History

Security/SELinux: seperate lsm specific mmap_min_addr

Currently SELinux enforcement of controls on the ability to map low memory is determined by the mmap_min_addr tunable. This patch causes SELinux to ignore the tunable and instead use a seperate Kconfig option specific to how much space the LSM should protect. The tunable will now only control the need for CAP_SYS_RAWIO and SELinux permissions will always protect the amount of low memory designated by CONFIG_LSM_MMAP_MIN_ADDR. This allows users who need to disable the mmap_min_addr controls (usual reason being they run WINE as a non-root user) to do so and still have SELinux controls preventing confined domains (like a web server) from being able to map some area of low memory.

Eric Paris committed 17 years ago

Commit 788084a1 parent 8cf948e11 files · +92 −30Browse files

Showing the changes to include (2 of 11 files). Show all

Unified · Split

2 files
  1. include/linux/mm.h +0 −15
  2. include/linux/security.h +17 −0
include/linux/mm.h+0−15
@@ -34,8 +34,6 @@ extern int sysctl_legacy_va_layout; · 33 unmodified lines
34#define sysctl_legacy_va_layout 034#define sysctl_legacy_va_layout 0
35#endif35#endif
36 36
37extern unsigned long mmap_min_addr;
38
39#include <asm/page.h>37#include <asm/page.h>
40#include <asm/pgtable.h>38#include <asm/pgtable.h>
41#include <asm/processor.h>39#include <asm/processor.h>
@@ -574,19 +572,6 @@ static inline void set_page_links(struct page *page, enum zone_type zone, · 532 unmodified lines
574 set_page_section(page, pfn_to_section_nr(pfn));572 set_page_section(page, pfn_to_section_nr(pfn));
575}573}
576 574
577/*
578 * If a hint addr is less than mmap_min_addr change hint to be as
579 * low as possible but still greater than mmap_min_addr
580 */
581static inline unsigned long round_hint_to_min(unsigned long hint)
582{
583 hint &= PAGE_MASK;
584 if (((void *)hint != NULL) &&
585 (hint < mmap_min_addr))
586 return PAGE_ALIGN(mmap_min_addr);
587 return hint;
588}
589
590/*575/*
591 * Some inline functions in vmstat.h depend on page_zone()576 * Some inline functions in vmstat.h depend on page_zone()
592 */577 */
include/linux/security.h+17−0
@@ -28,6 +28,7 @@ · 27 unmodified lines
28#include <linux/resource.h>28#include <linux/resource.h>
29#include <linux/sem.h>29#include <linux/sem.h>
30#include <linux/shm.h>30#include <linux/shm.h>
31#include <linux/mm.h> /* PAGE_ALIGN */
31#include <linux/msg.h>32#include <linux/msg.h>
32#include <linux/sched.h>33#include <linux/sched.h>
33#include <linux/key.h>34#include <linux/key.h>
@@ -95,6 +96,7 @@ extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb); · 61 unmodified lines
95extern int cap_netlink_recv(struct sk_buff *skb, int cap);96extern int cap_netlink_recv(struct sk_buff *skb, int cap);
96 97
97extern unsigned long mmap_min_addr;98extern unsigned long mmap_min_addr;
99extern unsigned long dac_mmap_min_addr;
98/*100/*
99 * Values used in the task_security_ops calls101 * Values used in the task_security_ops calls
100 */102 */
@@ -147,6 +149,21 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) · 46 unmodified lines
147 opts->num_mnt_opts = 0;149 opts->num_mnt_opts = 0;
148}150}
149 151
152/*
153 * If a hint addr is less than mmap_min_addr change hint to be as
154 * low as possible but still greater than mmap_min_addr
155 */
156static inline unsigned long round_hint_to_min(unsigned long hint)
157{
158 hint &= PAGE_MASK;
159 if (((void *)hint != NULL) &&
160 (hint < mmap_min_addr))
161 return PAGE_ALIGN(mmap_min_addr);
162 return hint;
163}
164
165extern int mmap_min_addr_handler(struct ctl_table *table, int write, struct file *filp,
166 void __user *buffer, size_t *lenp, loff_t *ppos);
150/**167/**
151 * struct security_operations - main security structure168 * struct security_operations - main security structure
152 *169 *