SOURCES (LINUX_2_6): linux-2.6-grsec_full.patch - pldized

zbyniu zbyniu at pld-linux.org
Tue Oct 28 22:08:32 CET 2008


Author: zbyniu                       Date: Tue Oct 28 21:08:32 2008 GMT
Module: SOURCES                       Tag: LINUX_2_6
---- Log message:
- pldized

---- Files affected:
SOURCES:
   linux-2.6-grsec_full.patch (1.1.2.45 -> 1.1.2.46) 

---- Diffs:

================================================================
Index: SOURCES/linux-2.6-grsec_full.patch
diff -u SOURCES/linux-2.6-grsec_full.patch:1.1.2.45 SOURCES/linux-2.6-grsec_full.patch:1.1.2.46
--- SOURCES/linux-2.6-grsec_full.patch:1.1.2.45	Tue Oct 28 22:06:42 2008
+++ SOURCES/linux-2.6-grsec_full.patch	Tue Oct 28 22:08:26 2008
@@ -39,9 +39,9 @@
 --- linux-2.6.27.4/arch/alpha/kernel/ptrace.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/arch/alpha/kernel/ptrace.c	2008-10-25 12:03:06.000000000 -0400
 @@ -15,6 +15,7 @@
- #include <linux/slab.h>
  #include <linux/security.h>
  #include <linux/signal.h>
+ #include <linux/vs_base.h>
 +#include <linux/grsecurity.h>
  
  #include <asm/uaccess.h>
@@ -13463,9 +13463,9 @@
 --- linux-2.6.27.4/fs/binfmt_aout.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/binfmt_aout.c	2008-10-27 22:36:18.000000000 -0400
 @@ -24,6 +24,7 @@
- #include <linux/binfmts.h>
  #include <linux/personality.h>
  #include <linux/init.h>
+ #include <linux/vs_memory.h>
 +#include <linux/grsecurity.h>
  
  #include <asm/system.h>
@@ -13544,9 +13544,9 @@
 --- linux-2.6.27.4/fs/binfmt_elf.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/binfmt_elf.c	2008-10-27 22:36:18.000000000 -0400
 @@ -38,10 +38,16 @@
- #include <linux/random.h>
  #include <linux/elf.h>
  #include <linux/utsname.h>
+ #include <linux/vs_memory.h>
 +#include <linux/grsecurity.h>
 +
  #include <asm/uaccess.h>
@@ -14680,15 +14680,23 @@
 diff -urNp linux-2.6.27.4/fs/ext3/balloc.c linux-2.6.27.4/fs/ext3/balloc.c
 --- linux-2.6.27.4/fs/ext3/balloc.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/ext3/balloc.c	2008-10-25 12:03:07.000000000 -0400
-@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
+@@ -1435,14 +1435,14 @@ static int ext3_has_free_blocks(struct s
+ 	DLIMIT_ADJUST_BLOCK(sb, dx_current_tag(), &free_blocks, &root_blocks);
  
- 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
--	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
+ 	cond = (free_blocks < root_blocks + 1 &&
+-		!capable(CAP_SYS_RESOURCE) &&
++		!capable_nolog(CAP_SYS_RESOURCE) &&
  		sbi->s_resuid != current->fsuid &&
- 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- 		return 0;
+ 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid)));
+ 
+ 	vxdprintk(VXD_CBIT(dlim, 3),
+ 		"ext3_has_free_blocks(%p): %llu<%llu+1, %c, %u!=%u r=%d",
+ 		sb, free_blocks, root_blocks,
+-		!capable(CAP_SYS_RESOURCE)?'1':'0',
++		!capable_nolog(CAP_SYS_RESOURCE)?'1':'0',
+ 		sbi->s_resuid, current->fsuid, cond?0:1);
+ 
+ 	return (cond ? 0 : 1);
 diff -urNp linux-2.6.27.4/fs/ext3/namei.c linux-2.6.27.4/fs/ext3/namei.c
 --- linux-2.6.27.4/fs/ext3/namei.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/ext3/namei.c	2008-10-27 22:36:18.000000000 -0400
@@ -14749,9 +14757,9 @@
 --- linux-2.6.27.4/fs/fcntl.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/fcntl.c	2008-10-25 12:15:49.000000000 -0400
 @@ -19,6 +19,7 @@
- #include <linux/signal.h>
  #include <linux/rcupdate.h>
  #include <linux/pid_namespace.h>
+ #include <linux/vs_limit.h>
 +#include <linux/grsecurity.h>
  
  #include <asm/poll.h>
@@ -14778,9 +14786,9 @@
 --- linux-2.6.27.4/fs/file.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/file.c	2008-10-26 03:47:18.000000000 -0400
 @@ -19,6 +19,7 @@
- #include <linux/spinlock.h>
  #include <linux/rcupdate.h>
  #include <linux/workqueue.h>
+ #include <linux/vs_limit.h>
 +#include <linux/grsecurity.h>
  
  struct fdtable_defer {
@@ -15067,9 +15075,9 @@
 --- linux-2.6.27.4/fs/namei.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/namei.c	2008-10-27 22:36:18.000000000 -0400
 @@ -31,6 +31,8 @@
- #include <linux/file.h>
- #include <linux/fcntl.h>
- #include <linux/device_cgroup.h>
+ #include <linux/vs_device.h>
+ #include <linux/vs_context.h>
+ #include <linux/pid_namespace.h>
 +#include <linux/grsecurity.h>
 +
  #include <asm/uaccess.h>
@@ -15397,9 +15405,9 @@
 --- linux-2.6.27.4/fs/namespace.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/namespace.c	2008-10-25 12:03:07.000000000 -0400
 @@ -27,6 +27,7 @@
- #include <linux/ramfs.h>
- #include <linux/log2.h>
- #include <linux/idr.h>
+ #include <linux/vs_tag.h>
+ #include <linux/vserver/space.h>
+ #include <linux/vserver/global.h>
 +#include <linux/grsecurity.h>
  #include <asm/uaccess.h>
  #include <asm/unistd.h>
@@ -15768,9 +15776,9 @@
 --- linux-2.6.27.4/fs/open.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/open.c	2008-10-26 03:40:32.000000000 -0400
 @@ -29,6 +29,7 @@
- #include <linux/rcupdate.h>
- #include <linux/audit.h>
- #include <linux/falloc.h>
+ #include <linux/vs_dlimit.h>
+ #include <linux/vs_tag.h>
+ #include <linux/vs_cowbl.h>
 +#include <linux/grsecurity.h>
  
  int vfs_statfs(struct dentry *dentry, struct kstatfs *buf)
@@ -15909,29 +15917,29 @@
  	if (user != (uid_t) -1) {
  		newattrs.ia_valid |= ATTR_UID;
 @@ -685,7 +741,7 @@ asmlinkage long sys_chown(const char __u
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto out_release;
--	error = chown_common(path.dentry, user, group);
-+	error = chown_common(path.dentry, user, group, path.mnt);
+ 	error = cow_check_and_break(&path);
+ 	if (!error)
+ #endif
+-		error = chown_common(path.dentry, user, group);
++		error = chown_common(path.dentry, user, group, path.mnt);
  	mnt_drop_write(path.mnt);
  out_release:
  	path_put(&path);
 @@ -710,7 +766,7 @@ asmlinkage long sys_fchownat(int dfd, co
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto out_release;
--	error = chown_common(path.dentry, user, group);
-+	error = chown_common(path.dentry, user, group, path.mnt);
+ 	error = cow_check_and_break(&path);
+ 	if (!error)
+ #endif
+-		error = chown_common(path.dentry, user, group);
++		error = chown_common(path.dentry, user, group, path.mnt);
  	mnt_drop_write(path.mnt);
  out_release:
  	path_put(&path);
 @@ -729,7 +785,7 @@ asmlinkage long sys_lchown(const char __
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto out_release;
--	error = chown_common(path.dentry, user, group);
-+	error = chown_common(path.dentry, user, group, path.mnt);
+ 	error = cow_check_and_break(&path);
+ 	if (!error)
+ #endif
+-		error = chown_common(path.dentry, user, group);
++		error = chown_common(path.dentry, user, group, path.mnt);
  	mnt_drop_write(path.mnt);
  out_release:
  	path_put(&path);
@@ -16053,9 +16061,9 @@
 --- linux-2.6.27.4/fs/proc/base.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/proc/base.c	2008-10-27 22:36:18.000000000 -0400
 @@ -79,6 +79,8 @@
- #include <linux/oom.h>
- #include <linux/elf.h>
  #include <linux/pid_namespace.h>
+ #include <linux/vs_context.h>
+ #include <linux/vs_network.h>
 +#include <linux/grsecurity.h>
 +
  #include "internal.h"
@@ -16235,9 +16243,9 @@
 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 +	INF("ipaddr",	  S_IRUSR, pid_ipaddr),
 +#endif
+ 	ONE("nsproxy",	S_IRUGO, pid_nsproxy),
  };
  
- static int proc_tgid_base_readdir(struct file * filp,
 @@ -2647,7 +2716,14 @@ static struct dentry *proc_pid_instantia
  	if (!inode)
  		goto out;
@@ -16268,7 +16276,7 @@
 @@ -2754,6 +2834,9 @@ int proc_pid_readdir(struct file * filp,
  {
  	unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
- 	struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
+ 	struct task_struct *reaper = get_proc_task_real(filp->f_path.dentry->d_inode);
 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 +	struct task_struct *tmp = current;
 +#endif
@@ -16291,8 +16299,8 @@
 +			continue;
 +
  		filp->f_pos = iter.tgid + TGID_OFFSET;
- 		if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
- 			put_task_struct(iter.task);
+ 		if (!vx_proc_task_visible(iter.task))
+ 			continue;
 diff -urNp linux-2.6.27.4/fs/proc/inode.c linux-2.6.27.4/fs/proc/inode.c
 --- linux-2.6.27.4/fs/proc/inode.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/proc/inode.c	2008-10-25 12:03:07.000000000 -0400
@@ -16312,9 +16320,9 @@
 --- linux-2.6.27.4/fs/proc/internal.h	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/proc/internal.h	2008-10-25 12:03:07.000000000 -0400
 @@ -55,6 +55,9 @@ extern int proc_pid_status(struct seq_fi
+ extern int proc_pid_nsproxy(struct seq_file *m, struct pid_namespace *ns,
  				struct pid *pid, struct task_struct *task);
- extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
- 				struct pid *pid, struct task_struct *task);
+ 
 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
 +#endif
@@ -16850,9 +16858,9 @@
 --- linux-2.6.27.4/fs/utimes.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/fs/utimes.c	2008-10-25 12:13:12.000000000 -0400
 @@ -8,6 +8,7 @@
- #include <linux/stat.h>
- #include <linux/utime.h>
  #include <linux/syscalls.h>
+ #include <linux/mount.h>
+ #include <linux/vs_cowbl.h>
 +#include <linux/grsecurity.h>
  #include <asm/uaccess.h>
  #include <asm/unistd.h>
@@ -30688,9 +30696,9 @@
 --- linux-2.6.27.4/ipc/msg.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/ipc/msg.c	2008-10-25 12:03:07.000000000 -0400
 @@ -38,6 +38,7 @@
- #include <linux/rwsem.h>
  #include <linux/nsproxy.h>
  #include <linux/ipc_namespace.h>
+ #include <linux/vs_base.h>
 +#include <linux/grsecurity.h>
  
  #include <asm/current.h>
@@ -30728,9 +30736,9 @@
 --- linux-2.6.27.4/ipc/sem.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/ipc/sem.c	2008-10-25 12:03:07.000000000 -0400
 @@ -83,6 +83,7 @@
- #include <linux/rwsem.h>
- #include <linux/nsproxy.h>
  #include <linux/ipc_namespace.h>
+ #include <linux/vs_base.h>
+ #include <linux/vs_limit.h>
 +#include <linux/grsecurity.h>
  
  #include <asm/uaccess.h>
@@ -30768,9 +30776,9 @@
 --- linux-2.6.27.4/ipc/shm.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/ipc/shm.c	2008-10-25 12:03:07.000000000 -0400
 @@ -39,6 +39,7 @@
- #include <linux/nsproxy.h>
- #include <linux/mount.h>
  #include <linux/ipc_namespace.h>
+ #include <linux/vs_context.h>
+ #include <linux/vs_limit.h>
 +#include <linux/grsecurity.h>
  
  #include <asm/uaccess.h>
@@ -30873,17 +30881,17 @@
 --- linux-2.6.27.4/kernel/capability.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/kernel/capability.c	2008-10-26 03:32:46.000000000 -0400
 @@ -13,6 +13,7 @@
- #include <linux/security.h>
  #include <linux/syscalls.h>
  #include <linux/pid_namespace.h>
+ #include <linux/vs_context.h>
 +#include <linux/grsecurity.h>
  #include <asm/uaccess.h>
  
  /*
 @@ -498,10 +499,21 @@ asmlinkage long sys_capset(cap_user_head
-  */
- int capable(int cap)
- {
+ 	/* here for now so we don't require task locking */
+ 	if (vs_check_bit(VXC_CAP_MASK, cap) && !vx_mcaps(1L << cap))
+ 		return 0;
 -	if (has_capability(current, cap)) {
 +	if (has_capability(current, cap) && gr_task_is_capable(current, cap)) {
  		current->flags |= PF_SUPERPRIV;
@@ -30942,9 +30950,9 @@
 --- linux-2.6.27.4/kernel/exit.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/kernel/exit.c	2008-10-27 22:36:18.000000000 -0400
 @@ -47,6 +47,11 @@
- #include <linux/blkdev.h>
- #include <linux/task_io_accounting_ops.h>
- #include <linux/tracehook.h>
+ #include <linux/vs_network.h> 
+ #include <linux/vs_pid.h> 
+ #include <linux/vserver/global.h>
 +#include <linux/grsecurity.h>
 +
 +#ifdef CONFIG_GRKERNSEC
@@ -31025,9 +31033,9 @@
 --- linux-2.6.27.4/kernel/fork.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/kernel/fork.c	2008-10-27 22:36:18.000000000 -0400
 @@ -58,6 +58,7 @@
- #include <linux/tty.h>
- #include <linux/proc_fs.h>
- #include <linux/blkdev.h>
+ #include <linux/vs_limit.h>
+ #include <linux/vs_memory.h>
+ #include <linux/vserver/global.h>
 +#include <linux/grsecurity.h>
  
  #include <asm/pgtable.h>
@@ -31117,9 +31125,9 @@
 +
 +	gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->user->processes), 0);
 +
+ 	if (!vx_nproc_avail(1))
+ 		goto bad_fork_cleanup_vm;
  	if (atomic_read(&p->user->processes) >=
- 			p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
- 		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
 @@ -1105,6 +1135,8 @@ static struct task_struct *copy_process(
  			goto bad_fork_free_pid;
  	}
@@ -31949,9 +31957,9 @@
 --- linux-2.6.27.4/kernel/pid.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/kernel/pid.c	2008-10-27 22:36:18.000000000 -0400
 @@ -36,6 +36,7 @@
- #include <linux/pid_namespace.h>
- #include <linux/init_task.h>
  #include <linux/syscalls.h>
+ #include <linux/vs_pid.h>
+ #include <linux/vserver/global.h>
 +#include <linux/grsecurity.h>
  
  #define pid_hashfn(nr, ns)	\
@@ -32037,9 +32045,9 @@
 --- linux-2.6.27.4/kernel/printk.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/kernel/printk.c	2008-10-25 12:03:07.000000000 -0400
 @@ -32,6 +32,7 @@
- #include <linux/security.h>
  #include <linux/bootmem.h>
  #include <linux/syscalls.h>
+ #include <linux/vs_cvirt.h>
 +#include <linux/grsecurity.h>
  
  #include <asm/uaccess.h>
@@ -32060,9 +32068,9 @@
 --- linux-2.6.27.4/kernel/ptrace.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/kernel/ptrace.c	2008-10-25 12:03:07.000000000 -0400
 @@ -21,6 +21,7 @@
- #include <linux/audit.h>
  #include <linux/pid_namespace.h>
  #include <linux/syscalls.h>
+ #include <linux/vs_context.h>
 +#include <linux/grsecurity.h>
  
  #include <asm/pgtable.h>
@@ -32141,9 +32149,9 @@
 --- linux-2.6.27.4/kernel/sched.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/kernel/sched.c	2008-10-27 22:36:18.000000000 -0400
 @@ -71,6 +71,7 @@
- #include <linux/debugfs.h>
- #include <linux/ctype.h>
  #include <linux/ftrace.h>
+ #include <linux/vs_sched.h>
+ #include <linux/vs_cvirt.h>
 +#include <linux/grsecurity.h>
  
  #include <asm/tlb.h>
@@ -32155,7 +32163,7 @@
 -	if (increment < 0 && !can_nice(current, nice))
 +	if (increment < 0 && (!can_nice(current, nice) ||
 +			      gr_handle_chroot_nice()))
- 		return -EPERM;
+ 		return vx_flags(VXF_IGNEG_NICE, 0) ? 0 : -EPERM;
  
  	retval = security_task_setnice(current, nice);
 @@ -6225,7 +6227,7 @@ static struct ctl_table sd_ctl_dir[] = {
@@ -32185,12 +32193,12 @@
  #include <linux/pid_namespace.h>
 +#include <linux/grsecurity.h>
  #include <linux/nsproxy.h>
- 
- #include <asm/param.h>
+ #include <linux/vs_context.h>
+ #include <linux/vs_pid.h>
 @@ -595,6 +596,9 @@ static int check_kill_permission(int sig
- 		}
+ 		return error;
  	}
- 
+ skip:
 +	if (gr_handle_signal(t, sig))
 +		return -EPERM;
 +
@@ -32621,7 +32629,7 @@
 @@ -92,6 +93,9 @@ asmlinkage long sys_stime(time_t __user 
  		return err;
  
- 	do_settimeofday(&tv);
+ 	vx_settimeofday(&tv);
 +
 +	gr_log_timechange();
 +
@@ -33364,9 +33372,9 @@
 --- linux-2.6.27.4/mm/mlock.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/mm/mlock.c	2008-10-27 22:36:19.000000000 -0400
 @@ -12,6 +12,7 @@
- #include <linux/syscalls.h>
  #include <linux/sched.h>
  #include <linux/module.h>
+ #include <linux/vs_memory.h>
 +#include <linux/grsecurity.h>
  
  int can_do_mlock(void)
@@ -33428,9 +33436,9 @@
  
  	ret = -ENOMEM;
 +	gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm, 1);
+ 	if (!vx_vmlocked_avail(current->mm, current->mm->total_vm))
+ 		goto out;
  	if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
- 	    capable(CAP_IPC_LOCK))
- 		ret = do_mlockall(flags);
 diff -urNp linux-2.6.27.4/mm/mmap.c linux-2.6.27.4/mm/mmap.c
 --- linux-2.6.27.4/mm/mmap.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/mm/mmap.c	2008-10-27 22:36:19.000000000 -0400
@@ -34167,7 +34175,7 @@
 +		}
 +#endif
 +
- 		mm->total_vm -= nrpages;
+ 		vx_vmpages_sub(mm, nrpages);
  		if (vma->vm_flags & VM_LOCKED)
  			mm->locked_vm -= nrpages;
 @@ -1792,6 +2049,16 @@ detach_vmas_to_be_unmapped(struct mm_str
@@ -34420,7 +34428,7 @@
  		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
  			return -EAGAIN;
  	}
-@@ -2006,22 +2413,22 @@ unsigned long do_brk(unsigned long addr,
+@@ -2006,23 +2413,23 @@ unsigned long do_brk(unsigned long addr,
  	/*
  	 * Clear old maps.  this also does some error checking for us
  	 */
@@ -34442,8 +34450,10 @@
  	if (mm->map_count > sysctl_max_map_count)
  		return -ENOMEM;
  
--	if (security_vm_enough_memory(len >> PAGE_SHIFT))
-+	if (security_vm_enough_memory(charged))
+-	if (security_vm_enough_memory(len >> PAGE_SHIFT) ||
+-		!vx_vmpages_avail(mm, len >> PAGE_SHIFT))
++	if (security_vm_enough_memory(charged) ||
++		!vx_vmpages_avail(mm, charged))
  		return -ENOMEM;
  
  	/* Can we just expand an old private anonymous mapping? */
@@ -34481,11 +34491,11 @@
 +#endif
 +
  out:
--	mm->total_vm += len >> PAGE_SHIFT;
-+	mm->total_vm += charged;
+-	vx_vmpages_add(mm, len >> PAGE_SHIFT);
++	vx_vmpages_add(mm, charged);
  	if (flags & VM_LOCKED) {
--		mm->locked_vm += len >> PAGE_SHIFT;
-+		mm->locked_vm += charged;
+-		vx_vmlocked_add(mm, len >> PAGE_SHIFT);
++		vx_vmlocked_add(mm, charged);
  		make_pages_present(addr, addr + len);
  	}
 +	track_exec_limit(mm, addr, addr + len, flags);
@@ -35357,7 +35367,7 @@
 diff -urNp linux-2.6.27.4/net/ipv4/inet_hashtables.c linux-2.6.27.4/net/ipv4/inet_hashtables.c
 --- linux-2.6.27.4/net/ipv4/inet_hashtables.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/net/ipv4/inet_hashtables.c	2008-10-25 12:03:07.000000000 -0400
-@@ -18,11 +18,14 @@
+@@ -18,12 +18,15 @@
  #include <linux/sched.h>
  #include <linux/slab.h>
  #include <linux/wait.h>
@@ -35365,6 +35375,7 @@
  
  #include <net/inet_connection_sock.h>
  #include <net/inet_hashtables.h>
+ #include <net/route.h>
  #include <net/ip.h>
  
 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
@@ -35827,9 +35838,9 @@
 --- linux-2.6.27.4/net/unix/af_unix.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/net/unix/af_unix.c	2008-10-25 12:03:07.000000000 -0400
 @@ -114,6 +114,7 @@
- #include <linux/mount.h>
- #include <net/checksum.h>
  #include <linux/security.h>
+ #include <linux/vs_context.h>
+ #include <linux/vs_limit.h>
 +#include <linux/grsecurity.h>
  
  static struct hlist_head unix_socket_table[UNIX_HASH_SIZE + 1];
@@ -35926,16 +35937,16 @@
 --- linux-2.6.27.4/security/commoncap.c	2008-10-22 17:38:01.000000000 -0400
 +++ linux-2.6.27.4/security/commoncap.c	2008-10-25 12:03:07.000000000 -0400
 @@ -26,10 +26,13 @@
- #include <linux/sched.h>
  #include <linux/prctl.h>
  #include <linux/securebits.h>
+ #include <linux/vs_context.h>
 +#include <linux/grsecurity.h>
 +
 +extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
  
  int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
  {
--	NETLINK_CB(skb).eff_cap = current->cap_effective;
+-	NETLINK_CB(skb).eff_cap = vx_mbcaps(current->cap_effective);
 +	NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
  	return 0;
  }
@@ -35944,8 +35955,8 @@
  int cap_capable (struct task_struct *tsk, int cap)
  {
  	/* Derived from include/linux/sched.h:capable. */
--	if (cap_raised(tsk->cap_effective, cap))
-+	if (cap_raised (tsk->cap_effective, cap))
+-	if (vx_cap_raised(vxi, tsk->cap_effective, cap))
++	if (vx_cap_raised(vxi, tsk->cap_effective, cap))
 +		return 0;
 +	return -EPERM;
 +}
================================================================

---- CVS-web:
    http://cvs.pld-linux.org/cgi-bin/cvsweb.cgi/SOURCES/linux-2.6-grsec_full.patch?r1=1.1.2.45&r2=1.1.2.46&f=u



More information about the pld-cvs-commit mailing list