summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthew Thode <prometheanfire@gentoo.org>2012-04-26 23:52:48 -0400
committerAnthony G. Basile <blueness@gentoo.org>2012-04-30 07:27:25 -0400
commita8c2ec02358ccda733de078af3d945de2753d246 (patch)
treeea7caba53386925635e6ef4d332a6e6a2420cac9 /2.6.32/4455_grsec-kconfig-gentoo.patch
parentGrsec/PaX: 2.9-{2.6.32,3.2.16,3.3.3}-201204231833 (diff)
downloadhardened-patchset-a8c2ec02358ccda733de078af3d945de2753d246.tar.gz
hardened-patchset-a8c2ec02358ccda733de078af3d945de2753d246.tar.bz2
hardened-patchset-a8c2ec02358ccda733de078af3d945de2753d246.zip
4455_grsec-kconfig-gentoo.patch: fixed CONFIG_PAX_MEMORY_STACKLEAK
On xenserver guests and other systems, relaxing the constraints on PAX_RANDKSTACK, PAX_KERNEXEC and PAX_MEMORY_UDEREF means that the user can turn on these which will cause breakage. Restoring the constrainst prevents this. Signed-off-by: Matthew Thode <prometheanfire@gentoo.org> Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
Diffstat (limited to '2.6.32/4455_grsec-kconfig-gentoo.patch')
-rw-r--r--2.6.32/4455_grsec-kconfig-gentoo.patch20
1 files changed, 10 insertions, 10 deletions
diff --git a/2.6.32/4455_grsec-kconfig-gentoo.patch b/2.6.32/4455_grsec-kconfig-gentoo.patch
index e578aa6..e18ba0b 100644
--- a/2.6.32/4455_grsec-kconfig-gentoo.patch
+++ b/2.6.32/4455_grsec-kconfig-gentoo.patch
@@ -77,7 +77,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select GRKERNSEC_SYSCTL_ON
+ select PAX
+ select PAX_ASLR
-+ select PAX_RANDKSTACK
++ select PAX_RANDKSTACK if (X86_TSC && X86)
+ select PAX_RANDUSTACK
+ select PAX_RANDMMAP
+ select PAX_NOEXEC
@@ -85,8 +85,8 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_EI_PAX
+ select PAX_PT_PAX_FLAGS
+ select PAX_HAVE_ACL_FLAGS
-+ select PAX_KERNEXEC
-+ select PAX_MEMORY_UDEREF
++ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
++ select PAX_MEMORY_UDEREF if (X86 && !XEN)
+ select PAX_SEGMEXEC if (X86_32)
+ select PAX_PAGEEXEC
+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
@@ -95,7 +95,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_REFCOUNT if (X86 || SPARC64)
+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
+ select PAX_MEMORY_SANITIZE
-+ select PAX_MEMORY_STACKLEAK
++ select PAX_MEMORY_STACKLEAK if (!XEN)
+ help
+ If you say Y here, a configuration for grsecurity/PaX features
+ will be used that is endorsed by the Hardened Gentoo project.
@@ -162,7 +162,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select GRKERNSEC_SYSCTL_ON
+ select PAX
+ select PAX_ASLR
-+ select PAX_RANDKSTACK
++ select PAX_RANDKSTACK if (X86_TSC && X86)
+ select PAX_RANDUSTACK
+ select PAX_RANDMMAP
+ select PAX_NOEXEC
@@ -170,8 +170,8 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_EI_PAX
+ select PAX_PT_PAX_FLAGS
+ select PAX_HAVE_ACL_FLAGS
-+ select PAX_KERNEXEC
-+ select PAX_MEMORY_UDEREF
++ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
++ select PAX_MEMORY_UDEREF if (X86 && !XEN)
+ select PAX_SEGMEXEC if (X86_32)
+ select PAX_PAGEEXEC
+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
@@ -180,7 +180,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_REFCOUNT if (X86 || SPARC64)
+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
+ select PAX_MEMORY_SANITIZE
-+ select PAX_MEMORY_STACKLEAK
++ select PAX_MEMORY_STACKLEAK if (!XEN)
+ help
+ If you say Y here, a configuration for grsecurity/PaX features
+ will be used that is endorsed by the Hardened Gentoo project.
@@ -247,7 +247,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select GRKERNSEC_SYSCTL_ON
+ select PAX
+ select PAX_ASLR
-+ select PAX_RANDKSTACK
++ select PAX_RANDKSTACK if (X86_TSC && X86)
+ select PAX_RANDUSTACK
+ select PAX_RANDMMAP
+ select PAX_NOEXEC
@@ -263,7 +263,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_REFCOUNT if (X86 || SPARC64)
+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
+ select PAX_MEMORY_SANITIZE
-+ select PAX_MEMORY_STACKLEAK
++ select PAX_MEMORY_STACKLEAK if (!XEN)
+ help
+ If you say Y here, a configuration for grsecurity/PaX features
+ will be used that is endorsed by the Hardened Gentoo project.