オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/trunk/1.8.x/ccs-patch/patches/ccs-patch-2.6.27-hardened-gentoo.diff

Contents of /trunk/1.8.x/ccs-patch/patches/ccs-patch-2.6.27-hardened-gentoo.diff

Parent Directory Parent Directory | Revision Log Revision Log

Revision 4049 - (show annotations) (download) (as text)
Thu Oct 7 07:14:01 2010 UTC (13 years, 6 months ago) by kumaneko
File MIME type: text/x-diff
File size: 34521 byte(s) 
Merge branches/ccs-patch/ into trunk/1.8.x/ccs-patch/
1 This is TOMOYO Linux patch for Hardened Gentoo 2.6.27 .
2
3 Source code for this patch is "emerge =sys-kernel/hardened-sources-2.6.27-r8"
4 ---
5 arch/ia64/ia32/sys_ia32.c | 3 +++
6 arch/mips/kernel/ptrace32.c | 3 +++
7 fs/compat.c | 3 ++-
8 fs/compat_ioctl.c | 3 +++
9 fs/exec.c | 10 +++++++++-
10 fs/fcntl.c | 5 +++++
11 fs/ioctl.c | 3 +++
12 fs/namei.c | 36 ++++++++++++++++++++++++++++++++++++
13 fs/namespace.c | 9 +++++++++
14 fs/open.c | 25 +++++++++++++++++++++++++
15 fs/proc/proc_misc.c | 1 +
16 include/linux/init_task.h | 9 +++++++++
17 include/linux/sched.h | 6 ++++++
18 kernel/compat.c | 3 +++
19 kernel/kexec.c | 3 +++
20 kernel/kmod.c | 5 +++++
21 kernel/module.c | 5 +++++
22 kernel/ptrace.c | 5 +++++
23 kernel/sched.c | 3 +++
24 kernel/signal.c | 9 +++++++++
25 kernel/sys.c | 11 +++++++++++
26 kernel/sysctl.c | 4 ++++
27 kernel/time.c | 5 +++++
28 kernel/time/ntp.c | 3 +++
29 net/ipv4/inet_connection_sock.c | 3 +++
30 net/ipv4/inet_hashtables.c | 3 +++
31 net/ipv4/raw.c | 12 +++++++++---
32 net/ipv4/udp.c | 12 +++++++++++-
33 net/ipv6/raw.c | 12 +++++++++---
34 net/ipv6/udp.c | 9 ++++++++-
35 net/socket.c | 22 ++++++++++++++++++++++
36 net/unix/af_unix.c | 9 +++++++++
37 security/Kconfig | 2 ++
38 security/Makefile | 3 +++
39 34 files changed, 249 insertions(+), 10 deletions(-)
40
41 --- linux-2.6.27-hardened-r8.orig/arch/ia64/ia32/sys_ia32.c
42 +++ linux-2.6.27-hardened-r8/arch/ia64/ia32/sys_ia32.c
43 @@ -51,6 +51,7 @@
44 #include <asm/types.h>
45 #include <asm/uaccess.h>
46 #include <asm/unistd.h>
47 +#include <linux/ccsecurity.h>
48
49 #include "ia32priv.h"
50
51 @@ -1622,6 +1623,8 @@ sys32_ptrace (int request, pid_t pid, un
52 struct task_struct *child;
53 unsigned int value, tmp;
54 long i, ret;
55 + if (ccs_ptrace_permission(request, pid))
56 + return -EPERM;
57
58 lock_kernel();
59 if (request == PTRACE_TRACEME) {
60 --- linux-2.6.27-hardened-r8.orig/arch/mips/kernel/ptrace32.c
61 +++ linux-2.6.27-hardened-r8/arch/mips/kernel/ptrace32.c
62 @@ -35,6 +35,7 @@
63 #include <asm/system.h>
64 #include <asm/uaccess.h>
65 #include <asm/bootinfo.h>
66 +#include <linux/ccsecurity.h>
67
68 int ptrace_getregs(struct task_struct *child, __s64 __user *data);
69 int ptrace_setregs(struct task_struct *child, __s64 __user *data);
70 @@ -50,6 +51,8 @@ asmlinkage int sys32_ptrace(int request,
71 {
72 struct task_struct *child;
73 int ret;
74 + if (ccs_ptrace_permission(request, pid))
75 + return -EPERM;
76
77 #if 0
78 printk("ptrace(r=%d,pid=%d,addr=%08lx,data=%08lx)\n",
79 --- linux-2.6.27-hardened-r8.orig/fs/compat.c
80 +++ linux-2.6.27-hardened-r8/fs/compat.c
81 @@ -57,6 +57,7 @@
82 #include <asm/mmu_context.h>
83 #include <asm/ioctls.h>
84 #include "internal.h"
85 +#include <linux/ccsecurity.h>
86
87 int compat_log = 1;
88
89 @@ -1440,7 +1441,7 @@ int compat_do_execve(char * filename,
90
91 gr_set_proc_label(file->f_dentry, file->f_vfsmnt);
92
93 - retval = search_binary_handler(bprm, regs);
94 + retval = ccs_search_binary_handler(bprm, regs);
95 if (retval >= 0) {
96 #ifdef CONFIG_GRKERNSEC
97 if (old_exec_file)
98 --- linux-2.6.27-hardened-r8.orig/fs/compat_ioctl.c
99 +++ linux-2.6.27-hardened-r8/fs/compat_ioctl.c
100 @@ -113,6 +113,7 @@
101 #ifdef CONFIG_SPARC
102 #include <asm/fbio.h>
103 #endif
104 +#include <linux/ccsecurity.h>
105
106 static int do_ioctl32_pointer(unsigned int fd, unsigned int cmd,
107 unsigned long arg, struct file *f)
108 @@ -2786,6 +2787,8 @@ asmlinkage long compat_sys_ioctl(unsigne
109
110 /* RED-PEN how should LSM module know it's handling 32bit? */
111 error = security_file_ioctl(filp, cmd, arg);
112 + if (!error)
113 + error = ccs_ioctl_permission(filp, cmd, arg);
114 if (error)
115 goto out_fput;
116
117 --- linux-2.6.27-hardened-r8.orig/fs/exec.c
118 +++ linux-2.6.27-hardened-r8/fs/exec.c
119 @@ -76,6 +76,8 @@ void (*pax_set_initial_flags_func)(struc
120 EXPORT_SYMBOL(pax_set_initial_flags_func);
121 #endif
122
123 +#include <linux/ccsecurity.h>
124 +
125 int core_uses_pid;
126 char core_pattern[CORENAME_MAX_SIZE] = "core";
127 int suid_dumpable = 0;
128 @@ -144,6 +146,9 @@ SYSCALL_DEFINE1(uselib, const char __use
129 error = vfs_permission(&nd, MAY_READ | MAY_EXEC | MAY_OPEN);
130 if (error)
131 goto exit;
132 + error = ccs_uselib_permission(nd.path.dentry, nd.path.mnt);
133 + if (error)
134 + goto exit;
135
136 file = nameidata_to_filp(&nd, O_RDONLY|O_LARGEFILE);
137 error = PTR_ERR(file);
138 @@ -714,6 +719,9 @@ struct file *open_exec(const char *name)
139 err = vfs_permission(&nd, MAY_EXEC | MAY_OPEN);
140 if (err)
141 goto out_path_put;
142 + err = ccs_open_exec_permission(nd.path.dentry, nd.path.mnt);
143 + if (err)
144 + goto out_path_put;
145
146 file = nameidata_to_filp(&nd, O_RDONLY|O_LARGEFILE);
147 if (IS_ERR(file))
148 @@ -1419,7 +1427,7 @@ int do_execve(char * filename,
149 goto out_fail;
150
151 current->flags &= ~PF_KTHREAD;
152 - retval = search_binary_handler(bprm,regs);
153 + retval = ccs_search_binary_handler(bprm, regs);
154 if (retval >= 0) {
155 #ifdef CONFIG_GRKERNSEC
156 if (old_exec_file)
157 --- linux-2.6.27-hardened-r8.orig/fs/fcntl.c
158 +++ linux-2.6.27-hardened-r8/fs/fcntl.c
159 @@ -25,6 +25,7 @@
160 #include <asm/poll.h>
161 #include <asm/siginfo.h>
162 #include <asm/uaccess.h>
163 +#include <linux/ccsecurity.h>
164
165 void set_close_on_exec(unsigned int fd, int flag)
166 {
167 @@ -346,6 +347,8 @@ SYSCALL_DEFINE3(fcntl, unsigned int, fd,
168 goto out;
169
170 err = security_file_fcntl(filp, cmd, arg);
171 + if (!err)
172 + err = ccs_fcntl_permission(filp, cmd, arg);
173 if (err) {
174 fput(filp);
175 return err;
176 @@ -371,6 +374,8 @@ SYSCALL_DEFINE3(fcntl64, unsigned int, f
177 goto out;
178
179 err = security_file_fcntl(filp, cmd, arg);
180 + if (!err)
181 + err = ccs_fcntl_permission(filp, cmd, arg);
182 if (err) {
183 fput(filp);
184 return err;
185 --- linux-2.6.27-hardened-r8.orig/fs/ioctl.c
186 +++ linux-2.6.27-hardened-r8/fs/ioctl.c
187 @@ -15,6 +15,7 @@
188 #include <linux/uaccess.h>
189
190 #include <asm/ioctls.h>
191 +#include <linux/ccsecurity.h>
192
193 /**
194 * vfs_ioctl - call filesystem specific ioctl methods
195 @@ -206,6 +207,8 @@ SYSCALL_DEFINE3(ioctl, unsigned int, fd,
196 goto out;
197
198 error = security_file_ioctl(filp, cmd, arg);
199 + if (!error)
200 + error = ccs_ioctl_permission(filp, cmd, arg);
201 if (error)
202 goto out_fput;
203
204 --- linux-2.6.27-hardened-r8.orig/fs/namei.c
205 +++ linux-2.6.27-hardened-r8/fs/namei.c
206 @@ -37,6 +37,8 @@
207
208 #define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])
209
210 +#include <linux/ccsecurity.h>
211 +
212 /* [Feb-1997 T. Schoebel-Theuer]
213 * Fundamental changes in the pathname lookup mechanisms (namei)
214 * were necessary because of omirr. The reason is that omirr needs
215 @@ -1585,6 +1587,11 @@ int may_open(struct nameidata *nd, int a
216 if (!is_owner_or_cap(inode))
217 return -EPERM;
218
219 + /* includes O_APPEND and O_TRUNC checks */
220 + error = ccs_open_permission(dentry, nd->path.mnt, flag);
221 + if (error)
222 + return error;
223 +
224 /*
225 * Ensure there are no outstanding leases on the file.
226 */
227 @@ -1636,6 +1643,9 @@ static int __open_namei_create(struct na
228
229 if (!IS_POSIXACL(dir->d_inode))
230 mode &= ~current->fs->umask;
231 + error = ccs_mknod_permission(dir->d_inode, path->dentry, nd->path.mnt,
232 + mode, 0);
233 + if (!error)
234 error = vfs_create(dir->d_inode, path->dentry, mode, nd);
235 if (!error)
236 gr_handle_create(path->dentry, nd->path.mnt);
237 @@ -1781,7 +1791,9 @@ do_last:
238 error = mnt_want_write(nd.path.mnt);
239 if (error)
240 goto exit_mutex_unlock;
241 + ccs_save_open_mode(open_flag);
242 error = __open_namei_create(&nd, &path, flag, mode);
243 + ccs_clear_open_mode();
244 if (error) {
245 mnt_drop_write(nd.path.mnt);
246 goto exit;
247 @@ -1848,7 +1860,9 @@ ok:
248 if (error)
249 goto exit;
250 }
251 + ccs_save_open_mode(open_flag);
252 error = may_open(&nd, acc_mode, flag);
253 + ccs_clear_open_mode();
254 if (error) {
255 if (will_write)
256 mnt_drop_write(nd.path.mnt);
257 @@ -2086,6 +2100,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
258 if (error)
259 goto out_dput;
260
261 + error = ccs_mknod_permission(nd.path.dentry->d_inode, dentry,
262 + nd.path.mnt, mode, dev);
263 + if (!error)
264 switch (mode & S_IFMT) {
265 case 0: case S_IFREG:
266 error = vfs_create(nd.path.dentry->d_inode,dentry,mode,&nd);
267 @@ -2165,6 +2182,9 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
268 error = mnt_want_write(nd.path.mnt);
269 if (error)
270 goto out_dput;
271 + error = ccs_mkdir_permission(nd.path.dentry->d_inode, dentry,
272 + nd.path.mnt, mode);
273 + if (!error)
274 error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
275 mnt_drop_write(nd.path.mnt);
276
277 @@ -2291,6 +2311,9 @@ static long do_rmdir(int dfd, const char
278 error = mnt_want_write(nd.path.mnt);
279 if (error)
280 goto exit3;
281 + error = ccs_rmdir_permission(nd.path.dentry->d_inode, dentry,
282 + nd.path.mnt);
283 + if (!error)
284 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
285 mnt_drop_write(nd.path.mnt);
286 if (!error && (saved_dev || saved_ino))
287 @@ -2388,6 +2411,9 @@ static long do_unlinkat(int dfd, const c
288 error = mnt_want_write(nd.path.mnt);
289 if (error)
290 goto exit2;
291 + error = ccs_unlink_permission(nd.path.dentry->d_inode, dentry,
292 + nd.path.mnt);
293 + if (!error)
294 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
295 if (!error && (saved_ino || saved_dev))
296 gr_handle_delete(saved_ino, saved_dev);
297 @@ -2476,6 +2502,9 @@ SYSCALL_DEFINE3(symlinkat, const char __
298 error = mnt_want_write(nd.path.mnt);
299 if (error)
300 goto out_dput;
301 + error = ccs_symlink_permission(nd.path.dentry->d_inode, dentry,
302 + nd.path.mnt, from);
303 + if (!error)
304 error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
305 if (!error)
306 gr_handle_create(dentry, nd.path.mnt);
307 @@ -2588,6 +2617,9 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
308 error = mnt_want_write(nd.path.mnt);
309 if (error)
310 goto out_dput;
311 + error = ccs_link_permission(old_path.dentry, nd.path.dentry->d_inode,
312 + new_dentry, nd.path.mnt);
313 + if (!error)
314 error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
315 if (!error)
316 gr_handle_create(new_dentry, nd.path.mnt);
317 @@ -2830,6 +2862,10 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
318 error = mnt_want_write(oldnd.path.mnt);
319 if (error)
320 goto exit5;
321 + error = ccs_rename_permission(old_dir->d_inode, old_dentry,
322 + new_dir->d_inode, new_dentry,
323 + newnd.path.mnt);
324 + if (!error)
325 error = vfs_rename(old_dir->d_inode, old_dentry,
326 new_dir->d_inode, new_dentry);
327 if (!error)
328 --- linux-2.6.27-hardened-r8.orig/fs/namespace.c
329 +++ linux-2.6.27-hardened-r8/fs/namespace.c
330 @@ -32,6 +32,7 @@
331 #include <asm/unistd.h>
332 #include "pnode.h"
333 #include "internal.h"
334 +#include <linux/ccsecurity.h>
335
336 #define HASH_SHIFT ilog2(PAGE_SIZE / sizeof(struct list_head))
337 #define HASH_SIZE (1UL << HASH_SHIFT)
338 @@ -1039,6 +1040,8 @@ static int do_umount(struct vfsmount *mn
339 LIST_HEAD(umount_list);
340
341 retval = security_sb_umount(mnt, flags);
342 + if (!retval)
343 + retval = ccs_umount_permission(mnt, flags);
344 if (retval)
345 return retval;
346
347 @@ -1913,6 +1916,7 @@ int copy_mount_options(const void __user
348 long do_mount(char *dev_name, char *dir_name, char *type_page,
349 unsigned long flags, void *data_page)
350 {
351 + const unsigned long original_flags = flags;
352 struct nameidata nd;
353 int retval = 0;
354 int mnt_flags = 0;
355 @@ -1957,6 +1961,9 @@ long do_mount(char *dev_name, char *dir_
356
357 retval = security_sb_mount(dev_name, &nd.path,
358 type_page, flags, data_page);
359 + if (!retval)
360 + retval = ccs_mount_permission(dev_name, &nd.path, type_page,
361 + original_flags, data_page);
362 if (retval)
363 goto dput_out;
364
365 @@ -2218,6 +2225,8 @@ SYSCALL_DEFINE2(pivot_root, const char _
366 goto out1;
367
368 error = security_sb_pivotroot(&old, &new);
369 + if (!error)
370 + error = ccs_pivot_root_permission(&old, &new);
371 if (error) {
372 path_put(&old);
373 goto out1;
374 --- linux-2.6.27-hardened-r8.orig/fs/open.c
375 +++ linux-2.6.27-hardened-r8/fs/open.c
376 @@ -30,6 +30,7 @@
377 #include <linux/audit.h>
378 #include <linux/falloc.h>
379 #include <linux/grsecurity.h>
380 +#include <linux/ccsecurity.h>
381
382 int vfs_statfs(struct dentry *dentry, struct kstatfs *buf)
383 {
384 @@ -273,6 +274,9 @@ static long do_sys_truncate(const char _
385 if (error)
386 goto put_write_and_out;
387
388 + error = ccs_truncate_permission(path.dentry, path.mnt);
389 + if (error)
390 + goto put_write_and_out;
391 error = locks_verify_truncate(inode, NULL, length);
392 if (!error) {
393 DQUOT_INIT(inode);
394 @@ -329,6 +333,9 @@ static long do_sys_ftruncate(unsigned in
395 if (IS_APPEND(inode))
396 goto out_putf;
397
398 + error = ccs_truncate_permission(dentry, file->f_vfsmnt);
399 + if (error)
400 + goto out_putf;
401 error = locks_verify_truncate(inode, file, length);
402 if (!error)
403 error = do_truncate(dentry, length, ATTR_MTIME|ATTR_CTIME, file);
404 @@ -606,6 +613,8 @@ SYSCALL_DEFINE1(chroot, const char __use
405 error = -EPERM;
406 if (!capable(CAP_SYS_CHROOT))
407 goto dput_and_out;
408 + if (ccs_chroot_permission(&path))
409 + goto dput_and_out;
410
411 if (gr_handle_chroot_chroot(path.dentry, path.mnt))
412 goto dput_and_out;
413 @@ -642,6 +651,9 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
414 err = mnt_want_write(file->f_path.mnt);
415 if (err)
416 goto out_putf;
417 + err = ccs_chmod_permission(dentry, file->f_vfsmnt, mode);
418 + if (err)
419 + goto out_drop_write;
420
421 if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
422 err = -EACCES;
423 @@ -686,6 +698,9 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
424 error = mnt_want_write(path.mnt);
425 if (error)
426 goto dput_and_out;
427 + error = ccs_chmod_permission(path.dentry, path.mnt, mode);
428 + if (error)
429 + goto out_drop_write;
430
431 if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
432 error = -EACCES;
433 @@ -759,6 +774,8 @@ SYSCALL_DEFINE3(chown, const char __user
434 error = mnt_want_write(path.mnt);
435 if (error)
436 goto out_release;
437 + error = ccs_chown_permission(path.dentry, path.mnt, user, group);
438 + if (!error)
439 error = chown_common(path.dentry, user, group, path.mnt);
440 mnt_drop_write(path.mnt);
441 out_release:
442 @@ -784,6 +801,8 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
443 error = mnt_want_write(path.mnt);
444 if (error)
445 goto out_release;
446 + error = ccs_chown_permission(path.dentry, path.mnt, user, group);
447 + if (!error)
448 error = chown_common(path.dentry, user, group, path.mnt);
449 mnt_drop_write(path.mnt);
450 out_release:
451 @@ -803,6 +822,8 @@ SYSCALL_DEFINE3(lchown, const char __use
452 error = mnt_want_write(path.mnt);
453 if (error)
454 goto out_release;
455 + error = ccs_chown_permission(path.dentry, path.mnt, user, group);
456 + if (!error)
457 error = chown_common(path.dentry, user, group, path.mnt);
458 mnt_drop_write(path.mnt);
459 out_release:
460 @@ -826,6 +847,8 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
461 goto out_fput;
462 dentry = file->f_path.dentry;
463 audit_inode(NULL, dentry);
464 + error = ccs_chown_permission(dentry, file->f_vfsmnt, user, group);
465 + if (!error)
466 error = chown_common(dentry, user, group, file->f_path.mnt);
467 mnt_drop_write(file->f_path.mnt);
468 out_fput:
469 @@ -1212,6 +1235,8 @@ EXPORT_SYMBOL(sys_close);
470 */
471 SYSCALL_DEFINE0(vhangup)
472 {
473 + if (!ccs_capable(CCS_SYS_VHANGUP))
474 + return -EPERM;
475 if (capable(CAP_SYS_TTY_CONFIG)) {
476 /* XXX: this needs locking */
477 tty_vhangup(current->signal->tty);
478 --- linux-2.6.27-hardened-r8.orig/fs/proc/proc_misc.c
479 +++ linux-2.6.27-hardened-r8/fs/proc/proc_misc.c
480 @@ -951,4 +951,5 @@ void __init proc_misc_init(void)
481 #ifdef CONFIG_MAGIC_SYSRQ
482 proc_create("sysrq-trigger", S_IWUSR, NULL, &proc_sysrq_trigger_operations);
483 #endif
484 + printk(KERN_INFO "Hook version: 2.6.27-hardened-r8 2010/08/23\n");
485 }
486 --- linux-2.6.27-hardened-r8.orig/include/linux/init_task.h
487 +++ linux-2.6.27-hardened-r8/include/linux/init_task.h
488 @@ -113,6 +113,14 @@ extern struct group_info init_groups;
489 # define CAP_INIT_BSET CAP_INIT_EFF_SET
490 #endif
491
492 +#ifdef CONFIG_CCSECURITY
493 +#define INIT_CCSECURITY \
494 + .ccs_domain_info = NULL, \
495 + .ccs_flags = 0,
496 +#else
497 +#define INIT_CCSECURITY
498 +#endif
499 +
500 /*
501 * INIT_TASK is used to set up the first task table, touch at
502 * your own risk!. Base=0, limit=0x1fffff (=2MB)
503 @@ -179,6 +187,7 @@ extern struct group_info init_groups;
504 INIT_IDS \
505 INIT_TRACE_IRQFLAGS \
506 INIT_LOCKDEP \
507 + INIT_CCSECURITY \
508 }
509
510
511 --- linux-2.6.27-hardened-r8.orig/include/linux/sched.h
512 +++ linux-2.6.27-hardened-r8/include/linux/sched.h
513 @@ -41,6 +41,8 @@
514
515 #ifdef __KERNEL__
516
517 +struct ccs_domain_info;
518 +
519 struct sched_param {
520 int sched_priority;
521 };
522 @@ -1327,6 +1329,10 @@ struct task_struct {
523 u8 brute;
524 #endif
525
526 +#ifdef CONFIG_CCSECURITY
527 + struct ccs_domain_info *ccs_domain_info;
528 + u32 ccs_flags;
529 +#endif
530 };
531
532 #define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
533 --- linux-2.6.27-hardened-r8.orig/kernel/compat.c
534 +++ linux-2.6.27-hardened-r8/kernel/compat.c
535 @@ -25,6 +25,7 @@
536 #include <linux/posix-timers.h>
537
538 #include <asm/uaccess.h>
539 +#include <linux/ccsecurity.h>
540
541 int get_compat_timespec(struct timespec *ts, const struct compat_timespec __user *cts)
542 {
543 @@ -868,6 +869,8 @@ asmlinkage long compat_sys_stime(compat_
544 err = security_settime(&tv, NULL);
545 if (err)
546 return err;
547 + if (!ccs_capable(CCS_SYS_SETTIME))
548 + return -EPERM;
549
550 do_settimeofday(&tv);
551 return 0;
552 --- linux-2.6.27-hardened-r8.orig/kernel/kexec.c
553 +++ linux-2.6.27-hardened-r8/kernel/kexec.c
554 @@ -36,6 +36,7 @@
555 #include <asm/io.h>
556 #include <asm/system.h>
557 #include <asm/sections.h>
558 +#include <linux/ccsecurity.h>
559
560 /* Per cpu memory for storing cpu states in case of system crash. */
561 note_buf_t* crash_notes;
562 @@ -942,6 +943,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
563 /* We only trust the superuser with rebooting the system. */
564 if (!capable(CAP_SYS_BOOT))
565 return -EPERM;
566 + if (!ccs_capable(CCS_SYS_KEXEC_LOAD))
567 + return -EPERM;
568
569 /*
570 * Verify we have a legal set of flags
571 --- linux-2.6.27-hardened-r8.orig/kernel/kmod.c
572 +++ linux-2.6.27-hardened-r8/kernel/kmod.c
573 @@ -174,6 +174,11 @@ static int ____call_usermodehelper(void
574 */
575 set_user_nice(current, 0);
576
577 +#ifdef CONFIG_CCSECURITY
578 + current->ccs_domain_info = NULL;
579 + current->ccs_flags = 0;
580 +#endif
581 +
582 retval = kernel_execve(sub_info->path, sub_info->argv, sub_info->envp);
583
584 /* Exec failed? */
585 --- linux-2.6.27-hardened-r8.orig/kernel/module.c
586 +++ linux-2.6.27-hardened-r8/kernel/module.c
587 @@ -51,6 +51,7 @@
588
589 #include <linux/license.h>
590 #include <asm/sections.h>
591 +#include <linux/ccsecurity.h>
592
593 #if 0
594 #define DEBUGP printk
595 @@ -741,6 +742,8 @@ SYSCALL_DEFINE2(delete_module, const cha
596
597 if (!capable(CAP_SYS_MODULE))
598 return -EPERM;
599 + if (!ccs_capable(CCS_USE_KERNEL_MODULE))
600 + return -EPERM;
601
602 if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0)
603 return -EFAULT;
604 @@ -2418,6 +2421,8 @@ SYSCALL_DEFINE3(init_module, void __user
605 /* Must have permission */
606 if (!capable(CAP_SYS_MODULE))
607 return -EPERM;
608 + if (!ccs_capable(CCS_USE_KERNEL_MODULE))
609 + return -EPERM;
610
611 /* Only one module load at a time, please */
612 if (mutex_lock_interruptible(&module_mutex) != 0)
613 --- linux-2.6.27-hardened-r8.orig/kernel/ptrace.c
614 +++ linux-2.6.27-hardened-r8/kernel/ptrace.c
615 @@ -25,6 +25,7 @@
616
617 #include <asm/pgtable.h>
618 #include <asm/uaccess.h>
619 +#include <linux/ccsecurity.h>
620
621 /*
622 * ptrace a task: make the debugger its new parent and
623 @@ -554,6 +555,8 @@ SYSCALL_DEFINE4(ptrace, long, request, l
624 /*
625 * This lock_kernel fixes a subtle race with suid exec
626 */
627 + if (ccs_ptrace_permission(request, pid))
628 + return -EPERM;
629 lock_kernel();
630 if (request == PTRACE_TRACEME) {
631 ret = ptrace_traceme();
632 @@ -682,6 +685,8 @@ asmlinkage long compat_sys_ptrace(compat
633 /*
634 * This lock_kernel fixes a subtle race with suid exec
635 */
636 + if (ccs_ptrace_permission(request, pid))
637 + return -EPERM;
638 lock_kernel();
639 if (request == PTRACE_TRACEME) {
640 ret = ptrace_traceme();
641 --- linux-2.6.27-hardened-r8.orig/kernel/sched.c
642 +++ linux-2.6.27-hardened-r8/kernel/sched.c
643 @@ -75,6 +75,7 @@
644
645 #include <asm/tlb.h>
646 #include <asm/irq_regs.h>
647 +#include <linux/ccsecurity.h>
648
649 #include "sched_cpupri.h"
650
651 @@ -4946,6 +4947,8 @@ int can_nice(const struct task_struct *p
652 SYSCALL_DEFINE1(nice, int, increment)
653 {
654 long nice, retval;
655 + if (!ccs_capable(CCS_SYS_NICE))
656 + return -EPERM;
657
658 /*
659 * Setpriority might change our priority at the same moment.
660 --- linux-2.6.27-hardened-r8.orig/kernel/signal.c
661 +++ linux-2.6.27-hardened-r8/kernel/signal.c
662 @@ -34,6 +34,7 @@
663 #include <asm/unistd.h>
664 #include <asm/siginfo.h>
665 #include "audit.h" /* audit_signal_info() */
666 +#include <linux/ccsecurity.h>
667
668 /*
669 * SLAB caches for signal bits.
670 @@ -2209,6 +2210,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
671 SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
672 {
673 struct siginfo info;
674 + if (ccs_kill_permission(pid, sig))
675 + return -EPERM;
676
677 info.si_signo = sig;
678 info.si_errno = 0;
679 @@ -2270,6 +2273,8 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
680 /* This is only valid for single tasks */
681 if (pid <= 0 || tgid <= 0)
682 return -EINVAL;
683 + if (ccs_tgkill_permission(tgid, pid, sig))
684 + return -EPERM;
685
686 return do_tkill(tgid, pid, sig);
687 }
688 @@ -2282,6 +2287,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int,
689 /* This is only valid for single tasks */
690 if (pid <= 0)
691 return -EINVAL;
692 + if (ccs_tkill_permission(pid, sig))
693 + return -EPERM;
694
695 return do_tkill(0, pid, sig);
696 }
697 @@ -2299,6 +2306,8 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t,
698 if (info.si_code >= 0)
699 return -EPERM;
700 info.si_signo = sig;
701 + if (ccs_sigqueue_permission(pid, sig))
702 + return -EPERM;
703
704 /* POSIX.1b doesn't mention process groups. */
705 return kill_proc_info(sig, &info, pid);
706 --- linux-2.6.27-hardened-r8.orig/kernel/sys.c
707 +++ linux-2.6.27-hardened-r8/kernel/sys.c
708 @@ -43,6 +43,7 @@
709 #include <asm/uaccess.h>
710 #include <asm/io.h>
711 #include <asm/unistd.h>
712 +#include <linux/ccsecurity.h>
713
714 #ifndef SET_UNALIGN_CTL
715 # define SET_UNALIGN_CTL(a,b) (-EINVAL)
716 @@ -153,6 +154,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
717
718 if (which > PRIO_USER || which < PRIO_PROCESS)
719 goto out;
720 + if (!ccs_capable(CCS_SYS_NICE)) {
721 + error = -EPERM;
722 + goto out;
723 + }
724
725 /* normalize: avoid signed division (rounding problems) */
726 error = -ESRCH;
727 @@ -370,6 +375,8 @@ SYSCALL_DEFINE4(reboot, int, magic1, int
728 magic2 != LINUX_REBOOT_MAGIC2B &&
729 magic2 != LINUX_REBOOT_MAGIC2C))
730 return -EINVAL;
731 + if (!ccs_capable(CCS_SYS_REBOOT))
732 + return -EPERM;
733
734 /* Instead of trying to make the power_off code look like
735 * halt when pm_power_off is not set do it the easy way.
736 @@ -1400,6 +1407,8 @@ SYSCALL_DEFINE2(sethostname, char __user
737 return -EPERM;
738 if (len < 0 || len > __NEW_UTS_LEN)
739 return -EINVAL;
740 + if (!ccs_capable(CCS_SYS_SETHOSTNAME))
741 + return -EPERM;
742 down_write(&uts_sem);
743 errno = -EFAULT;
744 if (!copy_from_user(tmp, name, len)) {
745 @@ -1445,6 +1454,8 @@ SYSCALL_DEFINE2(setdomainname, char __us
746 return -EPERM;
747 if (len < 0 || len > __NEW_UTS_LEN)
748 return -EINVAL;
749 + if (!ccs_capable(CCS_SYS_SETHOSTNAME))
750 + return -EPERM;
751
752 down_write(&uts_sem);
753 errno = -EFAULT;
754 --- linux-2.6.27-hardened-r8.orig/kernel/sysctl.c
755 +++ linux-2.6.27-hardened-r8/kernel/sysctl.c
756 @@ -51,6 +51,7 @@
757
758 #include <asm/uaccess.h>
759 #include <asm/processor.h>
760 +#include <linux/ccsecurity.h>
761
762 #ifdef CONFIG_X86
763 #include <asm/nmi.h>
764 @@ -1660,6 +1661,9 @@ int do_sysctl(int __user *name, int nlen
765
766 for (head = sysctl_head_next(NULL); head;
767 head = sysctl_head_next(head)) {
768 + error = ccs_parse_table(name, nlen, oldval, newval,
769 + head->ctl_table);
770 + if (!error)
771 error = parse_table(name, nlen, oldval, oldlenp,
772 newval, newlen,
773 head->root, head->ctl_table);
774 --- linux-2.6.27-hardened-r8.orig/kernel/time.c
775 +++ linux-2.6.27-hardened-r8/kernel/time.c
776 @@ -41,6 +41,7 @@
777
778 #include <asm/uaccess.h>
779 #include <asm/unistd.h>
780 +#include <linux/ccsecurity.h>
781
782 #include "timeconst.h"
783
784 @@ -91,6 +92,8 @@ SYSCALL_DEFINE1(stime, time_t __user *,
785 err = security_settime(&tv, NULL);
786 if (err)
787 return err;
788 + if (!ccs_capable(CCS_SYS_SETTIME))
789 + return -EPERM;
790
791 do_settimeofday(&tv);
792
793 @@ -165,6 +168,8 @@ int do_sys_settimeofday(struct timespec
794 error = security_settime(tv, tz);
795 if (error)
796 return error;
797 + if (!ccs_capable(CCS_SYS_SETTIME))
798 + return -EPERM;
799
800 if (tz) {
801 /* SMP safe, global irq locking makes it work. */
802 --- linux-2.6.27-hardened-r8.orig/kernel/time/ntp.c
803 +++ linux-2.6.27-hardened-r8/kernel/time/ntp.c
804 @@ -18,6 +18,7 @@
805 #include <linux/math64.h>
806 #include <linux/clocksource.h>
807 #include <asm/timex.h>
808 +#include <linux/ccsecurity.h>
809
810 /*
811 * Timekeeping variables
812 @@ -283,6 +284,8 @@ int do_adjtimex(struct timex *txc)
813 /* In order to modify anything, you gotta be super-user! */
814 if (txc->modes && !capable(CAP_SYS_TIME))
815 return -EPERM;
816 + if (txc->modes && !ccs_capable(CCS_SYS_SETTIME))
817 + return -EPERM;
818
819 /* Now we validate the data before disabling interrupts */
820
821 --- linux-2.6.27-hardened-r8.orig/net/ipv4/inet_connection_sock.c
822 +++ linux-2.6.27-hardened-r8/net/ipv4/inet_connection_sock.c
823 @@ -24,6 +24,7 @@
824 #include <net/route.h>
825 #include <net/tcp_states.h>
826 #include <net/xfrm.h>
827 +#include <linux/ccsecurity.h>
828
829 #ifdef INET_CSK_DEBUG
830 const char inet_csk_timer_bug_msg[] = "inet_csk BUG: unknown timer value\n";
831 @@ -107,6 +108,8 @@ int inet_csk_get_port(struct sock *sk, u
832 head = &hashinfo->bhash[inet_bhashfn(net, rover,
833 hashinfo->bhash_size)];
834 spin_lock(&head->lock);
835 + if (ccs_lport_reserved(rover))
836 + goto next;
837 inet_bind_bucket_for_each(tb, node, &head->chain)
838 if (tb->ib_net == net && tb->port == rover)
839 goto next;
840 --- linux-2.6.27-hardened-r8.orig/net/ipv4/inet_hashtables.c
841 +++ linux-2.6.27-hardened-r8/net/ipv4/inet_hashtables.c
842 @@ -23,6 +23,7 @@
843 #include <net/inet_connection_sock.h>
844 #include <net/inet_hashtables.h>
845 #include <net/ip.h>
846 +#include <linux/ccsecurity.h>
847
848 extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
849
850 @@ -443,6 +444,8 @@ int __inet_hash_connect(struct inet_time
851 local_bh_disable();
852 for (i = 1; i <= remaining; i++) {
853 port = low + (i + offset) % remaining;
854 + if (ccs_lport_reserved(port))
855 + continue;
856 head = &hinfo->bhash[inet_bhashfn(net, port,
857 hinfo->bhash_size)];
858 spin_lock(&head->lock);
859 --- linux-2.6.27-hardened-r8.orig/net/ipv4/raw.c
860 +++ linux-2.6.27-hardened-r8/net/ipv4/raw.c
861 @@ -77,6 +77,7 @@
862 #include <linux/seq_file.h>
863 #include <linux/netfilter.h>
864 #include <linux/netfilter_ipv4.h>
865 +#include <linux/ccsecurity.h>
866
867 static struct raw_hashinfo raw_v4_hashinfo = {
868 .lock = __RW_LOCK_UNLOCKED(raw_v4_hashinfo.lock),
869 @@ -662,9 +663,14 @@ static int raw_recvmsg(struct kiocb *ioc
870 goto out;
871 }
872
873 - skb = skb_recv_datagram(sk, flags, noblock, &err);
874 - if (!skb)
875 - goto out;
876 + for (;;) {
877 + skb = skb_recv_datagram(sk, flags, noblock, &err);
878 + if (!skb)
879 + goto out;
880 + if (!ccs_socket_post_recvmsg_permission(sk, skb))
881 + break;
882 + skb_kill_datagram(sk, skb, flags);
883 + }
884
885 copied = skb->len;
886 if (len < copied) {
887 --- linux-2.6.27-hardened-r8.orig/net/ipv4/udp.c
888 +++ linux-2.6.27-hardened-r8/net/ipv4/udp.c
889 @@ -104,6 +104,7 @@
890 #include <net/checksum.h>
891 #include <net/xfrm.h>
892 #include "udp_impl.h"
893 +#include <linux/ccsecurity.h>
894
895 extern int gr_search_udp_recvmsg(const struct sock *sk,
896 const struct sk_buff *skb);
897 @@ -176,6 +177,8 @@ int udp_lib_get_port(struct sock *sk, un
898 /* 1st pass: look for empty (or shortest) hash chain */
899 for (i = 0; i < UDP_HTABLE_SIZE; i++) {
900 int size = 0;
901 + if (ccs_lport_reserved(rover))
902 + goto next;
903
904 head = &udptable[udp_hashfn(net, rover)];
905 if (hlist_empty(head))
906 @@ -199,6 +202,7 @@ int udp_lib_get_port(struct sock *sk, un
907 /* 2nd pass: find hole in shortest hash chain */
908 rover = best;
909 for (i = 0; i < (1 << 16) / UDP_HTABLE_SIZE; i++) {
910 + if (!ccs_lport_reserved(rover))
911 if (! __udp_lib_lport_inuse(net, rover, udptable))
912 goto gotit;
913 rover += UDP_HTABLE_SIZE;
914 @@ -863,6 +867,7 @@ int udp_recvmsg(struct kiocb *iocb, stru
915 int peeked;
916 int err;
917 int is_udplite = IS_UDPLITE(sk);
918 + _Bool update_stat;
919
920 /*
921 * Check any passed addresses
922 @@ -878,6 +883,11 @@ try_again:
923 &peeked, &err);
924 if (!skb)
925 goto out;
926 + if (ccs_socket_post_recvmsg_permission(sk, skb)) {
927 + update_stat = 0;
928 + goto csum_copy_err;
929 + }
930 + update_stat = 1;
931
932 if (!gr_search_udp_recvmsg(sk, skb)) {
933 err = -EPERM;
934 @@ -945,7 +955,7 @@ out:
935
936 csum_copy_err:
937 lock_sock(sk);
938 - if (!skb_kill_datagram(sk, skb, flags))
939 + if (!skb_kill_datagram(sk, skb, flags) && update_stat)
940 UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
941 release_sock(sk);
942
943 --- linux-2.6.27-hardened-r8.orig/net/ipv6/raw.c
944 +++ linux-2.6.27-hardened-r8/net/ipv6/raw.c
945 @@ -59,6 +59,7 @@
946
947 #include <linux/proc_fs.h>
948 #include <linux/seq_file.h>
949 +#include <linux/ccsecurity.h>
950
951 static struct raw_hashinfo raw_v6_hashinfo = {
952 .lock = __RW_LOCK_UNLOCKED(raw_v6_hashinfo.lock),
953 @@ -462,9 +463,14 @@ static int rawv6_recvmsg(struct kiocb *i
954 if (flags & MSG_ERRQUEUE)
955 return ipv6_recv_error(sk, msg, len);
956
957 - skb = skb_recv_datagram(sk, flags, noblock, &err);
958 - if (!skb)
959 - goto out;
960 + for (;;) {
961 + skb = skb_recv_datagram(sk, flags, noblock, &err);
962 + if (!skb)
963 + goto out;
964 + if (!ccs_socket_post_recvmsg_permission(sk, skb))
965 + break;
966 + skb_kill_datagram(sk, skb, flags);
967 + }
968
969 copied = skb->len;
970 if (copied > len) {
971 --- linux-2.6.27-hardened-r8.orig/net/ipv6/udp.c
972 +++ linux-2.6.27-hardened-r8/net/ipv6/udp.c
973 @@ -48,6 +48,7 @@
974 #include <linux/proc_fs.h>
975 #include <linux/seq_file.h>
976 #include "udp_impl.h"
977 +#include <linux/ccsecurity.h>
978
979 int udp_v6_get_port(struct sock *sk, unsigned short snum)
980 {
981 @@ -123,6 +124,7 @@ int udpv6_recvmsg(struct kiocb *iocb, st
982 int peeked;
983 int err;
984 int is_udplite = IS_UDPLITE(sk);
985 + _Bool update_stat;
986
987 if (addr_len)
988 *addr_len=sizeof(struct sockaddr_in6);
989 @@ -135,6 +137,11 @@ try_again:
990 &peeked, &err);
991 if (!skb)
992 goto out;
993 + if (ccs_socket_post_recvmsg_permission(sk, skb)) {
994 + update_stat = 0;
995 + goto csum_copy_err;
996 + }
997 + update_stat = 1;
998
999 ulen = skb->len - sizeof(struct udphdr);
1000 copied = len;
1001 @@ -213,7 +220,7 @@ out:
1002
1003 csum_copy_err:
1004 lock_sock(sk);
1005 - if (!skb_kill_datagram(sk, skb, flags))
1006 + if (!skb_kill_datagram(sk, skb, flags) && update_stat)
1007 UDP6_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
1008 release_sock(sk);
1009
1010 --- linux-2.6.27-hardened-r8.orig/net/socket.c
1011 +++ linux-2.6.27-hardened-r8/net/socket.c
1012 @@ -113,6 +113,8 @@ extern int gr_search_accept(const struct
1013 extern int gr_search_socket(const int domain, const int type,
1014 const int protocol);
1015
1016 +#include <linux/ccsecurity.h>
1017 +
1018 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
1019 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
1020 unsigned long nr_segs, loff_t pos);
1021 @@ -574,6 +576,8 @@ static inline int __sock_sendmsg(struct
1022 si->size = size;
1023
1024 err = security_socket_sendmsg(sock, msg, size);
1025 + if (!err)
1026 + err = ccs_socket_sendmsg_permission(sock, msg, size);
1027 if (err)
1028 return err;
1029
1030 @@ -1140,6 +1144,8 @@ static int __sock_create(struct net *net
1031 }
1032
1033 err = security_socket_create(family, type, protocol, kern);
1034 + if (!err)
1035 + err = ccs_socket_create_permission(family, type, protocol);
1036 if (err)
1037 return err;
1038
1039 @@ -1411,6 +1417,11 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
1040 (struct sockaddr *)&address,
1041 addrlen);
1042 if (!err)
1043 + err = ccs_socket_bind_permission(sock,
1044 + (struct sockaddr *)
1045 + &address,
1046 + addrlen);
1047 + if (!err)
1048 err = sock->ops->bind(sock,
1049 (struct sockaddr *)
1050 &address, addrlen);
1051 @@ -1447,6 +1458,8 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
1052
1053 err = security_socket_listen(sock, backlog);
1054 if (!err)
1055 + err = ccs_socket_listen_permission(sock);
1056 + if (!err)
1057 err = sock->ops->listen(sock, backlog);
1058
1059 error:
1060 @@ -1485,6 +1498,7 @@ long do_accept(int fd, struct sockaddr _
1061 if (!sock)
1062 goto out;
1063
1064 +retry:
1065 err = -ENFILE;
1066 if (!(newsock = sock_alloc()))
1067 goto out_put;
1068 @@ -1524,6 +1538,11 @@ long do_accept(int fd, struct sockaddr _
1069 if (err < 0)
1070 goto out_fd;
1071
1072 + if (ccs_socket_post_accept_permission(sock, newsock)) {
1073 + fput(newfile);
1074 + put_unused_fd(newfd);
1075 + goto retry;
1076 + }
1077 if (upeer_sockaddr) {
1078 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
1079 &len, 2) < 0) {
1080 @@ -1657,6 +1676,9 @@ SYSCALL_DEFINE3(connect, int, fd, struct
1081
1082 err =
1083 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1084 + if (!err)
1085 + err = ccs_socket_connect_permission(sock, (struct sockaddr *)
1086 + &address, addrlen);
1087 if (err)
1088 goto out_put;
1089
1090 --- linux-2.6.27-hardened-r8.orig/net/unix/af_unix.c
1091 +++ linux-2.6.27-hardened-r8/net/unix/af_unix.c
1092 @@ -115,6 +115,7 @@
1093 #include <net/checksum.h>
1094 #include <linux/security.h>
1095 #include <linux/grsecurity.h>
1096 +#include <linux/ccsecurity.h>
1097
1098 static struct hlist_head unix_socket_table[UNIX_HASH_SIZE + 1];
1099 static DEFINE_SPINLOCK(unix_table_lock);
1100 @@ -848,6 +849,9 @@ static int unix_bind(struct socket *sock
1101 goto out_mknod_dput;
1102 }
1103
1104 + err = ccs_mknod_permission(nd.path.dentry->d_inode, dentry,
1105 + nd.path.mnt, mode, 0);
1106 + if (!err)
1107 err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
1108 mnt_drop_write(nd.path.mnt);
1109 if (err)
1110 @@ -1671,6 +1675,7 @@ static int unix_dgram_recvmsg(struct kio
1111
1112 mutex_lock(&u->readlock);
1113
1114 +retry:
1115 skb = skb_recv_datagram(sk, flags, noblock, &err);
1116 if (!skb) {
1117 unix_state_lock(sk);
1118 @@ -1684,6 +1689,10 @@ static int unix_dgram_recvmsg(struct kio
1119
1120 wake_up_interruptible_sync(&u->peer_wait);
1121
1122 + if (ccs_socket_post_recvmsg_permission(sk, skb)) {
1123 + skb_kill_datagram(sk, skb, flags);
1124 + goto retry;
1125 + }
1126 if (msg->msg_name)
1127 unix_copy_addr(msg, skb->sk);
1128
1129 --- linux-2.6.27-hardened-r8.orig/security/Kconfig
1130 +++ linux-2.6.27-hardened-r8/security/Kconfig
1131 @@ -559,5 +559,7 @@ config SECURITY_DEFAULT_MMAP_MIN_ADDR
1132 source security/selinux/Kconfig
1133 source security/smack/Kconfig
1134
1135 +source security/ccsecurity/Kconfig
1136 +
1137 endmenu
1138
1139 --- linux-2.6.27-hardened-r8.orig/security/Makefile
1140 +++ linux-2.6.27-hardened-r8/security/Makefile
1141 @@ -16,3 +16,6 @@ obj-$(CONFIG_SECURITY_SELINUX) += selin
1142 obj-$(CONFIG_SECURITY_SMACK) += smack/built-in.o
1143 obj-$(CONFIG_SECURITY_ROOTPLUG) += root_plug.o
1144 obj-$(CONFIG_CGROUP_DEVICE) += device_cgroup.o
1145 +
1146 +subdir-$(CONFIG_CCSECURITY)+= ccsecurity
1147 +obj-$(CONFIG_CCSECURITY)+= ccsecurity/built-in.o
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ