kernel-grsec-minimal.patch

   1 diff -urNp linux-2.6.26.orig/arch/sparc/Makefile linux-2.6.26/arch/sparc/Makefile
   2 --- linux-2.6.26.orig/arch/sparc/Makefile       2008-09-01 11:44:21.000000000 +0200
   3 +++ linux-2.6.26/arch/sparc/Makefile    2008-09-02 12:17:21.000000000 +0200
   4 @@ -36,7 +36,7 @@ drivers-$(CONFIG_OPROFILE)    += arch/sparc
   5  # Renaming is done to avoid confusing pattern matching rules in 2.5.45 (multy-)
   6  INIT_Y         := $(patsubst %/, %/built-in.o, $(init-y))
   7  CORE_Y         := $(core-y)
   8 -CORE_Y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
   9 +CORE_Y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
  10  CORE_Y         := $(patsubst %/, %/built-in.o, $(CORE_Y))
  11  DRIVERS_Y      := $(patsubst %/, %/built-in.o, $(drivers-y))
  12  NET_Y          := $(patsubst %/, %/built-in.o, $(net-y))
  13 diff -urNp linux-2.6.26.orig/drivers/char/keyboard.c linux-2.6.26/drivers/char/keyboard.c
  14 --- linux-2.6.26.orig/drivers/char/keyboard.c   2008-09-01 11:43:37.000000000 +0200
  15 +++ linux-2.6.26/drivers/char/keyboard.c        2008-09-02 12:17:21.000000000 +0200
  16 @@ -633,6 +633,16 @@ static void k_spec(struct vc_data *vc, u
  17              kbd->kbdmode == VC_MEDIUMRAW) &&
  18              value != KVAL(K_SAK))
  19                 return;         /* SAK is allowed even in raw mode */
  20 +
  21 +#if defined(CONFIG_GRKERNSEC_PROC)
  22 +       {
  23 +               void *func = fn_handler[value];
  24 +               if (func == fn_show_state || func == fn_show_ptregs ||
  25 +                   func == fn_show_mem)
  26 +                       return;
  27 +       }
  28 +#endif
  29 +
  30         fn_handler[value](vc);
  31  }
  32
  33 diff -urNp linux-2.6.26.orig/drivers/pci/proc.c linux-2.6.26/drivers/pci/proc.c
  34 --- linux-2.6.26.orig/drivers/pci/proc.c        2008-09-01 11:43:47.000000000 +0200
  35 +++ linux-2.6.26/drivers/pci/proc.c     2008-09-02 12:17:21.000000000 +0200
  36 @@ -472,7 +472,16 @@ static const struct file_operations proc
  37  static int __init pci_proc_init(void)
  38  {
  39         struct pci_dev *dev = NULL;
  40 +
  41 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
  42 +#ifdef CONFIG_GRKERNSEC_PROC_USER
  43 +       proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
  44 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
  45 +       proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
  46 +#endif
  47 +#else
  48         proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
  49 +#endif
  50         proc_create("devices", 0, proc_bus_pci_dir,
  51                     &proc_bus_pci_dev_operations);
  52         proc_initialized = 1;
  53 diff -urNp linux-2.6.26.orig/fs/Kconfig linux-2.6.26/fs/Kconfig
  54 --- linux-2.6.26.orig/fs/proc/Kconfig   2008-09-01 11:43:58.000000000 +0200
  55 +++ linux-2.6.26/fs/proc/Kconfig        2008-09-02 12:17:21.000000000 +0200
  56 @@ -926,12 +926,12 @@ config PROC_FS
  57
  58  config PROC_KCORE
  59         bool "/proc/kcore support" if !ARM
  60 -       depends on PROC_FS && MMU
  61 +       depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
  62
  63  config PROC_VMCORE
  64          bool "/proc/vmcore support (EXPERIMENTAL)"
  65 -        depends on PROC_FS && CRASH_DUMP
  66 -       default y
  67 +        depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
  68 +       default n
  69          help
  70          Exports the dump image of crashed kernel in ELF format.
  71
  72 diff -urNp linux-2.6.26.orig/fs/namei.c linux-2.6.26/fs/namei.c
  73 --- linux-2.6.26.orig/fs/namei.c        2008-09-01 11:43:59.000000000 +0200
  74 +++ linux-2.6.26/fs/namei.c     2008-09-02 12:17:21.000000000 +0200
  75 @@ -38,6 +38,7 @@
  76  #include <linux/vs_cowbl.h>
  77  #include <linux/vs_device.h>
  78  #include <linux/vs_context.h>
  79 +#include <linux/grsecurity.h>
  80  #include <linux/pid_namespace.h>
  81  #include <asm/uaccess.h>
  82
  83 @@ -740,6 +741,13 @@ static inline int do_follow_link(struct
  84         err = security_inode_follow_link(path->dentry, nd);
  85         if (err)
  86                 goto loop;
  87 +
  88 +       if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
  89 +                                 path->dentry->d_inode, path->dentry)) {
  90 +               err = -EACCES;
  91 +               goto loop;
  92 +       }
  93 +
  94         current->link_count++;
  95         current->total_link_count++;
  96         nd->depth++;
  97 @@ -1925,6 +1933,12 @@ do_last:
  98         /*
  99          * It already exists.
 100          */
 101 +
 102 +       if (gr_handle_fifo(path.dentry, dir, flag, acc_mode)) {
 103 +               error = -EACCES;
 104 +               goto exit_mutex_unlock;
 105 +       }
 106 +
 107         mutex_unlock(&dir->d_inode->i_mutex);
 108         audit_inode(pathname, path.dentry);
 109
 110 @@ -2028,6 +2042,13 @@ do_link:
 111         error = security_inode_follow_link(path.dentry, &nd);
 112         if (error)
 113                 goto exit_dput;
 114 +
 115 +       if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
 116 +                                 path.dentry)) {
 117 +               error = -EACCES;
 118 +               goto exit_dput;
 119 +       }
 120 +
 121         error = __do_follow_link(&path, &nd);
 122         if (error) {
 123                 /* Does someone understand code flow here? Or it is only
 124 @@ -2669,6 +2690,13 @@ asmlinkage long sys_linkat(int olddfd, c
 125         error = PTR_ERR(new_dentry);
 126         if (IS_ERR(new_dentry))
 127                 goto out_unlock;
 128 +
 129 +       if (gr_handle_hardlink(old_path.dentry, old_path.dentry->d_inode,
 130 +                              old_path.dentry->d_inode->i_mode, to)) {
 131 +               error = -EACCES;
 132 +               goto out_dput;
 133 +       }
 134 +
 135         error = mnt_want_write(nd.path.mnt);
 136         if (error)
 137                 goto out_dput;
 138 diff -urNp linux-2.6.26.orig/fs/proc/array.c linux-2.6.26/fs/proc/array.c
 139 --- linux-2.6.26.orig/fs/proc/array.c   2008-09-01 11:43:59.000000000 +0200
 140 +++ linux-2.6.26/fs/proc/array.c        2008-09-02 12:17:21.000000000 +0200
 141 @@ -639,3 +639,10 @@ int proc_pid_statm(struct seq_file *m, s
 142
 143         return 0;
 144  }
 145 +
 146 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 147 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
 148 +{
 149 +       return sprintf(buffer, "%u.%u.%u.%u\n", NIPQUAD(task->signal->curr_ip));
 150 +}
 151 +#endif
 152 diff -urNp linux-2.6.26.orig/fs/proc/base.c linux-2.6.26/fs/proc/base.c
 153 --- linux-2.6.26.orig/fs/proc/base.c    2008-09-01 11:43:59.000000000 +0200
 154 +++ linux-2.6.26/fs/proc/base.c 2008-09-02 12:23:45.000000000 +0200
 155 @@ -79,6 +79,8 @@
 156  #include <linux/pid_namespace.h>
 157  #include <linux/vs_context.h>
 158  #include <linux/vs_network.h>
 159 +#include <linux/grsecurity.h>
 160 +
 161  #include "internal.h"
 162
 163  /* NOTE:
 164 @@ -307,9 +312,9 @@ static int proc_pid_auxv(struct task_str
 165         struct mm_struct *mm = get_task_mm(task);
 166         if (mm) {
 167                 unsigned int nwords = 0;
 168 -               do
 169 +               do {
 170                         nwords += 2;
 171 -               while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
 172 +               } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
 173                 res = nwords * sizeof(mm->saved_auxv[0]);
 174                 if (res > PAGE_SIZE)
 175                         res = PAGE_SIZE;
 176 @@ -1412,7 +1417,11 @@ static struct inode *proc_pid_make_inode
 177         inode->i_gid = 0;
 178         if (task_dumpable(task)) {
 179                 inode->i_uid = task->euid;
 180 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 181 +               inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
 182 +#else
 183                 inode->i_gid = task->egid;
 184 +#endif
 185         }
 186         /* procfs is xid tagged */
 187         inode->i_tag = (tag_t)vx_task_xid(task);
 188 @@ -1430,17 +1439,39 @@ static int pid_getattr(struct vfsmount *
 189  {
 190         struct inode *inode = dentry->d_inode;
 191         struct task_struct *task;
 192 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 193 +       struct task_struct *tmp = current;
 194 +#endif
 195 +
 196         generic_fillattr(inode, stat);
 197
 198         rcu_read_lock();
 199         stat->uid = 0;
 200         stat->gid = 0;
 201         task = pid_task(proc_pid(inode), PIDTYPE_PID);
 202 -       if (task) {
 203 +
 204 +       if (task
 205 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 206 +           && (!tmp->uid || (tmp->uid == task->uid)
 207 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 208 +           || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
 209 +#endif
 210 +           )
 211 +#endif
 212 +       ) {
 213                 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
 214 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 215 +                   (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
 216 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 217 +                   (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
 218 +#endif
 219                     task_dumpable(task)) {
 220                         stat->uid = task->euid;
 221 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 222 +                       stat->gid = CONFIG_GRKERNSEC_PROC_GID;
 223 +#else
 224                         stat->gid = task->egid;
 225 +#endif
 226                 }
 227         }
 228         rcu_read_unlock();
 229 @@ -1468,11 +1505,21 @@ static int pid_revalidate(struct dentry
 230  {
 231         struct inode *inode = dentry->d_inode;
 232         struct task_struct *task = get_proc_task(inode);
 233 +
 234         if (task) {
 235                 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
 236 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 237 +                   (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
 238 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 239 +                   (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
 240 +#endif
 241                     task_dumpable(task)) {
 242                         inode->i_uid = task->euid;
 243 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 244 +                       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
 245 +#else
 246                         inode->i_gid = task->egid;
 247 +#endif
 248                 } else {
 249                         inode->i_uid = 0;
 250                         inode->i_gid = 0;
 251 @@ -1841,12 +1888,19 @@ static int proc_fd_permission(struct ino
 252                                 struct nameidata *nd)
 253  {
 254         int rv;
 255 +       struct task_struct *task;
 256
 257         rv = generic_permission(inode, mask, NULL);
 258 -       if (rv == 0)
 259 -               return 0;
 260 +
 261         if (task_pid(current) == proc_pid(inode))
 262                 rv = 0;
 263 +
 264 +       task = get_proc_task(inode);
 265 +       if (task == NULL)
 266 +               return rv;
 267 +
 268 +       put_task_struct(task);
 269 +
 270         return rv;
 271  }
 272
 273 @@ -2617,7 +2683,14 @@ static struct dentry *proc_pid_instantia
 274         if (!inode)
 275                 goto out;
 276
 277 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 278 +       inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
 279 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 280 +       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
 281 +       inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
 282 +#else
 283         inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
 284 +#endif
 285         inode->i_op = &proc_tgid_base_inode_operations;
 286         inode->i_fop = &proc_tgid_base_operations;
 287         inode->i_flags|=S_IMMUTABLE;
 288 @@ -2724,6 +2801,9 @@ int proc_pid_readdir(struct file * filp,
 289  {
 290         unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
 291         struct task_struct *reaper = get_proc_task_real(filp->f_path.dentry->d_inode);
 292 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 293 +       struct task_struct *tmp = current;
 294 +#endif
 295         struct tgid_iter iter;
 296         struct pid_namespace *ns;
 297
 298 @@ -2742,6 +2822,15 @@ int proc_pid_readdir(struct file * filp,
 299         for (iter = next_tgid(ns, iter);
 300              iter.task;
 301              iter.tgid += 1, iter = next_tgid(ns, iter)) {
 302 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 303 +               if (tmp->uid && (iter.task->uid != tmp->uid)
 304 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 305 +                       && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
 306 +#endif
 307 +               )
 308 +#endif
 309 +                       continue;
 310 +
 311                 filp->f_pos = iter.tgid + TGID_OFFSET;
 312                 if (!vx_proc_task_visible(iter.task))
 313                         continue;
 314 @@ -2815,6 +2906,9 @@ static const struct pid_entry tid_base_s
 315  #ifdef CONFIG_FAULT_INJECTION
 316         REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
 317  #endif
 318 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 319 +       INF("ipaddr",     S_IRUSR, pid_ipaddr),
 320 +#endif
 321  };
 322
 323  static int proc_tid_base_readdir(struct file * filp,
 324 diff -urNp linux-2.6.26.orig/fs/proc/inode.c linux-2.6.26/fs/proc/inode.c
 325 --- linux-2.6.26.orig/fs/proc/inode.c   2008-09-01 11:43:59.000000000 +0200
 326 +++ linux-2.6.26/fs/proc/inode.c        2008-09-02 12:17:21.000000000 +0200
 327 @@ -403,7 +403,11 @@ struct inode *proc_get_inode(struct supe
 328                 if (de->mode) {
 329                         inode->i_mode = de->mode;
 330                         inode->i_uid = de->uid;
 331 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
 332 +                       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
 333 +#else
 334                         inode->i_gid = de->gid;
 335 +#endif
 336                 }
 337                 if (de->vx_flags)
 338                         PROC_I(inode)->vx_flags = de->vx_flags;
 339 diff -urNp linux-2.6.26.orig/fs/proc/internal.h linux-2.6.26/fs/proc/internal.h
 340 --- linux-2.6.26.orig/fs/proc/internal.h        2008-09-01 11:43:59.000000000 +0200
 341 +++ linux-2.6.26/fs/proc/internal.h     2008-09-02 12:17:21.000000000 +0200
 342 @@ -58,6 +58,9 @@ extern int proc_pid_statm(struct seq_fil
 343                                 struct pid *pid, struct task_struct *task);
 344  extern int proc_pid_nsproxy(struct seq_file *m, struct pid_namespace *ns,
 345                                 struct pid *pid, struct task_struct *task);
 346 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 347 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
 348 +#endif
 349
 350  extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
 351
 352 --- linux-2.6.26.orig/fs/proc/cmdline.c 2008-12-25 00:26:37.000000000 +0100
 353 +++ linux-2.6.26/fs/proc/cmdline.c      2009-01-02 17:46:34.278247774 +0100
 354 @@ -23,7 +23,15 @@
 355
 356  static int __init proc_cmdline_init(void)
 357  {
 358 -       proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
 359 +       int gr_mode = 0;
 360 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 361 +       gr_mode = S_IRUSR;
 362 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 363 +       gr_mode = S_IRUSR | S_IRGRP;
 364 +#endif
 365 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 366 +       proc_create("cmdline", gr_mode, NULL, &cmdline_proc_fops);
 367 +#endif
 368         return 0;
 369  }
 370  module_init(proc_cmdline_init);
 371 --- linux-2.6.26.orig/fs/proc/devices.c 2008-12-25 00:26:37.000000000 +0100
 372 +++ linux-2.6.26/fs/proc/devices.c      2009-01-02 17:43:00.758269666 +0100
 373 @@ -64,7 +64,13 @@
 374
 375  static int __init proc_devices_init(void)
 376  {
 377 -       proc_create("devices", 0, NULL, &proc_devinfo_operations);
 378 +       int gr_mode = 0;
 379 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 380 +       gr_mode = S_IRUSR;
 381 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 382 +       gr_mode = S_IRUSR | S_IRGRP;
 383 +#endif
 384 +       proc_create("devices", gr_mode, NULL, &proc_devinfo_operations);
 385         return 0;
 386  }
 387  module_init(proc_devices_init);
 388 --- linux-2.6.26.orig/fs/proc/kcore.c   2008-12-25 00:26:37.000000000 +0100
 389 +++ linux-2.6.26/fs/proc/kcore.c        2009-01-02 17:45:03.714922801 +0100
 390 @@ -404,10 +404,12 @@
 391
 392  static int __init proc_kcore_init(void)
 393  {
 394 +#if defined(CONFIG_PROC_KCORE) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
 395         proc_root_kcore = proc_create("kcore", S_IRUSR, NULL, &proc_kcore_operations);
 396         if (proc_root_kcore)
 397                 proc_root_kcore->size =
 398                                 (size_t)high_memory - PAGE_OFFSET + PAGE_SIZE;
 399 +#endif
 400         return 0;
 401  }
 402  module_init(proc_kcore_init);
 403 diff -urNp linux-2.6.26.orig/fs/proc/root.c linux-2.6.26/fs/proc/root.c
 404 --- linux-2.6.26.orig/fs/proc/root.c    2008-09-01 11:43:59.000000000 +0200
 405 +++ linux-2.6.26/fs/proc/root.c 2008-09-02 12:17:21.000000000 +0200
 406 @@ -139,7 +139,15 @@ void __init proc_root_init(void)
 407  #ifdef CONFIG_PROC_DEVICETREE
 408         proc_device_tree_init();
 409  #endif
 410 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 411 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 412 +       proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
 413 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 414 +       proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
 415 +#endif
 416 +#else
 417         proc_mkdir("bus", NULL);
 418 +#endif
 419         proc_sys_init();
 420         proc_vx_init();
 421  }
 422 diff -urNp linux-2.6.26.orig/grsecurity/grsec_disabled.c linux-2.6.26/grsecurity/grsec_disabled.c
 423 --- linux-2.6.26.orig/grsecurity/grsec_disabled.c       1970-01-01 01:00:00.000000000 +0100
 424 +++ linux-2.6.26/grsecurity/grsec_disabled.c    2008-09-02 12:17:21.000000000 +0200
 425 @@ -0,0 +1,6 @@
 426 +void
 427 +grsecurity_init(void)
 428 +{
 429 +       return;
 430 +}
 431 +
 432 diff -urNp linux-2.6.26.orig/grsecurity/grsec_fifo.c linux-2.6.26/grsecurity/grsec_fifo.c
 433 --- linux-2.6.26.orig/grsecurity/grsec_fifo.c   1970-01-01 01:00:00.000000000 +0100
 434 +++ linux-2.6.26/grsecurity/grsec_fifo.c        2008-09-02 12:17:21.000000000 +0200
 435 @@ -0,0 +1,20 @@
 436 +#include <linux/kernel.h>
 437 +#include <linux/sched.h>
 438 +#include <linux/fs.h>
 439 +#include <linux/file.h>
 440 +#include <linux/grinternal.h>
 441 +
 442 +int
 443 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
 444 +              const struct dentry *dir, const int flag, const int acc_mode)
 445 +{
 446 +#ifdef CONFIG_GRKERNSEC_FIFO
 447 +       if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
 448 +           !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
 449 +           (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
 450 +           (current->fsuid != dentry->d_inode->i_uid)) {
 451 +               return -EACCES;
 452 +       }
 453 +#endif
 454 +       return 0;
 455 +}
 456 diff -urNp linux-2.6.26.orig/grsecurity/grsec_init.c linux-2.6.26/grsecurity/grsec_init.c
 457 --- linux-2.6.26.orig/grsecurity/grsec_init.c   1970-01-01 01:00:00.000000000 +0100
 458 +++ linux-2.6.26/grsecurity/grsec_init.c        2008-09-02 12:17:21.000000000 +0200
 459 @@ -0,0 +1,29 @@
 460 +#include <linux/kernel.h>
 461 +#include <linux/sched.h>
 462 +#include <linux/mm.h>
 463 +#include <linux/smp_lock.h>
 464 +#include <linux/slab.h>
 465 +#include <linux/vmalloc.h>
 466 +#include <linux/percpu.h>
 467 +
 468 +int grsec_enable_link;
 469 +int grsec_enable_fifo;
 470 +int grsec_lock;
 471 +
 472 +void
 473 +grsecurity_init(void)
 474 +{
 475 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
 476 +#ifndef CONFIG_GRKERNSEC_SYSCTL
 477 +       grsec_lock = 1;
 478 +#endif
 479 +#ifdef CONFIG_GRKERNSEC_LINK
 480 +       grsec_enable_link = 1;
 481 +#endif
 482 +#ifdef CONFIG_GRKERNSEC_FIFO
 483 +       grsec_enable_fifo = 1;
 484 +#endif
 485 +#endif
 486 +
 487 +       return;
 488 +}
 489 diff -urNp linux-2.6.26.orig/grsecurity/grsec_link.c linux-2.6.26/grsecurity/grsec_link.c
 490 --- linux-2.6.26.orig/grsecurity/grsec_link.c   1970-01-01 01:00:00.000000000 +0100
 491 +++ linux-2.6.26/grsecurity/grsec_link.c        2008-09-02 12:17:21.000000000 +0200
 492 @@ -0,0 +1,37 @@
 493 +#include <linux/kernel.h>
 494 +#include <linux/sched.h>
 495 +#include <linux/fs.h>
 496 +#include <linux/file.h>
 497 +#include <linux/grinternal.h>
 498 +
 499 +int
 500 +gr_handle_follow_link(const struct inode *parent,
 501 +                     const struct inode *inode,
 502 +                     const struct dentry *dentry, const struct vfsmount *mnt)
 503 +{
 504 +#ifdef CONFIG_GRKERNSEC_LINK
 505 +       if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
 506 +           (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
 507 +           (parent->i_mode & S_IWOTH) && (current->fsuid != inode->i_uid)) {
 508 +               return -EACCES;
 509 +       }
 510 +#endif
 511 +       return 0;
 512 +}
 513 +
 514 +int
 515 +gr_handle_hardlink(const struct dentry *dentry,
 516 +                  const struct vfsmount *mnt,
 517 +                  struct inode *inode, const int mode, const char *to)
 518 +{
 519 +#ifdef CONFIG_GRKERNSEC_LINK
 520 +       if (grsec_enable_link && current->fsuid != inode->i_uid &&
 521 +           (!S_ISREG(mode) || (mode & S_ISUID) ||
 522 +            ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
 523 +            (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
 524 +           !capable(CAP_FOWNER) && current->uid) {
 525 +               return -EPERM;
 526 +       }
 527 +#endif
 528 +       return 0;
 529 +}
 530 diff -urNp linux-2.6.26.orig/grsecurity/grsec_sock.c linux-2.6.26/grsecurity/grsec_sock.c
 531 --- linux-2.6.26.orig/grsecurity/grsec_sock.c   1970-01-01 01:00:00.000000000 +0100
 532 +++ linux-2.6.26/grsecurity/grsec_sock.c        2008-09-02 12:17:21.000000000 +0200
 533 @@ -0,0 +1,170 @@
 534 +#include <linux/kernel.h>
 535 +#include <linux/module.h>
 536 +#include <linux/sched.h>
 537 +#include <linux/file.h>
 538 +#include <linux/net.h>
 539 +#include <linux/in.h>
 540 +#include <linux/ip.h>
 541 +#include <net/sock.h>
 542 +#include <net/inet_sock.h>
 543 +#include <linux/grsecurity.h>
 544 +#include <linux/grinternal.h>
 545 +
 546 +#ifdef CONFIG_GRKERNSEC
 547 +#define gr_conn_table_size 32749
 548 +struct conn_table_entry {
 549 +       struct conn_table_entry *next;
 550 +       struct signal_struct *sig;
 551 +};
 552 +
 553 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
 554 +spinlock_t gr_conn_table_lock = SPIN_LOCK_UNLOCKED;
 555 +
 556 +extern const char * gr_socktype_to_name(unsigned char type);
 557 +extern const char * gr_proto_to_name(unsigned char proto);
 558 +
 559 +static __inline__ int
 560 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
 561 +{
 562 +       return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
 563 +}
 564 +
 565 +static __inline__ int
 566 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
 567 +          __u16 sport, __u16 dport)
 568 +{
 569 +       if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
 570 +                    sig->gr_sport == sport && sig->gr_dport == dport))
 571 +               return 1;
 572 +       else
 573 +               return 0;
 574 +}
 575 +
 576 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
 577 +{
 578 +       struct conn_table_entry **match;
 579 +       unsigned int index;
 580 +
 581 +       index = conn_hash(sig->gr_saddr, sig->gr_daddr,
 582 +                         sig->gr_sport, sig->gr_dport,
 583 +                         gr_conn_table_size);
 584 +
 585 +       newent->sig = sig;
 586 +
 587 +       match = &gr_conn_table[index];
 588 +       newent->next = *match;
 589 +       *match = newent;
 590 +
 591 +       return;
 592 +}
 593 +
 594 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
 595 +{
 596 +       struct conn_table_entry *match, *last = NULL;
 597 +       unsigned int index;
 598 +
 599 +       index = conn_hash(sig->gr_saddr, sig->gr_daddr,
 600 +                         sig->gr_sport, sig->gr_dport,
 601 +                         gr_conn_table_size);
 602 +
 603 +       match = gr_conn_table[index];
 604 +       while (match && !conn_match(match->sig,
 605 +               sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
 606 +               sig->gr_dport)) {
 607 +               last = match;
 608 +               match = match->next;
 609 +       }
 610 +
 611 +       if (match) {
 612 +               if (last)
 613 +                       last->next = match->next;
 614 +               else
 615 +                       gr_conn_table[index] = NULL;
 616 +               kfree(match);
 617 +       }
 618 +
 619 +       return;
 620 +}
 621 +
 622 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
 623 +                                            __u16 sport, __u16 dport)
 624 +{
 625 +       struct conn_table_entry *match;
 626 +       unsigned int index;
 627 +
 628 +       index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
 629 +
 630 +       match = gr_conn_table[index];
 631 +       while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
 632 +               match = match->next;
 633 +
 634 +       if (match)
 635 +               return match->sig;
 636 +       else
 637 +               return NULL;
 638 +}
 639 +
 640 +#endif
 641 +
 642 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
 643 +{
 644 +#ifdef CONFIG_GRKERNSEC
 645 +       struct signal_struct *sig = task->signal;
 646 +       struct conn_table_entry *newent;
 647 +
 648 +       newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
 649 +       if (newent == NULL)
 650 +               return;
 651 +       /* no bh lock needed since we are called with bh disabled */
 652 +       spin_lock(&gr_conn_table_lock);
 653 +       gr_del_task_from_ip_table_nolock(sig);
 654 +       sig->gr_saddr = inet->rcv_saddr;
 655 +       sig->gr_daddr = inet->daddr;
 656 +       sig->gr_sport = inet->sport;
 657 +       sig->gr_dport = inet->dport;
 658 +       gr_add_to_task_ip_table_nolock(sig, newent);
 659 +       spin_unlock(&gr_conn_table_lock);
 660 +#endif
 661 +       return;
 662 +}
 663 +
 664 +void gr_del_task_from_ip_table(struct task_struct *task)
 665 +{
 666 +#ifdef CONFIG_GRKERNSEC
 667 +       spin_lock(&gr_conn_table_lock);
 668 +       gr_del_task_from_ip_table_nolock(task->signal);
 669 +       spin_unlock(&gr_conn_table_lock);
 670 +#endif
 671 +       return;
 672 +}
 673 +
 674 +void
 675 +gr_attach_curr_ip(const struct sock *sk)
 676 +{
 677 +#ifdef CONFIG_GRKERNSEC
 678 +       struct signal_struct *p, *set;
 679 +       const struct inet_sock *inet = inet_sk(sk);
 680 +
 681 +       if (unlikely(sk->sk_protocol != IPPROTO_TCP))
 682 +               return;
 683 +
 684 +       set = current->signal;
 685 +
 686 +       spin_lock_bh(&gr_conn_table_lock);
 687 +       p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
 688 +                                   inet->dport, inet->sport);
 689 +       if (unlikely(p != NULL)) {
 690 +               set->curr_ip = p->curr_ip;
 691 +               set->used_accept = 1;
 692 +               gr_del_task_from_ip_table_nolock(p);
 693 +               spin_unlock_bh(&gr_conn_table_lock);
 694 +               return;
 695 +       }
 696 +       spin_unlock_bh(&gr_conn_table_lock);
 697 +
 698 +       set->curr_ip = inet->daddr;
 699 +       set->used_accept = 1;
 700 +#endif
 701 +       return;
 702 +}
 703 +
 704 diff -urNp linux-2.6.26.orig/grsecurity/grsec_sysctl.c linux-2.6.26/grsecurity/grsec_sysctl.c
 705 --- linux-2.6.26.orig/grsecurity/grsec_sysctl.c 1970-01-01 01:00:00.000000000 +0100
 706 +++ linux-2.6.26/grsecurity/grsec_sysctl.c      2008-09-02 12:17:21.000000000 +0200
 707 @@ -0,0 +1,52 @@
 708 +#include <linux/kernel.h>
 709 +#include <linux/sched.h>
 710 +#include <linux/sysctl.h>
 711 +#include <linux/grsecurity.h>
 712 +#include <linux/grinternal.h>
 713 +
 714 +int
 715 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
 716 +{
 717 +#ifdef CONFIG_GRKERNSEC_SYSCTL
 718 +       if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & 002)) {
 719 +               return -EACCES;
 720 +       }
 721 +#endif
 722 +       return 0;
 723 +}
 724 +
 725 +#if defined(CONFIG_GRKERNSEC_SYSCTL)
 726 +ctl_table grsecurity_table[] = {
 727 +#ifdef CONFIG_GRKERNSEC_SYSCTL
 728 +#ifdef CONFIG_GRKERNSEC_LINK
 729 +       {
 730 +               .ctl_name       = CTL_UNNUMBERED,
 731 +               .procname       = "linking_restrictions",
 732 +               .data           = &grsec_enable_link,
 733 +               .maxlen         = sizeof(int),
 734 +               .mode           = 0600,
 735 +               .proc_handler   = &proc_dointvec,
 736 +       },
 737 +#endif
 738 +#ifdef CONFIG_GRKERNSEC_FIFO
 739 +       {
 740 +               .ctl_name       = CTL_UNNUMBERED,
 741 +               .procname       = "fifo_restrictions",
 742 +               .data           = &grsec_enable_fifo,
 743 +               .maxlen         = sizeof(int),
 744 +               .mode           = 0600,
 745 +               .proc_handler   = &proc_dointvec,
 746 +       },
 747 +#endif
 748 +       {
 749 +               .ctl_name       = CTL_UNNUMBERED,
 750 +               .procname       = "grsec_lock",
 751 +               .data           = &grsec_lock,
 752 +               .maxlen         = sizeof(int),
 753 +               .mode           = 0600,
 754 +               .proc_handler   = &proc_dointvec,
 755 +       },
 756 +#endif
 757 +       { .ctl_name = 0 }
 758 +};
 759 +#endif
 760 diff -urNp linux-2.6.26.orig/grsecurity/Kconfig linux-2.6.26/grsecurity/Kconfig
 761 --- linux-2.6.26.orig/grsecurity/Kconfig        1970-01-01 01:00:00.000000000 +0100
 762 +++ linux-2.6.26/grsecurity/Kconfig     2008-09-02 12:17:21.000000000 +0200
 763 @@ -0,0 +1,123 @@
 764 +#
 765 +# grecurity configuration
 766 +#
 767 +
 768 +menu "Grsecurity"
 769 +
 770 +config GRKERNSEC
 771 +       bool "Grsecurity"
 772 +       select CRYPTO
 773 +       select CRYPTO_SHA256
 774 +       select SECURITY
 775 +       select SECURITY_CAPABILITIES
 776 +       help
 777 +         If you say Y here, you will be able to configure many features
 778 +         that will enhance the security of your system.  It is highly
 779 +         recommended that you say Y here and read through the help
 780 +         for each option so that you fully understand the features and
 781 +         can evaluate their usefulness for your machine.
 782 +
 783 +menu "Filesystem Protections"
 784 +depends on GRKERNSEC
 785 +
 786 +config GRKERNSEC_PROC
 787 +       bool "Proc restrictions"
 788 +       help
 789 +         If you say Y here, the permissions of the /proc filesystem
 790 +         will be altered to enhance system security and privacy.  You MUST
 791 +         choose either a user only restriction or a user and group restriction.
 792 +         Depending upon the option you choose, you can either restrict users to
 793 +         see only the processes they themselves run, or choose a group that can
 794 +         view all processes and files normally restricted to root if you choose
 795 +         the "restrict to user only" option.  NOTE: If you're running identd as
 796 +         a non-root user, you will have to run it as the group you specify here.
 797 +
 798 +config GRKERNSEC_PROC_USER
 799 +       bool "Restrict /proc to user only"
 800 +       depends on GRKERNSEC_PROC
 801 +       help
 802 +         If you say Y here, non-root users will only be able to view their own
 803 +         processes, and restricts them from viewing network-related information,
 804 +         and viewing kernel symbol and module information.
 805 +
 806 +config GRKERNSEC_PROC_USERGROUP
 807 +       bool "Allow special group"
 808 +       depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
 809 +       help
 810 +         If you say Y here, you will be able to select a group that will be
 811 +         able to view all processes, network-related information, and
 812 +         kernel and symbol information.  This option is useful if you want
 813 +         to run identd as a non-root user.
 814 +
 815 +config GRKERNSEC_PROC_GID
 816 +       int "GID for special group"
 817 +       depends on GRKERNSEC_PROC_USERGROUP
 818 +       default 1001
 819 +
 820 +config GRKERNSEC_PROC_ADD
 821 +       bool "Additional restrictions"
 822 +       depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
 823 +       help
 824 +         If you say Y here, additional restrictions will be placed on
 825 +         /proc that keep normal users from viewing device information and
 826 +         slabinfo information that could be useful for exploits.
 827 +
 828 +config GRKERNSEC_LINK
 829 +       bool "Linking restrictions"
 830 +       help
 831 +         If you say Y here, /tmp race exploits will be prevented, since users
 832 +         will no longer be able to follow symlinks owned by other users in
 833 +         world-writable +t directories (i.e. /tmp), unless the owner of the
 834 +         symlink is the owner of the directory. users will also not be
 835 +         able to hardlink to files they do not own.  If the sysctl option is
 836 +         enabled, a sysctl option with name "linking_restrictions" is created.
 837 +
 838 +config GRKERNSEC_FIFO
 839 +       bool "FIFO restrictions"
 840 +       help
 841 +         If you say Y here, users will not be able to write to FIFOs they don't
 842 +         own in world-writable +t directories (i.e. /tmp), unless the owner of
 843 +         the FIFO is the same owner of the directory it's held in.  If the sysctl
 844 +         option is enabled, a sysctl option with name "fifo_restrictions" is
 845 +         created.
 846 +
 847 +config GRKERNSEC_PROC_IPADDR
 848 +       bool "/proc/<pid>/ipaddr support"
 849 +       help
 850 +         If you say Y here, a new entry will be added to each /proc/<pid>
 851 +         directory that contains the IP address of the person using the task.
 852 +         The IP is carried across local TCP and AF_UNIX stream sockets.
 853 +         This information can be useful for IDS/IPSes to perform remote response
 854 +         to a local attack.  The entry is readable by only the owner of the
 855 +         process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
 856 +         the RBAC system), and thus does not create privacy concerns.
 857 +
 858 +endmenu
 859 +
 860 +config GRKERNSEC_SYSCTL
 861 +       bool "Sysctl support"
 862 +       help
 863 +         If you say Y here, you will be able to change the options that
 864 +         grsecurity runs with at bootup, without having to recompile your
 865 +         kernel.  You can echo values to files in /proc/sys/kernel/grsecurity
 866 +         to enable (1) or disable (0) various features.  All the sysctl entries
 867 +         are mutable until the "grsec_lock" entry is set to a non-zero value.
 868 +         All features enabled in the kernel configuration are disabled at boot
 869 +         if you do not say Y to the "Turn on features by default" option.
 870 +         All options should be set at startup, and the grsec_lock entry should
 871 +         be set to a non-zero value after all the options are set.
 872 +         *THIS IS EXTREMELY IMPORTANT*
 873 +
 874 +config GRKERNSEC_SYSCTL_ON
 875 +       bool "Turn on features by default"
 876 +       depends on GRKERNSEC_SYSCTL
 877 +       help
 878 +         If you say Y here, instead of having all features enabled in the
 879 +         kernel configuration disabled at boot time, the features will be
 880 +         enabled at boot time.  It is recommended you say Y here unless
 881 +         there is some reason you would want all sysctl-tunable features to
 882 +         be disabled by default.  As mentioned elsewhere, it is important
 883 +         to enable the grsec_lock entry once you have finished modifying
 884 +         the sysctl entries.
 885 +
 886 +endmenu
 887 diff -urNp linux-2.6.26.orig/grsecurity/Makefile linux-2.6.26/grsecurity/Makefile
 888 --- linux-2.6.26.orig/grsecurity/Makefile       1970-01-01 01:00:00.000000000 +0100
 889 +++ linux-2.6.26/grsecurity/Makefile    2008-09-02 12:17:21.000000000 +0200
 890 @@ -0,0 +1,11 @@
 891 +# All code in this directory and various hooks inserted throughout the kernel
 892 +# are copyright Brad Spengler, and released under the GPL v2 or higher
 893 +
 894 +obj-y = grsec_fifo.o grsec_sock.o grsec_sysctl.o grsec_link.o
 895 +
 896 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o
 897 +
 898 +ifndef CONFIG_GRKERNSEC
 899 +obj-y += grsec_disabled.o
 900 +endif
 901 +
 902 diff -urNp linux-2.6.26.orig/include/linux/grinternal.h linux-2.6.26/include/linux/grinternal.h
 903 --- linux-2.6.26.orig/include/linux/grinternal.h        1970-01-01 01:00:00.000000000 +0100
 904 +++ linux-2.6.26/include/linux/grinternal.h     2008-09-02 12:17:21.000000000 +0200
 905 @@ -0,0 +1,14 @@
 906 +#ifndef __GRINTERNAL_H
 907 +#define __GRINTERNAL_H
 908 +
 909 +#ifdef CONFIG_GRKERNSEC
 910 +
 911 +#include <linux/fs.h>
 912 +
 913 +extern int grsec_enable_link;
 914 +extern int grsec_enable_fifo;
 915 +extern int grsec_lock;
 916 +
 917 +#endif
 918 +
 919 +#endif
 920 diff -urNp linux-2.6.26.orig/include/linux/grsecurity.h linux-2.6.26/include/linux/grsecurity.h
 921 --- linux-2.6.26.orig/include/linux/grsecurity.h        1970-01-01 01:00:00.000000000 +0100
 922 +++ linux-2.6.26/include/linux/grsecurity.h     2008-09-02 12:17:21.000000000 +0200
 923 @@ -0,0 +1,18 @@
 924 +#ifndef GR_SECURITY_H
 925 +#define GR_SECURITY_H
 926 +#include <linux/fs.h>
 927 +#include <linux/binfmts.h>
 928 +
 929 +void gr_del_task_from_ip_table(struct task_struct *p);
 930 +
 931 +int gr_handle_follow_link(const struct inode *parent,
 932 +                                const struct inode *inode,
 933 +                                const struct dentry *dentry);
 934 +int gr_handle_fifo(const struct dentry *dentry,
 935 +                         const struct dentry *dir, const int flag,
 936 +                         const int acc_mode);
 937 +int gr_handle_hardlink(const struct dentry *dentry,
 938 +                             struct inode *inode,
 939 +                             const int mode, const char *to);
 940 +
 941 +#endif
 942 diff -urNp linux-2.6.26.orig/include/linux/sched.h linux-2.6.26/include/linux/sched.h
 943 --- linux-2.6.26.orig/include/linux/sched.h     2008-09-01 11:43:34.000000000 +0200
 944 +++ linux-2.6.26/include/linux/sched.h  2008-09-02 12:17:21.000000000 +0200
 945 @@ -544,6 +544,15 @@ struct signal_struct {
 946         unsigned audit_tty;
 947         struct tty_audit_buf *tty_audit_buf;
 948  #endif
 949 +
 950 +#ifdef CONFIG_GRKERNSEC
 951 +       u32 curr_ip;
 952 +       u32 gr_saddr;
 953 +       u32 gr_daddr;
 954 +       u16 gr_sport;
 955 +       u16 gr_dport;
 956 +       u8 used_accept:1;
 957 +#endif
 958  };
 959
 960  /* Context switch must be unlocked if interrupts are to be enabled */
 961 diff -urNp linux-2.6.26.orig/include/linux/sysctl.h linux-2.6.26/include/linux/sysctl.h
 962 --- linux-2.6.26.orig/include/linux/sysctl.h    2008-09-01 11:43:34.000000000 +0200
 963 +++ linux-2.6.26/include/linux/sysctl.h 2008-09-02 12:17:21.000000000 +0200
 964 @@ -165,8 +165,11 @@ enum
 965         KERN_MAX_LOCK_DEPTH=74,
 966         KERN_NMI_WATCHDOG=75, /* int: enable/disable nmi watchdog */
 967         KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
 968 -};
 969 +#ifdef CONFIG_GRKERNSEC
 970 +       KERN_GRSECURITY=98,     /* grsecurity */
 971 +#endif
 972
 973 +};
 974
 975
 976  /* CTL_VM names: */
 977 diff -urNp linux-2.6.26.orig/kernel/configs.c linux-2.6.26/kernel/configs.c
 978 --- linux-2.6.26.orig/kernel/configs.c  2008-09-01 11:43:58.000000000 +0200
 979 +++ linux-2.6.26/kernel/configs.c       2008-09-02 12:17:21.000000000 +0200
 980 @@ -79,8 +79,19 @@ static int __init ikconfig_init(void)
 981         struct proc_dir_entry *entry;
 982
 983         /* create the current config file */
 984 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 985 +#ifdef CONFIG_GRKERNSEC_PROC_USER
 986 +       entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
 987 +                           &ikconfig_file_ops);
 988 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 989 +       entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
 990 +                           &ikconfig_file_ops);
 991 +#endif
 992 +#else
 993         entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
 994                             &ikconfig_file_ops);
 995 +#endif
 996 +
 997         if (!entry)
 998                 return -ENOMEM;
 999
1000 diff -urNp linux-2.6.26.orig/kernel/exit.c linux-2.6.26/kernel/exit.c
1001 --- linux-2.6.26.orig/kernel/exit.c     2008-09-01 11:43:58.000000000 +0200
1002 +++ linux-2.6.26/kernel/exit.c  2008-09-02 12:17:21.000000000 +0200
1003 @@ -50,6 +50,7 @@
1004  #include <linux/vs_pid.h>
1005  #include <linux/vserver/global.h>
1006  #include <trace/sched.h>
1007 +#include <linux/grsecurity.h>
1008
1009  #include <asm/uaccess.h>
1010  #include <asm/unistd.h>
1011 @@ -137,6 +138,7 @@ static void __exit_signal(struct task_st
1012          */
1013         flush_sigqueue(&tsk->pending);
1014
1015 +       gr_del_task_from_ip_table(tsk);
1016         tsk->signal = NULL;
1017         tsk->sighand = NULL;
1018         spin_unlock(&sighand->siglock);
1019 diff -urNp linux-2.6.26.orig/kernel/kallsyms.c linux-2.6.26/kernel/kallsyms.c
1020 --- linux-2.6.26.orig/kernel/kallsyms.c 2008-09-01 11:43:58.000000000 +0200
1021 +++ linux-2.6.26/kernel/kallsyms.c      2008-09-02 12:17:21.000000000 +0200
1022 @@ -472,7 +472,15 @@ static const struct file_operations kall
1023
1024  static int __init kallsyms_init(void)
1025  {
1026 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
1027 +#ifdef CONFIG_GRKERNSEC_PROC_USER
1028 +       proc_create("kallsyms", S_IFREG | S_IRUSR, NULL, &kallsyms_operations);
1029 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1030 +       proc_create("kallsyms", S_IFREG | S_IRUSR | S_IRGRP, NULL, &kallsyms_operations);
1031 +#endif
1032 +#else
1033         proc_create("kallsyms", 0444, NULL, &kallsyms_operations);
1034 +#endif
1035         return 0;
1036  }
1037  __initcall(kallsyms_init);
1038 diff -urNp linux-2.6.26.orig/kernel/resource.c linux-2.6.26/kernel/resource.c
1039 --- linux-2.6.26.orig/kernel/resource.c 2008-09-01 11:43:58.000000000 +0200
1040 +++ linux-2.6.26/kernel/resource.c      2008-09-02 12:17:21.000000000 +0200
1041 @@ -131,8 +131,18 @@ static const struct file_operations proc
1042
1043  static int __init ioresources_init(void)
1044  {
1045 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
1046 +#ifdef CONFIG_GRKERNSEC_PROC_USER
1047 +       proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
1048 +       proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
1049 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1050 +       proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
1051 +       proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
1052 +#endif
1053 +#else
1054         proc_create("ioports", 0, NULL, &proc_ioports_operations);
1055         proc_create("iomem", 0, NULL, &proc_iomem_operations);
1056 +#endif
1057         return 0;
1058  }
1059  __initcall(ioresources_init);
1060 diff -urNp linux-2.6.26.orig/kernel/sysctl.c linux-2.6.26/kernel/sysctl.c
1061 --- linux-2.6.26.orig/kernel/sysctl.c   2008-09-01 11:43:58.000000000 +0200
1062 +++ linux-2.6.26/kernel/sysctl.c        2008-09-02 12:17:21.000000000 +0200
1063 @@ -59,6 +59,11 @@
1064  static int deprecated_sysctl_warning(struct __sysctl_args *args);
1065
1066  #if defined(CONFIG_SYSCTL)
1067 +#include <linux/grsecurity.h>
1068 +#include <linux/grinternal.h>
1069 +
1070 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
1071 +                               const int op);
1072
1073  /* External variables not in a header file. */
1074  extern int C_A_D;
1075 @@ -153,6 +158,7 @@ static int proc_do_cad_pid(struct ctl_ta
1076  static int proc_dointvec_taint(struct ctl_table *table, int write, struct file *filp,
1077                                void __user *buffer, size_t *lenp, loff_t *ppos);
1078  #endif
1079 +extern ctl_table grsecurity_table[];
1080
1081  static struct ctl_table root_table[];
1082  static struct ctl_table_root sysctl_table_root;
1083 @@ -823,6 +829,15 @@ static struct ctl_table kern_table[] = {
1084                 .child          = key_sysctls,
1085         },
1086  #endif
1087 +
1088 +#if defined(CONFIG_GRKERNSEC_SYSCTL)
1089 +       {
1090 +               .ctl_name       = CTL_UNNUMBERED,
1091 +               .procname       = "grsecurity",
1092 +               .mode           = 0500,
1093 +               .child          = grsecurity_table,
1094 +       },
1095 +#endif
1096  /*
1097   * NOTE: do not add new entries to this table unless you have read
1098   * Documentation/sysctl/ctl_unnumbered.txt
1099 @@ -1585,6 +1600,10 @@ int sysctl_perm(struct ctl_table_root *r
1100         int error;
1101         int mode;
1102
1103 +       if (table->parent != NULL && table->parent->procname != NULL &&
1104 +           table->procname != NULL &&
1105 +           gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
1106 +               return -EACCES;
1107         error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
1108         if (error)
1109                 return error;
1110 diff -urNp linux-2.6.26.orig/Makefile linux-2.6.26/Makefile
1111 --- linux-2.6.26.orig/Makefile  2008-09-01 11:44:01.000000000 +0200
1112 +++ linux-2.6.26/Makefile       2008-09-02 12:17:21.000000000 +0200
1113 @@ -607,7 +607,7 @@ export mod_strip_cmd
1114
1115
1116  ifeq ($(KBUILD_EXTMOD),)
1117 -core-y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
1118 +core-y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
1119
1120  vmlinux-dirs   := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
1121                      $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
1122 diff -urNp linux-2.6.26.orig/net/ipv4/inet_hashtables.c linux-2.6.26/net/ipv4/inet_hashtables.c
1123 --- linux-2.6.26.orig/net/ipv4/inet_hashtables.c        2008-09-01 11:43:37.000000000 +0200
1124 +++ linux-2.6.26/net/ipv4/inet_hashtables.c     2008-09-02 12:17:21.000000000 +0200
1125 @@ -18,12 +18,15 @@
1126  #include <linux/sched.h>
1127  #include <linux/slab.h>
1128  #include <linux/wait.h>
1129 +#include <linux/grsecurity.h>
1130
1131  #include <net/inet_connection_sock.h>
1132  #include <net/inet_hashtables.h>
1133  #include <net/route.h>
1134  #include <net/ip.h>
1135
1136 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
1137 +
1138  /*
1139   * Allocate and initialize a new local port bind bucket.
1140   * The bindhash mutex for snum's hash chain must be held here.
1141 @@ -484,6 +487,8 @@ ok:
1142                 }
1143                 spin_unlock(&head->lock);
1144
1145 +               gr_update_task_in_ip_table(current, inet_sk(sk));
1146 +
1147                 if (tw) {
1148                         inet_twsk_deschedule(tw, death_row);
1149                         inet_twsk_put(tw);
1150 diff -urNp linux-2.6.26.orig/net/socket.c linux-2.6.26/net/socket.c
1151 --- linux-2.6.26.orig/net/socket.c      2008-09-01 11:43:36.000000000 +0200
1152 +++ linux-2.6.26/net/socket.c   2008-09-02 12:17:21.000000000 +0200
1153 @@ -85,6 +85,7 @@
1154  #include <linux/audit.h>
1155  #include <linux/wireless.h>
1156  #include <linux/nsproxy.h>
1157 +#include <linux/in.h>
1158
1159  #include <asm/uaccess.h>
1160  #include <asm/unistd.h>
1161 @@ -98,6 +99,8 @@
1162  #include <linux/vs_inet.h>
1163  #include <linux/vs_inet6.h>
1164
1165 +extern void gr_attach_curr_ip(const struct sock *sk);
1166 +
1167  static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
1168  static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
1169                          unsigned long nr_segs, loff_t pos);
1170 @@ -1502,6 +1505,7 @@ asmlinkage long sys_accept(int fd, struc
1171         err = newfd;
1172
1173         security_socket_post_accept(sock, newsock);
1174 +       gr_attach_curr_ip(newsock->sk);
1175
1176  out_put:
1177         fput_light(sock->file, fput_needed);
1178 diff -urNp linux-2.6.26.orig/security/Kconfig linux-2.6.26/security/Kconfig
1179 --- linux-2.6.26.orig/security/Kconfig  2008-09-01 11:43:58.000000000 +0200
1180 +++ linux-2.6.26/security/Kconfig       2008-09-02 12:17:21.000000000 +0200
1181 @@ -4,6 +4,8 @@
1182
1183  menu "Security options"
1184
1185 +source grsecurity/Kconfig
1186 +
1187  config KEYS
1188         bool "Enable access key retention support"
1189         help