Eric Paris
ed03218951
security: Protection for exploiting null dereference using mmap ...
Add a new security check on mmap operations to see if the user is attempting
to mmap to low area of the address space. The amount of space protected is
indicated by the new proc tunable /proc/sys/vm/mmap_min_addr and defaults to
0, preserving existing behavior.
This patch uses a new SELinux security class "memprotect." Policy already
contains a number of allow rules like a_t self:process * (unconfined_t being
one of them) which mean that putting this check in the process class (its
best current fit) would make it useless as all user processes, which we also
want to protect against, would be allowed. By taking the memprotect name of
the new class it will also make it possible for us to move some of the other
memory protect permissions out of 'process' and into the new class next time
we bump the policy version number (which I also think is a good future idea)
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
2007-07-11 22:52:29 -04:00
Fix crash with irqpoll due to the IRQF_IRQPOLL flag testing
2007-05-24 08:37:14 -07:00
PM: introduce set_target method in pm_ops
2007-07-01 12:29:44 -07:00
NTP: remove clock_was_set() call to prevent deadlock
2007-07-03 13:54:27 -07:00
audit: add spaces on either side of case "..." operator.
2007-05-08 11:15:09 -07:00
[PATCH] audit signal recipients
2007-05-11 05:38:25 -04:00
audit: fix oops removing watch if audit disabled
2007-06-24 08:59:12 -07:00
[PATCH] Abnormal End of Processes
2007-05-11 05:38:26 -04:00
signal/timer/event: timerfd compat code
2007-05-11 08:29:36 -07:00
use simple_read_from_buffer in kernel/
2007-05-09 12:30:49 -07:00
microcode: use suspend-related CPU hotplug notifications
2007-05-09 12:30:56 -07:00
cpuset: zero malloc - fix for old cpusets
2007-06-16 13:16:15 -07:00
sched: update delay-accounting to use CFS's precise stats
2007-07-09 18:52:00 +02:00
move die notifier handling to common code
2007-05-08 11:15:04 -07:00
sched: update delay-accounting to use CFS's precise stats
2007-07-09 18:52:00 +02:00
sched: update delay-accounting to use CFS's precise stats
2007-07-09 18:52:00 +02:00
FUTEX: Restore the dropped ERSCH fix
2007-06-24 12:08:53 -07:00
Revert "futex_requeue_pi optimization"
2007-06-18 09:48:41 -07:00
Add suspend-related notifications for CPU hotplug
2007-05-09 12:30:56 -07:00
The scheduled -EINVAL for invalid timevals in setitimer
2007-05-08 11:15:13 -07:00
fix possible null ptr deref in kallsyms_lookup
2007-05-30 10:51:38 -07:00
Fix trivial typos in Kconfig* files
2007-05-09 07:12:20 +02:00
kdump/kexec: calculate note size at compile time
2007-05-08 11:15:07 -07:00
wait_for_helper: remove unneeded do_sigaction()
2007-05-09 12:30:53 -07:00
Kprobes: The ON/OFF knob thru debugfs
2007-05-08 11:15:19 -07:00
remove "struct subsystem" as it is no longer needed
2007-05-02 18:57:59 -07:00
freezer: fix kthread_create vs freezer theoretical race
2007-05-23 20:14:11 -07:00
lockdep: removed unused ip argument in mark_lock & mark_held_locks
2007-05-08 11:15:13 -07:00
move die notifier handling to common code
2007-05-08 11:15:04 -07:00
Fix minor typoes in kernel/module.c
2007-05-09 07:26:28 +02:00
wrap access to thread_info
2007-05-09 12:30:56 -07:00
fix refcounting of nsproxy object when unshared
2007-06-24 08:59:10 -07:00
kernel/params.c: fix lying comment for param_array()
2007-05-08 11:15:08 -07:00
statically initialize struct pid for swapper
2007-05-11 08:29:35 -07:00
sched: make posix-cpu-timers use CFS's accounting information
2007-07-09 18:51:58 +02:00
posix-timers: Prevent softirq starvation by small intervals and SIG_IGN
2007-06-21 15:57:04 -07:00
header cleaning: don't include smp_lock.h when not used
2007-05-08 11:15:07 -07:00
Detach sched.h from mm.h
2007-05-21 09:18:19 -07:00
[PATCH] auditing ptrace
2007-05-11 05:38:25 -04:00
Add suspend-related notifications for CPU hotplug
2007-05-09 12:30:56 -07:00
rcutorture: Remove redundant assignment to cur_ops in for loop
2007-05-08 11:15:17 -07:00
pipe: change the ->pin() operation to ->confirm()
2007-07-10 08:04:15 +02:00
Revert "futex_requeue_pi optimization"
2007-06-18 09:48:41 -07:00
Revert "futex_requeue_pi optimization"
2007-06-18 09:48:41 -07:00
Lockdep treats down_write_trylock like regular down_write
2007-05-08 11:15:09 -07:00
sched: add CFS credits
2007-07-09 18:52:01 +02:00
sched: scheduler debugging, core
2007-07-09 18:52:00 +02:00
sched: cfs core, kernel/sched_fair.c
2007-07-09 18:51:58 +02:00
sched: cfs core, kernel/sched_idletask.c
2007-07-09 18:51:58 +02:00
sched: cfs core, kernel/sched_rt.c
2007-07-09 18:51:58 +02:00
sched: update delay-accounting to use CFS's precise stats
2007-07-09 18:52:00 +02:00
Fix signalfd interaction with thread-private signals
2007-06-18 10:18:32 -07:00
sched: do not set softirqs to nice +19
2007-07-09 18:52:00 +02:00
Add suspend-related notifications for CPU hotplug
2007-05-09 12:30:56 -07:00
stop_machine() now uses hard_irq_disable
2007-05-11 08:29:34 -07:00
attach_pid() with struct pid parameter
2007-05-11 08:29:35 -07:00
compat signalfd and timerfd are cond syscalls
2007-05-12 10:55:40 -07:00
security: Protection for exploiting null dereference using mmap
2007-07-11 22:52:29 -04:00
KMEM_CACHE(): simplify slab cache creation
2007-05-07 12:12:55 -07:00
header cleaning: don't include smp_lock.h when not used
2007-05-08 11:15:07 -07:00
NOHZ: prevent multiplication overflow - stop timer for huge timeouts
2007-05-29 18:11:10 -07:00
header cleaning: don't include smp_lock.h when not used
2007-05-08 11:15:07 -07:00
Merge sys_clone()/sys_unshare() nsproxy and namespace handling
2007-05-08 11:15:00 -07:00
Fix occurrences of "the the "
2007-05-09 08:57:56 +02:00
simplify cleanup_workqueue_thread()
2007-05-23 20:14:13 -07:00
ed03218951