kernel-grsec-minimal.patch

   1 diff -urNp linux-2.6.26.orig/arch/sparc/Makefile linux-2.6.26/arch/sparc/Makefile
   2 --- linux-2.6.26.orig/arch/sparc/Makefile       2008-09-01 11:44:21.000000000 +0200
   3 +++ linux-2.6.26/arch/sparc/Makefile    2008-09-02 12:17:21.000000000 +0200
   4 @@ -81,7 +81,7 @@
   5  # Export what is needed by arch/sparc/boot/Makefile
   6  export VMLINUX_INIT VMLINUX_MAIN
   7  VMLINUX_INIT := $(head-y) $(init-y)
   8 -VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
   9 +VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
  10  VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
  11  VMLINUX_MAIN += $(drivers-y) $(net-y)
  12
  13 diff -urNp linux-2.6.26.orig/drivers/char/keyboard.c linux-2.6.26/drivers/char/keyboard.c
  14 --- linux-2.6.26.orig/drivers/char/keyboard.c   2008-09-01 11:43:37.000000000 +0200
  15 +++ linux-2.6.26/drivers/char/keyboard.c        2008-09-02 12:17:21.000000000 +0200
  16 @@ -633,6 +633,16 @@ static void k_spec(struct vc_data *vc, u
  17              kbd->kbdmode == VC_MEDIUMRAW) &&
  18              value != KVAL(K_SAK))
  19                 return;         /* SAK is allowed even in raw mode */
  20 +
  21 +#if defined(CONFIG_GRKERNSEC_PROC)
  22 +       {
  23 +               void *func = fn_handler[value];
  24 +               if (func == fn_show_state || func == fn_show_ptregs ||
  25 +                   func == fn_show_mem)
  26 +                       return;
  27 +       }
  28 +#endif
  29 +
  30         fn_handler[value](vc);
  31  }
  32
  33 diff -urNp linux-2.6.26.orig/drivers/pci/proc.c linux-2.6.26/drivers/pci/proc.c
  34 --- linux-2.6.26.orig/drivers/pci/proc.c        2008-09-01 11:43:47.000000000 +0200
  35 +++ linux-2.6.26/drivers/pci/proc.c     2008-09-02 12:17:21.000000000 +0200
  36 @@ -472,7 +472,16 @@ static const struct file_operations proc
  37  static int __init pci_proc_init(void)
  38  {
  39         struct pci_dev *dev = NULL;
  40 +
  41 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
  42 +#ifdef CONFIG_GRKERNSEC_PROC_USER
  43 +       proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
  44 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
  45 +       proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
  46 +#endif
  47 +#else
  48         proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
  49 +#endif
  50         proc_create("devices", 0, proc_bus_pci_dir,
  51                     &proc_bus_pci_dev_operations);
  52         proc_initialized = 1;
  53 diff -urNp linux-2.6.26.orig/fs/Kconfig linux-2.6.26/fs/Kconfig
  54 --- linux-2.6.26.orig/fs/proc/Kconfig   2008-09-01 11:43:58.000000000 +0200
  55 +++ linux-2.6.26/fs/proc/Kconfig        2008-09-02 12:17:21.000000000 +0200
  56 @@ -926,12 +926,12 @@ config PROC_FS
  57
  58  config PROC_KCORE
  59         bool "/proc/kcore support" if !ARM
  60 -       depends on PROC_FS && MMU
  61 +       depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
  62
  63  config PROC_VMCORE
  64          bool "/proc/vmcore support (EXPERIMENTAL)"
  65 -        depends on PROC_FS && CRASH_DUMP
  66 -       default y
  67 +        depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
  68 +       default n
  69          help
  70          Exports the dump image of crashed kernel in ELF format.
  71
  72 diff -urNp linux-2.6.26.orig/fs/namei.c linux-2.6.26/fs/namei.c
  73 --- linux-2.6.26.orig/fs/namei.c        2008-09-01 11:43:59.000000000 +0200
  74 +++ linux-2.6.26/fs/namei.c     2008-09-02 12:17:21.000000000 +0200
  75 @@ -38,6 +38,7 @@
  76  #include <linux/vs_cowbl.h>
  77  #include <linux/vs_device.h>
  78  #include <linux/vs_context.h>
  79 +#include <linux/grsecurity.h>
  80  #include <linux/pid_namespace.h>
  81  #include <asm/uaccess.h>
  82
  83 @@ -740,6 +741,13 @@ static inline int do_follow_link(struct
  84         err = security_inode_follow_link(path->dentry, nd);
  85         if (err)
  86                 goto loop;
  87 +
  88 +       if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
  89 +                                 path->dentry->d_inode, path->dentry)) {
  90 +               err = -EACCES;
  91 +               goto loop;
  92 +       }
  93 +
  94         current->link_count++;
  95         current->total_link_count++;
  96         nd->depth++;
  97 @@ -1925,6 +1933,12 @@ do_last:
  98         /*
  99          * It already exists.
 100          */
 101 +
 102 +       if (gr_handle_fifo(path.dentry, dir, flag, acc_mode)) {
 103 +               error = -EACCES;
 104 +               goto exit_mutex_unlock;
 105 +       }
 106 +
 107         mutex_unlock(&dir->d_inode->i_mutex);
 108         audit_inode(pathname, path.dentry);
 109
 110 @@ -2028,6 +2042,13 @@ do_link:
 111         error = security_inode_follow_link(path.dentry, &nd);
 112         if (error)
 113                 goto exit_dput;
 114 +
 115 +       if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
 116 +                                 path.dentry)) {
 117 +               error = -EACCES;
 118 +               goto exit_dput;
 119 +       }
 120 +
 121         error = __do_follow_link(&path, &nd);
 122         if (error) {
 123                 /* Does someone understand code flow here? Or it is only
 124 @@ -2669,6 +2690,13 @@ asmlinkage long sys_linkat(int olddfd, c
 125         error = PTR_ERR(new_dentry);
 126         if (IS_ERR(new_dentry))
 127                 goto out_unlock;
 128 +
 129 +       if (gr_handle_hardlink(old_path.dentry, old_path.dentry->d_inode,
 130 +                              old_path.dentry->d_inode->i_mode, to)) {
 131 +               error = -EACCES;
 132 +               goto out_dput;
 133 +       }
 134 +
 135         error = mnt_want_write(nd.path.mnt);
 136         if (error)
 137                 goto out_dput;
 138 diff -urNp linux-2.6.26.orig/fs/proc/array.c linux-2.6.26/fs/proc/array.c
 139 --- linux-2.6.26.orig/fs/proc/array.c   2008-09-01 11:43:59.000000000 +0200
 140 +++ linux-2.6.26/fs/proc/array.c        2008-09-02 12:17:21.000000000 +0200
 141 @@ -639,3 +639,10 @@ int proc_pid_statm(struct seq_file *m, s
 142
 143         return 0;
 144  }
 145 +
 146 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 147 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
 148 +{
 149 +       return sprintf(buffer, "%u.%u.%u.%u\n", NIPQUAD(task->signal->curr_ip));
 150 +}
 151 +#endif
 152 diff -urNp linux-2.6.26.orig/fs/proc/base.c linux-2.6.26/fs/proc/base.c
 153 --- linux-2.6.26.orig/fs/proc/base.c    2008-09-01 11:43:59.000000000 +0200
 154 +++ linux-2.6.26/fs/proc/base.c 2008-09-02 12:23:45.000000000 +0200
 155 @@ -79,6 +79,8 @@
 156  #include <linux/pid_namespace.h>
 157  #include <linux/vs_context.h>
 158  #include <linux/vs_network.h>
 159 +#include <linux/grsecurity.h>
 160 +
 161  #include "internal.h"
 162
 163  /* NOTE:
 164 @@ -1445,7 +1445,11 @@
 165                 rcu_read_lock();
 166                 cred = __task_cred(task);
 167                 inode->i_uid = cred->euid;
 168 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 169 +               inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
 170 +#else
 171                 inode->i_gid = cred->egid;
 172 +#endif
 173                 rcu_read_unlock();
 174         }
 175         /* procfs is xid tagged */
 176 @@ -1469,6 +1469,9 @@
 177         struct inode *inode = dentry->d_inode;
 178         struct task_struct *task;
 179         const struct cred *cred;
 180 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 181 +       struct task_struct *tmp = current;
 182 +#endif
 183
 184         generic_fillattr(inode, stat);
 185
 186 @@ -1476,12 +1479,29 @@
 187         stat->uid = 0;
 188         stat->gid = 0;
 189         task = pid_task(proc_pid(inode), PIDTYPE_PID);
 190 -       if (task) {
 191 +       if (task
 192 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 193 +               && (!tmp->uid || (tmp->uid == task->uid)
 194 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 195 +                       || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
 196 +#endif
 197 +               )
 198 +#endif
 199 +               ) {
 200                 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
 201 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 202 +                               (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
 203 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 204 +                               (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
 205 +#endif
 206                     task_dumpable(task)) {
 207                         cred = __task_cred(task);
 208                         stat->uid = cred->euid;
 209 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 210 +                       stat->gid = CONFIG_GRKERNSEC_PROC_GID;
 211 +#else
 212                         stat->gid = cred->egid;
 213 +#endif
 214                 }
 215         }
 216         rcu_read_unlock();
 217 @@ -1533,11 +1533,20 @@
 218
 219         if (task) {
 220                 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
 221 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 222 +                       (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
 223 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 224 +                       (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
 225 +#endif
 226                     task_dumpable(task)) {
 227                         rcu_read_lock();
 228                         cred = __task_cred(task);
 229                         inode->i_uid = cred->euid;
 230 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 231 +                       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
 232 +#else
 233                         inode->i_gid = cred->egid;
 234 +#endif
 235                         rcu_read_unlock();
 236                 } else {
 237                         inode->i_uid = 0;
 238 @@ -1841,12 +1888,19 @@ static int proc_fd_permission(struct ino
 239                                 struct nameidata *nd)
 240  {
 241         int rv;
 242 +       struct task_struct *task;
 243
 244         rv = generic_permission(inode, mask, NULL);
 245 -       if (rv == 0)
 246 -               return 0;
 247 +
 248         if (task_pid(current) == proc_pid(inode))
 249                 rv = 0;
 250 +
 251 +       task = get_proc_task(inode);
 252 +       if (task == NULL)
 253 +               return rv;
 254 +
 255 +       put_task_struct(task);
 256 +
 257         return rv;
 258  }
 259
 260 @@ -2617,7 +2683,14 @@ static struct dentry *proc_pid_instantia
 261         if (!inode)
 262                 goto out;
 263
 264 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 265 +       inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
 266 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 267 +       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
 268 +       inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
 269 +#else
 270         inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
 271 +#endif
 272         inode->i_op = &proc_tgid_base_inode_operations;
 273         inode->i_fop = &proc_tgid_base_operations;
 274         inode->i_flags|=S_IMMUTABLE;
 275 @@ -2724,6 +2801,9 @@ int proc_pid_readdir(struct file * filp,
 276  {
 277         unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
 278         struct task_struct *reaper = get_proc_task_real(filp->f_path.dentry->d_inode);
 279 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 280 +       struct task_struct *tmp = current;
 281 +#endif
 282         struct tgid_iter iter;
 283         struct pid_namespace *ns;
 284
 285 @@ -2742,6 +2822,15 @@ int proc_pid_readdir(struct file * filp,
 286         for (iter = next_tgid(ns, iter);
 287              iter.task;
 288              iter.tgid += 1, iter = next_tgid(ns, iter)) {
 289 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 290 +               if (tmp->uid && (iter.task->uid != tmp->uid)
 291 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 292 +                       && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
 293 +#endif
 294 +               )
 295 +#endif
 296 +                       continue;
 297 +
 298                 filp->f_pos = iter.tgid + TGID_OFFSET;
 299                 if (!vx_proc_task_visible(iter.task))
 300                         continue;
 301 @@ -2815,6 +2906,9 @@ static const struct pid_entry tid_base_s
 302  #ifdef CONFIG_FAULT_INJECTION
 303         REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
 304  #endif
 305 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 306 +       INF("ipaddr",     S_IRUSR, pid_ipaddr),
 307 +#endif
 308  };
 309
 310  static int proc_tid_base_readdir(struct file * filp,
 311 diff -urNp linux-2.6.26.orig/fs/proc/inode.c linux-2.6.26/fs/proc/inode.c
 312 --- linux-2.6.26.orig/fs/proc/inode.c   2008-09-01 11:43:59.000000000 +0200
 313 +++ linux-2.6.26/fs/proc/inode.c        2008-09-02 12:17:21.000000000 +0200
 314 @@ -403,7 +403,11 @@ struct inode *proc_get_inode(struct supe
 315                 if (de->mode) {
 316                         inode->i_mode = de->mode;
 317                         inode->i_uid = de->uid;
 318 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 319 +                       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
 320 +#else
 321                         inode->i_gid = de->gid;
 322 +#endif
 323                 }
 324                 if (de->vx_flags)
 325                         PROC_I(inode)->vx_flags = de->vx_flags;
 326 diff -urNp linux-2.6.26.orig/fs/proc/internal.h linux-2.6.26/fs/proc/internal.h
 327 --- linux-2.6.26.orig/fs/proc/internal.h        2008-09-01 11:43:59.000000000 +0200
 328 +++ linux-2.6.26/fs/proc/internal.h     2008-09-02 12:17:21.000000000 +0200
 329 @@ -58,6 +58,9 @@ extern int proc_pid_statm(struct seq_fil
 330                                 struct pid *pid, struct task_struct *task);
 331  extern int proc_pid_nsproxy(struct seq_file *m, struct pid_namespace *ns,
 332                                 struct pid *pid, struct task_struct *task);
 333 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 334 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
 335 +#endif
 336
 337  extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
 338
 339 --- linux-2.6.26.orig/fs/proc/cmdline.c 2008-12-25 00:26:37.000000000 +0100
 340 +++ linux-2.6.26/fs/proc/cmdline.c      2009-01-02 17:46:34.278247774 +0100
 341 @@ -23,7 +23,15 @@
 342
 343  static int __init proc_cmdline_init(void)
 344  {
 345 -       proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
 346 +       int gr_mode = 0;
 347 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 348 +       gr_mode = S_IRUSR;
 349 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 350 +       gr_mode = S_IRUSR | S_IRGRP;
 351 +#endif
 352 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 353 +       proc_create("cmdline", gr_mode, NULL, &cmdline_proc_fops);
 354 +#endif
 355         return 0;
 356  }
 357  module_init(proc_cmdline_init);
 358 --- linux-2.6.26.orig/fs/proc/devices.c 2008-12-25 00:26:37.000000000 +0100
 359 +++ linux-2.6.26/fs/proc/devices.c      2009-01-02 17:43:00.758269666 +0100
 360 @@ -64,7 +64,13 @@
 361
 362  static int __init proc_devices_init(void)
 363  {
 364 -       proc_create("devices", 0, NULL, &proc_devinfo_operations);
 365 +       int gr_mode = 0;
 366 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 367 +       gr_mode = S_IRUSR;
 368 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 369 +       gr_mode = S_IRUSR | S_IRGRP;
 370 +#endif
 371 +       proc_create("devices", gr_mode, NULL, &proc_devinfo_operations);
 372         return 0;
 373  }
 374  module_init(proc_devices_init);
 375 --- linux-2.6.26.orig/fs/proc/kcore.c   2008-12-25 00:26:37.000000000 +0100
 376 +++ linux-2.6.26/fs/proc/kcore.c        2009-01-02 17:45:03.714922801 +0100
 377 @@ -404,10 +404,12 @@
 378
 379  static int __init proc_kcore_init(void)
 380  {
 381 +#if defined(CONFIG_PROC_KCORE) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
 382         proc_root_kcore = proc_create("kcore", S_IRUSR, NULL, &proc_kcore_operations);
 383         if (proc_root_kcore)
 384                 proc_root_kcore->size =
 385                                 (size_t)high_memory - PAGE_OFFSET + PAGE_SIZE;
 386 +#endif
 387         return 0;
 388  }
 389  module_init(proc_kcore_init);
 390 diff -urNp linux-2.6.26.orig/fs/proc/root.c linux-2.6.26/fs/proc/root.c
 391 --- linux-2.6.26.orig/fs/proc/root.c    2008-09-01 11:43:59.000000000 +0200
 392 +++ linux-2.6.26/fs/proc/root.c 2008-09-02 12:17:21.000000000 +0200
 393 @@ -139,7 +139,15 @@ void __init proc_root_init(void)
 394  #ifdef CONFIG_PROC_DEVICETREE
 395         proc_device_tree_init();
 396  #endif
 397 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 398 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 399 +       proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
 400 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 401 +       proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
 402 +#endif
 403 +#else
 404         proc_mkdir("bus", NULL);
 405 +#endif
 406         proc_sys_init();
 407         proc_vx_init();
 408  }
 409 diff -urNp linux-2.6.26.orig/grsecurity/grsec_disabled.c linux-2.6.26/grsecurity/grsec_disabled.c
 410 --- linux-2.6.26.orig/grsecurity/grsec_disabled.c       1970-01-01 01:00:00.000000000 +0100
 411 +++ linux-2.6.26/grsecurity/grsec_disabled.c    2008-09-02 12:17:21.000000000 +0200
 412 @@ -0,0 +1,6 @@
 413 +void
 414 +grsecurity_init(void)
 415 +{
 416 +       return;
 417 +}
 418 +
 419 diff -urNp linux-2.6.26.orig/grsecurity/grsec_fifo.c linux-2.6.26/grsecurity/grsec_fifo.c
 420 --- linux-2.6.26.orig/grsecurity/grsec_fifo.c   1970-01-01 01:00:00.000000000 +0100
 421 +++ linux-2.6.26/grsecurity/grsec_fifo.c        2008-09-02 12:17:21.000000000 +0200
 422 @@ -0,0 +1,20 @@
 423 +#include <linux/kernel.h>
 424 +#include <linux/sched.h>
 425 +#include <linux/fs.h>
 426 +#include <linux/file.h>
 427 +#include <linux/grinternal.h>
 428 +
 429 +int
 430 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
 431 +              const struct dentry *dir, const int flag, const int acc_mode)
 432 +{
 433 +#ifdef CONFIG_GRKERNSEC_FIFO
 434 +       if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
 435 +           !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
 436 +           (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
 437 +           (current->fsuid != dentry->d_inode->i_uid)) {
 438 +               return -EACCES;
 439 +       }
 440 +#endif
 441 +       return 0;
 442 +}
 443 diff -urNp linux-2.6.26.orig/grsecurity/grsec_init.c linux-2.6.26/grsecurity/grsec_init.c
 444 --- linux-2.6.26.orig/grsecurity/grsec_init.c   1970-01-01 01:00:00.000000000 +0100
 445 +++ linux-2.6.26/grsecurity/grsec_init.c        2008-09-02 12:17:21.000000000 +0200
 446 @@ -0,0 +1,29 @@
 447 +#include <linux/kernel.h>
 448 +#include <linux/sched.h>
 449 +#include <linux/mm.h>
 450 +#include <linux/smp_lock.h>
 451 +#include <linux/slab.h>
 452 +#include <linux/vmalloc.h>
 453 +#include <linux/percpu.h>
 454 +
 455 +int grsec_enable_link;
 456 +int grsec_enable_fifo;
 457 +int grsec_lock;
 458 +
 459 +void
 460 +grsecurity_init(void)
 461 +{
 462 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
 463 +#ifndef CONFIG_GRKERNSEC_SYSCTL
 464 +       grsec_lock = 1;
 465 +#endif
 466 +#ifdef CONFIG_GRKERNSEC_LINK
 467 +       grsec_enable_link = 1;
 468 +#endif
 469 +#ifdef CONFIG_GRKERNSEC_FIFO
 470 +       grsec_enable_fifo = 1;
 471 +#endif
 472 +#endif
 473 +
 474 +       return;
 475 +}
 476 diff -urNp linux-2.6.26.orig/grsecurity/grsec_link.c linux-2.6.26/grsecurity/grsec_link.c
 477 --- linux-2.6.26.orig/grsecurity/grsec_link.c   1970-01-01 01:00:00.000000000 +0100
 478 +++ linux-2.6.26/grsecurity/grsec_link.c        2008-09-02 12:17:21.000000000 +0200
 479 @@ -0,0 +1,37 @@
 480 +#include <linux/kernel.h>
 481 +#include <linux/sched.h>
 482 +#include <linux/fs.h>
 483 +#include <linux/file.h>
 484 +#include <linux/grinternal.h>
 485 +
 486 +int
 487 +gr_handle_follow_link(const struct inode *parent,
 488 +                     const struct inode *inode,
 489 +                     const struct dentry *dentry, const struct vfsmount *mnt)
 490 +{
 491 +#ifdef CONFIG_GRKERNSEC_LINK
 492 +       if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
 493 +           (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
 494 +           (parent->i_mode & S_IWOTH) && (current->fsuid != inode->i_uid)) {
 495 +               return -EACCES;
 496 +       }
 497 +#endif
 498 +       return 0;
 499 +}
 500 +
 501 +int
 502 +gr_handle_hardlink(const struct dentry *dentry,
 503 +                  const struct vfsmount *mnt,
 504 +                  struct inode *inode, const int mode, const char *to)
 505 +{
 506 +#ifdef CONFIG_GRKERNSEC_LINK
 507 +       if (grsec_enable_link && current->fsuid != inode->i_uid &&
 508 +           (!S_ISREG(mode) || (mode & S_ISUID) ||
 509 +            ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
 510 +            (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
 511 +           !capable(CAP_FOWNER) && current->uid) {
 512 +               return -EPERM;
 513 +       }
 514 +#endif
 515 +       return 0;
 516 +}
 517 diff -urNp linux-2.6.26.orig/grsecurity/grsec_sock.c linux-2.6.26/grsecurity/grsec_sock.c
 518 --- linux-2.6.26.orig/grsecurity/grsec_sock.c   1970-01-01 01:00:00.000000000 +0100
 519 +++ linux-2.6.26/grsecurity/grsec_sock.c        2008-09-02 12:17:21.000000000 +0200
 520 @@ -0,0 +1,170 @@
 521 +#include <linux/kernel.h>
 522 +#include <linux/module.h>
 523 +#include <linux/sched.h>
 524 +#include <linux/file.h>
 525 +#include <linux/net.h>
 526 +#include <linux/in.h>
 527 +#include <linux/ip.h>
 528 +#include <net/sock.h>
 529 +#include <net/inet_sock.h>
 530 +#include <linux/grsecurity.h>
 531 +#include <linux/grinternal.h>
 532 +
 533 +#ifdef CONFIG_GRKERNSEC
 534 +#define gr_conn_table_size 32749
 535 +struct conn_table_entry {
 536 +       struct conn_table_entry *next;
 537 +       struct signal_struct *sig;
 538 +};
 539 +
 540 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
 541 +spinlock_t gr_conn_table_lock = SPIN_LOCK_UNLOCKED;
 542 +
 543 +extern const char * gr_socktype_to_name(unsigned char type);
 544 +extern const char * gr_proto_to_name(unsigned char proto);
 545 +
 546 +static __inline__ int
 547 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
 548 +{
 549 +       return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
 550 +}
 551 +
 552 +static __inline__ int
 553 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
 554 +          __u16 sport, __u16 dport)
 555 +{
 556 +       if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
 557 +                    sig->gr_sport == sport && sig->gr_dport == dport))
 558 +               return 1;
 559 +       else
 560 +               return 0;
 561 +}
 562 +
 563 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
 564 +{
 565 +       struct conn_table_entry **match;
 566 +       unsigned int index;
 567 +
 568 +       index = conn_hash(sig->gr_saddr, sig->gr_daddr,
 569 +                         sig->gr_sport, sig->gr_dport,
 570 +                         gr_conn_table_size);
 571 +
 572 +       newent->sig = sig;
 573 +
 574 +       match = &gr_conn_table[index];
 575 +       newent->next = *match;
 576 +       *match = newent;
 577 +
 578 +       return;
 579 +}
 580 +
 581 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
 582 +{
 583 +       struct conn_table_entry *match, *last = NULL;
 584 +       unsigned int index;
 585 +
 586 +       index = conn_hash(sig->gr_saddr, sig->gr_daddr,
 587 +                         sig->gr_sport, sig->gr_dport,
 588 +                         gr_conn_table_size);
 589 +
 590 +       match = gr_conn_table[index];
 591 +       while (match && !conn_match(match->sig,
 592 +               sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
 593 +               sig->gr_dport)) {
 594 +               last = match;
 595 +               match = match->next;
 596 +       }
 597 +
 598 +       if (match) {
 599 +               if (last)
 600 +                       last->next = match->next;
 601 +               else
 602 +                       gr_conn_table[index] = NULL;
 603 +               kfree(match);
 604 +       }
 605 +
 606 +       return;
 607 +}
 608 +
 609 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
 610 +                                            __u16 sport, __u16 dport)
 611 +{
 612 +       struct conn_table_entry *match;
 613 +       unsigned int index;
 614 +
 615 +       index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
 616 +
 617 +       match = gr_conn_table[index];
 618 +       while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
 619 +               match = match->next;
 620 +
 621 +       if (match)
 622 +               return match->sig;
 623 +       else
 624 +               return NULL;
 625 +}
 626 +
 627 +#endif
 628 +
 629 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
 630 +{
 631 +#ifdef CONFIG_GRKERNSEC
 632 +       struct signal_struct *sig = task->signal;
 633 +       struct conn_table_entry *newent;
 634 +
 635 +       newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
 636 +       if (newent == NULL)
 637 +               return;
 638 +       /* no bh lock needed since we are called with bh disabled */
 639 +       spin_lock(&gr_conn_table_lock);
 640 +       gr_del_task_from_ip_table_nolock(sig);
 641 +       sig->gr_saddr = inet->rcv_saddr;
 642 +       sig->gr_daddr = inet->daddr;
 643 +       sig->gr_sport = inet->sport;
 644 +       sig->gr_dport = inet->dport;
 645 +       gr_add_to_task_ip_table_nolock(sig, newent);
 646 +       spin_unlock(&gr_conn_table_lock);
 647 +#endif
 648 +       return;
 649 +}
 650 +
 651 +void gr_del_task_from_ip_table(struct task_struct *task)
 652 +{
 653 +#ifdef CONFIG_GRKERNSEC
 654 +       spin_lock(&gr_conn_table_lock);
 655 +       gr_del_task_from_ip_table_nolock(task->signal);
 656 +       spin_unlock(&gr_conn_table_lock);
 657 +#endif
 658 +       return;
 659 +}
 660 +
 661 +void
 662 +gr_attach_curr_ip(const struct sock *sk)
 663 +{
 664 +#ifdef CONFIG_GRKERNSEC
 665 +       struct signal_struct *p, *set;
 666 +       const struct inet_sock *inet = inet_sk(sk);
 667 +
 668 +       if (unlikely(sk->sk_protocol != IPPROTO_TCP))
 669 +               return;
 670 +
 671 +       set = current->signal;
 672 +
 673 +       spin_lock_bh(&gr_conn_table_lock);
 674 +       p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
 675 +                                   inet->dport, inet->sport);
 676 +       if (unlikely(p != NULL)) {
 677 +               set->curr_ip = p->curr_ip;
 678 +               set->used_accept = 1;
 679 +               gr_del_task_from_ip_table_nolock(p);
 680 +               spin_unlock_bh(&gr_conn_table_lock);
 681 +               return;
 682 +       }
 683 +       spin_unlock_bh(&gr_conn_table_lock);
 684 +
 685 +       set->curr_ip = inet->daddr;
 686 +       set->used_accept = 1;
 687 +#endif
 688 +       return;
 689 +}
 690 +
 691 diff -urNp linux-2.6.26.orig/grsecurity/grsec_sysctl.c linux-2.6.26/grsecurity/grsec_sysctl.c
 692 --- linux-2.6.26.orig/grsecurity/grsec_sysctl.c 1970-01-01 01:00:00.000000000 +0100
 693 +++ linux-2.6.26/grsecurity/grsec_sysctl.c      2008-09-02 12:17:21.000000000 +0200
 694 @@ -0,0 +1,52 @@
 695 +#include <linux/kernel.h>
 696 +#include <linux/sched.h>
 697 +#include <linux/sysctl.h>
 698 +#include <linux/grsecurity.h>
 699 +#include <linux/grinternal.h>
 700 +
 701 +int
 702 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
 703 +{
 704 +#ifdef CONFIG_GRKERNSEC_SYSCTL
 705 +       if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & 002)) {
 706 +               return -EACCES;
 707 +       }
 708 +#endif
 709 +       return 0;
 710 +}
 711 +
 712 +#if defined(CONFIG_GRKERNSEC_SYSCTL)
 713 +ctl_table grsecurity_table[] = {
 714 +#ifdef CONFIG_GRKERNSEC_SYSCTL
 715 +#ifdef CONFIG_GRKERNSEC_LINK
 716 +       {
 717 +               .ctl_name       = CTL_UNNUMBERED,
 718 +               .procname       = "linking_restrictions",
 719 +               .data           = &grsec_enable_link,
 720 +               .maxlen         = sizeof(int),
 721 +               .mode           = 0600,
 722 +               .proc_handler   = &proc_dointvec,
 723 +       },
 724 +#endif
 725 +#ifdef CONFIG_GRKERNSEC_FIFO
 726 +       {
 727 +               .ctl_name       = CTL_UNNUMBERED,
 728 +               .procname       = "fifo_restrictions",
 729 +               .data           = &grsec_enable_fifo,
 730 +               .maxlen         = sizeof(int),
 731 +               .mode           = 0600,
 732 +               .proc_handler   = &proc_dointvec,
 733 +       },
 734 +#endif
 735 +       {
 736 +               .ctl_name       = CTL_UNNUMBERED,
 737 +               .procname       = "grsec_lock",
 738 +               .data           = &grsec_lock,
 739 +               .maxlen         = sizeof(int),
 740 +               .mode           = 0600,
 741 +               .proc_handler   = &proc_dointvec,
 742 +       },
 743 +#endif
 744 +       { .ctl_name = 0 }
 745 +};
 746 +#endif
 747 diff -urNp linux-2.6.26.orig/grsecurity/Kconfig linux-2.6.26/grsecurity/Kconfig
 748 --- linux-2.6.26.orig/grsecurity/Kconfig        1970-01-01 01:00:00.000000000 +0100
 749 +++ linux-2.6.26/grsecurity/Kconfig     2008-09-02 12:17:21.000000000 +0200
 750 @@ -0,0 +1,123 @@
 751 +#
 752 +# grecurity configuration
 753 +#
 754 +
 755 +menu "Grsecurity"
 756 +
 757 +config GRKERNSEC
 758 +       bool "Grsecurity"
 759 +       select CRYPTO
 760 +       select CRYPTO_SHA256
 761 +       select SECURITY
 762 +       select SECURITY_CAPABILITIES
 763 +       help
 764 +         If you say Y here, you will be able to configure many features
 765 +         that will enhance the security of your system.  It is highly
 766 +         recommended that you say Y here and read through the help
 767 +         for each option so that you fully understand the features and
 768 +         can evaluate their usefulness for your machine.
 769 +
 770 +menu "Filesystem Protections"
 771 +depends on GRKERNSEC
 772 +
 773 +config GRKERNSEC_PROC
 774 +       bool "Proc restrictions"
 775 +       help
 776 +         If you say Y here, the permissions of the /proc filesystem
 777 +         will be altered to enhance system security and privacy.  You MUST
 778 +         choose either a user only restriction or a user and group restriction.
 779 +         Depending upon the option you choose, you can either restrict users to
 780 +         see only the processes they themselves run, or choose a group that can
 781 +         view all processes and files normally restricted to root if you choose
 782 +         the "restrict to user only" option.  NOTE: If you're running identd as
 783 +         a non-root user, you will have to run it as the group you specify here.
 784 +
 785 +config GRKERNSEC_PROC_USER
 786 +       bool "Restrict /proc to user only"
 787 +       depends on GRKERNSEC_PROC
 788 +       help
 789 +         If you say Y here, non-root users will only be able to view their own
 790 +         processes, and restricts them from viewing network-related information,
 791 +         and viewing kernel symbol and module information.
 792 +
 793 +config GRKERNSEC_PROC_USERGROUP
 794 +       bool "Allow special group"
 795 +       depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
 796 +       help
 797 +         If you say Y here, you will be able to select a group that will be
 798 +         able to view all processes, network-related information, and
 799 +         kernel and symbol information.  This option is useful if you want
 800 +         to run identd as a non-root user.
 801 +
 802 +config GRKERNSEC_PROC_GID
 803 +       int "GID for special group"
 804 +       depends on GRKERNSEC_PROC_USERGROUP
 805 +       default 1001
 806 +
 807 +config GRKERNSEC_PROC_ADD
 808 +       bool "Additional restrictions"
 809 +       depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
 810 +       help
 811 +         If you say Y here, additional restrictions will be placed on
 812 +         /proc that keep normal users from viewing device information and
 813 +         slabinfo information that could be useful for exploits.
 814 +
 815 +config GRKERNSEC_LINK
 816 +       bool "Linking restrictions"
 817 +       help
 818 +         If you say Y here, /tmp race exploits will be prevented, since users
 819 +         will no longer be able to follow symlinks owned by other users in
 820 +         world-writable +t directories (i.e. /tmp), unless the owner of the
 821 +         symlink is the owner of the directory. users will also not be
 822 +         able to hardlink to files they do not own.  If the sysctl option is
 823 +         enabled, a sysctl option with name "linking_restrictions" is created.
 824 +
 825 +config GRKERNSEC_FIFO
 826 +       bool "FIFO restrictions"
 827 +       help
 828 +         If you say Y here, users will not be able to write to FIFOs they don't
 829 +         own in world-writable +t directories (i.e. /tmp), unless the owner of
 830 +         the FIFO is the same owner of the directory it's held in.  If the sysctl
 831 +         option is enabled, a sysctl option with name "fifo_restrictions" is
 832 +         created.
 833 +
 834 +config GRKERNSEC_PROC_IPADDR
 835 +       bool "/proc/<pid>/ipaddr support"
 836 +       help
 837 +         If you say Y here, a new entry will be added to each /proc/<pid>
 838 +         directory that contains the IP address of the person using the task.
 839 +         The IP is carried across local TCP and AF_UNIX stream sockets.
 840 +         This information can be useful for IDS/IPSes to perform remote response
 841 +         to a local attack.  The entry is readable by only the owner of the
 842 +         process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
 843 +         the RBAC system), and thus does not create privacy concerns.
 844 +
 845 +endmenu
 846 +
 847 +config GRKERNSEC_SYSCTL
 848 +       bool "Sysctl support"
 849 +       help
 850 +         If you say Y here, you will be able to change the options that
 851 +         grsecurity runs with at bootup, without having to recompile your
 852 +         kernel.  You can echo values to files in /proc/sys/kernel/grsecurity
 853 +         to enable (1) or disable (0) various features.  All the sysctl entries
 854 +         are mutable until the "grsec_lock" entry is set to a non-zero value.
 855 +         All features enabled in the kernel configuration are disabled at boot
 856 +         if you do not say Y to the "Turn on features by default" option.
 857 +         All options should be set at startup, and the grsec_lock entry should
 858 +         be set to a non-zero value after all the options are set.
 859 +         *THIS IS EXTREMELY IMPORTANT*
 860 +
 861 +config GRKERNSEC_SYSCTL_ON
 862 +       bool "Turn on features by default"
 863 +       depends on GRKERNSEC_SYSCTL
 864 +       help
 865 +         If you say Y here, instead of having all features enabled in the
 866 +         kernel configuration disabled at boot time, the features will be
 867 +         enabled at boot time.  It is recommended you say Y here unless
 868 +         there is some reason you would want all sysctl-tunable features to
 869 +         be disabled by default.  As mentioned elsewhere, it is important
 870 +         to enable the grsec_lock entry once you have finished modifying
 871 +         the sysctl entries.
 872 +
 873 +endmenu
 874 diff -urNp linux-2.6.26.orig/grsecurity/Makefile linux-2.6.26/grsecurity/Makefile
 875 --- linux-2.6.26.orig/grsecurity/Makefile       1970-01-01 01:00:00.000000000 +0100
 876 +++ linux-2.6.26/grsecurity/Makefile    2008-09-02 12:17:21.000000000 +0200
 877 @@ -0,0 +1,11 @@
 878 +# All code in this directory and various hooks inserted throughout the kernel
 879 +# are copyright Brad Spengler, and released under the GPL v2 or higher
 880 +
 881 +obj-y = grsec_fifo.o grsec_sock.o grsec_sysctl.o grsec_link.o
 882 +
 883 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o
 884 +
 885 +ifndef CONFIG_GRKERNSEC
 886 +obj-y += grsec_disabled.o
 887 +endif
 888 +
 889 diff -urNp linux-2.6.26.orig/include/linux/grinternal.h linux-2.6.26/include/linux/grinternal.h
 890 --- linux-2.6.26.orig/include/linux/grinternal.h        1970-01-01 01:00:00.000000000 +0100
 891 +++ linux-2.6.26/include/linux/grinternal.h     2008-09-02 12:17:21.000000000 +0200
 892 @@ -0,0 +1,14 @@
 893 +#ifndef __GRINTERNAL_H
 894 +#define __GRINTERNAL_H
 895 +
 896 +#ifdef CONFIG_GRKERNSEC
 897 +
 898 +#include <linux/fs.h>
 899 +
 900 +extern int grsec_enable_link;
 901 +extern int grsec_enable_fifo;
 902 +extern int grsec_lock;
 903 +
 904 +#endif
 905 +
 906 +#endif
 907 diff -urNp linux-2.6.26.orig/include/linux/grsecurity.h linux-2.6.26/include/linux/grsecurity.h
 908 --- linux-2.6.26.orig/include/linux/grsecurity.h        1970-01-01 01:00:00.000000000 +0100
 909 +++ linux-2.6.26/include/linux/grsecurity.h     2008-09-02 12:17:21.000000000 +0200
 910 @@ -0,0 +1,18 @@
 911 +#ifndef GR_SECURITY_H
 912 +#define GR_SECURITY_H
 913 +#include <linux/fs.h>
 914 +#include <linux/binfmts.h>
 915 +
 916 +void gr_del_task_from_ip_table(struct task_struct *p);
 917 +
 918 +int gr_handle_follow_link(const struct inode *parent,
 919 +                                const struct inode *inode,
 920 +                                const struct dentry *dentry);
 921 +int gr_handle_fifo(const struct dentry *dentry,
 922 +                         const struct dentry *dir, const int flag,
 923 +                         const int acc_mode);
 924 +int gr_handle_hardlink(const struct dentry *dentry,
 925 +                             struct inode *inode,
 926 +                             const int mode, const char *to);
 927 +
 928 +#endif
 929 diff -urNp linux-2.6.26.orig/include/linux/sched.h linux-2.6.26/include/linux/sched.h
 930 --- linux-2.6.26.orig/include/linux/sched.h     2008-09-01 11:43:34.000000000 +0200
 931 +++ linux-2.6.26/include/linux/sched.h  2008-09-02 12:17:21.000000000 +0200
 932 @@ -544,6 +544,15 @@ struct signal_struct {
 933         unsigned audit_tty;
 934         struct tty_audit_buf *tty_audit_buf;
 935  #endif
 936 +
 937 +#ifdef CONFIG_GRKERNSEC
 938 +       u32 curr_ip;
 939 +       u32 gr_saddr;
 940 +       u32 gr_daddr;
 941 +       u16 gr_sport;
 942 +       u16 gr_dport;
 943 +       u8 used_accept:1;
 944 +#endif
 945  };
 946
 947  /* Context switch must be unlocked if interrupts are to be enabled */
 948 diff -urNp linux-2.6.26.orig/include/linux/sysctl.h linux-2.6.26/include/linux/sysctl.h
 949 --- linux-2.6.26.orig/include/linux/sysctl.h    2008-09-01 11:43:34.000000000 +0200
 950 +++ linux-2.6.26/include/linux/sysctl.h 2008-09-02 12:17:21.000000000 +0200
 951 @@ -165,8 +165,11 @@ enum
 952         KERN_MAX_LOCK_DEPTH=74,
 953         KERN_NMI_WATCHDOG=75, /* int: enable/disable nmi watchdog */
 954         KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
 955 -};
 956 +#ifdef CONFIG_GRKERNSEC
 957 +       KERN_GRSECURITY=98,     /* grsecurity */
 958 +#endif
 959
 960 +};
 961
 962
 963  /* CTL_VM names: */
 964 diff -urNp linux-2.6.26.orig/kernel/configs.c linux-2.6.26/kernel/configs.c
 965 --- linux-2.6.26.orig/kernel/configs.c  2008-09-01 11:43:58.000000000 +0200
 966 +++ linux-2.6.26/kernel/configs.c       2008-09-02 12:17:21.000000000 +0200
 967 @@ -79,8 +79,19 @@ static int __init ikconfig_init(void)
 968         struct proc_dir_entry *entry;
 969
 970         /* create the current config file */
 971 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 972 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 973 +       entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
 974 +                           &ikconfig_file_ops);
 975 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 976 +       entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
 977 +                           &ikconfig_file_ops);
 978 +#endif
 979 +#else
 980         entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
 981                             &ikconfig_file_ops);
 982 +#endif
 983 +
 984         if (!entry)
 985                 return -ENOMEM;
 986
 987 diff -urNp linux-2.6.26.orig/kernel/exit.c linux-2.6.26/kernel/exit.c
 988 --- linux-2.6.26.orig/kernel/exit.c     2008-09-01 11:43:58.000000000 +0200
 989 +++ linux-2.6.26/kernel/exit.c  2008-09-02 12:17:21.000000000 +0200
 990 @@ -50,6 +50,7 @@
 991  #include <linux/vs_pid.h>
 992  #include <linux/vserver/global.h>
 993  #include <trace/sched.h>
 994 +#include <linux/grsecurity.h>
 995
 996  #include <asm/uaccess.h>
 997  #include <asm/unistd.h>
 998 @@ -137,6 +138,7 @@ static void __exit_signal(struct task_st
 999          */
1000         flush_sigqueue(&tsk->pending);
1001
1002 +       gr_del_task_from_ip_table(tsk);
1003         tsk->signal = NULL;
1004         tsk->sighand = NULL;
1005         spin_unlock(&sighand->siglock);
1006 diff -urNp linux-2.6.26.orig/kernel/kallsyms.c linux-2.6.26/kernel/kallsyms.c
1007 --- linux-2.6.26.orig/kernel/kallsyms.c 2008-09-01 11:43:58.000000000 +0200
1008 +++ linux-2.6.26/kernel/kallsyms.c      2008-09-02 12:17:21.000000000 +0200
1009 @@ -472,7 +472,15 @@ static const struct file_operations kall
1010
1011  static int __init kallsyms_init(void)
1012  {
1013 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
1014 +#ifdef CONFIG_GRKERNSEC_PROC_USER
1015 +       proc_create("kallsyms", S_IFREG | S_IRUSR, NULL, &kallsyms_operations);
1016 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1017 +       proc_create("kallsyms", S_IFREG | S_IRUSR | S_IRGRP, NULL, &kallsyms_operations);
1018 +#endif
1019 +#else
1020         proc_create("kallsyms", 0444, NULL, &kallsyms_operations);
1021 +#endif
1022         return 0;
1023  }
1024  __initcall(kallsyms_init);
1025 diff -urNp linux-2.6.26.orig/kernel/resource.c linux-2.6.26/kernel/resource.c
1026 --- linux-2.6.26.orig/kernel/resource.c 2008-09-01 11:43:58.000000000 +0200
1027 +++ linux-2.6.26/kernel/resource.c      2008-09-02 12:17:21.000000000 +0200
1028 @@ -131,8 +131,18 @@ static const struct file_operations proc
1029
1030  static int __init ioresources_init(void)
1031  {
1032 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
1033 +#ifdef CONFIG_GRKERNSEC_PROC_USER
1034 +       proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
1035 +       proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
1036 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1037 +       proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
1038 +       proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
1039 +#endif
1040 +#else
1041         proc_create("ioports", 0, NULL, &proc_ioports_operations);
1042         proc_create("iomem", 0, NULL, &proc_iomem_operations);
1043 +#endif
1044         return 0;
1045  }
1046  __initcall(ioresources_init);
1047 diff -urNp linux-2.6.26.orig/kernel/sysctl.c linux-2.6.26/kernel/sysctl.c
1048 --- linux-2.6.26.orig/kernel/sysctl.c   2008-09-01 11:43:58.000000000 +0200
1049 +++ linux-2.6.26/kernel/sysctl.c        2008-09-02 12:17:21.000000000 +0200
1050 @@ -59,6 +59,11 @@
1051  static int deprecated_sysctl_warning(struct __sysctl_args *args);
1052
1053  #if defined(CONFIG_SYSCTL)
1054 +#include <linux/grsecurity.h>
1055 +#include <linux/grinternal.h>
1056 +
1057 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
1058 +                               const int op);
1059
1060  /* External variables not in a header file. */
1061  extern int C_A_D;
1062 @@ -153,6 +158,7 @@ static int proc_do_cad_pid(struct ctl_ta
1063  static int proc_dointvec_taint(struct ctl_table *table, int write, struct file *filp,
1064                                void __user *buffer, size_t *lenp, loff_t *ppos);
1065  #endif
1066 +extern ctl_table grsecurity_table[];
1067
1068  static struct ctl_table root_table[];
1069  static struct ctl_table_root sysctl_table_root;
1070 @@ -823,6 +829,15 @@ static struct ctl_table kern_table[] = {
1071                 .child          = key_sysctls,
1072         },
1073  #endif
1074 +
1075 +#if defined(CONFIG_GRKERNSEC_SYSCTL)
1076 +       {
1077 +               .ctl_name       = CTL_UNNUMBERED,
1078 +               .procname       = "grsecurity",
1079 +               .mode           = 0500,
1080 +               .child          = grsecurity_table,
1081 +       },
1082 +#endif
1083  /*
1084   * NOTE: do not add new entries to this table unless you have read
1085   * Documentation/sysctl/ctl_unnumbered.txt
1086 @@ -1585,6 +1600,10 @@ int sysctl_perm(struct ctl_table_root *r
1087         int error;
1088         int mode;
1089
1090 +       if (table->parent != NULL && table->parent->procname != NULL &&
1091 +           table->procname != NULL &&
1092 +           gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
1093 +               return -EACCES;
1094         error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
1095         if (error)
1096                 return error;
1097 diff -urNp linux-2.6.26.orig/Makefile linux-2.6.26/Makefile
1098 --- linux-2.6.26.orig/Makefile  2008-09-01 11:44:01.000000000 +0200
1099 +++ linux-2.6.26/Makefile       2008-09-02 12:17:21.000000000 +0200
1100 @@ -607,7 +607,7 @@ export mod_strip_cmd
1101
1102
1103  ifeq ($(KBUILD_EXTMOD),)
1104 -core-y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
1105 +core-y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
1106
1107  vmlinux-dirs   := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
1108                      $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
1109 diff -urNp linux-2.6.26.orig/net/ipv4/inet_hashtables.c linux-2.6.26/net/ipv4/inet_hashtables.c
1110 --- linux-2.6.26.orig/net/ipv4/inet_hashtables.c        2008-09-01 11:43:37.000000000 +0200
1111 +++ linux-2.6.26/net/ipv4/inet_hashtables.c     2008-09-02 12:17:21.000000000 +0200
1112 @@ -18,12 +18,15 @@
1113  #include <linux/sched.h>
1114  #include <linux/slab.h>
1115  #include <linux/wait.h>
1116 +#include <linux/grsecurity.h>
1117
1118  #include <net/inet_connection_sock.h>
1119  #include <net/inet_hashtables.h>
1120  #include <net/route.h>
1121  #include <net/ip.h>
1122
1123 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
1124 +
1125  /*
1126   * Allocate and initialize a new local port bind bucket.
1127   * The bindhash mutex for snum's hash chain must be held here.
1128 @@ -484,6 +487,8 @@ ok:
1129                 }
1130                 spin_unlock(&head->lock);
1131
1132 +               gr_update_task_in_ip_table(current, inet_sk(sk));
1133 +
1134                 if (tw) {
1135                         inet_twsk_deschedule(tw, death_row);
1136                         inet_twsk_put(tw);
1137 diff -urNp linux-2.6.26.orig/net/socket.c linux-2.6.26/net/socket.c
1138 --- linux-2.6.26.orig/net/socket.c      2008-09-01 11:43:36.000000000 +0200
1139 +++ linux-2.6.26/net/socket.c   2008-09-02 12:17:21.000000000 +0200
1140 @@ -85,6 +85,7 @@
1141  #include <linux/audit.h>
1142  #include <linux/wireless.h>
1143  #include <linux/nsproxy.h>
1144 +#include <linux/in.h>
1145
1146  #include <asm/uaccess.h>
1147  #include <asm/unistd.h>
1148 @@ -98,6 +99,8 @@
1149  #include <linux/vs_inet.h>
1150  #include <linux/vs_inet6.h>
1151
1152 +extern void gr_attach_curr_ip(const struct sock *sk);
1153 +
1154  static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
1155  static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
1156                          unsigned long nr_segs, loff_t pos);
1157 @@ -1577,6 +1577,8 @@
1158         fd_install(newfd, newfile);
1159         err = newfd;
1160
1161 +       gr_attach_curr_ip(newsock->sk);
1162 +
1163  out_put:
1164         fput_light(sock->file, fput_needed);
1165  out:
1166 diff -urNp linux-2.6.26.orig/security/Kconfig linux-2.6.26/security/Kconfig
1167 --- linux-2.6.26.orig/security/Kconfig  2008-09-01 11:43:58.000000000 +0200
1168 +++ linux-2.6.26/security/Kconfig       2008-09-02 12:17:21.000000000 +0200
1169 @@ -4,6 +4,8 @@
1170
1171  menu "Security options"
1172
1173 +source grsecurity/Kconfig
1174 +
1175  config KEYS
1176         bool "Enable access key retention support"
1177         help