1 diff -urNp linux-2.6.26.orig/arch/sparc/Makefile linux-2.6.26/arch/sparc/Makefile
2 --- linux-2.6.26.orig/arch/sparc/Makefile 2008-09-01 11:44:21.000000000 +0200
3 +++ linux-2.6.26/arch/sparc/Makefile 2008-09-02 12:17:21.000000000 +0200
5 # Export what is needed by arch/sparc/boot/Makefile
6 export VMLINUX_INIT VMLINUX_MAIN
7 VMLINUX_INIT := $(head-y) $(init-y)
8 -VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
9 +VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
10 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
11 VMLINUX_MAIN += $(drivers-y) $(net-y)
13 diff -urNp linux-2.6.26.orig/drivers/char/keyboard.c linux-2.6.26/drivers/char/keyboard.c
14 --- linux-2.6.26.orig/drivers/char/keyboard.c 2008-09-01 11:43:37.000000000 +0200
15 +++ linux-2.6.26/drivers/char/keyboard.c 2008-09-02 12:17:21.000000000 +0200
16 @@ -633,6 +633,16 @@ static void k_spec(struct vc_data *vc, u
17 kbd->kbdmode == VC_MEDIUMRAW) &&
19 return; /* SAK is allowed even in raw mode */
21 +#if defined(CONFIG_GRKERNSEC_PROC)
23 + void *func = fn_handler[value];
24 + if (func == fn_show_state || func == fn_show_ptregs ||
25 + func == fn_show_mem)
30 fn_handler[value](vc);
33 diff -urNp linux-2.6.26.orig/drivers/pci/proc.c linux-2.6.26/drivers/pci/proc.c
34 --- linux-2.6.26.orig/drivers/pci/proc.c 2008-09-01 11:43:47.000000000 +0200
35 +++ linux-2.6.26/drivers/pci/proc.c 2008-09-02 12:17:21.000000000 +0200
36 @@ -472,7 +472,16 @@ static const struct file_operations proc
37 static int __init pci_proc_init(void)
39 struct pci_dev *dev = NULL;
41 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
42 +#ifdef CONFIG_GRKERNSEC_PROC_USER
43 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
44 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
48 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
50 proc_create("devices", 0, proc_bus_pci_dir,
51 &proc_bus_pci_dev_operations);
53 diff -urNp linux-2.6.26.orig/fs/Kconfig linux-2.6.26/fs/Kconfig
54 --- linux-2.6.26.orig/fs/proc/Kconfig 2008-09-01 11:43:58.000000000 +0200
55 +++ linux-2.6.26/fs/proc/Kconfig 2008-09-02 12:17:21.000000000 +0200
56 @@ -926,12 +926,12 @@ config PROC_FS
59 bool "/proc/kcore support" if !ARM
60 - depends on PROC_FS && MMU
61 + depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
64 bool "/proc/vmcore support (EXPERIMENTAL)"
65 - depends on PROC_FS && CRASH_DUMP
67 + depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
70 Exports the dump image of crashed kernel in ELF format.
72 diff -urNp linux-2.6.26.orig/fs/namei.c linux-2.6.26/fs/namei.c
73 --- linux-2.6.26.orig/fs/namei.c 2008-09-01 11:43:59.000000000 +0200
74 +++ linux-2.6.26/fs/namei.c 2008-09-02 12:17:21.000000000 +0200
76 #include <linux/vs_cowbl.h>
77 #include <linux/vs_device.h>
78 #include <linux/vs_context.h>
79 +#include <linux/grsecurity.h>
80 #include <linux/pid_namespace.h>
81 #include <asm/uaccess.h>
83 @@ -740,6 +741,13 @@ static inline int do_follow_link(struct
84 err = security_inode_follow_link(path->dentry, nd);
88 + if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
89 + path->dentry->d_inode, path->dentry)) {
94 current->link_count++;
95 current->total_link_count++;
97 @@ -1925,6 +1933,12 @@ do_last:
102 + if (gr_handle_fifo(path.dentry, dir, flag, acc_mode)) {
104 + goto exit_mutex_unlock;
107 mutex_unlock(&dir->d_inode->i_mutex);
108 audit_inode(pathname, path.dentry);
110 @@ -2028,6 +2042,13 @@ do_link:
111 error = security_inode_follow_link(path.dentry, &nd);
115 + if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
121 error = __do_follow_link(&path, &nd);
123 /* Does someone understand code flow here? Or it is only
124 @@ -2669,6 +2690,13 @@ asmlinkage long sys_linkat(int olddfd, c
125 error = PTR_ERR(new_dentry);
126 if (IS_ERR(new_dentry))
129 + if (gr_handle_hardlink(old_path.dentry, old_path.dentry->d_inode,
130 + old_path.dentry->d_inode->i_mode, to)) {
135 error = mnt_want_write(nd.path.mnt);
138 diff -urNp linux-2.6.26.orig/fs/proc/array.c linux-2.6.26/fs/proc/array.c
139 --- linux-2.6.26.orig/fs/proc/array.c 2008-09-01 11:43:59.000000000 +0200
140 +++ linux-2.6.26/fs/proc/array.c 2008-09-02 12:17:21.000000000 +0200
141 @@ -639,3 +639,10 @@ int proc_pid_statm(struct seq_file *m, s
146 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
147 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
149 + return sprintf(buffer, "%u.%u.%u.%u\n", NIPQUAD(task->signal->curr_ip));
152 diff -urNp linux-2.6.26.orig/fs/proc/base.c linux-2.6.26/fs/proc/base.c
153 --- linux-2.6.26.orig/fs/proc/base.c 2008-09-01 11:43:59.000000000 +0200
154 +++ linux-2.6.26/fs/proc/base.c 2008-09-02 12:23:45.000000000 +0200
156 #include <linux/pid_namespace.h>
157 #include <linux/vs_context.h>
158 #include <linux/vs_network.h>
159 +#include <linux/grsecurity.h>
161 #include "internal.h"
164 @@ -1445,7 +1445,11 @@
166 cred = __task_cred(task);
167 inode->i_uid = cred->euid;
168 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
169 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
171 inode->i_gid = cred->egid;
175 /* procfs is xid tagged */
176 @@ -1469,6 +1469,9 @@
177 struct inode *inode = dentry->d_inode;
178 struct task_struct *task;
179 const struct cred *cred;
180 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
181 + struct task_struct *tmp = current;
184 generic_fillattr(inode, stat);
186 @@ -1476,12 +1479,29 @@
189 task = pid_task(proc_pid(inode), PIDTYPE_PID);
192 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
193 + && (!tmp->uid || (tmp->uid == task->uid)
194 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
195 + || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
200 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
201 +#ifdef CONFIG_GRKERNSEC_PROC_USER
202 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
203 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
204 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
206 task_dumpable(task)) {
207 cred = __task_cred(task);
208 stat->uid = cred->euid;
209 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
210 + stat->gid = CONFIG_GRKERNSEC_PROC_GID;
212 stat->gid = cred->egid;
217 @@ -1533,11 +1533,20 @@
220 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
221 +#ifdef CONFIG_GRKERNSEC_PROC_USER
222 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
223 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
224 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
226 task_dumpable(task)) {
228 cred = __task_cred(task);
229 inode->i_uid = cred->euid;
230 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
231 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
233 inode->i_gid = cred->egid;
238 @@ -1841,12 +1888,19 @@ static int proc_fd_permission(struct ino
239 struct nameidata *nd)
242 + struct task_struct *task;
244 rv = generic_permission(inode, mask, NULL);
248 if (task_pid(current) == proc_pid(inode))
251 + task = get_proc_task(inode);
255 + put_task_struct(task);
260 @@ -2617,7 +2683,14 @@ static struct dentry *proc_pid_instantia
264 +#ifdef CONFIG_GRKERNSEC_PROC_USER
265 + inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
266 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
267 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
268 + inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
270 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
272 inode->i_op = &proc_tgid_base_inode_operations;
273 inode->i_fop = &proc_tgid_base_operations;
274 inode->i_flags|=S_IMMUTABLE;
275 @@ -2724,6 +2801,9 @@ int proc_pid_readdir(struct file * filp,
277 unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
278 struct task_struct *reaper = get_proc_task_real(filp->f_path.dentry->d_inode);
279 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
280 + struct task_struct *tmp = current;
282 struct tgid_iter iter;
283 struct pid_namespace *ns;
285 @@ -2742,6 +2822,15 @@ int proc_pid_readdir(struct file * filp,
286 for (iter = next_tgid(ns, iter);
288 iter.tgid += 1, iter = next_tgid(ns, iter)) {
289 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
290 + if (tmp->uid && (iter.task->uid != tmp->uid)
291 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
292 + && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
298 filp->f_pos = iter.tgid + TGID_OFFSET;
299 if (!vx_proc_task_visible(iter.task))
301 @@ -2815,6 +2906,9 @@ static const struct pid_entry tid_base_s
302 #ifdef CONFIG_FAULT_INJECTION
303 REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
305 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
306 + INF("ipaddr", S_IRUSR, pid_ipaddr),
310 static int proc_tid_base_readdir(struct file * filp,
311 diff -urNp linux-2.6.26.orig/fs/proc/inode.c linux-2.6.26/fs/proc/inode.c
312 --- linux-2.6.26.orig/fs/proc/inode.c 2008-09-01 11:43:59.000000000 +0200
313 +++ linux-2.6.26/fs/proc/inode.c 2008-09-02 12:17:21.000000000 +0200
314 @@ -403,7 +403,11 @@ struct inode *proc_get_inode(struct supe
316 inode->i_mode = de->mode;
317 inode->i_uid = de->uid;
318 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
319 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
321 inode->i_gid = de->gid;
325 PROC_I(inode)->vx_flags = de->vx_flags;
326 diff -urNp linux-2.6.26.orig/fs/proc/internal.h linux-2.6.26/fs/proc/internal.h
327 --- linux-2.6.26.orig/fs/proc/internal.h 2008-09-01 11:43:59.000000000 +0200
328 +++ linux-2.6.26/fs/proc/internal.h 2008-09-02 12:17:21.000000000 +0200
329 @@ -58,6 +58,9 @@ extern int proc_pid_statm(struct seq_fil
330 struct pid *pid, struct task_struct *task);
331 extern int proc_pid_nsproxy(struct seq_file *m, struct pid_namespace *ns,
332 struct pid *pid, struct task_struct *task);
333 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
334 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
337 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
339 --- linux-2.6.26.orig/fs/proc/cmdline.c 2008-12-25 00:26:37.000000000 +0100
340 +++ linux-2.6.26/fs/proc/cmdline.c 2009-01-02 17:46:34.278247774 +0100
343 static int __init proc_cmdline_init(void)
345 - proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
347 +#ifdef CONFIG_GRKERNSEC_PROC_USER
349 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
350 + gr_mode = S_IRUSR | S_IRGRP;
352 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
353 + proc_create("cmdline", gr_mode, NULL, &cmdline_proc_fops);
357 module_init(proc_cmdline_init);
358 --- linux-2.6.26.orig/fs/proc/devices.c 2008-12-25 00:26:37.000000000 +0100
359 +++ linux-2.6.26/fs/proc/devices.c 2009-01-02 17:43:00.758269666 +0100
362 static int __init proc_devices_init(void)
364 - proc_create("devices", 0, NULL, &proc_devinfo_operations);
366 +#ifdef CONFIG_GRKERNSEC_PROC_USER
368 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
369 + gr_mode = S_IRUSR | S_IRGRP;
371 + proc_create("devices", gr_mode, NULL, &proc_devinfo_operations);
374 module_init(proc_devices_init);
375 --- linux-2.6.26.orig/fs/proc/kcore.c 2008-12-25 00:26:37.000000000 +0100
376 +++ linux-2.6.26/fs/proc/kcore.c 2009-01-02 17:45:03.714922801 +0100
377 @@ -404,10 +404,12 @@
379 static int __init proc_kcore_init(void)
381 +#if defined(CONFIG_PROC_KCORE) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
382 proc_root_kcore = proc_create("kcore", S_IRUSR, NULL, &proc_kcore_operations);
384 proc_root_kcore->size =
385 (size_t)high_memory - PAGE_OFFSET + PAGE_SIZE;
389 module_init(proc_kcore_init);
390 diff -urNp linux-2.6.26.orig/fs/proc/root.c linux-2.6.26/fs/proc/root.c
391 --- linux-2.6.26.orig/fs/proc/root.c 2008-09-01 11:43:59.000000000 +0200
392 +++ linux-2.6.26/fs/proc/root.c 2008-09-02 12:17:21.000000000 +0200
393 @@ -139,7 +139,15 @@ void __init proc_root_init(void)
394 #ifdef CONFIG_PROC_DEVICETREE
395 proc_device_tree_init();
397 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
398 +#ifdef CONFIG_GRKERNSEC_PROC_USER
399 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
400 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
401 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
404 proc_mkdir("bus", NULL);
409 diff -urNp linux-2.6.26.orig/grsecurity/grsec_disabled.c linux-2.6.26/grsecurity/grsec_disabled.c
410 --- linux-2.6.26.orig/grsecurity/grsec_disabled.c 1970-01-01 01:00:00.000000000 +0100
411 +++ linux-2.6.26/grsecurity/grsec_disabled.c 2008-09-02 12:17:21.000000000 +0200
414 +grsecurity_init(void)
419 diff -urNp linux-2.6.26.orig/grsecurity/grsec_fifo.c linux-2.6.26/grsecurity/grsec_fifo.c
420 --- linux-2.6.26.orig/grsecurity/grsec_fifo.c 1970-01-01 01:00:00.000000000 +0100
421 +++ linux-2.6.26/grsecurity/grsec_fifo.c 2008-09-02 12:17:21.000000000 +0200
423 +#include <linux/kernel.h>
424 +#include <linux/sched.h>
425 +#include <linux/fs.h>
426 +#include <linux/file.h>
427 +#include <linux/grinternal.h>
430 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
431 + const struct dentry *dir, const int flag, const int acc_mode)
433 +#ifdef CONFIG_GRKERNSEC_FIFO
434 + if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
435 + !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
436 + (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
437 + (current->fsuid != dentry->d_inode->i_uid)) {
443 diff -urNp linux-2.6.26.orig/grsecurity/grsec_init.c linux-2.6.26/grsecurity/grsec_init.c
444 --- linux-2.6.26.orig/grsecurity/grsec_init.c 1970-01-01 01:00:00.000000000 +0100
445 +++ linux-2.6.26/grsecurity/grsec_init.c 2008-09-02 12:17:21.000000000 +0200
447 +#include <linux/kernel.h>
448 +#include <linux/sched.h>
449 +#include <linux/mm.h>
450 +#include <linux/smp_lock.h>
451 +#include <linux/slab.h>
452 +#include <linux/vmalloc.h>
453 +#include <linux/percpu.h>
455 +int grsec_enable_link;
456 +int grsec_enable_fifo;
460 +grsecurity_init(void)
462 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
463 +#ifndef CONFIG_GRKERNSEC_SYSCTL
466 +#ifdef CONFIG_GRKERNSEC_LINK
467 + grsec_enable_link = 1;
469 +#ifdef CONFIG_GRKERNSEC_FIFO
470 + grsec_enable_fifo = 1;
476 diff -urNp linux-2.6.26.orig/grsecurity/grsec_link.c linux-2.6.26/grsecurity/grsec_link.c
477 --- linux-2.6.26.orig/grsecurity/grsec_link.c 1970-01-01 01:00:00.000000000 +0100
478 +++ linux-2.6.26/grsecurity/grsec_link.c 2008-09-02 12:17:21.000000000 +0200
480 +#include <linux/kernel.h>
481 +#include <linux/sched.h>
482 +#include <linux/fs.h>
483 +#include <linux/file.h>
484 +#include <linux/grinternal.h>
487 +gr_handle_follow_link(const struct inode *parent,
488 + const struct inode *inode,
489 + const struct dentry *dentry, const struct vfsmount *mnt)
491 +#ifdef CONFIG_GRKERNSEC_LINK
492 + if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
493 + (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
494 + (parent->i_mode & S_IWOTH) && (current->fsuid != inode->i_uid)) {
502 +gr_handle_hardlink(const struct dentry *dentry,
503 + const struct vfsmount *mnt,
504 + struct inode *inode, const int mode, const char *to)
506 +#ifdef CONFIG_GRKERNSEC_LINK
507 + if (grsec_enable_link && current->fsuid != inode->i_uid &&
508 + (!S_ISREG(mode) || (mode & S_ISUID) ||
509 + ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
510 + (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
511 + !capable(CAP_FOWNER) && current->uid) {
517 diff -urNp linux-2.6.26.orig/grsecurity/grsec_sock.c linux-2.6.26/grsecurity/grsec_sock.c
518 --- linux-2.6.26.orig/grsecurity/grsec_sock.c 1970-01-01 01:00:00.000000000 +0100
519 +++ linux-2.6.26/grsecurity/grsec_sock.c 2008-09-02 12:17:21.000000000 +0200
521 +#include <linux/kernel.h>
522 +#include <linux/module.h>
523 +#include <linux/sched.h>
524 +#include <linux/file.h>
525 +#include <linux/net.h>
526 +#include <linux/in.h>
527 +#include <linux/ip.h>
528 +#include <net/sock.h>
529 +#include <net/inet_sock.h>
530 +#include <linux/grsecurity.h>
531 +#include <linux/grinternal.h>
533 +#ifdef CONFIG_GRKERNSEC
534 +#define gr_conn_table_size 32749
535 +struct conn_table_entry {
536 + struct conn_table_entry *next;
537 + struct signal_struct *sig;
540 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
541 +spinlock_t gr_conn_table_lock = SPIN_LOCK_UNLOCKED;
543 +extern const char * gr_socktype_to_name(unsigned char type);
544 +extern const char * gr_proto_to_name(unsigned char proto);
546 +static __inline__ int
547 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
549 + return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
552 +static __inline__ int
553 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
554 + __u16 sport, __u16 dport)
556 + if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
557 + sig->gr_sport == sport && sig->gr_dport == dport))
563 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
565 + struct conn_table_entry **match;
566 + unsigned int index;
568 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
569 + sig->gr_sport, sig->gr_dport,
570 + gr_conn_table_size);
574 + match = &gr_conn_table[index];
575 + newent->next = *match;
581 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
583 + struct conn_table_entry *match, *last = NULL;
584 + unsigned int index;
586 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
587 + sig->gr_sport, sig->gr_dport,
588 + gr_conn_table_size);
590 + match = gr_conn_table[index];
591 + while (match && !conn_match(match->sig,
592 + sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
595 + match = match->next;
600 + last->next = match->next;
602 + gr_conn_table[index] = NULL;
609 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
610 + __u16 sport, __u16 dport)
612 + struct conn_table_entry *match;
613 + unsigned int index;
615 + index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
617 + match = gr_conn_table[index];
618 + while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
619 + match = match->next;
629 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
631 +#ifdef CONFIG_GRKERNSEC
632 + struct signal_struct *sig = task->signal;
633 + struct conn_table_entry *newent;
635 + newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
636 + if (newent == NULL)
638 + /* no bh lock needed since we are called with bh disabled */
639 + spin_lock(&gr_conn_table_lock);
640 + gr_del_task_from_ip_table_nolock(sig);
641 + sig->gr_saddr = inet->rcv_saddr;
642 + sig->gr_daddr = inet->daddr;
643 + sig->gr_sport = inet->sport;
644 + sig->gr_dport = inet->dport;
645 + gr_add_to_task_ip_table_nolock(sig, newent);
646 + spin_unlock(&gr_conn_table_lock);
651 +void gr_del_task_from_ip_table(struct task_struct *task)
653 +#ifdef CONFIG_GRKERNSEC
654 + spin_lock(&gr_conn_table_lock);
655 + gr_del_task_from_ip_table_nolock(task->signal);
656 + spin_unlock(&gr_conn_table_lock);
662 +gr_attach_curr_ip(const struct sock *sk)
664 +#ifdef CONFIG_GRKERNSEC
665 + struct signal_struct *p, *set;
666 + const struct inet_sock *inet = inet_sk(sk);
668 + if (unlikely(sk->sk_protocol != IPPROTO_TCP))
671 + set = current->signal;
673 + spin_lock_bh(&gr_conn_table_lock);
674 + p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
675 + inet->dport, inet->sport);
676 + if (unlikely(p != NULL)) {
677 + set->curr_ip = p->curr_ip;
678 + set->used_accept = 1;
679 + gr_del_task_from_ip_table_nolock(p);
680 + spin_unlock_bh(&gr_conn_table_lock);
683 + spin_unlock_bh(&gr_conn_table_lock);
685 + set->curr_ip = inet->daddr;
686 + set->used_accept = 1;
691 diff -urNp linux-2.6.26.orig/grsecurity/grsec_sysctl.c linux-2.6.26/grsecurity/grsec_sysctl.c
692 --- linux-2.6.26.orig/grsecurity/grsec_sysctl.c 1970-01-01 01:00:00.000000000 +0100
693 +++ linux-2.6.26/grsecurity/grsec_sysctl.c 2008-09-02 12:17:21.000000000 +0200
695 +#include <linux/kernel.h>
696 +#include <linux/sched.h>
697 +#include <linux/sysctl.h>
698 +#include <linux/grsecurity.h>
699 +#include <linux/grinternal.h>
702 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
704 +#ifdef CONFIG_GRKERNSEC_SYSCTL
705 + if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & 002)) {
712 +#if defined(CONFIG_GRKERNSEC_SYSCTL)
713 +ctl_table grsecurity_table[] = {
714 +#ifdef CONFIG_GRKERNSEC_SYSCTL
715 +#ifdef CONFIG_GRKERNSEC_LINK
717 + .ctl_name = CTL_UNNUMBERED,
718 + .procname = "linking_restrictions",
719 + .data = &grsec_enable_link,
720 + .maxlen = sizeof(int),
722 + .proc_handler = &proc_dointvec,
725 +#ifdef CONFIG_GRKERNSEC_FIFO
727 + .ctl_name = CTL_UNNUMBERED,
728 + .procname = "fifo_restrictions",
729 + .data = &grsec_enable_fifo,
730 + .maxlen = sizeof(int),
732 + .proc_handler = &proc_dointvec,
736 + .ctl_name = CTL_UNNUMBERED,
737 + .procname = "grsec_lock",
738 + .data = &grsec_lock,
739 + .maxlen = sizeof(int),
741 + .proc_handler = &proc_dointvec,
747 diff -urNp linux-2.6.26.orig/grsecurity/Kconfig linux-2.6.26/grsecurity/Kconfig
748 --- linux-2.6.26.orig/grsecurity/Kconfig 1970-01-01 01:00:00.000000000 +0100
749 +++ linux-2.6.26/grsecurity/Kconfig 2008-09-02 12:17:21.000000000 +0200
752 +# grecurity configuration
760 + select CRYPTO_SHA256
762 + select SECURITY_CAPABILITIES
764 + If you say Y here, you will be able to configure many features
765 + that will enhance the security of your system. It is highly
766 + recommended that you say Y here and read through the help
767 + for each option so that you fully understand the features and
768 + can evaluate their usefulness for your machine.
770 +menu "Filesystem Protections"
771 +depends on GRKERNSEC
773 +config GRKERNSEC_PROC
774 + bool "Proc restrictions"
776 + If you say Y here, the permissions of the /proc filesystem
777 + will be altered to enhance system security and privacy. You MUST
778 + choose either a user only restriction or a user and group restriction.
779 + Depending upon the option you choose, you can either restrict users to
780 + see only the processes they themselves run, or choose a group that can
781 + view all processes and files normally restricted to root if you choose
782 + the "restrict to user only" option. NOTE: If you're running identd as
783 + a non-root user, you will have to run it as the group you specify here.
785 +config GRKERNSEC_PROC_USER
786 + bool "Restrict /proc to user only"
787 + depends on GRKERNSEC_PROC
789 + If you say Y here, non-root users will only be able to view their own
790 + processes, and restricts them from viewing network-related information,
791 + and viewing kernel symbol and module information.
793 +config GRKERNSEC_PROC_USERGROUP
794 + bool "Allow special group"
795 + depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
797 + If you say Y here, you will be able to select a group that will be
798 + able to view all processes, network-related information, and
799 + kernel and symbol information. This option is useful if you want
800 + to run identd as a non-root user.
802 +config GRKERNSEC_PROC_GID
803 + int "GID for special group"
804 + depends on GRKERNSEC_PROC_USERGROUP
807 +config GRKERNSEC_PROC_ADD
808 + bool "Additional restrictions"
809 + depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
811 + If you say Y here, additional restrictions will be placed on
812 + /proc that keep normal users from viewing device information and
813 + slabinfo information that could be useful for exploits.
815 +config GRKERNSEC_LINK
816 + bool "Linking restrictions"
818 + If you say Y here, /tmp race exploits will be prevented, since users
819 + will no longer be able to follow symlinks owned by other users in
820 + world-writable +t directories (i.e. /tmp), unless the owner of the
821 + symlink is the owner of the directory. users will also not be
822 + able to hardlink to files they do not own. If the sysctl option is
823 + enabled, a sysctl option with name "linking_restrictions" is created.
825 +config GRKERNSEC_FIFO
826 + bool "FIFO restrictions"
828 + If you say Y here, users will not be able to write to FIFOs they don't
829 + own in world-writable +t directories (i.e. /tmp), unless the owner of
830 + the FIFO is the same owner of the directory it's held in. If the sysctl
831 + option is enabled, a sysctl option with name "fifo_restrictions" is
834 +config GRKERNSEC_PROC_IPADDR
835 + bool "/proc/<pid>/ipaddr support"
837 + If you say Y here, a new entry will be added to each /proc/<pid>
838 + directory that contains the IP address of the person using the task.
839 + The IP is carried across local TCP and AF_UNIX stream sockets.
840 + This information can be useful for IDS/IPSes to perform remote response
841 + to a local attack. The entry is readable by only the owner of the
842 + process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
843 + the RBAC system), and thus does not create privacy concerns.
847 +config GRKERNSEC_SYSCTL
848 + bool "Sysctl support"
850 + If you say Y here, you will be able to change the options that
851 + grsecurity runs with at bootup, without having to recompile your
852 + kernel. You can echo values to files in /proc/sys/kernel/grsecurity
853 + to enable (1) or disable (0) various features. All the sysctl entries
854 + are mutable until the "grsec_lock" entry is set to a non-zero value.
855 + All features enabled in the kernel configuration are disabled at boot
856 + if you do not say Y to the "Turn on features by default" option.
857 + All options should be set at startup, and the grsec_lock entry should
858 + be set to a non-zero value after all the options are set.
859 + *THIS IS EXTREMELY IMPORTANT*
861 +config GRKERNSEC_SYSCTL_ON
862 + bool "Turn on features by default"
863 + depends on GRKERNSEC_SYSCTL
865 + If you say Y here, instead of having all features enabled in the
866 + kernel configuration disabled at boot time, the features will be
867 + enabled at boot time. It is recommended you say Y here unless
868 + there is some reason you would want all sysctl-tunable features to
869 + be disabled by default. As mentioned elsewhere, it is important
870 + to enable the grsec_lock entry once you have finished modifying
871 + the sysctl entries.
874 diff -urNp linux-2.6.26.orig/grsecurity/Makefile linux-2.6.26/grsecurity/Makefile
875 --- linux-2.6.26.orig/grsecurity/Makefile 1970-01-01 01:00:00.000000000 +0100
876 +++ linux-2.6.26/grsecurity/Makefile 2008-09-02 12:17:21.000000000 +0200
878 +# All code in this directory and various hooks inserted throughout the kernel
879 +# are copyright Brad Spengler, and released under the GPL v2 or higher
881 +obj-y = grsec_fifo.o grsec_sock.o grsec_sysctl.o grsec_link.o
883 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o
885 +ifndef CONFIG_GRKERNSEC
886 +obj-y += grsec_disabled.o
889 diff -urNp linux-2.6.26.orig/include/linux/grinternal.h linux-2.6.26/include/linux/grinternal.h
890 --- linux-2.6.26.orig/include/linux/grinternal.h 1970-01-01 01:00:00.000000000 +0100
891 +++ linux-2.6.26/include/linux/grinternal.h 2008-09-02 12:17:21.000000000 +0200
893 +#ifndef __GRINTERNAL_H
894 +#define __GRINTERNAL_H
896 +#ifdef CONFIG_GRKERNSEC
898 +#include <linux/fs.h>
900 +extern int grsec_enable_link;
901 +extern int grsec_enable_fifo;
902 +extern int grsec_lock;
907 diff -urNp linux-2.6.26.orig/include/linux/grsecurity.h linux-2.6.26/include/linux/grsecurity.h
908 --- linux-2.6.26.orig/include/linux/grsecurity.h 1970-01-01 01:00:00.000000000 +0100
909 +++ linux-2.6.26/include/linux/grsecurity.h 2008-09-02 12:17:21.000000000 +0200
911 +#ifndef GR_SECURITY_H
912 +#define GR_SECURITY_H
913 +#include <linux/fs.h>
914 +#include <linux/binfmts.h>
916 +void gr_del_task_from_ip_table(struct task_struct *p);
918 +int gr_handle_follow_link(const struct inode *parent,
919 + const struct inode *inode,
920 + const struct dentry *dentry);
921 +int gr_handle_fifo(const struct dentry *dentry,
922 + const struct dentry *dir, const int flag,
923 + const int acc_mode);
924 +int gr_handle_hardlink(const struct dentry *dentry,
925 + struct inode *inode,
926 + const int mode, const char *to);
929 diff -urNp linux-2.6.26.orig/include/linux/sched.h linux-2.6.26/include/linux/sched.h
930 --- linux-2.6.26.orig/include/linux/sched.h 2008-09-01 11:43:34.000000000 +0200
931 +++ linux-2.6.26/include/linux/sched.h 2008-09-02 12:17:21.000000000 +0200
932 @@ -544,6 +544,15 @@ struct signal_struct {
934 struct tty_audit_buf *tty_audit_buf;
937 +#ifdef CONFIG_GRKERNSEC
947 /* Context switch must be unlocked if interrupts are to be enabled */
948 diff -urNp linux-2.6.26.orig/include/linux/sysctl.h linux-2.6.26/include/linux/sysctl.h
949 --- linux-2.6.26.orig/include/linux/sysctl.h 2008-09-01 11:43:34.000000000 +0200
950 +++ linux-2.6.26/include/linux/sysctl.h 2008-09-02 12:17:21.000000000 +0200
951 @@ -165,8 +165,11 @@ enum
952 KERN_MAX_LOCK_DEPTH=74,
953 KERN_NMI_WATCHDOG=75, /* int: enable/disable nmi watchdog */
954 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
956 +#ifdef CONFIG_GRKERNSEC
957 + KERN_GRSECURITY=98, /* grsecurity */
964 diff -urNp linux-2.6.26.orig/kernel/configs.c linux-2.6.26/kernel/configs.c
965 --- linux-2.6.26.orig/kernel/configs.c 2008-09-01 11:43:58.000000000 +0200
966 +++ linux-2.6.26/kernel/configs.c 2008-09-02 12:17:21.000000000 +0200
967 @@ -79,8 +79,19 @@ static int __init ikconfig_init(void)
968 struct proc_dir_entry *entry;
970 /* create the current config file */
971 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
972 +#ifdef CONFIG_GRKERNSEC_PROC_USER
973 + entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
974 + &ikconfig_file_ops);
975 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
976 + entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
977 + &ikconfig_file_ops);
980 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
987 diff -urNp linux-2.6.26.orig/kernel/exit.c linux-2.6.26/kernel/exit.c
988 --- linux-2.6.26.orig/kernel/exit.c 2008-09-01 11:43:58.000000000 +0200
989 +++ linux-2.6.26/kernel/exit.c 2008-09-02 12:17:21.000000000 +0200
991 #include <linux/vs_pid.h>
992 #include <linux/vserver/global.h>
993 #include <trace/sched.h>
994 +#include <linux/grsecurity.h>
996 #include <asm/uaccess.h>
997 #include <asm/unistd.h>
998 @@ -137,6 +138,7 @@ static void __exit_signal(struct task_st
1000 flush_sigqueue(&tsk->pending);
1002 + gr_del_task_from_ip_table(tsk);
1004 tsk->sighand = NULL;
1005 spin_unlock(&sighand->siglock);
1006 diff -urNp linux-2.6.26.orig/kernel/kallsyms.c linux-2.6.26/kernel/kallsyms.c
1007 --- linux-2.6.26.orig/kernel/kallsyms.c 2008-09-01 11:43:58.000000000 +0200
1008 +++ linux-2.6.26/kernel/kallsyms.c 2008-09-02 12:17:21.000000000 +0200
1009 @@ -472,7 +472,15 @@ static const struct file_operations kall
1011 static int __init kallsyms_init(void)
1013 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
1014 +#ifdef CONFIG_GRKERNSEC_PROC_USER
1015 + proc_create("kallsyms", S_IFREG | S_IRUSR, NULL, &kallsyms_operations);
1016 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1017 + proc_create("kallsyms", S_IFREG | S_IRUSR | S_IRGRP, NULL, &kallsyms_operations);
1020 proc_create("kallsyms", 0444, NULL, &kallsyms_operations);
1024 __initcall(kallsyms_init);
1025 diff -urNp linux-2.6.26.orig/kernel/resource.c linux-2.6.26/kernel/resource.c
1026 --- linux-2.6.26.orig/kernel/resource.c 2008-09-01 11:43:58.000000000 +0200
1027 +++ linux-2.6.26/kernel/resource.c 2008-09-02 12:17:21.000000000 +0200
1028 @@ -131,8 +131,18 @@ static const struct file_operations proc
1030 static int __init ioresources_init(void)
1032 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
1033 +#ifdef CONFIG_GRKERNSEC_PROC_USER
1034 + proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
1035 + proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
1036 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
1037 + proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
1038 + proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
1041 proc_create("ioports", 0, NULL, &proc_ioports_operations);
1042 proc_create("iomem", 0, NULL, &proc_iomem_operations);
1046 __initcall(ioresources_init);
1047 diff -urNp linux-2.6.26.orig/kernel/sysctl.c linux-2.6.26/kernel/sysctl.c
1048 --- linux-2.6.26.orig/kernel/sysctl.c 2008-09-01 11:43:58.000000000 +0200
1049 +++ linux-2.6.26/kernel/sysctl.c 2008-09-02 12:17:21.000000000 +0200
1051 static int deprecated_sysctl_warning(struct __sysctl_args *args);
1053 #if defined(CONFIG_SYSCTL)
1054 +#include <linux/grsecurity.h>
1055 +#include <linux/grinternal.h>
1057 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
1060 /* External variables not in a header file. */
1062 @@ -153,6 +158,7 @@ static int proc_do_cad_pid(struct ctl_ta
1063 static int proc_dointvec_taint(struct ctl_table *table, int write, struct file *filp,
1064 void __user *buffer, size_t *lenp, loff_t *ppos);
1066 +extern ctl_table grsecurity_table[];
1068 static struct ctl_table root_table[];
1069 static struct ctl_table_root sysctl_table_root;
1070 @@ -823,6 +829,15 @@ static struct ctl_table kern_table[] = {
1071 .child = key_sysctls,
1075 +#if defined(CONFIG_GRKERNSEC_SYSCTL)
1077 + .ctl_name = CTL_UNNUMBERED,
1078 + .procname = "grsecurity",
1080 + .child = grsecurity_table,
1084 * NOTE: do not add new entries to this table unless you have read
1085 * Documentation/sysctl/ctl_unnumbered.txt
1086 @@ -1585,6 +1600,10 @@ int sysctl_perm(struct ctl_table_root *r
1090 + if (table->parent != NULL && table->parent->procname != NULL &&
1091 + table->procname != NULL &&
1092 + gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
1094 error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
1097 diff -urNp linux-2.6.26.orig/Makefile linux-2.6.26/Makefile
1098 --- linux-2.6.26.orig/Makefile 2008-09-01 11:44:01.000000000 +0200
1099 +++ linux-2.6.26/Makefile 2008-09-02 12:17:21.000000000 +0200
1100 @@ -607,7 +607,7 @@ export mod_strip_cmd
1103 ifeq ($(KBUILD_EXTMOD),)
1104 -core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
1105 +core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
1107 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
1108 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
1109 diff -urNp linux-2.6.26.orig/net/ipv4/inet_hashtables.c linux-2.6.26/net/ipv4/inet_hashtables.c
1110 --- linux-2.6.26.orig/net/ipv4/inet_hashtables.c 2008-09-01 11:43:37.000000000 +0200
1111 +++ linux-2.6.26/net/ipv4/inet_hashtables.c 2008-09-02 12:17:21.000000000 +0200
1113 #include <linux/sched.h>
1114 #include <linux/slab.h>
1115 #include <linux/wait.h>
1116 +#include <linux/grsecurity.h>
1118 #include <net/inet_connection_sock.h>
1119 #include <net/inet_hashtables.h>
1120 #include <net/route.h>
1123 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
1126 * Allocate and initialize a new local port bind bucket.
1127 * The bindhash mutex for snum's hash chain must be held here.
1128 @@ -484,6 +487,8 @@ ok:
1130 spin_unlock(&head->lock);
1132 + gr_update_task_in_ip_table(current, inet_sk(sk));
1135 inet_twsk_deschedule(tw, death_row);
1137 diff -urNp linux-2.6.26.orig/net/socket.c linux-2.6.26/net/socket.c
1138 --- linux-2.6.26.orig/net/socket.c 2008-09-01 11:43:36.000000000 +0200
1139 +++ linux-2.6.26/net/socket.c 2008-09-02 12:17:21.000000000 +0200
1141 #include <linux/audit.h>
1142 #include <linux/wireless.h>
1143 #include <linux/nsproxy.h>
1144 +#include <linux/in.h>
1146 #include <asm/uaccess.h>
1147 #include <asm/unistd.h>
1149 #include <linux/vs_inet.h>
1150 #include <linux/vs_inet6.h>
1152 +extern void gr_attach_curr_ip(const struct sock *sk);
1154 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
1155 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
1156 unsigned long nr_segs, loff_t pos);
1157 @@ -1577,6 +1577,8 @@
1158 fd_install(newfd, newfile);
1161 + gr_attach_curr_ip(newsock->sk);
1164 fput_light(sock->file, fput_needed);
1166 diff -urNp linux-2.6.26.orig/security/Kconfig linux-2.6.26/security/Kconfig
1167 --- linux-2.6.26.orig/security/Kconfig 2008-09-01 11:43:58.000000000 +0200
1168 +++ linux-2.6.26/security/Kconfig 2008-09-02 12:17:21.000000000 +0200
1171 menu "Security options"
1173 +source grsecurity/Kconfig
1176 bool "Enable access key retention support"