]>
Commit | Line | Data |
---|---|---|
2380c486 JR |
1 | netlink |
2 | cap_dac* | |
3 | diff -upr a/grsecurity/gracl_cap.c c/grsecurity/gracl_cap.c | |
4 | --- a/grsecurity/gracl_cap.c 2007-12-01 00:54:57.312774500 +0000 | |
5 | +++ c/grsecurity/gracl_cap.c 2007-12-01 01:09:34.923621750 +0000 | |
2ec0a0a8 | 6 | @@ -110,2 +110,2 @@ gr_is_capable_nolog(const int cap) |
2380c486 JR |
7 | return 0; |
8 | } | |
9 | ||
10 | +void | |
11 | +gr_log_cap_pid(const int cap, const pid_t pid) | |
12 | +{ | |
13 | + struct task_struct *p; | |
14 | + | |
15 | + if (gr_acl_is_enabled()) { | |
16 | + read_lock(&tasklist_lock); | |
17 | + p = find_task_by_vpid(pid); | |
18 | + if (p) { | |
19 | + get_task_struct(p); | |
20 | + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, p, captab_log[cap]); | |
21 | + } | |
22 | + read_unlock(&tasklist_lock); | |
23 | + } | |
24 | + return; | |
25 | +} | |
26 | --- a/grsecurity/grsec_sock.c 2008-03-24 00:24:22.482633101 +0100 | |
27 | +++ c/grsecurity/grsec_sock.c 2008-03-24 00:27:01.971671763 +0100 | |
9390b158 | 28 | @@ -247,25 +247,26 @@ |
2380c486 JR |
29 | gr_cap_rtnetlink(struct sock *sock) |
30 | { | |
31 | #ifdef CONFIG_GRKERNSEC | |
32 | + struct acl_subject_label *curracl; | |
33 | + kernel_cap_t cap_dropp = __cap_empty_set, cap_mask = __cap_empty_set; | |
34 | + | |
35 | if (!gr_acl_is_enabled()) | |
36 | return current_cap(); | |
37 | - else if (sock->sk_protocol == NETLINK_ISCSI && | |
38 | - cap_raised(current_cap(), CAP_SYS_ADMIN) && | |
39 | - gr_is_capable(CAP_SYS_ADMIN)) | |
40 | - return current_cap(); | |
41 | - else if (sock->sk_protocol == NETLINK_AUDIT && | |
42 | - cap_raised(current_cap(), CAP_AUDIT_WRITE) && | |
43 | - gr_is_capable(CAP_AUDIT_WRITE) && | |
44 | - cap_raised(current_cap(), CAP_AUDIT_CONTROL) && | |
45 | - gr_is_capable(CAP_AUDIT_CONTROL)) | |
46 | - return current_cap(); | |
47 | - else if (cap_raised(current_cap(), CAP_NET_ADMIN) && | |
9390b158 | 48 | - ((sock->sk_protocol == NETLINK_ROUTE) ? |
49 | - gr_is_capable_nolog(CAP_NET_ADMIN) : | |
50 | - gr_is_capable(CAP_NET_ADMIN))) | |
2380c486 JR |
51 | - return current_cap(); |
52 | - else | |
53 | - return __cap_empty_set; | |
54 | + else { | |
55 | + curracl = current->acl; | |
56 | + | |
57 | + cap_dropp = curracl->cap_lower; | |
58 | + cap_mask = curracl->cap_mask; | |
59 | + | |
60 | + while ((curracl = curracl->parent_subject)) { | |
61 | + cap_dropp = cap_combine(cap_dropp, | |
62 | + cap_intersect(curracl->cap_lower, | |
63 | + cap_drop(cap_mask, curracl->cap_mask))); | |
64 | + cap_mask = cap_combine(cap_mask, curracl->cap_mask); | |
65 | + } | |
66 | + return cap_drop(current_cap(), | |
67 | + cap_intersect(cap_dropp, cap_mask)); | |
68 | + } | |
69 | #else | |
70 | return current_cap(); | |
71 | #endif | |
72 | diff -upr a/include/linux/grsecurity.h c/include/linux/grsecurity.h | |
73 | --- a/include/linux/grsecurity.h 2007-12-01 00:54:57.224769000 +0000 | |
74 | +++ c/include/linux/grsecurity.h 2007-12-01 01:09:34.923621750 +0000 | |
75 | @@ -76,6 +76,7 @@ void gr_log_semrm(const uid_t uid, const | |
76 | void gr_log_shmget(const int err, const int shmflg, const size_t size); | |
77 | void gr_log_shmrm(const uid_t uid, const uid_t cuid); | |
78 | void gr_log_textrel(struct vm_area_struct *vma); | |
79 | +void gr_log_cap_pid(const int cap, pid_t pid); | |
80 | ||
81 | int gr_handle_follow_link(const struct inode *parent, | |
82 | const struct inode *inode, | |
83 | diff -upr a/security/commoncap.c c/security/commoncap.c | |
84 | --- a/security/commoncap.c 2007-12-01 00:54:57.300773750 +0000 | |
85 | +++ c/security/commoncap.c 2007-12-01 01:09:34.923621750 +0000 | |
86 | @@ -55,8 +55,12 @@ | |
87 | ||
88 | int cap_netlink_recv(struct sk_buff *skb, int cap) | |
89 | { | |
90 | - if (!cap_raised(NETLINK_CB(skb).eff_cap, cap)) | |
91 | + if (!cap_raised(NETLINK_CB(skb).eff_cap, cap)) { | |
92 | +#ifdef CONFIG_GRKERNSEC | |
93 | + gr_log_cap_pid(cap, NETLINK_CREDS(skb)->pid); | |
94 | +#endif | |
95 | return -EPERM; | |
96 | + } | |
97 | return 0; | |
98 | } | |
99 | ||
d1ac4147 AM |
100 | --- linux-2.6.30/kernel/vserver/context.c~ 2009-07-31 12:07:52.365267958 +0200 |
101 | +++ linux-2.6.30/kernel/vserver/context.c 2009-07-31 12:43:04.991723596 +0200 | |
102 | @@ -122,7 +122,7 @@ | |
103 | // preconfig fs entries | |
104 | for (index = 0; index < VX_SPACES; index++) { | |
105 | write_lock(&init_fs.lock); | |
106 | - init_fs.users++; | |
107 | + atomic_inc(&init_fs.users); | |
108 | write_unlock(&init_fs.lock); | |
109 | new->vx_fs[index] = &init_fs; | |
110 | } | |
111 | @@ -196,7 +196,7 @@ | |
112 | ||
113 | fs = xchg(&vxi->vx_fs[index], NULL); | |
114 | write_lock(&fs->lock); | |
115 | - kill = !--fs->users; | |
116 | + kill = !atomic_dec_return(&fs->users); | |
117 | write_unlock(&fs->lock); | |
118 | if (kill) | |
119 | free_fs_struct(fs); | |
120 | --- linux-2.6.30/kernel/vserver/space.c~ 2009-07-31 12:07:52.398601243 +0200 | |
121 | +++ linux-2.6.30/kernel/vserver/space.c 2009-07-31 12:47:48.638394441 +0200 | |
122 | @@ -220,7 +220,7 @@ | |
123 | if (mask & CLONE_FS) { | |
124 | write_lock(&fs_cur->lock); | |
125 | current->fs = fs; | |
126 | - kill = !--fs_cur->users; | |
127 | + kill = !atomic_dec_return(&fs_cur->users); | |
128 | write_unlock(&fs_cur->lock); | |
129 | } | |
130 | ||
131 | @@ -278,7 +278,7 @@ | |
132 | if (mask & CLONE_FS) { | |
133 | write_lock(&fs_vxi->lock); | |
134 | vxi->vx_fs[index] = fs; | |
135 | - kill = !--fs_vxi->users; | |
136 | + kill = !atomic_dec_return(&fs_vxi->users); | |
137 | write_unlock(&fs_vxi->lock); | |
138 | } | |
139 | ||
35254aaf AM |
140 | --- linux-2.6.28/fs/proc/Kconfig~ 2008-11-20 23:26:34.000000000 +0100 |
141 | +++ linux-2.6.28/fs/proc/Kconfig 2008-12-01 20:37:12.000000000 +0100 | |
142 | @@ -59,8 +59,8 @@ | |
143 | limited in memory. | |
144 | ||
145 | config PROC_PAGE_MONITOR | |
146 | - default n | |
147 | - depends on PROC_FS && MMU && !GRKERNSEC | |
148 | + default y | |
149 | + depends on PROC_FS && MMU | |
150 | bool "Enable /proc page monitoring" if EMBEDDED | |
151 | help | |
152 | Various /proc files exist to monitor process memory utilization: | |
6b0d2b1a AM |
153 | --- linux-2.6.34/drivers/gpu/drm/i915/i915_dma.c~ 2010-05-16 23:17:36.000000000 +0200 |
154 | +++ linux-2.6.34/drivers/gpu/drm/i915/i915_dma.c 2010-07-06 13:27:42.295120649 +0200 | |
155 | @@ -1416,7 +1416,7 @@ | |
156 | bool can_switch; | |
157 | ||
158 | spin_lock(&dev->count_lock); | |
159 | - can_switch = (dev->open_count == 0); | |
160 | + can_switch = (atomic_read(&dev->open_count) == 0); | |
161 | spin_unlock(&dev->count_lock); | |
162 | return can_switch; | |
163 | } | |
164 | --- linux-2.6.34/drivers/gpu/drm/nouveau/nouveau_state.c~ 2010-05-16 23:17:36.000000000 +0200 | |
165 | +++ linux-2.6.34/drivers/gpu/drm/nouveau/nouveau_state.c 2010-07-06 13:38:37.321928956 +0200 | |
166 | @@ -391,7 +391,7 @@ | |
167 | bool can_switch; | |
168 | ||
169 | spin_lock(&dev->count_lock); | |
170 | - can_switch = (dev->open_count == 0); | |
171 | + can_switch = (atomic_read(&dev->open_count) == 0); | |
172 | spin_unlock(&dev->count_lock); | |
173 | return can_switch; | |
174 | } | |
a6bb676c AM |
175 | --- linux-2.6.34/net/socket.c~ 2010-07-06 13:40:05.892545375 +0200 |
176 | +++ linux-2.6.34/net/socket.c 2010-07-06 14:53:01.074608654 +0200 | |
2ec0a0a8 | 177 | @@ -1573,12 +1573,6 @@ |
a6bb676c AM |
178 | newsock->type = sock->type; |
179 | newsock->ops = sock->ops; | |
180 | ||
181 | - if (gr_handle_sock_server_other(sock->sk)) { | |
182 | - err = -EPERM; | |
183 | - sock_release(newsock); | |
184 | - goto out_put; | |
185 | - } | |
a6bb676c AM |
186 | - |
187 | /* | |
188 | * We don't need try_module_get here, as the listening socket (sock) | |
189 | * has the protocol module (sock->ops->owner) held. |