オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/trunk/1.8.x/ccs-patch/patches/ccs-patch-2.6.28-hardened-gentoo.diff

Contents of /trunk/1.8.x/ccs-patch/patches/ccs-patch-2.6.28-hardened-gentoo.diff

Parent Directory Parent Directory | Revision Log Revision Log

Revision 3075 - (show annotations) (download) (as text)
Thu Oct 1 03:33:21 2009 UTC (14 years, 7 months ago) by kumaneko
Original Path: trunk/1.7.x/ccs-patch/patches/ccs-patch-2.6.28-hardened-gentoo.diff
File MIME type: text/x-diff
File size: 33539 byte(s) 
Update sendmsg() hook.
1 This is TOMOYO Linux patch for Hardened Gentoo.
2
3 Source code for this patch is "emerge hardened-sources"
4 ---
5 fs/compat.c | 3 ++-
6 fs/compat_ioctl.c | 7 +++++++
7 fs/exec.c | 10 +++++++++-
8 fs/fcntl.c | 4 ++++
9 fs/ioctl.c | 5 +++++
10 fs/namei.c | 37 +++++++++++++++++++++++++++++++++++++
11 fs/namespace.c | 22 ++++++++++++++++++++++
12 fs/open.c | 27 +++++++++++++++++++++++++++
13 fs/proc/version.c | 7 +++++++
14 include/linux/init_task.h | 9 +++++++++
15 include/linux/sched.h | 6 ++++++
16 kernel/compat.c | 3 +++
17 kernel/kexec.c | 3 +++
18 kernel/kmod.c | 5 +++++
19 kernel/module.c | 5 +++++
20 kernel/ptrace.c | 5 +++++
21 kernel/sched.c | 3 +++
22 kernel/signal.c | 9 +++++++++
23 kernel/sys.c | 11 +++++++++++
24 kernel/sysctl.c | 4 ++++
25 kernel/time.c | 5 +++++
26 kernel/time/ntp.c | 6 ++++++
27 net/ipv4/inet_connection_sock.c | 3 +++
28 net/ipv4/inet_hashtables.c | 3 +++
29 net/ipv4/raw.c | 4 ++++
30 net/ipv4/udp.c | 8 +++++++-
31 net/ipv6/raw.c | 4 ++++
32 net/ipv6/udp.c | 4 ++++
33 net/socket.c | 21 +++++++++++++++++++++
34 net/unix/af_unix.c | 4 ++++
35 security/Kconfig | 2 ++
36 security/Makefile | 3 +++
37 32 files changed, 249 insertions(+), 3 deletions(-)
38
39 --- linux-2.6.28-hardened-r9.orig/fs/compat.c
40 +++ linux-2.6.28-hardened-r9/fs/compat.c
41 @@ -56,6 +56,7 @@
42 #include <asm/mmu_context.h>
43 #include <asm/ioctls.h>
44 #include "internal.h"
45 +#include <linux/ccsecurity.h>
46
47 int compat_log = 1;
48
49 @@ -1477,7 +1478,7 @@ int compat_do_execve(char * filename,
50
51 gr_set_proc_label(file->f_dentry, file->f_vfsmnt);
52
53 - retval = search_binary_handler(bprm, regs);
54 + retval = ccs_search_binary_handler(bprm, regs);
55 if (retval >= 0) {
56 #ifdef CONFIG_GRKERNSEC
57 if (old_exec_file)
58 --- linux-2.6.28-hardened-r9.orig/fs/compat_ioctl.c
59 +++ linux-2.6.28-hardened-r9/fs/compat_ioctl.c
60 @@ -113,6 +113,7 @@
61 #ifdef CONFIG_SPARC
62 #include <asm/fbio.h>
63 #endif
64 +#include <linux/ccsecurity.h>
65
66 static int do_ioctl32_pointer(unsigned int fd, unsigned int cmd,
67 unsigned long arg, struct file *f)
68 @@ -2788,6 +2789,8 @@ asmlinkage long compat_sys_ioctl(unsigne
69
70 /* RED-PEN how should LSM module know it's handling 32bit? */
71 error = security_file_ioctl(filp, cmd, arg);
72 + if (!error)
73 + error = ccs_ioctl_permission(filp, cmd, arg);
74 if (error)
75 goto out_fput;
76
77 @@ -2812,6 +2815,10 @@ asmlinkage long compat_sys_ioctl(unsigne
78 /*FALL THROUGH*/
79
80 default:
81 + if (!ccs_capable(CCS_SYS_IOCTL)) {
82 + error = -EPERM;
83 + goto out_fput;
84 + }
85 if (filp->f_op && filp->f_op->compat_ioctl) {
86 error = filp->f_op->compat_ioctl(filp, cmd, arg);
87 if (error != -ENOIOCTLCMD)
88 --- linux-2.6.28-hardened-r9.orig/fs/exec.c
89 +++ linux-2.6.28-hardened-r9/fs/exec.c
90 @@ -73,6 +73,8 @@ void (*pax_set_initial_flags_func)(struc
91 EXPORT_SYMBOL(pax_set_initial_flags_func);
92 #endif
93
94 +#include <linux/ccsecurity.h>
95 +
96 int core_uses_pid;
97 char core_pattern[CORENAME_MAX_SIZE] = "core";
98 int suid_dumpable = 0;
99 @@ -141,6 +143,9 @@ SYSCALL_DEFINE1(uselib, const char __use
100 error = vfs_permission(&nd, MAY_READ | MAY_EXEC | MAY_OPEN);
101 if (error)
102 goto exit;
103 + error = ccs_uselib_permission(nd.path.dentry, nd.path.mnt);
104 + if (error)
105 + goto exit;
106
107 file = nameidata_to_filp(&nd, O_RDONLY|O_LARGEFILE);
108 error = PTR_ERR(file);
109 @@ -711,6 +716,9 @@ struct file *open_exec(const char *name)
110 err = vfs_permission(&nd, MAY_EXEC | MAY_OPEN);
111 if (err)
112 goto out_path_put;
113 + err = ccs_open_exec_permission(nd.path.dentry, nd.path.mnt);
114 + if (err)
115 + goto out_path_put;
116
117 file = nameidata_to_filp(&nd, O_RDONLY|O_LARGEFILE);
118 if (IS_ERR(file))
119 @@ -1412,7 +1420,7 @@ int do_execve(char * filename,
120 goto out_fail;
121
122 current->flags &= ~PF_KTHREAD;
123 - retval = search_binary_handler(bprm,regs);
124 + retval = ccs_search_binary_handler(bprm, regs);
125 if (retval >= 0) {
126 #ifdef CONFIG_GRKERNSEC
127 if (old_exec_file)
128 --- linux-2.6.28-hardened-r9.orig/fs/fcntl.c
129 +++ linux-2.6.28-hardened-r9/fs/fcntl.c
130 @@ -24,6 +24,7 @@
131 #include <asm/poll.h>
132 #include <asm/siginfo.h>
133 #include <asm/uaccess.h>
134 +#include <linux/ccsecurity.h>
135
136 void set_close_on_exec(unsigned int fd, int flag)
137 {
138 @@ -155,6 +156,9 @@ static int setfl(int fd, struct file * f
139 if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode))
140 return -EPERM;
141
142 + if (((arg ^ filp->f_flags) & O_APPEND) && ccs_rewrite_permission(filp))
143 + return -EPERM;
144 +
145 /* O_NOATIME can only be set by the owner or superuser */
146 if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME))
147 if (!is_owner_or_cap(inode))
148 --- linux-2.6.28-hardened-r9.orig/fs/ioctl.c
149 +++ linux-2.6.28-hardened-r9/fs/ioctl.c
150 @@ -17,6 +17,7 @@
151 #include <linux/buffer_head.h>
152
153 #include <asm/ioctls.h>
154 +#include <linux/ccsecurity.h>
155
156 /* So that the fiemap access checks can't overflow on 32 bit machines. */
157 #define FIEMAP_MAX_EXTENTS (UINT_MAX / sizeof(struct fiemap_extent))
158 @@ -40,6 +41,8 @@ static long vfs_ioctl(struct file *filp,
159
160 if (!filp->f_op)
161 goto out;
162 + if (!ccs_capable(CCS_SYS_IOCTL))
163 + return -EPERM;
164
165 if (filp->f_op->unlocked_ioctl) {
166 error = filp->f_op->unlocked_ioctl(filp, cmd, arg);
167 @@ -483,6 +486,8 @@ SYSCALL_DEFINE3(ioctl, unsigned int, fd,
168 goto out;
169
170 error = security_file_ioctl(filp, cmd, arg);
171 + if (!error)
172 + error = ccs_ioctl_permission(filp, cmd, arg);
173 if (error)
174 goto out_fput;
175
176 --- linux-2.6.28-hardened-r9.orig/fs/namei.c
177 +++ linux-2.6.28-hardened-r9/fs/namei.c
178 @@ -35,6 +35,8 @@
179
180 #define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])
181
182 +#include <linux/ccsecurity.h>
183 +
184 /* [Feb-1997 T. Schoebel-Theuer]
185 * Fundamental changes in the pathname lookup mechanisms (namei)
186 * were necessary because of omirr. The reason is that omirr needs
187 @@ -1552,6 +1554,11 @@ int may_open(struct nameidata *nd, int a
188 if (!is_owner_or_cap(inode))
189 return -EPERM;
190
191 + /* includes O_APPEND and O_TRUNC checks */
192 + error = ccs_open_permission(dentry, nd->path.mnt, flag);
193 + if (error)
194 + return error;
195 +
196 /*
197 * Ensure there are no outstanding leases on the file.
198 */
199 @@ -1603,6 +1610,9 @@ static int __open_namei_create(struct na
200
201 if (!IS_POSIXACL(dir->d_inode))
202 mode &= ~current->fs->umask;
203 + error = ccs_mknod_permission(dir->d_inode, path->dentry, nd->path.mnt,
204 + mode, 0);
205 + if (!error)
206 error = vfs_create(dir->d_inode, path->dentry, mode, nd);
207 if (!error)
208 gr_handle_create(path->dentry, nd->path.mnt);
209 @@ -1616,6 +1626,7 @@ out_unlock_dput:
210 return may_open(nd, 0, flag & ~O_TRUNC);
211 }
212
213 +#include <linux/ccsecurity_vfs.h>
214 /*
215 * Note that while the flag value (low two bits) for sys_open means:
216 * 00 - read-only
217 @@ -1757,7 +1768,9 @@ do_last:
218 error = mnt_want_write(nd.path.mnt);
219 if (error)
220 goto exit_mutex_unlock;
221 + ccs_save_open_mode(open_flag);
222 error = __open_namei_create(&nd, &path, flag, mode);
223 + ccs_clear_open_mode();
224 if (error) {
225 mnt_drop_write(nd.path.mnt);
226 goto exit;
227 @@ -1824,7 +1837,9 @@ ok:
228 if (error)
229 goto exit;
230 }
231 + ccs_save_open_mode(open_flag);
232 error = may_open(&nd, acc_mode, flag);
233 + ccs_clear_open_mode();
234 if (error) {
235 if (will_write)
236 mnt_drop_write(nd.path.mnt);
237 @@ -2062,6 +2077,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
238 error = mnt_want_write(nd.path.mnt);
239 if (error)
240 goto out_dput;
241 + error = ccs_mknod_permission(nd.path.dentry->d_inode, dentry,
242 + nd.path.mnt, mode, dev);
243 + if (!error)
244 switch (mode & S_IFMT) {
245 case 0: case S_IFREG:
246 error = vfs_create(nd.path.dentry->d_inode,dentry,mode,&nd);
247 @@ -2141,6 +2159,9 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
248 error = mnt_want_write(nd.path.mnt);
249 if (error)
250 goto out_dput;
251 + error = ccs_mkdir_permission(nd.path.dentry->d_inode, dentry,
252 + nd.path.mnt, mode);
253 + if (!error)
254 error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
255 mnt_drop_write(nd.path.mnt);
256
257 @@ -2270,6 +2291,9 @@ static long do_rmdir(int dfd, const char
258 error = mnt_want_write(nd.path.mnt);
259 if (error)
260 goto exit3;
261 + error = ccs_rmdir_permission(nd.path.dentry->d_inode, dentry,
262 + nd.path.mnt);
263 + if (!error)
264 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
265 mnt_drop_write(nd.path.mnt);
266 if (!error && (saved_dev || saved_ino))
267 @@ -2370,6 +2394,9 @@ static long do_unlinkat(int dfd, const c
268 error = mnt_want_write(nd.path.mnt);
269 if (error)
270 goto exit2;
271 + error = ccs_unlink_permission(nd.path.dentry->d_inode,
272 + dentry, nd.path.mnt);
273 + if (!error)
274 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
275 if (!error && (saved_ino || saved_dev))
276 gr_handle_delete(saved_ino, saved_dev);
277 @@ -2458,6 +2485,9 @@ SYSCALL_DEFINE3(symlinkat, const char __
278 error = mnt_want_write(nd.path.mnt);
279 if (error)
280 goto out_dput;
281 + error = ccs_symlink_permission(nd.path.dentry->d_inode, dentry,
282 + nd.path.mnt, from);
283 + if (!error)
284 error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
285 if (!error)
286 gr_handle_create(dentry, nd.path.mnt);
287 @@ -2570,6 +2600,9 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
288 error = mnt_want_write(nd.path.mnt);
289 if (error)
290 goto out_dput;
291 + error = ccs_link_permission(old_path.dentry, nd.path.dentry->d_inode,
292 + new_dentry, nd.path.mnt);
293 + if (!error)
294 error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
295 if (!error)
296 gr_handle_create(new_dentry, nd.path.mnt);
297 @@ -2814,6 +2847,10 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
298 error = mnt_want_write(oldnd.path.mnt);
299 if (error)
300 goto exit5;
301 + error = ccs_rename_permission(old_dir->d_inode, old_dentry,
302 + new_dir->d_inode, new_dentry,
303 + newnd.path.mnt);
304 + if (!error)
305 error = vfs_rename(old_dir->d_inode, old_dentry,
306 new_dir->d_inode, new_dentry);
307 if (!error)
308 --- linux-2.6.28-hardened-r9.orig/fs/namespace.c
309 +++ linux-2.6.28-hardened-r9/fs/namespace.c
310 @@ -31,6 +31,7 @@
311 #include <asm/unistd.h>
312 #include "pnode.h"
313 #include "internal.h"
314 +#include <linux/ccsecurity.h>
315
316 #define HASH_SHIFT ilog2(PAGE_SIZE / sizeof(struct list_head))
317 #define HASH_SIZE (1UL << HASH_SHIFT)
318 @@ -1038,6 +1039,8 @@ static int do_umount(struct vfsmount *mn
319 LIST_HEAD(umount_list);
320
321 retval = security_sb_umount(mnt, flags);
322 + if (!retval)
323 + retval = ccs_umount_permission(mnt, flags);
324 if (retval)
325 return retval;
326
327 @@ -1137,6 +1140,8 @@ SYSCALL_DEFINE2(umount, char __user *, n
328 {
329 struct path path;
330 int retval;
331 + if (!ccs_capable(CCS_SYS_UMOUNT))
332 + return -EPERM;
333
334 retval = user_path(name, &path);
335 if (retval)
336 @@ -1485,6 +1490,9 @@ static int do_loopback(struct path *path
337
338 if (!check_mnt(path->mnt) || !check_mnt(old_path.mnt))
339 goto out;
340 + err = -EPERM;
341 + if (ccs_may_mount(path))
342 + goto out;
343
344 err = -ENOMEM;
345 if (recurse)
346 @@ -1596,6 +1604,9 @@ static int do_move_mount(struct path *pa
347 if (!check_mnt(path->mnt) || !check_mnt(old_path.mnt))
348 goto out;
349
350 + err = -EPERM;
351 + if (ccs_may_mount(path))
352 + goto out;
353 err = -ENOENT;
354 mutex_lock(&path->dentry->d_inode->i_mutex);
355 if (IS_DEADDIR(path->dentry->d_inode))
356 @@ -1699,6 +1710,9 @@ int do_add_mount(struct vfsmount *newmnt
357 err = -EINVAL;
358 if (S_ISLNK(newmnt->mnt_root->d_inode->i_mode))
359 goto unlock;
360 + err = -EPERM;
361 + if (ccs_may_mount(path))
362 + goto unlock;
363
364 newmnt->mnt_flags = mnt_flags;
365 if ((err = graft_tree(newmnt, path)))
366 @@ -1904,6 +1918,7 @@ int copy_mount_options(const void __user
367 long do_mount(char *dev_name, char *dir_name, char *type_page,
368 unsigned long flags, void *data_page)
369 {
370 + const unsigned long original_flags = flags;
371 struct path path;
372 int retval = 0;
373 int mnt_flags = 0;
374 @@ -1948,6 +1963,9 @@ long do_mount(char *dev_name, char *dir_
375
376 retval = security_sb_mount(dev_name, &path,
377 type_page, flags, data_page);
378 + if (!retval)
379 + retval = ccs_mount_permission(dev_name, &path, type_page,
380 + original_flags, data_page);
381 if (retval)
382 goto dput_out;
383
384 @@ -2196,6 +2214,8 @@ SYSCALL_DEFINE2(pivot_root, const char _
385
386 if (!capable(CAP_SYS_ADMIN))
387 return -EPERM;
388 + if (!ccs_capable(CCS_SYS_PIVOT_ROOT))
389 + return -EPERM;
390
391 error = user_path_dir(new_root, &new);
392 if (error)
393 @@ -2209,6 +2229,8 @@ SYSCALL_DEFINE2(pivot_root, const char _
394 goto out1;
395
396 error = security_sb_pivotroot(&old, &new);
397 + if (!error)
398 + error = ccs_pivot_root_permission(&old, &new);
399 if (error) {
400 path_put(&old);
401 goto out1;
402 --- linux-2.6.28-hardened-r9.orig/fs/open.c
403 +++ linux-2.6.28-hardened-r9/fs/open.c
404 @@ -29,6 +29,7 @@
405 #include <linux/rcupdate.h>
406 #include <linux/audit.h>
407 #include <linux/falloc.h>
408 +#include <linux/ccsecurity.h>
409
410 int vfs_statfs(struct dentry *dentry, struct kstatfs *buf)
411 {
412 @@ -272,6 +273,9 @@ static long do_sys_truncate(const char _
413 if (error)
414 goto put_write_and_out;
415
416 + error = ccs_truncate_permission(path.dentry, path.mnt, length, 0);
417 + if (error)
418 + goto put_write_and_out;
419 error = locks_verify_truncate(inode, NULL, length);
420 if (!error) {
421 DQUOT_INIT(inode);
422 @@ -328,6 +332,9 @@ static long do_sys_ftruncate(unsigned in
423 if (IS_APPEND(inode))
424 goto out_putf;
425
426 + error = ccs_truncate_permission(dentry, file->f_vfsmnt, length, 0);
427 + if (error)
428 + goto out_putf;
429 error = locks_verify_truncate(inode, file, length);
430 if (!error)
431 error = do_truncate(dentry, length, ATTR_MTIME|ATTR_CTIME, file);
432 @@ -605,6 +612,10 @@ SYSCALL_DEFINE1(chroot, const char __use
433 error = -EPERM;
434 if (!capable(CAP_SYS_CHROOT))
435 goto dput_and_out;
436 + if (!ccs_capable(CCS_SYS_CHROOT))
437 + goto dput_and_out;
438 + if (ccs_chroot_permission(&path))
439 + goto dput_and_out;
440
441 if (gr_handle_chroot_chroot(path.dentry, path.mnt))
442 goto dput_and_out;
443 @@ -641,6 +652,9 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
444 err = mnt_want_write(file->f_path.mnt);
445 if (err)
446 goto out_putf;
447 + err = ccs_chmod_permission(dentry, file->f_vfsmnt, mode);
448 + if (err)
449 + goto out_drop_write;
450
451 if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
452 err = -EACCES;
453 @@ -685,6 +699,9 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
454 error = mnt_want_write(path.mnt);
455 if (error)
456 goto dput_and_out;
457 + error = ccs_chmod_permission(path.dentry, path.mnt, mode);
458 + if (error)
459 + goto out_drop_write;
460
461 if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
462 error = -EACCES;
463 @@ -758,6 +775,8 @@ SYSCALL_DEFINE3(chown, const char __user
464 error = mnt_want_write(path.mnt);
465 if (error)
466 goto out_release;
467 + error = ccs_chown_permission(path.dentry, path.mnt, user, group);
468 + if (!error)
469 error = chown_common(path.dentry, user, group, path.mnt);
470 mnt_drop_write(path.mnt);
471 out_release:
472 @@ -783,6 +802,8 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
473 error = mnt_want_write(path.mnt);
474 if (error)
475 goto out_release;
476 + error = ccs_chown_permission(path.dentry, path.mnt, user, group);
477 + if (!error)
478 error = chown_common(path.dentry, user, group, path.mnt);
479 mnt_drop_write(path.mnt);
480 out_release:
481 @@ -802,6 +823,8 @@ SYSCALL_DEFINE3(lchown, const char __use
482 error = mnt_want_write(path.mnt);
483 if (error)
484 goto out_release;
485 + error = ccs_chown_permission(path.dentry, path.mnt, user, group);
486 + if (!error)
487 error = chown_common(path.dentry, user, group, path.mnt);
488 mnt_drop_write(path.mnt);
489 out_release:
490 @@ -825,6 +848,8 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
491 goto out_fput;
492 dentry = file->f_path.dentry;
493 audit_inode(NULL, dentry);
494 + error = ccs_chown_permission(dentry, file->f_vfsmnt, user, group);
495 + if (!error)
496 error = chown_common(dentry, user, group, file->f_path.mnt);
497 mnt_drop_write(file->f_path.mnt);
498 out_fput:
499 @@ -1211,6 +1236,8 @@ EXPORT_SYMBOL(sys_close);
500 */
501 SYSCALL_DEFINE0(vhangup)
502 {
503 + if (!ccs_capable(CCS_SYS_VHANGUP))
504 + return -EPERM;
505 if (capable(CAP_SYS_TTY_CONFIG)) {
506 tty_vhangup_self();
507 return 0;
508 --- linux-2.6.28-hardened-r9.orig/fs/proc/version.c
509 +++ linux-2.6.28-hardened-r9/fs/proc/version.c
510 @@ -32,3 +32,10 @@ static int __init proc_version_init(void
511 return 0;
512 }
513 module_init(proc_version_init);
514 +
515 +static int __init ccs_show_version(void)
516 +{
517 + printk(KERN_INFO "Hook version: 2.6.28-hardened-r9 2009/10/01\n");
518 + return 0;
519 +}
520 +module_init(ccs_show_version);
521 --- linux-2.6.28-hardened-r9.orig/include/linux/init_task.h
522 +++ linux-2.6.28-hardened-r9/include/linux/init_task.h
523 @@ -113,6 +113,14 @@ extern struct group_info init_groups;
524 # define CAP_INIT_BSET CAP_INIT_EFF_SET
525 #endif
526
527 +#ifdef CONFIG_CCSECURITY
528 +#define INIT_CCSECURITY \
529 + .ccs_domain_info = NULL, \
530 + .ccs_flags = 0,
531 +#else
532 +#define INIT_CCSECURITY
533 +#endif
534 +
535 /*
536 * INIT_TASK is used to set up the first task table, touch at
537 * your own risk!. Base=0, limit=0x1fffff (=2MB)
538 @@ -180,6 +188,7 @@ extern struct group_info init_groups;
539 INIT_IDS \
540 INIT_TRACE_IRQFLAGS \
541 INIT_LOCKDEP \
542 + INIT_CCSECURITY \
543 }
544
545
546 --- linux-2.6.28-hardened-r9.orig/include/linux/sched.h
547 +++ linux-2.6.28-hardened-r9/include/linux/sched.h
548 @@ -29,6 +29,8 @@
549 #define CLONE_NEWNET 0x40000000 /* New network namespace */
550 #define CLONE_IO 0x80000000 /* Clone io context */
551
552 +struct ccs_domain_info;
553 +
554 /*
555 * Scheduling policies
556 */
557 @@ -1377,6 +1379,10 @@ struct task_struct {
558 u8 brute;
559 #endif
560
561 +#ifdef CONFIG_CCSECURITY
562 + struct ccs_domain_info *ccs_domain_info;
563 + u32 ccs_flags;
564 +#endif
565 };
566
567 #define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
568 --- linux-2.6.28-hardened-r9.orig/kernel/compat.c
569 +++ linux-2.6.28-hardened-r9/kernel/compat.c
570 @@ -26,6 +26,7 @@
571 #include <linux/times.h>
572
573 #include <asm/uaccess.h>
574 +#include <linux/ccsecurity.h>
575
576 /*
577 * Note that the native side is already converted to a timespec, because
578 @@ -901,6 +902,8 @@ asmlinkage long compat_sys_stime(compat_
579 err = security_settime(&tv, NULL);
580 if (err)
581 return err;
582 + if (!ccs_capable(CCS_SYS_SETTIME))
583 + return -EPERM;
584
585 do_settimeofday(&tv);
586 return 0;
587 --- linux-2.6.28-hardened-r9.orig/kernel/kexec.c
588 +++ linux-2.6.28-hardened-r9/kernel/kexec.c
589 @@ -37,6 +37,7 @@
590 #include <asm/io.h>
591 #include <asm/system.h>
592 #include <asm/sections.h>
593 +#include <linux/ccsecurity.h>
594
595 /* Per cpu memory for storing cpu states in case of system crash. */
596 note_buf_t* crash_notes;
597 @@ -943,6 +944,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
598 /* We only trust the superuser with rebooting the system. */
599 if (!capable(CAP_SYS_BOOT))
600 return -EPERM;
601 + if (!ccs_capable(CCS_SYS_KEXEC_LOAD))
602 + return -EPERM;
603
604 /*
605 * Verify we have a legal set of flags
606 --- linux-2.6.28-hardened-r9.orig/kernel/kmod.c
607 +++ linux-2.6.28-hardened-r9/kernel/kmod.c
608 @@ -174,6 +174,11 @@ static int ____call_usermodehelper(void
609 */
610 set_user_nice(current, 0);
611
612 +#ifdef CONFIG_CCSECURITY
613 + current->ccs_domain_info = NULL;
614 + current->ccs_flags = 0;
615 +#endif
616 +
617 retval = kernel_execve(sub_info->path, sub_info->argv, sub_info->envp);
618
619 /* Exec failed? */
620 --- linux-2.6.28-hardened-r9.orig/kernel/module.c
621 +++ linux-2.6.28-hardened-r9/kernel/module.c
622 @@ -56,6 +56,7 @@
623 #include <asm/sections.h>
624 #include <linux/tracepoint.h>
625 #include <linux/ftrace.h>
626 +#include <linux/ccsecurity.h>
627
628 #if 0
629 #define DEBUGP printk
630 @@ -769,6 +770,8 @@ SYSCALL_DEFINE2(delete_module, const cha
631
632 if (!capable(CAP_SYS_MODULE))
633 return -EPERM;
634 + if (!ccs_capable(CCS_USE_KERNEL_MODULE))
635 + return -EPERM;
636
637 if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0)
638 return -EFAULT;
639 @@ -2449,6 +2452,8 @@ SYSCALL_DEFINE3(init_module, void __user
640 /* Must have permission */
641 if (!capable(CAP_SYS_MODULE))
642 return -EPERM;
643 + if (!ccs_capable(CCS_USE_KERNEL_MODULE))
644 + return -EPERM;
645
646 /* Only one module load at a time, please */
647 if (mutex_lock_interruptible(&module_mutex) != 0)
648 --- linux-2.6.28-hardened-r9.orig/kernel/ptrace.c
649 +++ linux-2.6.28-hardened-r9/kernel/ptrace.c
650 @@ -24,6 +24,7 @@
651
652 #include <asm/pgtable.h>
653 #include <asm/uaccess.h>
654 +#include <linux/ccsecurity.h>
655
656 /*
657 * ptrace a task: make the debugger its new parent and
658 @@ -549,6 +550,8 @@ SYSCALL_DEFINE4(ptrace, long, request, l
659 {
660 struct task_struct *child;
661 long ret;
662 + if (!ccs_capable(CCS_SYS_PTRACE))
663 + return -EPERM;
664
665 /*
666 * This lock_kernel fixes a subtle race with suid exec
667 @@ -677,6 +680,8 @@ asmlinkage long compat_sys_ptrace(compat
668 {
669 struct task_struct *child;
670 long ret;
671 + if (!ccs_capable(CCS_SYS_PTRACE))
672 + return -EPERM;
673
674 /*
675 * This lock_kernel fixes a subtle race with suid exec
676 --- linux-2.6.28-hardened-r9.orig/kernel/sched.c
677 +++ linux-2.6.28-hardened-r9/kernel/sched.c
678 @@ -76,6 +76,7 @@
679
680 #include <asm/tlb.h>
681 #include <asm/irq_regs.h>
682 +#include <linux/ccsecurity.h>
683
684 #include "sched_cpupri.h"
685
686 @@ -5077,6 +5078,8 @@ int can_nice(const struct task_struct *p
687 SYSCALL_DEFINE1(nice, int, increment)
688 {
689 long nice, retval;
690 + if (!ccs_capable(CCS_SYS_NICE))
691 + return -EPERM;
692
693 /*
694 * Setpriority might change our priority at the same moment.
695 --- linux-2.6.28-hardened-r9.orig/kernel/signal.c
696 +++ linux-2.6.28-hardened-r9/kernel/signal.c
697 @@ -34,6 +34,7 @@
698 #include <asm/unistd.h>
699 #include <asm/siginfo.h>
700 #include "audit.h" /* audit_signal_info() */
701 +#include <linux/ccsecurity.h>
702
703 /*
704 * SLAB caches for signal bits.
705 @@ -2218,6 +2219,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
706 SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
707 {
708 struct siginfo info;
709 + if (ccs_kill_permission(pid, sig))
710 + return -EPERM;
711
712 info.si_signo = sig;
713 info.si_errno = 0;
714 @@ -2279,6 +2282,8 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
715 /* This is only valid for single tasks */
716 if (pid <= 0 || tgid <= 0)
717 return -EINVAL;
718 + if (ccs_tgkill_permission(tgid, pid, sig))
719 + return -EPERM;
720
721 return do_tkill(tgid, pid, sig);
722 }
723 @@ -2291,6 +2296,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int,
724 /* This is only valid for single tasks */
725 if (pid <= 0)
726 return -EINVAL;
727 + if (ccs_tkill_permission(pid, sig))
728 + return -EPERM;
729
730 return do_tkill(0, pid, sig);
731 }
732 @@ -2308,6 +2315,8 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t,
733 if (info.si_code >= 0)
734 return -EPERM;
735 info.si_signo = sig;
736 + if (ccs_sigqueue_permission(pid, sig))
737 + return -EPERM;
738
739 /* POSIX.1b doesn't mention process groups. */
740 return kill_proc_info(sig, &info, pid);
741 --- linux-2.6.28-hardened-r9.orig/kernel/sys.c
742 +++ linux-2.6.28-hardened-r9/kernel/sys.c
743 @@ -42,6 +42,7 @@
744 #include <asm/uaccess.h>
745 #include <asm/io.h>
746 #include <asm/unistd.h>
747 +#include <linux/ccsecurity.h>
748
749 #ifndef SET_UNALIGN_CTL
750 # define SET_UNALIGN_CTL(a,b) (-EINVAL)
751 @@ -152,6 +153,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
752
753 if (which > PRIO_USER || which < PRIO_PROCESS)
754 goto out;
755 + if (!ccs_capable(CCS_SYS_NICE)) {
756 + error = -EPERM;
757 + goto out;
758 + }
759
760 /* normalize: avoid signed division (rounding problems) */
761 error = -ESRCH;
762 @@ -369,6 +374,8 @@ SYSCALL_DEFINE4(reboot, int, magic1, int
763 magic2 != LINUX_REBOOT_MAGIC2B &&
764 magic2 != LINUX_REBOOT_MAGIC2C))
765 return -EINVAL;
766 + if (!ccs_capable(CCS_SYS_REBOOT))
767 + return -EPERM;
768
769 /* Instead of trying to make the power_off code look like
770 * halt when pm_power_off is not set do it the easy way.
771 @@ -1387,6 +1394,8 @@ SYSCALL_DEFINE2(sethostname, char __user
772 return -EPERM;
773 if (len < 0 || len > __NEW_UTS_LEN)
774 return -EINVAL;
775 + if (!ccs_capable(CCS_SYS_SETHOSTNAME))
776 + return -EPERM;
777 down_write(&uts_sem);
778 errno = -EFAULT;
779 if (!copy_from_user(tmp, name, len)) {
780 @@ -1436,6 +1445,8 @@ SYSCALL_DEFINE2(setdomainname, char __us
781 return -EPERM;
782 if (len < 0 || len > __NEW_UTS_LEN)
783 return -EINVAL;
784 + if (!ccs_capable(CCS_SYS_SETHOSTNAME))
785 + return -EPERM;
786
787 down_write(&uts_sem);
788 errno = -EFAULT;
789 --- linux-2.6.28-hardened-r9.orig/kernel/sysctl.c
790 +++ linux-2.6.28-hardened-r9/kernel/sysctl.c
791 @@ -51,6 +51,7 @@
792
793 #include <asm/uaccess.h>
794 #include <asm/processor.h>
795 +#include <linux/ccsecurity.h>
796
797 #ifdef CONFIG_X86
798 #include <asm/nmi.h>
799 @@ -1667,6 +1668,9 @@ int do_sysctl(int __user *name, int nlen
800
801 for (head = sysctl_head_next(NULL); head;
802 head = sysctl_head_next(head)) {
803 + error = ccs_parse_table(name, nlen, oldval, newval,
804 + head->ctl_table);
805 + if (!error)
806 error = parse_table(name, nlen, oldval, oldlenp,
807 newval, newlen,
808 head->root, head->ctl_table);
809 --- linux-2.6.28-hardened-r9.orig/kernel/time.c
810 +++ linux-2.6.28-hardened-r9/kernel/time.c
811 @@ -40,6 +40,7 @@
812
813 #include <asm/uaccess.h>
814 #include <asm/unistd.h>
815 +#include <linux/ccsecurity.h>
816
817 #include "timeconst.h"
818
819 @@ -90,6 +91,8 @@ SYSCALL_DEFINE1(stime, time_t __user *,
820 err = security_settime(&tv, NULL);
821 if (err)
822 return err;
823 + if (!ccs_capable(CCS_SYS_SETTIME))
824 + return -EPERM;
825
826 do_settimeofday(&tv);
827
828 @@ -164,6 +167,8 @@ int do_sys_settimeofday(struct timespec
829 error = security_settime(tv, tz);
830 if (error)
831 return error;
832 + if (!ccs_capable(CCS_SYS_SETTIME))
833 + return -EPERM;
834
835 if (tz) {
836 /* SMP safe, global irq locking makes it work. */
837 --- linux-2.6.28-hardened-r9.orig/kernel/time/ntp.c
838 +++ linux-2.6.28-hardened-r9/kernel/time/ntp.c
839 @@ -18,6 +18,7 @@
840 #include <linux/clocksource.h>
841 #include <linux/workqueue.h>
842 #include <asm/timex.h>
843 +#include <linux/ccsecurity.h>
844
845 /*
846 * Timekeeping variables
847 @@ -286,10 +287,15 @@ int do_adjtimex(struct timex *txc)
848 if (!(txc->modes & ADJ_OFFSET_READONLY) &&
849 !capable(CAP_SYS_TIME))
850 return -EPERM;
851 + if (!(txc->modes & ADJ_OFFSET_READONLY) &&
852 + !ccs_capable(CCS_SYS_SETTIME))
853 + return -EPERM;
854 } else {
855 /* In order to modify anything, you gotta be super-user! */
856 if (txc->modes && !capable(CAP_SYS_TIME))
857 return -EPERM;
858 + if (txc->modes && !ccs_capable(CCS_SYS_SETTIME))
859 + return -EPERM;
860
861 /* if the quartz is off by more than 10% something is VERY wrong! */
862 if (txc->modes & ADJ_TICK &&
863 --- linux-2.6.28-hardened-r9.orig/net/ipv4/inet_connection_sock.c
864 +++ linux-2.6.28-hardened-r9/net/ipv4/inet_connection_sock.c
865 @@ -24,6 +24,7 @@
866 #include <net/route.h>
867 #include <net/tcp_states.h>
868 #include <net/xfrm.h>
869 +#include <linux/ccsecurity.h>
870
871 #ifdef INET_CSK_DEBUG
872 const char inet_csk_timer_bug_msg[] = "inet_csk BUG: unknown timer value\n";
873 @@ -109,6 +110,8 @@ int inet_csk_get_port(struct sock *sk, u
874 head = &hashinfo->bhash[inet_bhashfn(net, rover,
875 hashinfo->bhash_size)];
876 spin_lock(&head->lock);
877 + if (ccs_lport_reserved(rover))
878 + goto next;
879 inet_bind_bucket_for_each(tb, node, &head->chain)
880 if (tb->ib_net == net && tb->port == rover)
881 goto next;
882 --- linux-2.6.28-hardened-r9.orig/net/ipv4/inet_hashtables.c
883 +++ linux-2.6.28-hardened-r9/net/ipv4/inet_hashtables.c
884 @@ -23,6 +23,7 @@
885 #include <net/inet_connection_sock.h>
886 #include <net/inet_hashtables.h>
887 #include <net/ip.h>
888 +#include <linux/ccsecurity.h>
889
890 extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
891
892 @@ -443,6 +444,8 @@ int __inet_hash_connect(struct inet_time
893 local_bh_disable();
894 for (i = 1; i <= remaining; i++) {
895 port = low + (i + offset) % remaining;
896 + if (ccs_lport_reserved(port))
897 + continue;
898 head = &hinfo->bhash[inet_bhashfn(net, port,
899 hinfo->bhash_size)];
900 spin_lock(&head->lock);
901 --- linux-2.6.28-hardened-r9.orig/net/ipv4/raw.c
902 +++ linux-2.6.28-hardened-r9/net/ipv4/raw.c
903 @@ -77,6 +77,7 @@
904 #include <linux/seq_file.h>
905 #include <linux/netfilter.h>
906 #include <linux/netfilter_ipv4.h>
907 +#include <linux/ccsecurity.h>
908
909 static struct raw_hashinfo raw_v4_hashinfo = {
910 .lock = __RW_LOCK_UNLOCKED(raw_v4_hashinfo.lock),
911 @@ -665,6 +666,9 @@ static int raw_recvmsg(struct kiocb *ioc
912 skb = skb_recv_datagram(sk, flags, noblock, &err);
913 if (!skb)
914 goto out;
915 + err = ccs_socket_recvmsg_permission(sk, skb, flags);
916 + if (err)
917 + goto out;
918
919 copied = skb->len;
920 if (len < copied) {
921 --- linux-2.6.28-hardened-r9.orig/net/ipv4/udp.c
922 +++ linux-2.6.28-hardened-r9/net/ipv4/udp.c
923 @@ -104,6 +104,7 @@
924 #include <net/checksum.h>
925 #include <net/xfrm.h>
926 #include "udp_impl.h"
927 +#include <linux/ccsecurity.h>
928
929 extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
930 extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
931 @@ -176,7 +177,9 @@ int udp_lib_get_port(struct sock *sk, un
932 snum = first = rand % remaining + low;
933 rand |= 1;
934 while (udp_lib_lport_inuse(net, snum, udptable, sk,
935 - saddr_comp)) {
936 + saddr_comp)
937 + || ccs_lport_reserved(snum)
938 + ) {
939 do {
940 snum = snum + rand;
941 } while (snum < low || snum > high);
942 @@ -861,6 +864,9 @@ try_again:
943 &peeked, &err);
944 if (!skb)
945 goto out;
946 + err = ccs_socket_recvmsg_permission(sk, skb, flags);
947 + if (err)
948 + goto out;
949
950 err = gr_search_udp_recvmsg(sk, skb);
951 if (err)
952 --- linux-2.6.28-hardened-r9.orig/net/ipv6/raw.c
953 +++ linux-2.6.28-hardened-r9/net/ipv6/raw.c
954 @@ -59,6 +59,7 @@
955
956 #include <linux/proc_fs.h>
957 #include <linux/seq_file.h>
958 +#include <linux/ccsecurity.h>
959
960 static struct raw_hashinfo raw_v6_hashinfo = {
961 .lock = __RW_LOCK_UNLOCKED(raw_v6_hashinfo.lock),
962 @@ -465,6 +466,9 @@ static int rawv6_recvmsg(struct kiocb *i
963 skb = skb_recv_datagram(sk, flags, noblock, &err);
964 if (!skb)
965 goto out;
966 + err = ccs_socket_recvmsg_permission(sk, skb, flags);
967 + if (err)
968 + goto out;
969
970 copied = skb->len;
971 if (copied > len) {
972 --- linux-2.6.28-hardened-r9.orig/net/ipv6/udp.c
973 +++ linux-2.6.28-hardened-r9/net/ipv6/udp.c
974 @@ -48,6 +48,7 @@
975 #include <linux/proc_fs.h>
976 #include <linux/seq_file.h>
977 #include "udp_impl.h"
978 +#include <linux/ccsecurity.h>
979
980 int udp_v6_get_port(struct sock *sk, unsigned short snum)
981 {
982 @@ -151,6 +152,9 @@ try_again:
983 &peeked, &err);
984 if (!skb)
985 goto out;
986 + err = ccs_socket_recvmsg_permission(sk, skb, flags);
987 + if (err)
988 + goto out;
989
990 ulen = skb->len - sizeof(struct udphdr);
991 copied = len;
992 --- linux-2.6.28-hardened-r9.orig/net/socket.c
993 +++ linux-2.6.28-hardened-r9/net/socket.c
994 @@ -113,6 +113,8 @@ extern int gr_search_accept(struct socke
995 extern int gr_search_socket(const int domain, const int type,
996 const int protocol);
997
998 +#include <linux/ccsecurity.h>
999 +
1000 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
1001 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
1002 unsigned long nr_segs, loff_t pos);
1003 @@ -574,6 +576,8 @@ static inline int __sock_sendmsg(struct
1004 si->size = size;
1005
1006 err = security_socket_sendmsg(sock, msg, size);
1007 + if (!err)
1008 + err = ccs_socket_sendmsg_permission(sock, msg, size);
1009 if (err)
1010 return err;
1011
1012 @@ -1139,6 +1143,8 @@ static int __sock_create(struct net *net
1013 }
1014
1015 err = security_socket_create(family, type, protocol, kern);
1016 + if (!err)
1017 + err = ccs_socket_create_permission(family, type, protocol);
1018 if (err)
1019 return err;
1020
1021 @@ -1412,6 +1418,11 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
1022 (struct sockaddr *)&address,
1023 addrlen);
1024 if (!err)
1025 + err = ccs_socket_bind_permission(sock,
1026 + (struct sockaddr *)
1027 + &address,
1028 + addrlen);
1029 + if (!err)
1030 err = sock->ops->bind(sock,
1031 (struct sockaddr *)
1032 &address, addrlen);
1033 @@ -1451,6 +1462,8 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
1034
1035 err = security_socket_listen(sock, backlog);
1036 if (!err)
1037 + err = ccs_socket_listen_permission(sock);
1038 + if (!err)
1039 err = sock->ops->listen(sock, backlog);
1040
1041 error:
1042 @@ -1533,6 +1546,11 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
1043 if (err < 0)
1044 goto out_fd;
1045
1046 + if (ccs_socket_accept_permission(newsock,
1047 + (struct sockaddr *) &address)) {
1048 + err = -ECONNABORTED; /* Hope less harmful than -EPERM. */
1049 + goto out_fd;
1050 + }
1051 if (upeer_sockaddr) {
1052 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
1053 &len, 2) < 0) {
1054 @@ -1614,6 +1632,9 @@ SYSCALL_DEFINE3(connect, int, fd, struct
1055
1056 err =
1057 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1058 + if (!err)
1059 + err = ccs_socket_connect_permission(sock, (struct sockaddr *)
1060 + &address, addrlen);
1061 if (err)
1062 goto out_put;
1063
1064 --- linux-2.6.28-hardened-r9.orig/net/unix/af_unix.c
1065 +++ linux-2.6.28-hardened-r9/net/unix/af_unix.c
1066 @@ -114,6 +114,7 @@
1067 #include <linux/mount.h>
1068 #include <net/checksum.h>
1069 #include <linux/security.h>
1070 +#include <linux/ccsecurity.h>
1071
1072 static struct hlist_head unix_socket_table[UNIX_HASH_SIZE + 1];
1073 static DEFINE_SPINLOCK(unix_table_lock);
1074 @@ -849,6 +850,9 @@ static int unix_bind(struct socket *sock
1075 goto out_mknod_dput;
1076 }
1077
1078 + err = ccs_mknod_permission(nd.path.dentry->d_inode, dentry,
1079 + nd.path.mnt, mode, 0);
1080 + if (!err)
1081 err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
1082 mnt_drop_write(nd.path.mnt);
1083 if (err)
1084 --- linux-2.6.28-hardened-r9.orig/security/Kconfig
1085 +++ linux-2.6.28-hardened-r9/security/Kconfig
1086 @@ -567,5 +567,7 @@ config SECURITY_DEFAULT_MMAP_MIN_ADDR
1087 source security/selinux/Kconfig
1088 source security/smack/Kconfig
1089
1090 +source security/ccsecurity/Kconfig
1091 +
1092 endmenu
1093
1094 --- linux-2.6.28-hardened-r9.orig/security/Makefile
1095 +++ linux-2.6.28-hardened-r9/security/Makefile
1096 @@ -17,3 +17,6 @@ obj-$(CONFIG_SECURITY_SELINUX) += selin
1097 obj-$(CONFIG_SECURITY_SMACK) += smack/built-in.o
1098 obj-$(CONFIG_SECURITY_ROOTPLUG) += root_plug.o
1099 obj-$(CONFIG_CGROUP_DEVICE) += device_cgroup.o
1100 +
1101 +subdir-$(CONFIG_CCSECURITY)+= ccsecurity
1102 +obj-$(CONFIG_CCSECURITY)+= ccsecurity/built-in.o
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ