kernel-grsec-minimal.patch

   1 diff -urNp linux-2.6.16.2/arch/sparc/Makefile linux-2.6.16.2/arch/sparc/Makefile
   2 --- linux-2.6.16.2/arch/sparc/Makefile  2006-04-07 12:56:47.000000000 -0400
   3 +++ linux-2.6.16.2/arch/sparc/Makefile  2006-04-09 21:23:54.000000000 -0400
   4 @@ -34,7 +34,7 @@ libs-y += arch/sparc/prom/ arch/sparc/li
   5  # Renaming is done to avoid confusing pattern matching rules in 2.5.45 (multy-)
   6  INIT_Y         := $(patsubst %/, %/built-in.o, $(init-y))
   7  CORE_Y         := $(core-y)
   8 -CORE_Y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
   9 +CORE_Y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
  10  CORE_Y         := $(patsubst %/, %/built-in.o, $(CORE_Y))
  11  DRIVERS_Y      := $(patsubst %/, %/built-in.o, $(drivers-y))
  12  NET_Y          := $(patsubst %/, %/built-in.o, $(net-y))
  13 diff -urN linux-2.6.16.2/Makefile linux-2.6.16.2-grsec/Makefile
  14 --- linux-2.6.16.2/Makefile     2006-04-07 18:56:47.000000000 +0200
  15 +++ linux-2.6.16.2-grsec/Makefile       2006-04-11 17:44:40.069707000 +0200
  16 @@ -556,7 +556,7 @@
  17
  18
  19  ifeq ($(KBUILD_EXTMOD),)
  20 -core-y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
  21 +core-y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
  22
  23  vmlinux-dirs   := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
  24                      $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
  25 diff -urN linux-2.6.16.2/drivers/char/keyboard.c linux-2.6.16.2-grsec/drivers/char/keyboard.c
  26 --- linux-2.6.16.2/drivers/char/keyboard.c      2006-04-07 18:56:47.000000000 +0200
  27 +++ linux-2.6.16.2-grsec/drivers/char/keyboard.c        2006-04-11 17:44:40.073707250 +0200
  28 @@ -607,6 +607,16 @@
  29              kbd->kbdmode == VC_MEDIUMRAW) &&
  30              value != KVAL(K_SAK))
  31                 return;         /* SAK is allowed even in raw mode */
  32 +
  33 +#if defined(CONFIG_GRKERNSEC_PROC)
  34 +       {
  35 +               void *func = fn_handler[value];
  36 +               if (func == fn_show_state || func == fn_show_ptregs ||
  37 +                   func == fn_show_mem)
  38 +                       return;
  39 +       }
  40 +#endif
  41 +
  42         fn_handler[value](vc);
  43  }
  44
  45 diff -urNp linux-2.6.16.2/drivers/pci/proc.c linux-2.6.16.2-grsec/drivers/pci/proc.c
  46 --- linux-2.6.16.2/drivers/pci/proc.c   2006-04-07 18:56:47.000000000 +0200
  47 +++ linux-2.6.16.2-grsec/drivers/pci/proc.c     2006-04-11 17:44:40.073707250 +0200
  48 @@ -467,7 +467,15 @@ static int __init pci_proc_init(void)
  49  {
  50         struct proc_dir_entry *entry;
  51         struct pci_dev *dev = NULL;
  52 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
  53 +#ifdef CONFIG_GRKERNSEC_PROC_USER
  54 +       proc_bus_pci_dir = proc_mkdir_mode("pci", S_IRUSR | S_IXUSR, proc_bus);
  55 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
  56 +       proc_bus_pci_dir = proc_mkdir_mode("pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, proc_bus);
  57 +#endif
  58 +#else
  59         proc_bus_pci_dir = proc_mkdir("pci", proc_bus);
  60 +#endif
  61         entry = create_proc_entry("devices", 0, proc_bus_pci_dir);
  62         if (entry)
  63                 entry->proc_fops = &proc_bus_pci_dev_operations;
  64 diff -urNp linux-2.6.16.2/fs/Kconfig linux-2.6.16.2-grsec/fs/Kconfig
  65 --- linux-2.6.16.2/fs/Kconfig   2006-04-07 18:56:47.000000000 +0200
  66 +++ linux-2.6.16.2-grsec/fs/Kconfig     2006-04-11 17:44:40.073707250 +0200
  67 @@ -817,7 +817,7 @@ config PROC_FS
  68
  69  config PROC_KCORE
  70         bool "/proc/kcore support" if !ARM
  71 -       depends on PROC_FS && MMU
  72 +       depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
  73
  74  config PROC_VMCORE
  75          bool "/proc/vmcore support (EXPERIMENTAL)"
  76 diff -urN linux-2.6.16.2/fs/namei.c linux-2.6.16.2-grsec/fs/namei.c
  77 --- linux-2.6.16.2/fs/namei.c   2006-04-07 18:56:47.000000000 +0200
  78 +++ linux-2.6.16.2-grsec/fs/namei.c     2006-04-11 18:10:35.961452750 +0200
  79 @@ -32,6 +32,7 @@
  80  #include <linux/vs_cowbl.h>
  81  #include <linux/vs_device.h>
  82  #include <linux/vs_context.h>
  83 +#include <linux/grsecurity.h>
  84  #include <asm/namei.h>
  85  #include <asm/uaccess.h>
  86
  87 @@ -608,6 +609,13 @@
  88         err = security_inode_follow_link(path->dentry, nd);
  89         if (err)
  90                 goto loop;
  91 +
  92 +       if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
  93 +                                 path->dentry->d_inode, path->dentry, nd->mnt)) {
  94 +               err = -EACCES;
  95 +               goto loop;
  96 +       }
  97 +
  98         current->link_count++;
  99         current->total_link_count++;
 100         nd->depth++;
 101 @@ -1647,6 +1655,13 @@
 102         /*
 103          * It already exists.
 104          */
 105 +
 106 +       if (gr_handle_fifo(path.dentry, nd->mnt, dir, flag, acc_mode)) {
 107 +               mutex_unlock(&dir->d_inode->i_mutex);
 108 +               error = -EACCES;
 109 +               goto exit_dput;
 110 +       }
 111 +
 112         mutex_unlock(&dir->d_inode->i_mutex);
 113         audit_inode_update(path.dentry->d_inode);
 114
 115 @@ -1700,6 +1715,13 @@
 116         error = security_inode_follow_link(path.dentry, nd);
 117         if (error)
 118                 goto exit_dput;
 119 +
 120 +       if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
 121 +                                 path.dentry, nd->mnt)) {
 122 +               error = -EACCES;
 123 +               goto exit_dput;
 124 +       }
 125 +
 126         error = __do_follow_link(&path, nd);
 127         if (error) {
 128                 /* Does someone understand code flow here? Or it is only
 129 @@ -2326,7 +2454,16 @@ asmlinkage long sys_linkat(int olddfd, c
 130         error = PTR_ERR(new_dentry);
 131         if (IS_ERR(new_dentry))
 132                 goto out_unlock;
 133 +
 134 +       if (gr_handle_hardlink(old_nd.dentry, old_nd.mnt,
 135 +                              old_nd.dentry->d_inode,
 136 +                              old_nd.dentry->d_inode->i_mode, to)) {
 137 +               error = -EACCES;
 138 +               goto out_unlock_dput;
 139 +       }
 140 +
 141         error = vfs_link(old_nd.dentry, nd.dentry->d_inode, new_dentry, &nd);
 142 +out_unlock_dput:
 143         dput(new_dentry);
 144  out_unlock:
 145         mutex_unlock(&nd.dentry->d_inode->i_mutex);
 146 diff -urN linux-2.6.16.2/fs/proc/array.c linux-2.6.16.2-grsec/fs/proc/array.c
 147 --- linux-2.6.16.2/fs/proc/array.c      2006-04-07 18:56:47.000000000 +0200
 148 +++ linux-2.6.16.2-grsec/fs/proc/array.c        2006-04-11 17:44:40.077707500 +0200
 149 @@ -488,3 +488,14 @@
 150         return sprintf(buffer,"%d %d %d %d %d %d %d\n",
 151                        size, resident, shared, text, lib, data, 0);
 152  }
 153 +
 154 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 155 +int proc_pid_ipaddr(struct task_struct *task, char * buffer)
 156 +{
 157 +       int len;
 158 +
 159 +       len = sprintf(buffer, "%u.%u.%u.%u\n", NIPQUAD(task->signal->curr_ip));
 160 +       return len;
 161 +}
 162 +#endif
 163 +
 164 diff -urNp linux-2.6.16.2/fs/proc/inode.c linux-2.6.16.2-grsec/fs/proc/inode.c
 165 --- linux-2.6.16.2/fs/proc/inode.c      2006-04-07 18:56:47.000000000 +0200
 166 +++ linux-2.6.16.2-grsec/fs/proc/inode.c        2006-04-11 17:44:40.077707500 +0200
 167 @@ -166,7 +166,11 @@ struct inode *proc_get_inode(struct supe
 168                 if (de->mode) {
 169                         inode->i_mode = de->mode;
 170                         inode->i_uid = de->uid;
 171 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 172 +                       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
 173 +#else
 174                         inode->i_gid = de->gid;
 175 +#endif
 176                 }
 177                 if (de->vx_flags)
 178                         PROC_I(inode)->vx_flags = de->vx_flags;
 179 diff -urNp linux-2.6.16.2/fs/proc/internal.h linux-2.6.16.2-grsec/fs/proc/internal.h
 180 --- linux-2.6.16.2/fs/proc/internal.h   2006-04-07 18:56:47.000000000 +0200
 181 +++ linux-2.6.16.2-grsec/fs/proc/internal.h     2006-04-11 17:44:40.077707500 +0200
 182 @@ -36,6 +36,9 @@ extern int proc_tid_stat(struct task_str
 183  extern int proc_tgid_stat(struct task_struct *, char *);
 184  extern int proc_pid_status(struct task_struct *, char *);
 185  extern int proc_pid_statm(struct task_struct *, char *);
 186 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 187 +extern int proc_pid_ipaddr(struct task_struct*,char*);
 188 +#endif
 189
 190  extern struct file_operations proc_maps_operations;
 191  extern struct file_operations proc_numa_maps_operations;
 192 diff -urN linux-2.6.16.2/fs/proc/proc_misc.c linux-2.6.16.2-grsec/fs/proc/proc_misc.c
 193 --- linux-2.6.16.2/fs/proc/proc_misc.c  2006-04-07 18:56:47.000000000 +0200
 194 +++ linux-2.6.16.2-grsec/fs/proc/proc_misc.c    2006-04-11 17:44:40.109709500 +0200
 195 @@ -667,6 +667,8 @@ void create_seq_entry(char *name, mode_t
 196
 197  void __init proc_misc_init(void)
 198  {
 199 +       int gr_mode = 0;
 200 +
 201         static struct {
 202                 char *name;
 203                 int (*read_proc)(char*,char**,off_t,int,int*,void*);
 204 @@ -685,7 +687,9 @@ void __init proc_misc_init(void)
 205                 {"stram",       stram_read_proc},
 206  #endif
 207                 {"filesystems", filesystems_read_proc},
 208 +#ifndef CONFIG_GRKERNSEC_PROC_ADD
 209                 {"cmdline",     cmdline_read_proc},
 210 +#endif
 211                 {"locks",       locks_read_proc},
 212                 {"execdomains", execdomains_read_proc},
 213                 {NULL,}
 214 @@ -735,6 +735,15 @@ void __init proc_misc_init(void)
 215         for (p = simple_ones; p->name; p++)
 216                 create_proc_read_entry(p->name, 0, NULL, p->read_proc, NULL);
 217
 218 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 219 +       gr_mode = S_IRUSR;
 220 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 221 +       gr_mode = S_IRUSR | S_IRGRP;
 222 +#endif
 223 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 224 +       create_proc_read_entry("cmdline", gr_mode, NULL, &cmdline_read_proc, NULL);
 225 +#endif
 226 +
 227         proc_symlink("mounts", NULL, "self/mounts");
 228
 229         /* And now for trickier ones */
 230 @@ -743,7 +752,11 @@
 231         if (entry)
 232                 entry->proc_fops = &proc_kmsg_operations;
 233  #endif
 234 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 235 +       create_seq_entry("devices", gr_mode, &proc_devinfo_operations);
 236 +#else
 237         create_seq_entry("devices", 0, &proc_devinfo_operations);
 238 +#endif
 239         create_seq_entry("cpuinfo", 0, &proc_cpuinfo_operations);
 240  #ifdef CONFIG_BLOCK
 241         create_seq_entry("partitions", 0, &proc_partitions_operations);
 242 @@ -707,7 +724,11 @@ void __init proc_misc_init(void)
 243         create_seq_entry("stat", 0, &proc_stat_operations);
 244         create_seq_entry("interrupts", 0, &proc_interrupts_operations);
 245  #ifdef CONFIG_SLAB
 246 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 247 +       create_seq_entry("slabinfo",S_IWUSR|gr_mode,&proc_slabinfo_operations);
 248 +#else
 249         create_seq_entry("slabinfo",S_IWUSR|S_IRUGO,&proc_slabinfo_operations);
 250 +#endif
 251  #ifdef CONFIG_DEBUG_SLAB_LEAK
 252         create_seq_entry("slab_allocators", 0 ,&proc_slabstats_operations);
 253  #endif
 254 @@ -724,7 +745,7 @@ void __init proc_misc_init(void)
 255  #ifdef CONFIG_SCHEDSTATS
 256         create_seq_entry("schedstat", 0, &proc_schedstat_operations);
 257  #endif
 258 -#ifdef CONFIG_PROC_KCORE
 259 +#if defined(CONFIG_PROC_KCORE) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
 260         proc_root_kcore = create_proc_entry("kcore", S_IRUSR, NULL);
 261         if (proc_root_kcore) {
 262                 proc_root_kcore->proc_fops = &proc_kcore_operations;
 263 diff -urN linux-2.6.16.2/fs/proc/root.c linux-2.6.16.2-grsec/fs/proc/root.c
 264 --- linux-2.6.16.2/fs/proc/root.c       2006-04-07 18:56:47.000000000 +0200
 265 +++ linux-2.6.16.2-grsec/fs/proc/root.c 2006-04-11 17:44:40.113709750 +0200
 266 @@ -53,7 +53,13 @@
 267                 return;
 268         }
 269         proc_misc_init();
 270 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 271 +       proc_net = proc_mkdir_mode("net", S_IRUSR | S_IXUSR, NULL);
 272 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 273 +       proc_net = proc_mkdir_mode("net", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
 274 +#else
 275         proc_net = proc_mkdir("net", NULL);
 276 +#endif
 277         proc_net_stat = proc_mkdir("net/stat", NULL);
 278
 279  #ifdef CONFIG_SYSVIPC
 280 @@ -77,7 +83,15 @@
 281  #ifdef CONFIG_PROC_DEVICETREE
 282         proc_device_tree_init();
 283  #endif
 284 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 285 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 286 +       proc_bus = proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
 287 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 288 +       proc_bus = proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
 289 +#endif
 290 +#else
 291         proc_bus = proc_mkdir("bus", NULL);
 292 +#endif
 293         proc_vx_init();
 294  }
 295
 296 diff -urN linux-2.6.16.2/grsecurity/Kconfig linux-2.6.16.2-grsec/grsecurity/Kconfig
 297 --- linux-2.6.16.2/grsecurity/Kconfig   1970-01-01 01:00:00.000000000 +0100
 298 +++ linux-2.6.16.2-grsec/grsecurity/Kconfig     2006-04-11 19:03:04.020561250 +0200
 299 @@ -0,0 +1,135 @@
 300 +#
 301 +# grecurity configuration
 302 +#
 303 +
 304 +menu "Grsecurity"
 305 +
 306 +config GRKERNSEC
 307 +       bool "Grsecurity"
 308 +       select CRYPTO
 309 +       select CRYPTO_SHA256
 310 +       help
 311 +         If you say Y here, you will be able to configure many features
 312 +         that will enhance the security of your system.  It is highly
 313 +         recommended that you say Y here and read through the help
 314 +         for each option so that you fully understand the features and
 315 +         can evaluate their usefulness for your machine.
 316 +
 317 +menu "Filesystem Protections"
 318 +depends on GRKERNSEC
 319 +
 320 +config GRKERNSEC_PROC
 321 +       bool "Proc restrictions"
 322 +       help
 323 +         If you say Y here, the permissions of the /proc filesystem
 324 +         will be altered to enhance system security and privacy.  You MUST
 325 +         choose either a user only restriction or a user and group restriction.
 326 +         Depending upon the option you choose, you can either restrict users to
 327 +         see only the processes they themselves run, or choose a group that can
 328 +         view all processes and files normally restricted to root if you choose
 329 +         the "restrict to user only" option.  NOTE: If you're running identd as
 330 +         a non-root user, you will have to run it as the group you specify here.
 331 +
 332 +config GRKERNSEC_PROC_USER
 333 +       bool "Restrict /proc to user only"
 334 +       depends on GRKERNSEC_PROC
 335 +       help
 336 +         If you say Y here, non-root users will only be able to view their own
 337 +         processes, and restricts them from viewing network-related information,
 338 +         and viewing kernel symbol and module information.
 339 +
 340 +config GRKERNSEC_PROC_USERGROUP
 341 +       bool "Allow special group"
 342 +       depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
 343 +       help
 344 +         If you say Y here, you will be able to select a group that will be
 345 +         able to view all processes, network-related information, and
 346 +         kernel and symbol information.  This option is useful if you want
 347 +         to run identd as a non-root user.
 348 +
 349 +config GRKERNSEC_PROC_GID
 350 +       int "GID for special group"
 351 +       depends on GRKERNSEC_PROC_USERGROUP
 352 +       default 1001
 353 +
 354 +config GRKERNSEC_PROC_ADD
 355 +       bool "Additional restrictions"
 356 +       depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
 357 +       help
 358 +         If you say Y here, additional restrictions will be placed on
 359 +         /proc that keep normal users from viewing device information and
 360 +         slabinfo information that could be useful for exploits.
 361 +
 362 +config GRKERNSEC_LINK
 363 +       bool "Linking restrictions"
 364 +       help
 365 +         If you say Y here, /tmp race exploits will be prevented, since users
 366 +         will no longer be able to follow symlinks owned by other users in
 367 +         world-writable +t directories (i.e. /tmp), unless the owner of the
 368 +         symlink is the owner of the directory. users will also not be
 369 +         able to hardlink to files they do not own.  If the sysctl option is
 370 +         enabled, a sysctl option with name "linking_restrictions" is created.
 371 +
 372 +config GRKERNSEC_FIFO
 373 +       bool "FIFO restrictions"
 374 +       help
 375 +         If you say Y here, users will not be able to write to FIFOs they don't
 376 +         own in world-writable +t directories (i.e. /tmp), unless the owner of
 377 +         the FIFO is the same owner of the directory it's held in.  If the sysctl
 378 +         option is enabled, a sysctl option with name "fifo_restrictions" is
 379 +         created.
 380 +
 381 +endmenu
 382 +
 383 +config GRKERNSEC_PROC_IPADDR
 384 +       depends on GRKERNSEC
 385 +       bool "/proc/<pid>/ipaddr support"
 386 +       help
 387 +         If you say Y here, a new entry will be added to each /proc/<pid>
 388 +         directory that contains the IP address of the person using the task.
 389 +         The IP is carried across local TCP and AF_UNIX stream sockets.
 390 +         This information can be useful for IDS/IPSes to perform remote response
 391 +         to a local attack.  The entry is readable by only the owner of the
 392 +         process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
 393 +         the RBAC system), and thus does not create privacy concerns.
 394 +
 395 +config GRKERNSEC_SHM
 396 +       depends on GRKERNSEC
 397 +       bool "Destroy unused shared memory"
 398 +       depends on SYSVIPC
 399 +       help
 400 +         If you say Y here, shared memory will be destroyed when no one is
 401 +         attached to it.  Otherwise, resources involved with the shared
 402 +         memory can be used up and not be associated with any process (as the
 403 +         shared memory still exists, and the creating process has exited).  If
 404 +         the sysctl option is enabled, a sysctl option with name
 405 +         "destroy_unused_shm" is created.
 406 +
 407 +config GRKERNSEC_SYSCTL
 408 +       depends on GRKERNSEC && SYSCTL
 409 +       bool "Sysctl support"
 410 +       help
 411 +         If you say Y here, you will be able to change the options that
 412 +         grsecurity runs with at bootup, without having to recompile your
 413 +         kernel.  You can echo values to files in /proc/sys/kernel/grsecurity
 414 +         to enable (1) or disable (0) various features.  All the sysctl entries
 415 +         are mutable until the "grsec_lock" entry is set to a non-zero value.
 416 +         All features enabled in the kernel configuration are disabled at boot
 417 +         if you do not say Y to the "Turn on features by default" option.
 418 +         All options should be set at startup, and the grsec_lock entry should
 419 +         be set to a non-zero value after all the options are set.
 420 +         *THIS IS EXTREMELY IMPORTANT*
 421 +
 422 +config GRKERNSEC_SYSCTL_ON
 423 +       bool "Turn on features by default"
 424 +       depends on GRKERNSEC_SYSCTL
 425 +       help
 426 +         If you say Y here, instead of having all features enabled in the
 427 +         kernel configuration disabled at boot time, the features will be
 428 +         enabled at boot time.  It is recommended you say Y here unless
 429 +         there is some reason you would want all sysctl-tunable features to
 430 +         be disabled by default.  As mentioned elsewhere, it is important
 431 +         to enable the grsec_lock entry once you have finished modifying
 432 +         the sysctl entries.
 433 +
 434 +endmenu
 435 diff -urN linux-2.6.16.2/grsecurity/Makefile linux-2.6.16.2-grsec/grsecurity/Makefile
 436 --- linux-2.6.16.2/grsecurity/Makefile  1970-01-01 01:00:00.000000000 +0100
 437 +++ linux-2.6.16.2-grsec/grsecurity/Makefile    2006-04-11 19:03:17.509404250 +0200
 438 @@ -0,0 +1,11 @@
 439 +# All code in this directory and various hooks inserted throughout the kernel
 440 +# are copyright Brad Spengler, and released under the GPL v2 or higher
 441 +
 442 +obj-y = grsec_fifo.o grsec_sock.o grsec_sysctl.o grsec_link.o
 443 +
 444 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o
 445 +
 446 +ifndef CONFIG_GRKERNSEC
 447 +obj-y += grsec_disabled.o
 448 +endif
 449 +
 450 diff -urN linux-2.6.16.2/grsecurity/grsec_disabled.c linux-2.6.16.2-grsec/grsecurity/grsec_disabled.c
 451 --- linux-2.6.16.2/grsecurity/grsec_disabled.c  1970-01-01 01:00:00.000000000 +0100
 452 +++ linux-2.6.16.2-grsec/grsecurity/grsec_disabled.c    2006-04-11 17:44:40.113709750 +0200
 453 @@ -0,0 +1,5 @@
 454 +void
 455 +grsecurity_init(void)
 456 +{
 457 +       return;
 458 +}
 459 diff -urN linux-2.6.16.2/grsecurity/grsec_fifo.c linux-2.6.16.2-grsec/grsecurity/grsec_fifo.c
 460 --- linux-2.6.16.2/grsecurity/grsec_fifo.c      1970-01-01 01:00:00.000000000 +0100
 461 +++ linux-2.6.16.2-grsec/grsecurity/grsec_fifo.c        2006-04-11 19:04:02.872239250 +0200
 462 @@ -0,0 +1,20 @@
 463 +#include <linux/kernel.h>
 464 +#include <linux/sched.h>
 465 +#include <linux/fs.h>
 466 +#include <linux/file.h>
 467 +#include <linux/grinternal.h>
 468 +
 469 +int
 470 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
 471 +              const struct dentry *dir, const int flag, const int acc_mode)
 472 +{
 473 +#ifdef CONFIG_GRKERNSEC_FIFO
 474 +       if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
 475 +           !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
 476 +           (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
 477 +           (current->fsuid != dentry->d_inode->i_uid)) {
 478 +               return -EACCES;
 479 +       }
 480 +#endif
 481 +       return 0;
 482 +}
 483 diff -urN linux-2.6.16.2/grsecurity/grsec_init.c linux-2.6.16.2-grsec/grsecurity/grsec_init.c
 484 --- linux-2.6.16.2/grsecurity/grsec_init.c      1970-01-01 01:00:00.000000000 +0100
 485 +++ linux-2.6.16.2-grsec/grsecurity/grsec_init.c        2006-04-11 19:04:24.693603000 +0200
 486 @@ -0,0 +1,33 @@
 487 +#include <linux/kernel.h>
 488 +#include <linux/sched.h>
 489 +#include <linux/mm.h>
 490 +#include <linux/smp_lock.h>
 491 +#include <linux/slab.h>
 492 +#include <linux/vmalloc.h>
 493 +#include <linux/percpu.h>
 494 +
 495 +int grsec_enable_shm;
 496 +int grsec_enable_link;
 497 +int grsec_enable_fifo;
 498 +int grsec_lock;
 499 +
 500 +void
 501 +grsecurity_init(void)
 502 +{
 503 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
 504 +#ifndef CONFIG_GRKERNSEC_SYSCTL
 505 +       grsec_lock = 1;
 506 +#endif
 507 +#ifdef CONFIG_GRKERNSEC_SHM
 508 +       grsec_enable_shm = 1;
 509 +#endif
 510 +#ifdef CONFIG_GRKERNSEC_LINK
 511 +       grsec_enable_link = 1;
 512 +#endif
 513 +#ifdef CONFIG_GRKERNSEC_FIFO
 514 +       grsec_enable_fifo = 1;
 515 +#endif
 516 +#endif
 517 +
 518 +       return;
 519 +}
 520 diff -urN linux-2.6.16.2/grsecurity/grsec_link.c linux-2.6.16.2-grsec/grsecurity/grsec_link.c
 521 --- linux-2.6.16.2/grsecurity/grsec_link.c      1970-01-01 01:00:00.000000000 +0100
 522 +++ linux-2.6.16.2-grsec/grsecurity/grsec_link.c        2006-04-11 19:04:40.258575750 +0200
 523 @@ -0,0 +1,37 @@
 524 +#include <linux/kernel.h>
 525 +#include <linux/sched.h>
 526 +#include <linux/fs.h>
 527 +#include <linux/file.h>
 528 +#include <linux/grinternal.h>
 529 +
 530 +int
 531 +gr_handle_follow_link(const struct inode *parent,
 532 +                     const struct inode *inode,
 533 +                     const struct dentry *dentry, const struct vfsmount *mnt)
 534 +{
 535 +#ifdef CONFIG_GRKERNSEC_LINK
 536 +       if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
 537 +           (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
 538 +           (parent->i_mode & S_IWOTH) && (current->fsuid != inode->i_uid)) {
 539 +               return -EACCES;
 540 +       }
 541 +#endif
 542 +       return 0;
 543 +}
 544 +
 545 +int
 546 +gr_handle_hardlink(const struct dentry *dentry,
 547 +                  const struct vfsmount *mnt,
 548 +                  struct inode *inode, const int mode, const char *to)
 549 +{
 550 +#ifdef CONFIG_GRKERNSEC_LINK
 551 +       if (grsec_enable_link && current->fsuid != inode->i_uid &&
 552 +           (!S_ISREG(mode) || (mode & S_ISUID) ||
 553 +            ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
 554 +            (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
 555 +           !capable(CAP_FOWNER) && current->uid) {
 556 +               return -EPERM;
 557 +       }
 558 +#endif
 559 +       return 0;
 560 +}
 561 diff -urN linux-2.6.16.2/grsecurity/grsec_sock.c linux-2.6.16.2-grsec/grsecurity/grsec_sock.c
 562 --- linux-2.6.16.2/grsecurity/grsec_sock.c      1970-01-01 01:00:00.000000000 +0100
 563 +++ linux-2.6.16.2-grsec/grsecurity/grsec_sock.c        2006-04-11 19:20:18.301199750 +0200
 564 @@ -0,0 +1,164 @@
 565 +#include <linux/kernel.h>
 566 +#include <linux/module.h>
 567 +#include <linux/sched.h>
 568 +#include <linux/file.h>
 569 +#include <linux/net.h>
 570 +#include <linux/in.h>
 571 +#include <linux/ip.h>
 572 +#include <net/sock.h>
 573 +#include <net/inet_sock.h>
 574 +#include <linux/grsecurity.h>
 575 +#include <linux/grinternal.h>
 576 +
 577 +#ifdef CONFIG_GRKERNSEC
 578 +#define gr_conn_table_size 32749
 579 +struct conn_table_entry {
 580 +       struct conn_table_entry *next;
 581 +       struct signal_struct *sig;
 582 +};
 583 +
 584 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
 585 +spinlock_t gr_conn_table_lock = SPIN_LOCK_UNLOCKED;
 586 +
 587 +static __inline__ int
 588 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
 589 +{
 590 +       return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
 591 +}
 592 +
 593 +static __inline__ int
 594 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
 595 +          __u16 sport, __u16 dport)
 596 +{
 597 +       if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
 598 +                    sig->gr_sport == sport && sig->gr_dport == dport))
 599 +               return 1;
 600 +       else
 601 +               return 0;
 602 +}
 603 +
 604 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
 605 +{
 606 +       struct conn_table_entry **match;
 607 +       unsigned int index;
 608 +
 609 +       index = conn_hash(sig->gr_saddr, sig->gr_daddr,
 610 +                         sig->gr_sport, sig->gr_dport,
 611 +                         gr_conn_table_size);
 612 +
 613 +       newent->sig = sig;
 614 +
 615 +       match = &gr_conn_table[index];
 616 +       newent->next = *match;
 617 +       *match = newent;
 618 +
 619 +       return;
 620 +}
 621 +
 622 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
 623 +{
 624 +       struct conn_table_entry *match, *last = NULL;
 625 +       unsigned int index;
 626 +
 627 +       index = conn_hash(sig->gr_saddr, sig->gr_daddr,
 628 +                         sig->gr_sport, sig->gr_dport,
 629 +                         gr_conn_table_size);
 630 +
 631 +       match = gr_conn_table[index];
 632 +       while (match && !conn_match(match->sig,
 633 +               sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
 634 +               sig->gr_dport)) {
 635 +               last = match;
 636 +               match = match->next;
 637 +       }
 638 +
 639 +       if (match) {
 640 +               if (last)
 641 +                       last->next = match->next;
 642 +               else
 643 +                       gr_conn_table[index] = NULL;
 644 +               kfree(match);
 645 +       }
 646 +
 647 +       return;
 648 +}
 649 +
 650 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
 651 +                                            __u16 sport, __u16 dport)
 652 +{
 653 +       struct conn_table_entry *match;
 654 +       unsigned int index;
 655 +
 656 +       index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
 657 +
 658 +       match = gr_conn_table[index];
 659 +       while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
 660 +               match = match->next;
 661 +
 662 +       if (match)
 663 +               return match->sig;
 664 +       else
 665 +               return NULL;
 666 +}
 667 +
 668 +#endif
 669 +
 670 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
 671 +{
 672 +#ifdef CONFIG_GRKERNSEC
 673 +       struct signal_struct *sig = task->signal;
 674 +       struct conn_table_entry *newent;
 675 +
 676 +       newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
 677 +       if (newent == NULL)
 678 +               return;
 679 +
 680 +       spin_lock(&gr_conn_table_lock);
 681 +       gr_del_task_from_ip_table_nolock(sig);
 682 +       sig->gr_saddr = inet->rcv_saddr;
 683 +       sig->gr_daddr = inet->daddr;
 684 +       sig->gr_sport = inet->sport;
 685 +       sig->gr_dport = inet->dport;
 686 +       gr_add_to_task_ip_table_nolock(sig, newent);
 687 +       spin_unlock(&gr_conn_table_lock);
 688 +#endif
 689 +       return;
 690 +}
 691 +
 692 +void gr_del_task_from_ip_table(struct task_struct *task)
 693 +{
 694 +#ifdef CONFIG_GRKERNSEC
 695 +       spin_lock(&gr_conn_table_lock);
 696 +       gr_del_task_from_ip_table_nolock(task->signal);
 697 +       spin_unlock(&gr_conn_table_lock);
 698 +#endif
 699 +       return;
 700 +}
 701 +
 702 +void
 703 +gr_attach_curr_ip(const struct sock *sk)
 704 +{
 705 +#ifdef CONFIG_GRKERNSEC
 706 +       struct signal_struct *p, *set;
 707 +       const struct inet_sock *inet = inet_sk(sk);
 708 +
 709 +       if (unlikely(sk->sk_protocol != IPPROTO_TCP))
 710 +               return;
 711 +
 712 +       set = current->signal;
 713 +
 714 +       spin_lock(&gr_conn_table_lock);
 715 +       p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
 716 +                                   inet->dport, inet->sport);
 717 +       if (unlikely(p != NULL)) {
 718 +               set->curr_ip = p->curr_ip;
 719 +               gr_del_task_from_ip_table_nolock(p);
 720 +               spin_unlock(&gr_conn_table_lock);
 721 +               return;
 722 +       }
 723 +       spin_unlock(&gr_conn_table_lock);
 724 +
 725 +       set->curr_ip = inet->daddr;
 726 +#endif
 727 +       return;
 728 +}
 729 diff -urN linux-2.6.16.2/grsecurity/grsec_sysctl.c linux-2.6.16.2-grsec/grsecurity/grsec_sysctl.c
 730 --- linux-2.6.16.2/grsecurity/grsec_sysctl.c    1970-01-01 01:00:00.000000000 +0100
 731 +++ linux-2.6.16.2-grsec/grsecurity/grsec_sysctl.c      2006-04-11 19:04:50.363207250 +0200
 732 @@ -0,0 +1,65 @@
 733 +#include <linux/kernel.h>
 734 +#include <linux/sched.h>
 735 +#include <linux/sysctl.h>
 736 +#include <linux/grsecurity.h>
 737 +#include <linux/grinternal.h>
 738 +
 739 +int
 740 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
 741 +{
 742 +#ifdef CONFIG_GRKERNSEC_SYSCTL
 743 +       if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & 002)) {
 744 +               return -EACCES;
 745 +       }
 746 +#endif
 747 +       return 0;
 748 +}
 749 +
 750 +#if defined(CONFIG_GRKERNSEC_SYSCTL)
 751 +enum {GS_LINK=1, GS_FIFO, GS_SHM, GS_LOCK};
 752 +
 753 +
 754 +ctl_table grsecurity_table[] = {
 755 +#ifdef CONFIG_GRKERNSEC_SYSCTL
 756 +#ifdef CONFIG_GRKERNSEC_LINK
 757 +       {
 758 +               .ctl_name       = GS_LINK,
 759 +               .procname       = "linking_restrictions",
 760 +               .data           = &grsec_enable_link,
 761 +               .maxlen         = sizeof(int),
 762 +               .mode           = 0600,
 763 +               .proc_handler   = &proc_dointvec,
 764 +       },
 765 +#endif
 766 +#ifdef CONFIG_GRKERNSEC_FIFO
 767 +       {
 768 +               .ctl_name       = GS_FIFO,
 769 +               .procname       = "fifo_restrictions",
 770 +               .data           = &grsec_enable_fifo,
 771 +               .maxlen         = sizeof(int),
 772 +               .mode           = 0600,
 773 +               .proc_handler   = &proc_dointvec,
 774 +       },
 775 +#endif
 776 +#ifdef CONFIG_GRKERNSEC_SHM
 777 +       {
 778 +               .ctl_name       = GS_SHM,
 779 +               .procname       = "destroy_unused_shm",
 780 +               .data           = &grsec_enable_shm,
 781 +               .maxlen         = sizeof(int),
 782 +               .mode           = 0600,
 783 +               .proc_handler   = &proc_dointvec,
 784 +       },
 785 +#endif
 786 +       {
 787 +               .ctl_name       = GS_LOCK,
 788 +               .procname       = "grsec_lock",
 789 +               .data           = &grsec_lock,
 790 +               .maxlen         = sizeof(int),
 791 +               .mode           = 0600,
 792 +               .proc_handler   = &proc_dointvec,
 793 +       },
 794 +#endif
 795 +       { .ctl_name = 0 }
 796 +};
 797 +#endif
 798 diff -urN linux-2.6.16.2/include/linux/grinternal.h linux-2.6.16.2-grsec/include/linux/grinternal.h
 799 --- linux-2.6.16.2/include/linux/grinternal.h   1970-01-01 01:00:00.000000000 +0100
 800 +++ linux-2.6.16.2-grsec/include/linux/grinternal.h     2006-04-11 19:03:34.734480750 +0200
 801 @@ -0,0 +1,15 @@
 802 +#ifndef __GRINTERNAL_H
 803 +#define __GRINTERNAL_H
 804 +
 805 +#ifdef CONFIG_GRKERNSEC
 806 +
 807 +#include <linux/fs.h>
 808 +
 809 +extern int grsec_enable_link;
 810 +extern int grsec_enable_fifo;
 811 +extern int grsec_enable_shm;
 812 +extern int grsec_lock;
 813 +
 814 +#endif
 815 +
 816 +#endif
 817 diff -urN linux-2.6.16.2/include/linux/grsecurity.h linux-2.6.16.2-grsec/include/linux/grsecurity.h
 818 --- linux-2.6.16.2/include/linux/grsecurity.h   1970-01-01 01:00:00.000000000 +0100
 819 +++ linux-2.6.16.2-grsec/include/linux/grsecurity.h     2006-04-11 18:06:03.000000000 +0200
 820 @@ -0,0 +1,34 @@
 821 +#ifndef GR_SECURITY_H
 822 +#define GR_SECURITY_H
 823 +#include <linux/fs.h>
 824 +#include <linux/binfmts.h>
 825 +
 826 +extern void gr_del_task_from_ip_table(struct task_struct *p);
 827 +
 828 +extern int gr_handle_follow_link(const struct inode *parent,
 829 +                                const struct inode *inode,
 830 +                                const struct dentry *dentry,
 831 +                                const struct vfsmount *mnt);
 832 +extern int gr_handle_fifo(const struct dentry *dentry,
 833 +                         const struct vfsmount *mnt,
 834 +                         const struct dentry *dir, const int flag,
 835 +                         const int acc_mode);
 836 +extern int gr_handle_hardlink(const struct dentry *dentry,
 837 +                             const struct vfsmount *mnt,
 838 +                             struct inode *inode,
 839 +                             const int mode, const char *to);
 840 +
 841 +#ifdef CONFIG_SYSVIPC
 842 +extern void gr_shm_exit(struct task_struct *task);
 843 +#else
 844 +static inline void gr_shm_exit(struct task_struct *task)
 845 +{
 846 +       return;
 847 +}
 848 +#endif
 849 +
 850 +#ifdef CONFIG_GRKERNSEC
 851 +extern int grsec_enable_shm;
 852 +#endif
 853 +
 854 +#endif
 855 diff -urNp linux-2.6.16.2/include/linux/sched.h linux-2.6.16.2-grsec/include/linux/sched.h
 856 --- linux-2.6.16.2/include/linux/sched.h        2006-04-07 18:56:47.000000000 +0200
 857 +++ linux-2.6.16.2-grsec/include/linux/sched.h  2006-04-11 19:14:15.574530750 +0200
 858 @@ -474,6 +474,13 @@ struct signal_struct {
 859         spinlock_t stats_lock;
 860         struct taskstats *stats;
 861  #endif
 862 +#ifdef CONFIG_GRKERNSEC
 863 +       u32 curr_ip;
 864 +       u32 gr_saddr;
 865 +       u32 gr_daddr;
 866 +       u16 gr_sport;
 867 +       u16 gr_dport;
 868 +#endif
 869  };
 870
 871  /* Context switch must be unlocked if interrupts are to be enabled */
 872 diff -urN linux-2.6.16.2/include/linux/shm.h linux-2.6.16.2-grsec/include/linux/shm.h
 873 --- linux-2.6.16.2/include/linux/shm.h  2006-04-07 18:56:47.000000000 +0200
 874 +++ linux-2.6.16.2-grsec/include/linux/shm.h    2006-04-11 17:44:40.121710250 +0200
 875 @@ -86,6 +86,10 @@
 876         pid_t                   shm_cprid;
 877         pid_t                   shm_lprid;
 878         struct user_struct      *mlock_user;
 879 +#ifdef CONFIG_GRKERNSEC
 880 +       time_t                  shm_createtime;
 881 +       pid_t                   shm_lapid;
 882 +#endif
 883  };
 884
 885  /* shm_mode upper byte flags */
 886 diff -urN linux-2.6.16.2/include/linux/sysctl.h linux-2.6.16.2-grsec/include/linux/sysctl.h
 887 --- linux-2.6.16.2/include/linux/sysctl.h       2006-04-07 18:56:47.000000000 +0200
 888 +++ linux-2.6.16.2-grsec/include/linux/sysctl.h 2006-04-11 18:09:09.244033250 +0200
 889 @@ -155,6 +155,9 @@
 890  /* CTL_VM names: */
 891  enum
 892  {
 893 +#ifdef CONFIG_GRKERNSEC
 894 +       KERN_GRSECURITY=98,     /* grsecurity */
 895 +#endif
 896         VM_UNUSED1=1,           /* was: struct: Set vm swapping control */
 897         VM_UNUSED2=2,           /* was; int: Linear or sqrt() swapout for hogs */
 898         VM_UNUSED3=3,           /* was: struct: Set free page thresholds */
 899 diff -urNp linux-2.6.16.2/ipc/shm.c linux-2.6.16.2-grsec/ipc/shm.c
 900 --- linux-2.6.16.2/ipc/shm.c    2006-04-07 18:56:47.000000000 +0200
 901 +++ linux-2.6.16.2-grsec/ipc/shm.c      2006-04-11 17:44:40.121710250 +0200
 902 @@ -34,6 +34,7 @@
 903  #include <linux/mutex.h>
 904  #include <linux/vs_context.h>
 905  #include <linux/vs_limit.h>
 906 +#include <linux/grsecurity.h>
 907
 908  #include <asm/uaccess.h>
 909
 910 @@ -156,6 +157,17 @@ static void shm_close (struct vm_area_st
 911         shp->shm_lprid = current->tgid;
 912         shp->shm_dtim = get_seconds();
 913         shp->shm_nattch--;
 914 +#ifdef CONFIG_GRKERNSEC_SHM
 915 +       if (grsec_enable_shm) {
 916 +               if (shp->shm_nattch == 0) {
 917 +                       shp->shm_perm.mode |= SHM_DEST;
 918 +                       shm_destroy(ns, shp);
 919 +               } else
 920 +                       shm_unlock(shp);
 921 +               mutex_unlock(&shm_ids(ns).mutex);
 922 +               return;
 923 +       }
 924 +#endif
 925         if(shp->shm_nattch == 0 &&
 926            shp->shm_perm.mode & SHM_DEST)
 927                 shm_destroy (shp);
 928 @@ -258,6 +270,9 @@ static int newseg (key_t key, int shmflg
 929         shp->shm_lprid = 0;
 930         shp->shm_atim = shp->shm_dtim = 0;
 931         shp->shm_ctim = get_seconds();
 932 +#ifdef CONFIG_GRKERNSEC
 933 +       shp->shm_createtime = get_seconds();
 934 +#endif
 935         shp->shm_segsz = size;
 936         shp->shm_nattch = 0;
 937         shp->id = shm_buildid(id,shp->shm_perm.seq);
 938 @@ -774,6 +789,9 @@ long do_shmat(int shmid, char __user *sh
 939         path.dentry = dget(shp->shm_file->f_path.dentry);
 940         path.mnt    = mntget(shp->shm_file->f_path.mnt);
 941         shp->shm_nattch++;
 942 +#ifdef CONFIG_GRKERNSEC
 943 +       shp->shm_lapid = current->pid;
 944 +#endif
 945         size = i_size_read(path.dentry->d_inode);
 946         shm_unlock(shp);
 947
 948 @@ -1014,3 +1059,27 @@ static int sysvipc_shm_proc_show(struct
 949                           shp->shm_ctim);
 950  }
 951  #endif
 952 +
 953 +void gr_shm_exit(struct task_struct *task)
 954 +{
 955 +#ifdef CONFIG_GRKERNSEC_SHM
 956 +       int i;
 957 +       struct shmid_kernel *shp;
 958 +       struct ipc_namespace *ns;
 959 +
 960 +       ns = current->nsproxy->ipc_ns;
 961 +
 962 +       if (!grsec_enable_shm)
 963 +               return;
 964 +
 965 +       for (i = 0; i <= shm_ids(ns).max_id; i++) {
 966 +               shp = shm_get(ns, i);
 967 +               if (shp && (shp->shm_cprid == task->pid) &&
 968 +                   (shp->shm_nattch <= 0)) {
 969 +                       shp->shm_perm.mode |= SHM_DEST;
 970 +                       shm_destroy(ns, shp);
 971 +               }
 972 +       }
 973 +#endif
 974 +       return;
 975 +}
 976 diff -urNp linux-2.6.18/kernel/configs.c linux-2.6.18/kernel/configs.c
 977 --- linux-2.6.18/kernel/configs.c       2006-09-19 23:42:06.000000000 -0400
 978 +++ linux-2.6.18/kernel/configs.c       2006-09-22 20:04:35.000000000 -0400
 979 @@ -88,8 +88,16 @@ static int __init ikconfig_init(void)
 980         struct proc_dir_entry *entry;
 981
 982         /* create the current config file */
 983 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 984 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 985 +       entry = create_proc_entry("config.gz", S_IFREG | S_IRUSR, &proc_root);
 986 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 987 +       entry = create_proc_entry("config.gz", S_IFREG | S_IRUSR | S_IRGRP, &proc_root);
 988 +#endif
 989 +#else
 990         entry = create_proc_entry("config.gz", S_IFREG | S_IRUGO,
 991                                   &proc_root);
 992 +#endif
 993         if (!entry)
 994                 return -ENOMEM;
 995
 996 diff -urN linux-2.6.16.2/kernel/exit.c linux-2.6.16.2-grsec/kernel/exit.c
 997 --- linux-2.6.16.2/kernel/exit.c        2006-04-07 18:56:47.000000000 +0200
 998 +++ linux-2.6.16.2-grsec/kernel/exit.c  2006-04-11 17:44:40.125710500 +0200
 999 @@ -36,6 +36,7 @@
1000  #include <linux/resource.h>
1001  #include <linux/blkdev.h>
1002  #include <linux/task_io_accounting_ops.h>
1003 +#include <linux/grsecurity.h>
1004  #include <linux/vs_limit.h>
1005  #include <linux/vs_context.h>
1006  #include <linux/vs_network.h>
1007 @@ -118,6 +123,7 @@ static void __exit_signal(struct task_st
1008
1009         __unhash_process(tsk);
1010
1011 +       gr_del_task_from_ip_table(tsk);
1012         tsk->signal = NULL;
1013         tsk->sighand = NULL;
1014         spin_unlock(&sighand->siglock);
1015 @@ -914,6 +942,7 @@ fastcall NORET_TYPE void do_exit(long co
1016         if (group_dead)
1017                 acct_process();
1018         exit_sem(tsk);
1019 +       gr_shm_exit(tsk);
1020         __exit_files(tsk);
1021         __exit_fs(tsk);
1022         exit_thread();
1023 diff -urNp linux-2.6.18/kernel/kallsyms.c linux-2.6.18/kernel/kallsyms.c
1024 --- linux-2.6.18/kernel/kallsyms.c      2006-09-19 23:42:06.000000000 -0400
1025 +++ linux-2.6.18/kernel/kallsyms.c      2006-09-22 20:45:04.000000000 -0400
1026 @@ -411,7 +410,15 @@ static int __init kallsyms_init(void)
1027  {
1028         struct proc_dir_entry *entry;
1029
1030 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
1031 +#ifdef CONFIG_GRKERNSEC_PROC_USER
1032 +       entry = create_proc_entry("kallsyms", S_IFREG | S_IRUSR, NULL);
1033 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1034 +       entry = create_proc_entry("kallsyms", S_IFREG | S_IRUSR | S_IRGRP, NULL);
1035 +#endif
1036 +#else
1037         entry = create_proc_entry("kallsyms", 0444, NULL);
1038 +#endif
1039         if (entry)
1040                 entry->proc_fops = &kallsyms_operations;
1041         return 0;
1042 diff -urNp linux-2.6.18/kernel/resource.c linux-2.6.18/kernel/resource.c
1043 --- linux-2.6.18/kernel/resource.c      2006-09-19 23:42:06.000000000 -0400
1044 +++ linux-2.6.18/kernel/resource.c      2006-09-22 20:04:35.000000000 -0400
1045 @@ -133,10 +133,27 @@ static int __init ioresources_init(void)
1046  {
1047         struct proc_dir_entry *entry;
1048
1049 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
1050 +#ifdef CONFIG_GRKERNSEC_PROC_USER
1051 +       entry = create_proc_entry("ioports", S_IRUSR, NULL);
1052 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1053 +       entry = create_proc_entry("ioports", S_IRUSR | S_IRGRP, NULL);
1054 +#endif
1055 +#else
1056         entry = create_proc_entry("ioports", 0, NULL);
1057 +#endif
1058         if (entry)
1059                 entry->proc_fops = &proc_ioports_operations;
1060 +
1061 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
1062 +#ifdef CONFIG_GRKERNSEC_PROC_USER
1063 +       entry = create_proc_entry("iomem", S_IRUSR, NULL);
1064 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1065 +       entry = create_proc_entry("iomem", S_IRUSR | S_IRGRP, NULL);
1066 +#endif
1067 +#else
1068         entry = create_proc_entry("iomem", 0, NULL);
1069 +#endif
1070         if (entry)
1071                 entry->proc_fops = &proc_iomem_operations;
1072         return 0;
1073 diff -urN linux-2.6.16.2/kernel/sysctl.c linux-2.6.16.2-grsec/kernel/sysctl.c
1074 --- linux-2.6.16.2/kernel/sysctl.c      2006-04-07 18:56:47.000000000 +0200
1075 +++ linux-2.6.16.2-grsec/kernel/sysctl.c        2006-04-11 17:44:40.125710500 +0200
1076 @@ -58,6 +58,11 @@ extern int proc_nr_files(ctl_table *tabl
1077  #endif
1078
1079  #if defined(CONFIG_SYSCTL)
1080 +#include <linux/grsecurity.h>
1081 +#include <linux/grinternal.h>
1082 +
1083 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
1084 +                               const int op);
1085
1086  /* External variables not in a header file. */
1087  extern int C_A_D;
1088 @@ -163,6 +168,7 @@ extern ctl_table inotify_table[];
1089  #ifdef HAVE_ARCH_PICK_MMAP_LAYOUT
1090  int sysctl_legacy_va_layout;
1091  #endif
1092 +extern ctl_table grsecurity_table[];
1093
1094  /* /proc declarations: */
1095
1096 @@ -972,6 +978,16 @@ static ctl_table vm_table[] = {
1097                 .extra1         = &zero,
1098         },
1099  #endif
1100 +
1101 +#if defined(CONFIG_GRKERNSEC_SYSCTL)
1102 +       {
1103 +               .ctl_name       = KERN_GRSECURITY,
1104 +               .procname       = "grsecurity",
1105 +               .mode           = 0500,
1106 +               .child          = grsecurity_table,
1107 +       },
1108 +#endif
1109 +
1110         { .ctl_name = 0 }
1111  };
1112
1113 @@ -1233,6 +1249,10 @@ static int test_perm(int mode, int op)
1114  static inline int ctl_perm(ctl_table *table, int op)
1115  {
1116         int error;
1117 +       if (table->parent != NULL && table->parent->procname != NULL &&
1118 +           table->procname != NULL &&
1119 +           gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
1120 +               return -EACCES;
1121         error = security_sysctl(table, op);
1122         if (error)
1123                 return error;
1124 diff -urNp linux-2.6.16.2/net/ipv4/inet_hashtables.c linux-2.6.16.2-grsec/net/ipv4/inet_hashtables.c
1125 --- linux-2.6.16.2/net/ipv4/inet_hashtables.c   2006-04-07 18:56:47.000000000 +0200
1126 +++ linux-2.6.16.2-grsec/net/ipv4/inet_hashtables.c     2006-04-11 17:44:40.125710500 +0200
1127 @@ -19,11 +19,14 @@
1128  #include <linux/sched.h>
1129  #include <linux/slab.h>
1130  #include <linux/wait.h>
1131 +#include <linux/grsecurity.h>
1132
1133  #include <net/inet_connection_sock.h>
1134  #include <net/inet_hashtables.h>
1135  #include <net/ip.h>
1136
1137 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
1138 +
1139  /*
1140   * Allocate and initialize a new local port bind bucket.
1141   * The bindhash mutex for snum's hash chain must be held here.
1142 @@ -308,6 +311,8 @@ ok:
1143                 }
1144                 spin_unlock(&head->lock);
1145
1146 +               gr_update_task_in_ip_table(current, inet_sk(sk));
1147 +
1148                 if (tw) {
1149                         inet_twsk_deschedule(tw, death_row);
1150                         inet_twsk_put(tw);
1151 diff -urNp linux-2.6.16.2/net/socket.c linux-2.6.16.2-grsec/net/socket.c
1152 --- linux-2.6.16.2/net/socket.c 2006-04-07 18:56:47.000000000 +0200
1153 +++ linux-2.6.16.2-grsec/net/socket.c   2006-04-11 17:44:40.125710500 +0200
1154 @@ -84,6 +84,7 @@
1155  #include <linux/compat.h>
1156  #include <linux/kmod.h>
1157  #include <linux/audit.h>
1158 +#include <linux/in.h>
1159  #include <linux/wireless.h>
1160
1161  #include <asm/uaccess.h>
1162 @@ -95,6 +96,7 @@
1163  #include <linux/netfilter.h>
1164  #include <linux/vs_socket.h>
1165
1166 +extern void gr_attach_curr_ip(const struct sock *sk);
1167  static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
1168  static ssize_t sock_aio_read(struct kiocb *iocb, char __user *buf,
1169                          size_t size, loff_t pos);
1170 @@ -1482,6 +1484,7 @@ asmlinkage long sys_accept(int fd, struc
1171         err = newfd;
1172
1173         security_socket_post_accept(sock, newsock);
1174 +       gr_attach_curr_ip(newsock->sk);
1175
1176  out_put:
1177         fput_light(sock->file, fput_needed);
1178 diff -urN linux-2.6.16.2/security/Kconfig linux-2.6.16.2-grsec/security/Kconfig
1179 --- linux-2.6.16.2/security/Kconfig     2006-04-07 18:56:47.000000000 +0200
1180 +++ linux-2.6.16.2-grsec/security/Kconfig       2006-04-11 17:44:40.129710750 +0200
1181 @@ -4,6 +4,8 @@
1182
1183  menu "Security options"
1184
1185 +source grsecurity/Kconfig
1186 +
1187  config KEYS
1188         bool "Enable access key retention support"
1189         help
1190 diff -urN linux-2.6.18/fs/proc/base.c linux-2.6.18-grsec/fs/proc/base.c
1191 --- linux-2.6.18/fs/proc/base.c.orig    2006-11-03 18:27:40.112510768 +0100
1192 +++ linux-2.6.18/fs/proc/base.c 2006-11-03 18:42:56.408212648 +0100
1193 @@ -969,7 +969,11 @@ static struct inode *proc_pid_make_inode
1194         if (task_dumpable(task)) {
1195                 inode->i_uid = task->euid;
1196                 inode->i_gid = task->egid;
1197 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
1198 +               inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
1199 +#endif
1200         }
1201 +
1202         /* procfs is xid tagged */
1203         inode->i_tag = (tag_t)vx_task_xid(task);
1204         security_task_to_inode(task, inode);
1205 @@ -985,17 +992,38 @@ static int pid_getattr(struct vfsmount *
1206  {
1207         struct inode *inode = dentry->d_inode;
1208         struct task_struct *task;
1209 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1210 +       struct task_struct *tmp = current;
1211 +#endif
1212 +
1213         generic_fillattr(inode, stat);
1214
1215         rcu_read_lock();
1216         stat->uid = 0;
1217         stat->gid = 0;
1218         task = pid_task(proc_pid(inode), PIDTYPE_PID);
1219 -       if (task) {
1220 +       if (task
1221 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1222 +           && (!tmp->uid || (tmp->uid == task->uid)
1223 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
1224 +           || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
1225 +#endif
1226 +           )
1227 +#endif
1228 +           ) {
1229                 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
1230 +#ifdef CONFIG_GRKERNSEC_PROC_USER
1231 +                   (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
1232 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1233 +                   (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
1234 +#endif
1235                     task_dumpable(task)) {
1236                         stat->uid = task->euid;
1237 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
1238 +                       stat->gid = CONFIG_GRKERNSEC_PROC_GID;
1239 +#else
1240                         stat->gid = task->egid;
1241 +#endif
1242                 }
1243         }
1244         rcu_read_unlock();
1245 @@ -1025,9 +1053,18 @@ static int pid_revalidate(struct dentry
1246         struct task_struct *task = get_proc_task(inode);
1247         if (task) {
1248                 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
1249 +#ifdef CONFIG_GRKERNSEC_PROC_USER
1250 +                   (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
1251 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1252 +                   (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
1253 +#endif
1254                     task_dumpable(task)) {
1255                         inode->i_uid = task->euid;
1256 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
1257 +                       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
1258 +#else
1259                         inode->i_gid = task->egid;
1260 +#endif
1261                 } else {
1262                         inode->i_uid = 0;
1263                         inode->i_gid = 0;
1264 @@ -1791,6 +1833,9 @@ static struct pid_entry tgid_base_stuff[
1265  #ifdef CONFIG_AUDITSYSCALL
1266         REG("loginuid",   S_IWUSR|S_IRUGO, loginuid),
1267  #endif
1268 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
1269 +       INF("ipaddr",     S_IRUSR, pid_ipaddr),
1270 +#endif
1271  };
1272
1273  static int proc_tgid_base_readdir(struct file * filp,
1274 @@ -1893,7 +1938,14 @@ struct dentry *proc_pid_instantiate(stru
1275         if (!inode)
1276                 goto out;
1277
1278 +#ifdef CONFIG_GRKERNSEC_PROC_USER
1279 +       inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
1280 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1281 +       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
1282 +       inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
1283 +#else
1284         inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
1285 +#endif
1286         inode->i_op = &proc_tgid_base_inode_operations;
1287         inode->i_fop = &proc_tgid_base_operations;
1288         inode->i_flags|=S_IMMUTABLE;
1289 @@ -1992,6 +2048,9 @@ int proc_pid_readdir(struct file * filp,
1290  {
1291         unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
1292         struct task_struct *reaper = get_proc_task_real(filp->f_path.dentry->d_inode);
1293 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1294 +       struct task_struct *tmp = current;
1295 +#endif
1296         struct task_struct *task;
1297         int tgid;
1298
1299 @@ -2009,6 +2068,16 @@ int proc_pid_readdir(struct file * filp,
1300              task;
1301              put_task_struct(task), task = next_tgid(tgid + 1)) {
1302                 tgid = task->pid;
1303 +
1304 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1305 +               if (tmp->uid && (task->uid != tmp->uid)
1306 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
1307 +                       && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
1308 +#endif
1309 +               )
1310 +                       continue;
1311 +#endif
1312 +
1313                 filp->f_pos = tgid + TGID_OFFSET;
1314                 if (proc_pid_fill_cache(filp, dirent, filldir, task, tgid) < 0) {
1315                         put_task_struct(task);