Currently SELinux enforcement of controls on the ability to map low memory is determined by the mmap_min_addr tunable. This patch causes SELinux to ignore the tunable and instead use a seperate Kconfig option specific to how much space the LSM should protect. The tunable will now only control the need for CAP_SYS_RAWIO and SELinux permissions will always protect the amount of low memory designated by CONFIG_LSM_MMAP_MIN_ADDR. This allows users who need to disable the mmap_min_addr controls (usual reason being they run WINE as a non-root user) to do so and still have SELinux controls preventing confined domains (like a web server) from being able to map some area of low memory.
Showing the changes to kernel (1 of 11 files). Show all
Unified · Split
| @@ -49,6 +49,7 @@ · 48 unmodified lines | |||
| 49 | #include <linux/acpi.h> | 49 | #include <linux/acpi.h> |
| 50 | #include <linux/reboot.h> | 50 | #include <linux/reboot.h> |
| 51 | #include <linux/ftrace.h> | 51 | #include <linux/ftrace.h> |
| 52 | #include <linux/security.h> | ||
| 52 | #include <linux/slow-work.h> | 53 | #include <linux/slow-work.h> |
| 53 | #include <linux/perf_counter.h> | 54 | #include <linux/perf_counter.h> |
| 54 | 55 | ||
| @@ -1306,10 +1307,10 @@ static struct ctl_table vm_table[] = { · 1251 unmodified lines | |||
| 1306 | { | 1307 | { |
| 1307 | .ctl_name = CTL_UNNUMBERED, | 1308 | .ctl_name = CTL_UNNUMBERED, |
| 1308 | .procname = "mmap_min_addr", | 1309 | .procname = "mmap_min_addr", |
| 1309 | .data = &mmap_min_addr, | 1310 | .data = &dac_mmap_min_addr, |
| 1310 | .maxlen = sizeof(unsigned long), | 1311 | .maxlen = sizeof(unsigned long), |
| 1311 | .mode = 0644, | 1312 | .mode = 0644, |
| 1312 | .proc_handler = &proc_doulongvec_minmax, | 1313 | .proc_handler = &mmap_min_addr_handler, |
| 1313 | }, | 1314 | }, |
| 1314 | #ifdef CONFIG_NUMA | 1315 | #ifdef CONFIG_NUMA |
| 1315 | { | 1316 | { |