SOURCES (Titanium): linux-2.6-grsec-vs-minimal.patch - recreated from grsec...

hawk hawk at pld-linux.org
Tue Sep 2 15:13:18 CEST 2008


Author: hawk                         Date: Tue Sep  2 13:13:18 2008 GMT
Module: SOURCES                       Tag: Titanium
---- Log message:
- recreated from grsecurity-2.1.11-2.6.23.1-200710311914.patch for 2.6.26.x kernels

---- Files affected:
SOURCES:
   linux-2.6-grsec-vs-minimal.patch (1.1.2.8.2.8 -> 1.1.2.8.2.9) 

---- Diffs:

================================================================
Index: SOURCES/linux-2.6-grsec-vs-minimal.patch
diff -u SOURCES/linux-2.6-grsec-vs-minimal.patch:1.1.2.8.2.8 SOURCES/linux-2.6-grsec-vs-minimal.patch:1.1.2.8.2.9
--- SOURCES/linux-2.6-grsec-vs-minimal.patch:1.1.2.8.2.8	Mon May  5 00:30:57 2008
+++ SOURCES/linux-2.6-grsec-vs-minimal.patch	Tue Sep  2 15:13:12 2008
@@ -1,6 +1,6 @@
-diff -urNp linux-2.6.25.orig/arch/sparc/Makefile linux-2.6.25/arch/sparc/Makefile
---- linux-2.6.25.orig/arch/sparc/Makefile	2008-04-25 15:09:15.000000000 +0200
-+++ linux-2.6.25/arch/sparc/Makefile	2008-04-25 15:10:25.000000000 +0200
+diff -urNp linux-2.6.26.orig/arch/sparc/Makefile linux-2.6.26/arch/sparc/Makefile
+--- linux-2.6.26.orig/arch/sparc/Makefile	2008-09-01 11:44:21.000000000 +0200
++++ linux-2.6.26/arch/sparc/Makefile	2008-09-02 12:17:21.000000000 +0200
 @@ -36,7 +36,7 @@ drivers-$(CONFIG_OPROFILE)	+= arch/sparc
  # Renaming is done to avoid confusing pattern matching rules in 2.5.45 (multy-)
  INIT_Y		:= $(patsubst %/, %/built-in.o, $(init-y))
@@ -10,22 +10,10 @@
  CORE_Y		:= $(patsubst %/, %/built-in.o, $(CORE_Y))
  DRIVERS_Y	:= $(patsubst %/, %/built-in.o, $(drivers-y))
  NET_Y		:= $(patsubst %/, %/built-in.o, $(net-y))
-diff -urNp linux-2.6.25.orig/Makefile linux-2.6.25/Makefile
---- linux-2.6.25.orig/Makefile	2008-04-25 15:09:13.000000000 +0200
-+++ linux-2.6.25/Makefile	2008-04-25 15:10:25.000000000 +0200
-@@ -603,7 +603,7 @@ export mod_strip_cmd
- 
- 
- ifeq ($(KBUILD_EXTMOD),)
--core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
- 
- vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
- 		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-diff -urNp linux-2.6.25.orig/drivers/char/keyboard.c linux-2.6.25/drivers/char/keyboard.c
---- linux-2.6.25.orig/drivers/char/keyboard.c	2008-04-25 15:09:06.000000000 +0200
-+++ linux-2.6.25/drivers/char/keyboard.c	2008-04-25 15:10:25.000000000 +0200
-@@ -630,6 +630,16 @@ static void k_spec(struct vc_data *vc, u
+diff -urNp linux-2.6.26.orig/drivers/char/keyboard.c linux-2.6.26/drivers/char/keyboard.c
+--- linux-2.6.26.orig/drivers/char/keyboard.c	2008-09-01 11:43:37.000000000 +0200
++++ linux-2.6.26/drivers/char/keyboard.c	2008-09-02 12:17:21.000000000 +0200
+@@ -633,6 +633,16 @@ static void k_spec(struct vc_data *vc, u
  	     kbd->kbdmode == VC_MEDIUMRAW) &&
  	     value != KVAL(K_SAK))
  		return;		/* SAK is allowed even in raw mode */
@@ -42,29 +30,30 @@
  	fn_handler[value](vc);
  }
  
-diff -urNp linux-2.6.25.orig/drivers/pci/proc.c linux-2.6.25/drivers/pci/proc.c
---- linux-2.6.25.orig/drivers/pci/proc.c	2008-04-25 15:09:08.000000000 +0200
-+++ linux-2.6.25/drivers/pci/proc.c	2008-04-25 15:10:25.000000000 +0200
-@@ -472,7 +472,15 @@ static int __init pci_proc_init(void)
+diff -urNp linux-2.6.26.orig/drivers/pci/proc.c linux-2.6.26/drivers/pci/proc.c
+--- linux-2.6.26.orig/drivers/pci/proc.c	2008-09-01 11:43:47.000000000 +0200
++++ linux-2.6.26/drivers/pci/proc.c	2008-09-02 12:17:21.000000000 +0200
+@@ -472,7 +472,16 @@ static const struct file_operations proc
+ static int __init pci_proc_init(void)
  {
- 	struct proc_dir_entry *entry;
  	struct pci_dev *dev = NULL;
++
 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 +#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_bus_pci_dir = proc_mkdir_mode("pci", S_IRUSR | S_IXUSR, proc_bus);
++	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_bus_pci_dir = proc_mkdir_mode("pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, proc_bus);
++	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
 +#endif
 +#else
- 	proc_bus_pci_dir = proc_mkdir("pci", proc_bus);
+ 	proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
 +#endif
- 	entry = create_proc_entry("devices", 0, proc_bus_pci_dir);
- 	if (entry)
- 		entry->proc_fops = &proc_bus_pci_dev_operations;
-diff -urNp linux-2.6.25.orig/fs/Kconfig linux-2.6.25/fs/Kconfig
---- linux-2.6.25.orig/fs/Kconfig	2008-04-25 15:09:12.000000000 +0200
-+++ linux-2.6.25/fs/Kconfig	2008-04-25 15:10:25.000000000 +0200
-@@ -899,7 +899,7 @@ config PROC_FS
+ 	proc_create("devices", 0, proc_bus_pci_dir,
+ 		    &proc_bus_pci_dev_operations);
+ 	proc_initialized = 1;
+diff -urNp linux-2.6.26.orig/fs/Kconfig linux-2.6.26/fs/Kconfig
+--- linux-2.6.26.orig/fs/Kconfig	2008-09-01 11:43:58.000000000 +0200
++++ linux-2.6.26/fs/Kconfig	2008-09-02 12:17:21.000000000 +0200
+@@ -926,12 +926,12 @@ config PROC_FS
  
  config PROC_KCORE
  	bool "/proc/kcore support" if !ARM
@@ -73,10 +62,17 @@
  
  config PROC_VMCORE
          bool "/proc/vmcore support (EXPERIMENTAL)"
-diff -urNp linux-2.6.25.orig/fs/namei.c linux-2.6.25/fs/namei.c
---- linux-2.6.25.orig/fs/namei.c	2008-04-25 15:09:12.000000000 +0200
-+++ linux-2.6.25/fs/namei.c	2008-04-25 15:10:25.000000000 +0200
-@@ -37,6 +37,7 @@
+-        depends on PROC_FS && EXPERIMENTAL && CRASH_DUMP
+-	default y
++        depends on PROC_FS && EXPERIMENTAL && CRASH_DUMP && !GRKERNSEC
++	default n
+         help
+         Exports the dump image of crashed kernel in ELF format.
+ 
+diff -urNp linux-2.6.26.orig/fs/namei.c linux-2.6.26/fs/namei.c
+--- linux-2.6.26.orig/fs/namei.c	2008-09-01 11:43:59.000000000 +0200
++++ linux-2.6.26/fs/namei.c	2008-09-02 12:17:21.000000000 +0200
+@@ -38,6 +38,7 @@
  #include <linux/vs_cowbl.h>
  #include <linux/vs_device.h>
  #include <linux/vs_context.h>
@@ -84,7 +80,7 @@
  #include <asm/namei.h>
  #include <asm/uaccess.h>
  
-@@ -729,6 +730,13 @@ static inline int do_follow_link(struct 
+@@ -740,6 +741,13 @@ static inline int do_follow_link(struct 
  	err = security_inode_follow_link(path->dentry, nd);
  	if (err)
  		goto loop;
@@ -98,22 +94,21 @@
  	current->link_count++;
  	current->total_link_count++;
  	nd->depth++;
-@@ -1859,6 +1867,13 @@ do_last:
+@@ -1925,6 +1933,12 @@ do_last:
  	/*
  	 * It already exists.
  	 */
 +
 +	if (gr_handle_fifo(path.dentry, dir, flag, acc_mode)) {
-+		mutex_unlock(&dir->d_inode->i_mutex);
 +		error = -EACCES;
-+		goto exit_dput;
++		goto exit_mutex_unlock;
 +	}
 +
  	mutex_unlock(&dir->d_inode->i_mutex);
  	audit_inode(pathname, path.dentry);
  
-@@ -1930,6 +1945,13 @@ do_link:
- 	error = security_inode_follow_link(path.dentry, nd);
+@@ -2028,6 +2042,13 @@ do_link:
+ 	error = security_inode_follow_link(path.dentry, &nd);
  	if (error)
  		goto exit_dput;
 +
@@ -123,10 +118,10 @@
 +		goto exit_dput;
 +	}
 +
- 	error = __do_follow_link(&path, nd);
+ 	error = __do_follow_link(&path, &nd);
  	if (error) {
  		/* Does someone understand code flow here? Or it is only
-@@ -2514,8 +2536,16 @@ asmlinkage long sys_linkat(int olddfd, c
+@@ -2669,6 +2690,13 @@ asmlinkage long sys_linkat(int olddfd, c
  	error = PTR_ERR(new_dentry);
  	if (IS_ERR(new_dentry))
  		goto out_unlock;
@@ -134,67 +129,239 @@
 +	if (gr_handle_hardlink(old_nd.path.dentry, old_nd.path.dentry->d_inode,
 +			       old_nd.path.dentry->d_inode->i_mode, to)) {
 +		error = -EACCES;
-+		goto out_unlock_dput;
++		goto out_dput;
 +	}
 +
- 	error = vfs_link(old_nd.path.dentry, nd.path.dentry->d_inode,
- 		new_dentry, &nd);
-+out_unlock_dput:
- 	dput(new_dentry);
- out_unlock:
- 	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
-diff -urNp linux-2.6.25.orig/fs/proc/array.c linux-2.6.25/fs/proc/array.c
---- linux-2.6.25.orig/fs/proc/array.c	2008-04-25 15:09:12.000000000 +0200
-+++ linux-2.6.25/fs/proc/array.c	2008-04-25 15:10:25.000000000 +0200
-@@ -637,3 +637,15 @@ int proc_pid_statm(struct seq_file *m, s
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto out_dput;
+diff -urNp linux-2.6.26.orig/fs/proc/array.c linux-2.6.26/fs/proc/array.c
+--- linux-2.6.26.orig/fs/proc/array.c	2008-09-01 11:43:59.000000000 +0200
++++ linux-2.6.26/fs/proc/array.c	2008-09-02 12:17:21.000000000 +0200
+@@ -639,3 +639,10 @@ int proc_pid_statm(struct seq_file *m, s
  
  	return 0;
  }
 +
 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+int proc_pid_ipaddr(struct seq_file *m, struct pid_namespace *ns,
-+			struct pid *pid, struct task_struct *task)
++int proc_pid_ipaddr(struct task_struct *task, char *buffer)
 +{
-+	int len;
-+
-+	len = seq_printf(m, "%u.%u.%u.%u\n", NIPQUAD(task->signal->curr_ip));
-+	return len;
++	return sprintf(buffer, "%u.%u.%u.%u\n", NIPQUAD(task->signal->curr_ip));
 +}
 +#endif
+diff -urNp linux-2.6.26.orig/fs/proc/base.c linux-2.6.26/fs/proc/base.c
+--- linux-2.6.26.orig/fs/proc/base.c	2008-09-01 11:43:59.000000000 +0200
++++ linux-2.6.26/fs/proc/base.c	2008-09-02 12:23:45.000000000 +0200
+@@ -79,6 +79,8 @@
+ #include <linux/pid_namespace.h>
+ #include <linux/vs_context.h>
+ #include <linux/vs_network.h>
++#include <linux/grsecurity.h>
++
+ #include "internal.h"
+ 
+ /* NOTE:
+@@ -148,7 +150,7 @@ static unsigned int pid_entry_count_dirs
+ 	return count;
+ }
+ 
+-int maps_protect;
++int maps_protect = 1;
+ EXPORT_SYMBOL(maps_protect);
+ 
+ static struct fs_struct *get_fs_struct(struct task_struct *task)
+@@ -307,9 +312,9 @@ static int proc_pid_auxv(struct task_str
+ 	struct mm_struct *mm = get_task_mm(task);
+ 	if (mm) {
+ 		unsigned int nwords = 0;
+-		do
++		do {
+ 			nwords += 2;
+-		while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
++		} while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
+ 		res = nwords * sizeof(mm->saved_auxv[0]);
+ 		if (res > PAGE_SIZE)
+ 			res = PAGE_SIZE;
+@@ -1412,7 +1417,11 @@ static struct inode *proc_pid_make_inode
+ 	inode->i_gid = 0;
+ 	if (task_dumpable(task)) {
+ 		inode->i_uid = task->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++		inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 		inode->i_gid = task->egid;
++#endif
+ 	}
+ 	/* procfs is xid tagged */
+ 	inode->i_tag = (tag_t)vx_task_xid(task);
+@@ -1430,17 +1439,39 @@ static int pid_getattr(struct vfsmount *
+ {
+ 	struct inode *inode = dentry->d_inode;
+ 	struct task_struct *task;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	struct task_struct *tmp = current;
++#endif
++
+ 	generic_fillattr(inode, stat);
+ 
+ 	rcu_read_lock();
+ 	stat->uid = 0;
+ 	stat->gid = 0;
+ 	task = pid_task(proc_pid(inode), PIDTYPE_PID);
+-	if (task) {
++
++	if (task
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	    && (!tmp->uid || (tmp->uid == task->uid)
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++	    || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
++#endif
++	    )
++#endif
++	) {
+ 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
++#endif
+ 		    task_dumpable(task)) {
+ 			stat->uid = task->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			stat->gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 			stat->gid = task->egid;
++#endif
+ 		}
+ 	}
+ 	rcu_read_unlock();
+@@ -1468,11 +1505,21 @@ static int pid_revalidate(struct dentry 
+ {
+ 	struct inode *inode = dentry->d_inode;
+ 	struct task_struct *task = get_proc_task(inode);
 +
-diff -urNp linux-2.6.25.orig/fs/proc/inode.c linux-2.6.25/fs/proc/inode.c
---- linux-2.6.25.orig/fs/proc/inode.c	2008-04-25 15:09:12.000000000 +0200
-+++ linux-2.6.25/fs/proc/inode.c	2008-04-25 15:10:25.000000000 +0200
-@@ -406,7 +406,11 @@ struct inode *proc_get_inode(struct supe
- 			if (de->mode) {
- 				inode->i_mode = de->mode;
- 				inode->i_uid = de->uid;
+ 	if (task) {
+ 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
++#endif
+ 		    task_dumpable(task)) {
+ 			inode->i_uid = task->euid;
 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+				inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 			inode->i_gid = task->egid;
++#endif
+ 		} else {
+ 			inode->i_uid = 0;
+ 			inode->i_gid = 0;
+@@ -1841,12 +1888,19 @@ static int proc_fd_permission(struct ino
+ 				struct nameidata *nd)
+ {
+ 	int rv;
++	struct task_struct *task;
+ 
+ 	rv = generic_permission(inode, mask, NULL);
+-	if (rv == 0)
+-		return 0;
++
+ 	if (task_pid(current) == proc_pid(inode))
+ 		rv = 0;
++
++	task = get_proc_task(inode);
++	if (task == NULL)
++		return rv;
++
++	put_task_struct(task);
++
+ 	return rv;
+ }
+ 
+@@ -2617,7 +2683,14 @@ static struct dentry *proc_pid_instantia
+ 	if (!inode)
+ 		goto out;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++	inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
 +#else
- 				inode->i_gid = de->gid;
+ 	inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
++#endif
+ 	inode->i_op = &proc_tgid_base_inode_operations;
+ 	inode->i_fop = &proc_tgid_base_operations;
+ 	inode->i_flags|=S_IMMUTABLE;
+@@ -2724,6 +2801,9 @@ int proc_pid_readdir(struct file * filp,
+ {
+ 	unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
+ 	struct task_struct *reaper = get_proc_task_real(filp->f_path.dentry->d_inode);
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	struct task_struct *tmp = current;
 +#endif
- 			}
+ 	struct tgid_iter iter;
+ 	struct pid_namespace *ns;
+ 
+@@ -2742,6 +2822,15 @@ int proc_pid_readdir(struct file * filp,
+ 	for (iter = next_tgid(ns, iter);
+ 	     iter.task;
+ 	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		if (tmp->uid && (iter.task->uid != tmp->uid)
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			&& !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
++#endif
++		)
++#endif
++			continue;
++
+ 		filp->f_pos = iter.tgid + TGID_OFFSET;
+ 		if (!vx_proc_task_visible(iter.task))
+ 			continue;
+@@ -2815,6 +2906,9 @@ static const struct pid_entry tid_base_s
+ #ifdef CONFIG_FAULT_INJECTION
+ 	REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
+ #endif
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++	INF("ipaddr",	  S_IRUSR, pid_ipaddr),
++#endif
+ };
+ 
+ static int proc_tid_base_readdir(struct file * filp,
+diff -urNp linux-2.6.26.orig/fs/proc/inode.c linux-2.6.26/fs/proc/inode.c
+--- linux-2.6.26.orig/fs/proc/inode.c	2008-09-01 11:43:59.000000000 +0200
++++ linux-2.6.26/fs/proc/inode.c	2008-09-02 12:17:21.000000000 +0200
+@@ -403,7 +403,11 @@ struct inode *proc_get_inode(struct supe
+ 		if (de->mode) {
+ 			inode->i_mode = de->mode;
+ 			inode->i_uid = de->uid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 			inode->i_gid = de->gid;
++#endif
+ 		}
  		if (de->vx_flags)
  			PROC_I(inode)->vx_flags = de->vx_flags;
-diff -urNp linux-2.6.25.orig/fs/proc/internal.h linux-2.6.25/fs/proc/internal.h
---- linux-2.6.25.orig/fs/proc/internal.h	2008-04-25 15:09:12.000000000 +0200
-+++ linux-2.6.25/fs/proc/internal.h	2008-04-25 15:10:25.000000000 +0200
-@@ -60,6 +60,10 @@ extern int proc_pid_statm(struct seq_fil
+diff -urNp linux-2.6.26.orig/fs/proc/internal.h linux-2.6.26/fs/proc/internal.h
+--- linux-2.6.26.orig/fs/proc/internal.h	2008-09-01 11:43:59.000000000 +0200
++++ linux-2.6.26/fs/proc/internal.h	2008-09-02 12:17:21.000000000 +0200
+@@ -58,6 +58,9 @@ extern int proc_pid_statm(struct seq_fil
  				struct pid *pid, struct task_struct *task);
  extern int proc_pid_nsproxy(struct seq_file *m, struct pid_namespace *ns,
  				struct pid *pid, struct task_struct *task);
 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+extern int proc_pid_ipaddr(struct seq_file *m, struct pid_namespace *ns,
-+				struct pid *pid, struct task_struct *task);
++extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
 +#endif
  
  extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
  
-diff -urNp linux-2.6.25.orig/fs/proc/proc_misc.c linux-2.6.25/fs/proc/proc_misc.c
---- linux-2.6.25.orig/fs/proc/proc_misc.c	2008-04-25 15:09:12.000000000 +0200
-+++ linux-2.6.25/fs/proc/proc_misc.c	2008-04-25 15:10:25.000000000 +0200
-@@ -843,6 +843,8 @@ void create_seq_entry(char *name, mode_t
+diff -urNp linux-2.6.26.orig/fs/proc/proc_misc.c linux-2.6.26/fs/proc/proc_misc.c
+--- linux-2.6.26.orig/fs/proc/proc_misc.c	2008-09-01 11:43:59.000000000 +0200
++++ linux-2.6.26/fs/proc/proc_misc.c	2008-09-02 12:17:21.000000000 +0200
+@@ -851,6 +851,8 @@ struct proc_dir_entry *proc_root_kcore;
  
  void __init proc_misc_init(void)
  {
@@ -203,7 +370,7 @@
  	static struct {
  		char *name;
  		int (*read_proc)(char*,char**,off_t,int,int*,void*);
-@@ -858,13 +860,24 @@ void __init proc_misc_init(void)
+@@ -866,13 +868,24 @@ void __init proc_misc_init(void)
  		{"stram",	stram_read_proc},
  #endif
  		{"filesystems",	filesystems_read_proc},
@@ -228,203 +395,57 @@
  	proc_symlink("mounts", NULL, "self/mounts");
  
  	/* And now for trickier ones */
-@@ -877,7 +890,11 @@ void __init proc_misc_init(void)
- 	}
+@@ -880,14 +893,18 @@ void __init proc_misc_init(void)
+ 	proc_create("kmsg", S_IRUSR, NULL, &proc_kmsg_operations);
  #endif
- 	create_seq_entry("locks", 0, &proc_locks_operations);
+ 	proc_create("locks", 0, NULL, &proc_locks_operations);
 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+	create_seq_entry("devices", gr_mode, &proc_devinfo_operations);
++	proc_create("devices", gr_mode, NULL, &proc_devinfo_operations);
 +#else
- 	create_seq_entry("devices", 0, &proc_devinfo_operations);
+ 	proc_create("devices", 0, NULL, &proc_devinfo_operations);
 +#endif
- 	create_seq_entry("cpuinfo", 0, &proc_cpuinfo_operations);
+ 	proc_create("cpuinfo", 0, NULL, &proc_cpuinfo_operations);
  #ifdef CONFIG_BLOCK
- 	create_seq_entry("partitions", 0, &proc_partitions_operations);
-@@ -885,7 +902,11 @@ void __init proc_misc_init(void)
- 	create_seq_entry("stat", 0, &proc_stat_operations);
- 	create_seq_entry("interrupts", 0, &proc_interrupts_operations);
- #ifdef CONFIG_SLABINFO
-+#ifdef CONFIG_GRKRENSEC_PROC_ADD
-+	create_seq_entry("slabinfo",S_IWUSR|gr_mode,&proc_slabinfo_operations);
-+#else
- 	create_seq_entry("slabinfo",S_IWUSR|S_IRUGO,&proc_slabinfo_operations);
-+#endif
- #ifdef CONFIG_DEBUG_SLAB_LEAK
- 	create_seq_entry("slab_allocators", 0 ,&proc_slabstats_operations);
+ 	proc_create("partitions", 0, NULL, &proc_partitions_operations);
  #endif
-@@ -903,7 +924,7 @@ void __init proc_misc_init(void)
+ 	proc_create("stat", 0, NULL, &proc_stat_operations);
+ 	proc_create("interrupts", 0, NULL, &proc_interrupts_operations);
+-#ifdef CONFIG_SLABINFO
++#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
+ 	proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
+ #ifdef CONFIG_DEBUG_SLAB_LEAK
+ 	proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
+@@ -909,7 +926,7 @@ void __init proc_misc_init(void)
  #ifdef CONFIG_SCHEDSTATS
- 	create_seq_entry("schedstat", 0, &proc_schedstat_operations);
+ 	proc_create("schedstat", 0, NULL, &proc_schedstat_operations);
  #endif
 -#ifdef CONFIG_PROC_KCORE
 +#if defined(CONFIG_PROC_KCORE) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- 	proc_root_kcore = create_proc_entry("kcore", S_IRUSR, NULL);
- 	if (proc_root_kcore) {
- 		proc_root_kcore->proc_fops = &proc_kcore_operations;
-diff -urNp linux-2.6.25.orig/fs/proc/root.c linux-2.6.25/fs/proc/root.c
---- linux-2.6.25.orig/fs/proc/root.c	2008-04-25 15:09:12.000000000 +0200
-+++ linux-2.6.25/fs/proc/root.c	2008-04-25 15:10:25.000000000 +0200
-@@ -140,7 +140,15 @@ void __init proc_root_init(void)
+ 	proc_root_kcore = proc_create("kcore", S_IRUSR, NULL, &proc_kcore_operations);
+ 	if (proc_root_kcore)
+ 		proc_root_kcore->size =
+diff -urNp linux-2.6.26.orig/fs/proc/root.c linux-2.6.26/fs/proc/root.c
+--- linux-2.6.26.orig/fs/proc/root.c	2008-09-01 11:43:59.000000000 +0200
++++ linux-2.6.26/fs/proc/root.c	2008-09-02 12:17:21.000000000 +0200
+@@ -139,7 +139,15 @@ void __init proc_root_init(void)
  #ifdef CONFIG_PROC_DEVICETREE
  	proc_device_tree_init();
  #endif
 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
 +#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_bus = proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
++	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_bus = proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
++	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
 +#endif
 +#else
- 	proc_bus = proc_mkdir("bus", NULL);
+ 	proc_mkdir("bus", NULL);
 +#endif
- 	proc_vx_init();
  	proc_sys_init();
+ 	proc_vx_init();
  }
-diff -urNp linux-2.6.25.orig/grsecurity/Kconfig linux-2.6.25/grsecurity/Kconfig
---- linux-2.6.25.orig/grsecurity/Kconfig	1970-01-01 01:00:00.000000000 +0100
-+++ linux-2.6.25/grsecurity/Kconfig	2008-04-25 15:10:25.000000000 +0200
-@@ -0,0 +1,123 @@
-+#
-+# grecurity configuration
-+#
-+
-+menu "Grsecurity"
-+
-+config GRKERNSEC
-+	bool "Grsecurity"
-+	select CRYPTO
-+	select CRYPTO_SHA256
-+	select SECURITY
-+	select SECURITY_CAPABILITIES
-+	help
-+	  If you say Y here, you will be able to configure many features
-+	  that will enhance the security of your system.  It is highly
-+	  recommended that you say Y here and read through the help
-+	  for each option so that you fully understand the features and
-+	  can evaluate their usefulness for your machine.
-+
-+menu "Filesystem Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_PROC
-+	bool "Proc restrictions"
-+	help
-+	  If you say Y here, the permissions of the /proc filesystem
-+	  will be altered to enhance system security and privacy.  You MUST
-+  	  choose either a user only restriction or a user and group restriction.
-+	  Depending upon the option you choose, you can either restrict users to
-+	  see only the processes they themselves run, or choose a group that can
-+	  view all processes and files normally restricted to root if you choose
-+	  the "restrict to user only" option.  NOTE: If you're running identd as
-+	  a non-root user, you will have to run it as the group you specify here.
-+
-+config GRKERNSEC_PROC_USER
-+	bool "Restrict /proc to user only"
-+	depends on GRKERNSEC_PROC
-+	help
-+	  If you say Y here, non-root users will only be able to view their own
-+	  processes, and restricts them from viewing network-related information,
-+	  and viewing kernel symbol and module information.
-+
-+config GRKERNSEC_PROC_USERGROUP
-+	bool "Allow special group"
-+	depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
-+	help
-+	  If you say Y here, you will be able to select a group that will be
-+	  able to view all processes, network-related information, and
-+	  kernel and symbol information.  This option is useful if you want
-+	  to run identd as a non-root user.
-+
-+config GRKERNSEC_PROC_GID
-+	int "GID for special group"
-+	depends on GRKERNSEC_PROC_USERGROUP
-+	default 1001
-+
-+config GRKERNSEC_PROC_ADD
-+	bool "Additional restrictions"
-+	depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
-+	help
-+	  If you say Y here, additional restrictions will be placed on
-+	  /proc that keep normal users from viewing device information and 
-+	  slabinfo information that could be useful for exploits.
-+
-+config GRKERNSEC_LINK
<<Diff was trimmed, longer than 597 lines>>

---- CVS-web:
    http://cvs.pld-linux.org/cgi-bin/cvsweb.cgi/SOURCES/linux-2.6-grsec-vs-minimal.patch?r1=1.1.2.8.2.8&r2=1.1.2.8.2.9&f=u



More information about the pld-cvs-commit mailing list