rpms/kernel/F-10 make-mmap_min_addr-suck-less.patch, NONE, 1.1 kernel.spec, 1.1402, 1.1403
Kyle McMartin
kyle at fedoraproject.org
Wed Aug 19 02:33:33 UTC 2009
Author: kyle
Update of /cvs/pkgs/rpms/kernel/F-10
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv25801
Modified Files:
kernel.spec
Added Files:
make-mmap_min_addr-suck-less.patch
Log Message:
* Tue Aug 18 2009 Kyle McMartin <kyle at redhat.com> 2.6.29.6-102
- CVE-2009-2848: execve: must clear current->clear_child_tid
- Backport several upstream commits 52dec22e739eec8f3a0154f768a599f5489048bd
to improve mmap_min_addr.
make-mmap_min_addr-suck-less.patch:
include/linux/mm.h | 17 ----------------
include/linux/security.h | 22 ++++++++++++++++++++-
kernel/sysctl.c | 9 +++-----
mm/Kconfig | 18 +++++++++++++++++
security/Kconfig | 22 ++++++++-------------
security/Makefile | 2 -
security/capability.c | 9 --------
security/commoncap.c | 30 ++++++++++++++++++++++++++++
security/min_addr.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++
security/security.c | 3 --
security/selinux/hooks.c | 14 ++++++++++++-
11 files changed, 145 insertions(+), 50 deletions(-)
--- NEW FILE make-mmap_min_addr-suck-less.patch ---
commit 954cd03196be852d3a471daec79bf7cbdaf93d65
Author: Eric Paris <eparis at redhat.com>
Date: Fri Aug 7 14:53:57 2009 -0400
security: define round_hint_to_min in !CONFIG_SECURITY
Fix the header files to define round_hint_to_min() and to define
mmap_min_addr_handler() in the !CONFIG_SECURITY case.
Built and tested with !CONFIG_SECURITY
Signed-off-by: Eric Paris <eparis at redhat.com>
Signed-off-by: James Morris <jmorris at namei.org>
(cherry picked from commit 1d9959734a1949ea4f2427bd2d8b21ede6b2441c)
commit 020d8d2dc7b9fae32f9e259cc5227cad108bac17
Author: Eric Paris <eparis at redhat.com>
Date: Fri Jul 31 12:54:11 2009 -0400
Security/SELinux: seperate lsm specific mmap_min_addr
Currently SELinux enforcement of controls on the ability to map low memory
is determined by the mmap_min_addr tunable. This patch causes SELinux to
ignore the tunable and instead use a seperate Kconfig option specific to how
much space the LSM should protect.
The tunable will now only control the need for CAP_SYS_RAWIO and SELinux
permissions will always protect the amount of low memory designated by
CONFIG_LSM_MMAP_MIN_ADDR.
This allows users who need to disable the mmap_min_addr controls (usual reason
being they run WINE as a non-root user) to do so and still have SELinux
controls preventing confined domains (like a web server) from being able to
map some area of low memory.
Signed-off-by: Eric Paris <eparis at redhat.com>
Signed-off-by: James Morris <jmorris at namei.org>
(cherry picked from commit 788084aba2ab7348257597496befcbccabdc98a3)
commit 141173509c591056154077288f3657b7750b4629
Author: Eric Paris <eparis at redhat.com>
Date: Fri Jul 31 12:54:05 2009 -0400
SELinux: call cap_file_mmap in selinux_file_mmap
Currently SELinux does not check CAP_SYS_RAWIO in the file_mmap hook. This
means there is no DAC check on the ability to mmap low addresses in the
memory space. This function adds the DAC check for CAP_SYS_RAWIO while
maintaining the selinux check on mmap_zero. This means that processes
which need to mmap low memory will need CAP_SYS_RAWIO and mmap_zero but will
NOT need the SELinux sys_rawio capability.
Signed-off-by: Eric Paris <eparis at redhat.com>
Signed-off-by: James Morris <jmorris at namei.org>
(cherry picked from commit 8cf948e744e0218af604c32edecde10006dc8e9e)
commit 5b6a9b164793aa837e8cf813cae0f1ec3c5e4c7d
Author: Eric Paris <eparis at redhat.com>
Date: Fri Jul 31 12:53:58 2009 -0400
Capabilities: move cap_file_mmap to commoncap.c
Currently we duplicate the mmap_min_addr test in cap_file_mmap and in
security_file_mmap if !CONFIG_SECURITY. This patch moves cap_file_mmap
into commoncap.c and then calls that function directly from
security_file_mmap ifndef CONFIG_SECURITY like all of the other capability
checks are done.
Signed-off-by: Eric Paris <eparis at redhat.com>
Acked-by: Serge Hallyn <serue at us.ibm.com>
Signed-off-by: James Morris <jmorris at namei.org>
(cherry picked from commit 9c0d90103c7e0eb6e638e5b649e9f6d8d9c1b4b3)
commit d464b4a55b8dafeb94d8a14d3c609b7b635ab291
Author: Christoph Lameter <cl at linux-foundation.org>
Date: Wed Jun 3 16:04:31 2009 -0400
security: use mmap_min_addr indepedently of security models
commit e0a94c2a63f2644826069044649669b5e7ca75d3 upstream.
This patch removes the dependency of mmap_min_addr on CONFIG_SECURITY.
It also sets a default mmap_min_addr of 4096.
mmapping of addresses below 4096 will only be possible for processes
with CAP_SYS_RAWIO.
Signed-off-by: Christoph Lameter <cl at linux-foundation.org>
Acked-by: Eric Paris <eparis at redhat.com>
Looks-ok-by: Linus Torvalds <torvalds at linux-foundation.org>
Signed-off-by: James Morris <jmorris at namei.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
(cherry picked from commit 2401fe3fbc5bd7db741867102fe355babce76506)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 93d0a69..190c298 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -34,8 +34,6 @@ extern int sysctl_legacy_va_layout;
#define sysctl_legacy_va_layout 0
#endif
-extern unsigned long mmap_min_addr;
-
#include <asm/page.h>
#include <asm/pgtable.h>
#include <asm/processor.h>
@@ -585,21 +583,6 @@ static inline void set_page_links(struct page *page, enum zone_type zone,
}
/*
- * If a hint addr is less than mmap_min_addr change hint to be as
- * low as possible but still greater than mmap_min_addr
- */
-static inline unsigned long round_hint_to_min(unsigned long hint)
-{
-#ifdef CONFIG_SECURITY
- hint &= PAGE_MASK;
- if (((void *)hint != NULL) &&
- (hint < mmap_min_addr))
- return PAGE_ALIGN(mmap_min_addr);
-#endif
- return hint;
-}
-
-/*
* Some inline functions in vmstat.h depend on page_zone()
*/
#include <linux/vmstat.h>
diff --git a/include/linux/security.h b/include/linux/security.h
index 1f2ab63..f12649b 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -28,6 +28,7 @@
#include <linux/resource.h>
#include <linux/sem.h>
#include <linux/shm.h>
+#include <linux/mm.h> /* PAGE_ALIGN */
#include <linux/msg.h>
#include <linux/sched.h>
#include <linux/key.h>
@@ -65,6 +66,9 @@ extern int cap_inode_setxattr(struct dentry *dentry, const char *name,
extern int cap_inode_removexattr(struct dentry *dentry, const char *name);
extern int cap_inode_need_killpriv(struct dentry *dentry);
extern int cap_inode_killpriv(struct dentry *dentry);
+extern int cap_file_mmap(struct file *file, unsigned long reqprot,
+ unsigned long prot, unsigned long flags,
+ unsigned long addr, unsigned long addr_only);
extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
unsigned long arg4, unsigned long arg5);
@@ -91,6 +95,7 @@ extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);
extern int cap_netlink_recv(struct sk_buff *skb, int cap);
extern unsigned long mmap_min_addr;
+extern unsigned long dac_mmap_min_addr;
/*
* Values used in the task_security_ops calls
*/
@@ -115,6 +120,21 @@ struct request_sock;
#define LSM_UNSAFE_PTRACE 2
#define LSM_UNSAFE_PTRACE_CAP 4
+/*
+ * If a hint addr is less than mmap_min_addr change hint to be as
+ * low as possible but still greater than mmap_min_addr
+ */
+static inline unsigned long round_hint_to_min(unsigned long hint)
+{
+ hint &= PAGE_MASK;
+ if (((void *)hint != NULL) &&
+ (hint < mmap_min_addr))
+ return PAGE_ALIGN(mmap_min_addr);
+ return hint;
+}
+extern int mmap_min_addr_handler(struct ctl_table *table, int write, struct file *filp,
+ void __user *buffer, size_t *lenp, loff_t *ppos);
+
#ifdef CONFIG_SECURITY
struct security_mnt_opts {
@@ -2203,7 +2223,7 @@ static inline int security_file_mmap(struct file *file, unsigned long reqprot,
unsigned long addr,
unsigned long addr_only)
{
- return 0;
+ return cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
}
static inline int security_file_mprotect(struct vm_area_struct *vma,
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 7755ae7..a3eead3 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -48,6 +48,7 @@
#include <linux/acpi.h>
#include <linux/reboot.h>
#include <linux/ftrace.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
#include <asm/processor.h>
@@ -1210,16 +1211,14 @@ static struct ctl_table vm_table[] = {
.strategy = &sysctl_jiffies,
},
#endif
-#ifdef CONFIG_SECURITY
{
.ctl_name = CTL_UNNUMBERED,
.procname = "mmap_min_addr",
- .data = &mmap_min_addr,
- .maxlen = sizeof(unsigned long),
+ .data = &dac_mmap_min_addr,
+ .maxlen = sizeof(unsigned long),
.mode = 0644,
- .proc_handler = &proc_doulongvec_minmax,
+ .proc_handler = &mmap_min_addr_handler,
},
-#endif
#ifdef CONFIG_NUMA
{
.ctl_name = CTL_UNNUMBERED,
diff --git a/mm/Kconfig b/mm/Kconfig
index a5b7781..be3ae9a 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -216,3 +216,21 @@ config UNEVICTABLE_LRU
config MMU_NOTIFIER
bool
+
+config DEFAULT_MMAP_MIN_ADDR
+ int "Low address space to protect from user allocation"
+ default 4096
+ help
+ This is the portion of low virtual memory which should be protected
+ from userspace allocation. Keeping a user from writing to low pages
+ can help reduce the impact of kernel NULL pointer bugs.
+
+ For most ia64, ppc64 and x86 users with lots of address space
+ a value of 65536 is reasonable and should cause no problems.
+ On arm and other archs it should not be higher than 32768.
+ Programs which use vm86 functionality or have some need to map
+ this low address space will need CAP_SYS_RAWIO or disable this
+ protection by setting the value to 0.
+
+ This value can be changed after boot using the
+ /proc/sys/vm/mmap_min_addr tunable.
diff --git a/security/Kconfig b/security/Kconfig
index 9438535..05da5ae 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -109,14 +109,14 @@ config SECURITY_ROOTPLUG
See <http://www.linuxjournal.com/article.php?sid=6279> for
more information about this module.
-
+
If you are unsure how to answer this question, answer N.
-config SECURITY_DEFAULT_MMAP_MIN_ADDR
- int "Low address space to protect from user allocation"
- depends on SECURITY
- default 0
- help
+config LSM_MMAP_MIN_ADDR
+ int "Low address space for LSM to from user allocation"
+ depends on SECURITY && SECURITY_SELINUX
+ default 65535
+ help
This is the portion of low virtual memory which should be protected
from userspace allocation. Keeping a user from writing to low pages
can help reduce the impact of kernel NULL pointer bugs.
@@ -124,13 +124,9 @@ config SECURITY_DEFAULT_MMAP_MIN_ADDR
For most ia64, ppc64 and x86 users with lots of address space
a value of 65536 is reasonable and should cause no problems.
On arm and other archs it should not be higher than 32768.
- Programs which use vm86 functionality would either need additional
- permissions from either the LSM or the capabilities module or have
- this protection disabled.
-
- This value can be changed after boot using the
- /proc/sys/vm/mmap_min_addr tunable.
-
+ Programs which use vm86 functionality or have some need to map
+ this low address space will need the permission specific to the
+ systems running LSM.
source security/selinux/Kconfig
source security/smack/Kconfig
diff --git a/security/Makefile b/security/Makefile
index c05c127..e457ea7 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -7,7 +7,7 @@ subdir-$(CONFIG_SECURITY_SELINUX) += selinux
subdir-$(CONFIG_SECURITY_SMACK) += smack
# always enable default capabilities
-obj-y += commoncap.o
+obj-y += commoncap.o min_addr.o
# Object file lists
obj-$(CONFIG_SECURITY) += security.o capability.o
diff --git a/security/capability.c b/security/capability.c
index c545bd1..2408d60 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -330,15 +330,6 @@ static int cap_file_ioctl(struct file *file, unsigned int command,
return 0;
}
-static int cap_file_mmap(struct file *file, unsigned long reqprot,
- unsigned long prot, unsigned long flags,
- unsigned long addr, unsigned long addr_only)
-{
- if ((addr < mmap_min_addr) && !capable(CAP_SYS_RAWIO))
- return -EACCES;
- return 0;
-}
-
static int cap_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
unsigned long prot)
{
diff --git a/security/commoncap.c b/security/commoncap.c
index beac025..42bb7c0 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -952,3 +952,33 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
cap_sys_admin = 1;
return __vm_enough_memory(mm, pages, cap_sys_admin);
}
+
+/*
+ * cap_file_mmap - check if able to map given addr
+ * @file: unused
+ * @reqprot: unused
+ * @prot: unused
+ * @flags: unused
+ * @addr: address attempting to be mapped
+ * @addr_only: unused
+ *
+ * If the process is attempting to map memory below mmap_min_addr they need
+ * CAP_SYS_RAWIO. The other parameters to this function are unused by the
+ * capability security module. Returns 0 if this mapping should be allowed
+ * -EPERM if not.
+ */
+int cap_file_mmap(struct file *file, unsigned long reqprot,
+ unsigned long prot, unsigned long flags,
+ unsigned long addr, unsigned long addr_only)
+{
+ int ret = 0;
+
+ if (addr < dac_mmap_min_addr) {
+ ret = cap_capable(current, current_cred(), CAP_SYS_RAWIO,
+ SECURITY_CAP_AUDIT);
+ /* set PF_SUPERPRIV if it turns out we allow the low mmap */
+ if (ret == 0)
+ current->flags |= PF_SUPERPRIV;
+ }
+ return ret;
+}
diff --git a/security/min_addr.c b/security/min_addr.c
new file mode 100644
index 0000000..14cc7b3
--- /dev/null
+++ b/security/min_addr.c
@@ -0,0 +1,49 @@
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/security.h>
+#include <linux/sysctl.h>
+
+/* amount of vm to protect from userspace access by both DAC and the LSM*/
+unsigned long mmap_min_addr;
+/* amount of vm to protect from userspace using CAP_SYS_RAWIO (DAC) */
+unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
+/* amount of vm to protect from userspace using the LSM = CONFIG_LSM_MMAP_MIN_ADDR */
+
+/*
+ * Update mmap_min_addr = max(dac_mmap_min_addr, CONFIG_LSM_MMAP_MIN_ADDR)
+ */
+static void update_mmap_min_addr(void)
+{
+#ifdef CONFIG_LSM_MMAP_MIN_ADDR
+ if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
+ mmap_min_addr = dac_mmap_min_addr;
+ else
+ mmap_min_addr = CONFIG_LSM_MMAP_MIN_ADDR;
+#else
+ mmap_min_addr = dac_mmap_min_addr;
+#endif
+}
+
+/*
+ * sysctl handler which just sets dac_mmap_min_addr = the new value and then
+ * calls update_mmap_min_addr() so non MAP_FIXED hints get rounded properly
+ */
+int mmap_min_addr_handler(struct ctl_table *table, int write, struct file *filp,
+ void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+ int ret;
+
+ ret = proc_doulongvec_minmax(table, write, filp, buffer, lenp, ppos);
+
+ update_mmap_min_addr();
+
+ return ret;
+}
+
+int __init init_mmap_min_addr(void)
+{
+ update_mmap_min_addr();
+
+ return 0;
+}
+pure_initcall(init_mmap_min_addr);
diff --git a/security/security.c b/security/security.c
index c3586c0..c024b5d 100644
--- a/security/security.c
+++ b/security/security.c
@@ -26,9 +26,6 @@ extern void security_fixup_ops(struct security_operations *ops);
struct security_operations *security_ops; /* Initialized to NULL */
-/* amount of vm to protect from userspace access */
-unsigned long mmap_min_addr = CONFIG_SECURITY_DEFAULT_MMAP_MIN_ADDR;
-
static inline int verify(struct security_operations *ops)
{
/* verify the security_operations structure exists */
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 9d62f29..64e6fe0 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3045,9 +3045,21 @@ static int selinux_file_mmap(struct file *file, unsigned long reqprot,
int rc = 0;
u32 sid = current_sid();
- if (addr < mmap_min_addr)
+ /*
+ * notice that we are intentionally putting the SELinux check before
+ * the secondary cap_file_mmap check. This is such a likely attempt
+ * at bad behaviour/exploit that we always want to get the AVC, even
+ * if DAC would have also denied the operation.
+ */
+ if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
MEMPROTECT__MMAP_ZERO, NULL);
+ if (rc)
+ return rc;
+ }
+
+ /* do DAC check on address space usage */
+ rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
if (rc || addr_only)
return rc;
Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-10/kernel.spec,v
retrieving revision 1.1402
retrieving revision 1.1403
diff -u -p -r1.1402 -r1.1403
--- kernel.spec 19 Aug 2009 01:52:04 -0000 1.1402
+++ kernel.spec 19 Aug 2009 02:33:33 -0000 1.1403
@@ -759,9 +759,10 @@ Patch11020: linux-2.6-usb-remove-low-lat
Patch11030: linux-2.6-x86-delay-tsc-barrier.patch
# security fixes from the F-11 2.6.29.6 kernel
Patch11040: add-fno-delete-null-pointer-checks-to-gcc-cflags.patch
-Patch11050: security-use-mmap_min_addr-indepedently-of-security-models.patch
+#Patch11050: security-use-mmap_min_addr-indepedently-of-security-models.patch
Patch11060: personality-fix-per_clear_on_setid.patch
Patch11070: execve-must-clear-current-clear_child_tid.patch
+Patch11080: make-mmap_min_addr-suck-less.patch
%endif
@@ -1437,12 +1438,14 @@ ApplyPatch linux-2.6-x86-delay-tsc-barri
# fix test-after-use of null pointers
ApplyPatch add-fno-delete-null-pointer-checks-to-gcc-cflags.patch
# mmap zero page fixes
-ApplyPatch security-use-mmap_min_addr-indepedently-of-security-models.patch
+#ApplyPatch security-use-mmap_min_addr-indepedently-of-security-models.patch
ApplyPatch personality-fix-per_clear_on_setid.patch
# CVE-2009-2848
ApplyPatch execve-must-clear-current-clear_child_tid.patch
+ApplyPatch make-mmap_min_addr-suck-less.patch
+
# ======= END OF PATCH APPLICATIONS =============================
%endif
@@ -2021,6 +2024,8 @@ fi
%changelog
* Tue Aug 18 2009 Kyle McMartin <kyle at redhat.com> 2.6.29.6-102
- CVE-2009-2848: execve: must clear current->clear_child_tid
+- Backport several upstream commits 52dec22e739eec8f3a0154f768a599f5489048bd
+ to improve mmap_min_addr.
* Tue Aug 18 2009 Chuck Ebbert <cebbert at redhat.com> 2.6.29.6-99
- Intel wireless fixes from Fedora 11:
More information about the scm-commits
mailing list