extern int grsec_enable_fifo;
 999 +extern int grsec_enable_shm;
1000 +extern int grsec_lock;
1001 +
1002 +#endif
1003 +
1004 +#endif
1005 diff -urN linux-2.6.16.2/include/linux/grsecurity.h linux-2.6.16.2-grsec/include/linux/grsecurity.h
1006 --- linux-2.6.16.2/include/linux/grsecurity.h   1970-01-01 01:00:00.000000000 +0100
1007 +++ linux-2.6.16.2-grsec/include/linux/grsecurity.h     2006-04-11 18:06:03.000000000 +0200
1008 @@ -0,0 +1,34 @@
1009 +#ifndef GR_SECURITY_H
1010 +#define GR_SECURITY_H
1011 +#include <linux/fs.h>
1012 +#include <linux/binfmts.h>
1013 +
1014 +extern void gr_del_task_from_ip_table(struct task_struct *p);
1015 +
1016 +extern int gr_handle_follow_link(const struct inode *parent,
1017 +                                const struct inode *inode,
1018 +                                const struct dentry *dentry,
1019 +                                const struct vfsmount *mnt);
1020 +extern int gr_handle_fifo(const struct dentry *dentry,
1021 +                         const struct vfsmount *mnt,
1022 +                         const struct dentry *dir, const int flag,
1023 +                         const int acc_mode);
1024 +extern int gr_handle_hardlink(const struct dentry *dentry,
1025 +                             const struct vfsmount *mnt,
1026 +                             struct inode *inode,
1027 +                             const int mode, const char *to);
1028 +
1029 +#ifdef CONFIG_SYSVIPC
1030 +extern void gr_shm_exit(struct task_struct *task);
1031 +#else
1032 +static inline void gr_shm_exit(struct task_struct *task)
1033 +{
1034 +       return;
1035 +}
1036 +#endif
1037 +
1038 +#ifdef CONFIG_GRKERNSEC
1039 +extern int grsec_enable_shm;
1040 +#endif
1041 +
1042 +#endif
1043 diff -urN linux-2.6.16.2/include/linux/sched.h linux-2.6.16.2-grsec/include/linux/sched.h
1044 --- linux-2.6.16.2/include/linux/sched.h        2006-04-07 18:56:47.000000000 +0200
1045 +++ linux-2.6.16.2-grsec/include/linux/sched.h  2006-04-11 19:14:15.574530750 +0200
1046 @@ -454,6 +454,13 @@
1047         struct key *session_keyring;    /* keyring inherited over fork */
1048         struct key *process_keyring;    /* keyring private to this process */
1049  #endif
1050 +#ifdef CONFIG_GRKERNSEC
1051 +       u32 curr_ip;
1052 +       u32 gr_saddr;
1053 +       u32 gr_daddr;
1054 +       u16 gr_sport;
1055 +       u16 gr_dport;
1056 +#endif
1057  };
1058
1059  /* Context switch must be unlocked if interrupts are to be enabled */
1060 diff -urN linux-2.6.16.2/include/linux/shm.h linux-2.6.16.2-grsec/include/linux/shm.h
1061 --- linux-2.6.16.2/include/linux/shm.h  2006-04-07 18:56:47.000000000 +0200
1062 +++ linux-2.6.16.2-grsec/include/linux/shm.h    2006-04-11 17:44:40.121710250 +0200
1063 @@ -86,6 +86,10 @@
1064         pid_t                   shm_cprid;
1065         pid_t                   shm_lprid;
1066         struct user_struct      *mlock_user;
1067 +#ifdef CONFIG_GRKERNSEC
1068 +       time_t                  shm_createtime;
1069 +       pid_t                   shm_lapid;
1070 +#endif
1071  };
1072
1073  /* shm_mode upper byte flags */
1074 diff -urN linux-2.6.16.2/include/linux/sysctl.h linux-2.6.16.2-grsec/include/linux/sysctl.h
1075 --- linux-2.6.16.2/include/linux/sysctl.h       2006-04-07 18:56:47.000000000 +0200
1076 +++ linux-2.6.16.2-grsec/include/linux/sysctl.h 2006-04-11 18:09:09.244033250 +0200
1077 @@ -81,6 +81,9 @@
1078  /* CTL_KERN names: */
1079  enum
1080  {
1081 +#ifdef CONFIG_GRKERNSEC
1082 +       KERN_GRSECURITY=98,     /* grsecurity */
1083 +#endif
1084         KERN_OSTYPE=1,          /* string: system version */
1085         KERN_OSRELEASE=2,       /* string: system release */
1086         KERN_OSREV=3,           /* int: system revision */
1087 diff -urN linux-2.6.16.2/ipc/shm.c linux-2.6.16.2-grsec/ipc/shm.c
1088 --- linux-2.6.16.2/ipc/shm.c    2006-04-07 18:56:47.000000000 +0200
1089 +++ linux-2.6.16.2-grsec/ipc/shm.c      2006-04-11 17:44:40.121710250 +0200
1090 @@ -30,6 +30,7 @@
1091  #include <linux/seq_file.h>
1092  #include <linux/vs_context.h>
1093  #include <linux/vs_limit.h>
1094 +#include <linux/grsecurity.h>
1095
1096  #include <asm/uaccess.h>
1097
1098 @@ -146,6 +147,17 @@
1099         shp->shm_lprid = current->tgid;
1100         shp->shm_dtim = get_seconds();
1101         shp->shm_nattch--;
1102 +#ifdef CONFIG_GRKERNSEC_SHM
1103 +       if (grsec_enable_shm) {
1104 +               if (shp->shm_nattch == 0) {
1105 +                       shp->shm_perm.mode |= SHM_DEST;
1106 +                       shm_destroy(shp);
1107 +               } else
1108 +                       shm_unlock(shp);
1109 +               up(&shm_ids.sem);
1110 +               return;
1111 +       }
1112 +#endif
1113         if(shp->shm_nattch == 0 &&
1114            shp->shm_perm.mode & SHM_DEST)
1115                 shm_destroy (shp);
1116 @@ -243,6 +255,9 @@
1117         shp->shm_lprid = 0;
1118         shp->shm_atim = shp->shm_dtim = 0;
1119         shp->shm_ctim = get_seconds();
1120 +#ifdef CONFIG_GRKERNSEC
1121 +       shp->shm_createtime = get_seconds();
1122 +#endif
1123         shp->shm_segsz = size;
1124         shp->shm_nattch = 0;
1125         shp->id = shm_buildid(id,shp->shm_perm.seq);
1126 @@ -750,6 +765,11 @@
1127         file = shp->shm_file;
1128         size = i_size_read(file->f_dentry->d_inode);
1129         shp->shm_nattch++;
1130 +
1131 +#ifdef CONFIG_GRKERNSEC
1132 +       shp->shm_lapid = current->pid;
1133 +#endif
1134 +
1135         shm_unlock(shp);
1136
1137         down_write(&current->mm->mmap_sem);
1138 @@ -916,3 +936,24 @@
1139                           shp->shm_ctim);
1140  }
1141  #endif
1142 +
1143 +void gr_shm_exit(struct task_struct *task)
1144 +{
1145 +#ifdef CONFIG_GRKERNSEC_SHM
1146 +       int i;
1147 +       struct shmid_kernel *shp;
1148 +
1149 +       if (!grsec_enable_shm)
1150 +               return;
1151 +
1152 +       for (i = 0; i <= shm_ids.max_id; i++) {
1153 +               shp = shm_get(i);
1154 +               if (shp && (shp->shm_cprid == task->pid) &&
1155 +                   (shp->shm_nattch <= 0)) {
1156 +                       shp->shm_perm.mode |= SHM_DEST;
1157 +                       shm_destroy(shp);
1158 +               }
1159 +       }
1160 +#endif
1161 +       return;
1162 +}
1163 diff -urN linux-2.6.16.2/kernel/signal.c linux-2.6.16.2-grsec/kernel/signal.c
1164 --- linux-2.6.16.2/kernel/signal.c      2006-04-07 18:56:47.000000000 +0200
1165 +++ linux-2.6.16.2-grsec/kernel/signal.c        2006-04-11 17:44:40.125710500 +0200
1166 @@ -26,6 +26,7 @@
1167  #include <linux/signal.h>
1168  #include <linux/audit.h>
1169  #include <linux/capability.h>
1170 +#include <linux/grsecurity.h>
1171  #include <linux/vs_pid.h>
1172  #include <asm/param.h>
1173  #include <asm/uaccess.h>
1174 @@ -380,6 +381,7 @@
1175                 }
1176                 if (tsk == sig->curr_target)
1177                         sig->curr_target = next_thread(tsk);
1178 +               gr_del_task_from_ip_table(tsk);
1179                 tsk->signal = NULL;
1180                 /*
1181                  * Accumulate here the counters for all threads but the
1182 diff -urN linux-2.6.16.2/kernel/sysctl.c linux-2.6.16.2-grsec/kernel/sysctl.c
1183 --- linux-2.6.16.2/kernel/sysctl.c      2006-04-07 18:56:47.000000000 +0200
1184 +++ linux-2.6.16.2-grsec/kernel/sysctl.c        2006-04-11 17:44:40.125710500 +0200
1185 @@ -54,6 +54,11 @@
1186                       void __user *buffer, size_t *lenp, loff_t *ppos);
1187
1188  #if defined(CONFIG_SYSCTL)
1189 +#include <linux/grsecurity.h>
1190 +#include <linux/grinternal.h>
1191 +
1192 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
1193 +                               const int op);
1194
1195  /* External variables not in a header file. */
1196  extern int C_A_D;
1197 @@ -157,6 +162,7 @@
1198  #ifdef HAVE_ARCH_PICK_MMAP_LAYOUT
1199  int sysctl_legacy_va_layout;
1200  #endif
1201 +extern ctl_table grsecurity_table[];
1202
1203  /* /proc declarations: */
1204
1205 @@ -683,6 +689,16 @@
1206                 .proc_handler   = &proc_dointvec,
1207         },
1208  #endif
1209 +
1210 +#if defined(CONFIG_GRKERNSEC_SYSCTL)
1211 +       {
1212 +               .ctl_name       = KERN_GRSECURITY,
1213 +               .procname       = "grsecurity",
1214 +               .mode           = 0500,
1215 +               .child          = grsecurity_table,
1216 +       },
1217 +#endif
1218 +
1219         { .ctl_name = 0 }
1220  };
1221
1222 @@ -1181,6 +1197,8 @@
1223  static inline int ctl_perm(ctl_table *table, int op)
1224  {
1225         int error;
1226 +       if (table->de && gr_handle_sysctl_mod(table->de->parent->name, table->de->name, op))
1227 +               return -EACCES;
1228         error = security_sysctl(table, op);
1229         if (error)
1230                 return error;
1231 diff -urN linux-2.6.16.2/net/ipv4/inet_hashtables.c linux-2.6.16.2-grsec/net/ipv4/inet_hashtables.c
1232 --- linux-2.6.16.2/net/ipv4/inet_hashtables.c   2006-04-07 18:56:47.000000000 +0200
1233 +++ linux-2.6.16.2-grsec/net/ipv4/inet_hashtables.c     2006-04-11 17:44:40.125710500 +0200
1234 @@ -19,11 +19,14 @@
1235  #include <linux/sched.h>
1236  #include <linux/slab.h>
1237  #include <linux/wait.h>
1238 +#include <linux/grsecurity.h>
1239
1240  #include <net/inet_connection_sock.h>
1241  #include <net/inet_hashtables.h>
1242  #include <net/ip.h>
1243
1244 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
1245 +
1246  /*
1247   * Allocate and initialize a new local port bind bucket.
1248   * The bindhash mutex for snum's hash chain must be held here.
1249 @@ -314,6 +317,8 @@
1250                 }
1251                 spin_unlock(&head->lock);
1252
1253 +               gr_update_task_in_ip_table(current, inet_sk(sk));
1254 +
1255                 if (tw) {
1256                         inet_twsk_deschedule(tw, death_row);;
1257                         inet_twsk_put(tw);
1258 diff -urN linux-2.6.16.2/net/socket.c linux-2.6.16.2-grsec/net/socket.c
1259 --- linux-2.6.16.2/net/socket.c 2006-04-07 18:56:47.000000000 +0200
1260 +++ linux-2.6.16.2-grsec/net/socket.c   2006-04-11 17:44:40.125710500 +0200
1261 @@ -84,6 +84,7 @@
1262  #include <linux/compat.h>
1263  #include <linux/kmod.h>
1264  #include <linux/audit.h>
1265 +#include <linux/in.h>
1266
1267  #ifdef CONFIG_NET_RADIO
1268  #include <linux/wireless.h>            /* Note : will define WIRELESS_EXT */
1269 @@ -97,6 +98,7 @@
1270  #include <linux/netfilter.h>
1271  #include <linux/vs_socket.h>
1272
1273 +extern void gr_attach_curr_ip(const struct sock *sk);
1274  static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
1275  static ssize_t sock_aio_read(struct kiocb *iocb, char __user *buf,
1276                          size_t size, loff_t pos);
1277 @@ -1396,6 +1398,7 @@
1278                 goto out_release;
1279
1280         security_socket_post_accept(sock, newsock);
1281 +       gr_attach_curr_ip(newsock->sk);
1282
1283  out_put:
1284         sockfd_put(sock);
1285 diff -urN linux-2.6.16.2/security/Kconfig linux-2.6.16.2-grsec/security/Kconfig
1286 --- linux-2.6.16.2/security/Kconfig     2006-04-07 18:56:47.000000000 +0200
1287 +++ linux-2.6.16.2-grsec/security/Kconfig       2006-04-11 17:44:40.129710750 +0200
1288 @@ -4,6 +4,8 @@
1289
1290  menu "Security options"
1291
1292 +source grsecurity/Kconfig
1293 +
1294  config KEYS
1295         bool "Enable access key retention support"
1296         help