/[linux-patches]/hardened/2.6/trunk/2.6.19/4453_grsec-2.1.9-2.6.19-io-kmem-sysctl.patch
Gentoo

Contents of /hardened/2.6/trunk/2.6.19/4453_grsec-2.1.9-2.6.19-io-kmem-sysctl.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 755 - (show annotations) (download)
Sun Dec 10 12:29:06 2006 UTC (8 years ago) by phreak
File size: 6443 byte(s)
Header updates, reordering.
1 This patch is broken, see http://bugs.gentoo.org/show_bug.cgi?id=157409
2
3 In the meantime: please do not use it until further notice, thanks
4
5 Alex <pappy@gentoo.org>
6
7 First initial import by Christian Heim <phreak@gentoo.org>
8
9 This patch reworks the logic behind GRKERNSEC_IO and GRKERNSEC_KMEM, making it less
10 intrusive and adding support for sysctl.
11
12 The original patch is based on the work of Peter S. Mazinger (ps dot m at gmx dot net)
13 and Nedd Ludd <solar@gentoo.org>.
14
15 Index: linux-2.6.19/arch/i386/kernel/ioport.c
16 ===================================================================
17 --- linux-2.6.19.orig/arch/i386/kernel/ioport.c
18 +++ linux-2.6.19/arch/i386/kernel/ioport.c
19 @@ -65,18 +65,21 @@ asmlinkage long sys_ioperm(unsigned long
20
21 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
22 return -EINVAL;
23 -#ifdef CONFIG_GRKERNSEC_IO
24 +
25 if (turn_on) {
26 - gr_handle_ioperm();
27 +#ifdef CONFIG_GRKERNSEC_IO
28 + if (!grsec_lock || (grsec_lock && grsec_enable_secure_io)) {
29 #else
30 - if (turn_on && !capable(CAP_SYS_RAWIO))
31 + if (grsec_enable_secure_io) {
32 #endif
33 - return -EPERM;
34 -#ifdef CONFIG_GRKERNSEC_IO
35 + gr_handle_ioperm();
36 + return -EPERM;
37 + } else if (!capable(CAP_SYS_RAWIO)) {
38 + return -EPERM;
39 + }
40 }
41 -#endif
42 - /*
43 - * If it's the first ioperm() call in this thread's lifetime, set the
44 +
45 + /* If it's the first ioperm() call in this thread's lifetime, set the
46 * IO bitmap up. ioperm() is much less timing critical than clone(),
47 * this is why we delay this operation until now:
48 */
49 @@ -152,13 +155,17 @@ asmlinkage long sys_iopl(unsigned long u
50 /* Trying to gain more privileges? */
51 if (level > old) {
52 #ifdef CONFIG_GRKERNSEC_IO
53 - gr_handle_iopl();
54 - return -EPERM;
55 + if (!grsec_lock || (grsec_lock && grsec_enable_secure_io)) {
56 #else
57 - if (!capable(CAP_SYS_RAWIO))
58 - return -EPERM;
59 + if (grsec_enable_secure_io) {
60 #endif
61 + gr_handle_iopl();
62 + return -EPERM;
63 + } else if (!capable(CAP_SYS_RAWIO)) {
64 + return -EPERM;
65 + }
66 }
67 +
68 t->iopl = level << 12;
69 regs->eflags = (regs->eflags & ~X86_EFLAGS_IOPL) | t->iopl;
70 set_iopl_mask(t->iopl);
71 Index: linux-2.6.19/drivers/char/mem.c
72 ===================================================================
73 --- linux-2.6.19.orig/drivers/char/mem.c
74 +++ linux-2.6.19/drivers/char/mem.c
75 @@ -180,9 +180,13 @@ static ssize_t write_mem(struct file * f
76 return -EFAULT;
77
78 #ifdef CONFIG_GRKERNSEC_KMEM
79 - gr_handle_mem_write();
80 - return -EPERM;
81 + if (!grsec_lock || (grsec_lock && grsec_enable_secure_kmem)) {
82 +#else
83 + if (grsec_enable_secure_kmem) {
84 #endif
85 + gr_handle_mem_write();
86 + return -EPERM;
87 + }
88
89 written = 0;
90
91 @@ -286,9 +290,13 @@ static int mmap_mem(struct file * file,
92 return -ENOSYS;
93
94 #ifdef CONFIG_GRKERNSEC_KMEM
95 - if (gr_handle_mem_mmap(vma->vm_pgoff << PAGE_SHIFT, vma))
96 - return -EPERM;
97 + if (!grsec_lock || (grsec_lock && grsec_enable_secure_kmem)) {
98 +#else
99 + if (grsec_enable_secure_kmem) {
100 #endif
101 + if (gr_handle_mem_mmap(vma->vm_pgoff << PAGE_SHIFT, vma))
102 + return -EPERM;
103 + }
104
105 vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
106 size,
107 @@ -522,9 +530,13 @@ static ssize_t write_kmem(struct file *
108 char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
109
110 #ifdef CONFIG_GRKERNSEC_KMEM
111 - gr_handle_kmem_write();
112 - return -EPERM;
113 + if (!grsec_lock || (grsec_lock && grsec_enable_secure_kmem)) {
114 +#else
115 + if (grsec_enable_secure_kmem) {
116 #endif
117 + gr_handle_kmem_write();
118 + return -EPERM;
119 + }
120
121 if (p < (unsigned long) high_memory) {
122
123 @@ -832,9 +844,13 @@ static loff_t memory_lseek(struct file *
124 static int open_port(struct inode * inode, struct file * filp)
125 {
126 #ifdef CONFIG_GRKERNSEC_KMEM
127 - gr_handle_open_port();
128 - return -EPERM;
129 + if (!grsec_lock || (grsec_lock && grsec_enable_secure_kmem)) {
130 +#else
131 + if (grsec_enable_secure_kmem) {
132 #endif
133 + gr_handle_open_port();
134 + return -EPERM;
135 + }
136
137 return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
138 }
139 Index: linux-2.6.19/grsecurity/grsec_init.c
140 ===================================================================
141 --- linux-2.6.19.orig/grsecurity/grsec_init.c
142 +++ linux-2.6.19/grsecurity/grsec_init.c
143 @@ -46,6 +46,8 @@ int grsec_enable_socket_client;
144 int grsec_socket_client_gid;
145 int grsec_enable_socket_server;
146 int grsec_socket_server_gid;
147 +int grsec_enable_secure_io;
148 +int grsec_enable_secure_kmem;
149 int grsec_resource_logging;
150 int grsec_lock;
151
152 @@ -230,6 +232,12 @@ grsecurity_init(void)
153 grsec_enable_socket_server = 1;
154 grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
155 #endif
156 +#ifdef CONFIG_GRKERNSEC_IO
157 + grsec_enable_secure_io = 1;
158 +#endif
159 +#ifdef CONFIG_GRKERNSEC_KMEM
160 + grsec_enable_secure_kmem = 1;
161 +#endif
162 #endif
163
164 return;
165 Index: linux-2.6.19/grsecurity/grsec_sysctl.c
166 ===================================================================
167 --- linux-2.6.19.orig/grsecurity/grsec_sysctl.c
168 +++ linux-2.6.19/grsecurity/grsec_sysctl.c
169 @@ -36,7 +36,7 @@ GS_CHROOT_SYSCTL, GS_TPE, GS_TPE_GID, GS
170 GS_RANDPID, GS_SOCKET_ALL, GS_SOCKET_ALL_GID, GS_SOCKET_CLIENT,
171 GS_SOCKET_CLIENT_GID, GS_SOCKET_SERVER, GS_SOCKET_SERVER_GID,
172 GS_GROUP, GS_GID, GS_ACHDIR, GS_AMOUNT, GS_AIPC, GS_DMSG,
173 -GS_TEXTREL, GS_FINDTASK, GS_SHM, GS_LOCK, GS_MODSTOP, GS_RESLOG};
174 +GS_TEXTREL, GS_FINDTASK, GS_SHM, GS_IO, GS_KMEM, GS_LOCK, GS_MODSTOP, GS_RESLOG};
175
176
177 ctl_table grsecurity_table[] = {
178 @@ -431,6 +431,26 @@ ctl_table grsecurity_table[] = {
179 .proc_handler = &proc_dointvec,
180 },
181 #endif
182 +#ifdef CONFIG_GRKERNSEC_IO
183 + {
184 + .ctl_name = GS_IO,
185 + .procname = "secure_io",
186 + .data = &grsec_enable_secure_io,
187 + .maxlen = sizeof(int),
188 + .mode = 0600,
189 + .proc_handler = &proc_dointvec,
190 + },
191 +#endif
192 +#ifdef CONFIG_GRKERNSEC_KMEM
193 + {
194 + .ctl_name = GS_KMEM,
195 + .procname = "secure_kmem",
196 + .data = &grsec_enable_secure_kmem,
197 + .maxlen = sizeof(int),
198 + .mode = 0600,
199 + .proc_handler = &proc_dointvec,
200 + },
201 +#endif
202 {
203 .ctl_name = GS_LOCK,
204 .procname = "grsec_lock",
205 Index: linux-2.6.19/include/linux/grsecurity.h
206 ===================================================================
207 --- linux-2.6.19.orig/include/linux/grsecurity.h
208 +++ linux-2.6.19/include/linux/grsecurity.h
209 @@ -188,6 +188,8 @@ extern int gr_handle_mem_mmap(const unsi
210 extern unsigned long pax_get_random_long(void);
211 #define get_random_long() pax_get_random_long()
212
213 +extern int grsec_enable_secure_io;
214 +extern int grsec_enable_secure_kmem;
215 extern int grsec_enable_dmesg;
216 extern int grsec_enable_randsrc;
217 extern int grsec_enable_shm;

  ViewVC Help
Powered by ViewVC 1.1.20