diff options
Diffstat (limited to '2.6.39/4435_grsec-kconfig-gentoo.patch')
| -rw-r--r-- | 2.6.39/4435_grsec-kconfig-gentoo.patch | 313 |
1 files changed, 0 insertions, 313 deletions
diff --git a/2.6.39/4435_grsec-kconfig-gentoo.patch b/2.6.39/4435_grsec-kconfig-gentoo.patch deleted file mode 100644 index bc09842..0000000 --- a/2.6.39/4435_grsec-kconfig-gentoo.patch +++ /dev/null @@ -1,313 +0,0 @@ -From: Anthony G. Basile <blueness@gentoo.org> -From: Gordon Malm <gengor@gentoo.org> -From: Jory A. Pratt <anarchy@gentoo.org> -From: Kerin Millar <kerframil@gmail.com> - -Add Hardened Gentoo [server/workstation] predefined grsecurity -levels. They're designed to provide a comparitively high level of -security while remaining generally suitable for as great a majority -of the userbase as possible (particularly new users). - -Make Hardened Gentoo [workstation] predefined grsecurity level the -default. The Hardened Gentoo [server] level is more restrictive -and conflicts with some software and thus would be less suitable. - -The original version of this patch was conceived and created by: -Ned Ludd <solar@gentoo.org> - -diff -Naur linux-2.6.38-hardened-r1.orig/grsecurity/Kconfig linux-2.6.38-hardened-r1/grsecurity/Kconfig ---- linux-2.6.38-hardened-r1.orig/grsecurity/Kconfig 2011-04-17 19:25:54.000000000 -0400 -+++ linux-2.6.38-hardened-r1/grsecurity/Kconfig 2011-04-17 19:27:46.000000000 -0400 -@@ -18,7 +18,7 @@ - choice - prompt "Security Level" - depends on GRKERNSEC -- default GRKERNSEC_CUSTOM -+ default GRKERNSEC_HARDENED_WORKSTATION - - config GRKERNSEC_LOW - bool "Low" -@@ -193,6 +193,258 @@ - - Restricted sysfs/debugfs - - Active kernel exploit response - -+config GRKERNSEC_HARDENED_SERVER -+ bool "Hardened Gentoo [server]" -+ select GRKERNSEC_LINK -+ select GRKERNSEC_FIFO -+ select GRKERNSEC_EXECVE -+ select GRKERNSEC_DMESG -+ select GRKERNSEC_FORKFAIL -+ select GRKERNSEC_TIME -+ select GRKERNSEC_SIGNAL -+ select GRKERNSEC_CHROOT -+ select GRKERNSEC_CHROOT_SHMAT -+ select GRKERNSEC_CHROOT_UNIX -+ select GRKERNSEC_CHROOT_MOUNT -+ select GRKERNSEC_CHROOT_FCHDIR -+ select GRKERNSEC_CHROOT_PIVOT -+ select GRKERNSEC_CHROOT_DOUBLE -+ select GRKERNSEC_CHROOT_CHDIR -+ select GRKERNSEC_CHROOT_MKNOD -+ select GRKERNSEC_CHROOT_CAPS -+ select GRKERNSEC_CHROOT_SYSCTL -+ select GRKERNSEC_CHROOT_FINDTASK -+ select GRKERNSEC_PROC -+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR) -+ select GRKERNSEC_HIDESYM -+ select GRKERNSEC_BRUTE -+ select GRKERNSEC_PROC_USERGROUP -+ select GRKERNSEC_KMEM -+ select GRKERNSEC_RESLOG -+ select GRKERNSEC_RANDNET -+ select GRKERNSEC_PROC_ADD -+ select GRKERNSEC_CHROOT_CHMOD -+ select GRKERNSEC_CHROOT_NICE -+ select GRKERNSEC_AUDIT_MOUNT -+ select GRKERNSEC_MODHARDEN if (MODULES) -+ select GRKERNSEC_HARDEN_PTRACE -+ select GRKERNSEC_VM86 if (X86_32) -+ select GRKERNSEC_IO if (X86) -+ select GRKERNSEC_PROC_IPADDR -+ select GRKERNSEC_RWXMAP_LOG -+ select GRKERNSEC_SYSCTL -+ select GRKERNSEC_SYSCTL_ON -+ select PAX -+ select PAX_RANDUSTACK -+ select PAX_ASLR -+ select PAX_RANDMMAP -+ select PAX_NOEXEC -+ select PAX_MPROTECT -+ select PAX_PT_PAX_FLAGS -+ select PAX_HAVE_ACL_FLAGS -+ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN) -+ select PAX_MEMORY_UDEREF if (X86 && !XEN) -+ select PAX_RANDKSTACK if (X86_TSC && !X86_64) -+ select PAX_SEGMEXEC if (X86_32) -+ select PAX_PAGEEXEC -+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64) -+ select PAX_EMUTRAMP if (PARISC) -+ select PAX_EMUSIGRT if (PARISC) -+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC) -+ select PAX_REFCOUNT if (X86 || SPARC64) -+ select PAX_USERCOPY if ((X86 || PPC || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB)) -+ select PAX_MEMORY_SANITIZE -+ help -+ If you say Y here, a configuration for grsecurity/PaX features -+ will be used that is endorsed by the Hardened Gentoo project. -+ These pre-defined security levels are designed to provide a high -+ level of security while minimizing incompatibilities with a majority -+ of Gentoo's available software. -+ -+ This "Hardened Gentoo [server]" level is identical to the -+ "Hardened Gentoo [workstation]" level, but with GRKERNSEC_IO, -+ and GRKERNSEC_PROC_ADD enabled. Accordingly, this is the preferred -+ security level if the system will not be utilizing software incompatible -+ with these features. -+ -+ When this level is selected, some security features will be forced on, -+ while others will default to their suggested values of off or on. The -+ later can be tweaked at the user's discretion, but may cause problems -+ in some situations. You can fully customize all grsecurity/PaX features -+ by choosing "Custom" in the Security Level menu. It may be helpful to -+ inherit the options selected by this security level as a starting point. -+ To accomplish this, select this security level, then exit the menuconfig -+ interface, saving changes when prompted. Run make menuconfig again and -+ select the "Custom" level. -+ -+config GRKERNSEC_HARDENED_WORKSTATION -+ bool "Hardened Gentoo [workstation]" -+ select GRKERNSEC_LINK -+ select GRKERNSEC_FIFO -+ select GRKERNSEC_EXECVE -+ select GRKERNSEC_DMESG -+ select GRKERNSEC_FORKFAIL -+ select GRKERNSEC_TIME -+ select GRKERNSEC_SIGNAL -+ select GRKERNSEC_CHROOT -+ select GRKERNSEC_CHROOT_SHMAT -+ select GRKERNSEC_CHROOT_UNIX -+ select GRKERNSEC_CHROOT_MOUNT -+ select GRKERNSEC_CHROOT_FCHDIR -+ select GRKERNSEC_CHROOT_PIVOT -+ select GRKERNSEC_CHROOT_DOUBLE -+ select GRKERNSEC_CHROOT_CHDIR -+ select GRKERNSEC_CHROOT_MKNOD -+ select GRKERNSEC_CHROOT_CAPS -+ select GRKERNSEC_CHROOT_SYSCTL -+ select GRKERNSEC_CHROOT_FINDTASK -+ select GRKERNSEC_PROC -+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR) -+ select GRKERNSEC_HIDESYM -+ select GRKERNSEC_BRUTE -+ select GRKERNSEC_PROC_USERGROUP -+ select GRKERNSEC_KMEM -+ select GRKERNSEC_RESLOG -+ select GRKERNSEC_RANDNET -+ # select GRKERNSEC_PROC_ADD -+ select GRKERNSEC_CHROOT_CHMOD -+ select GRKERNSEC_CHROOT_NICE -+ select GRKERNSEC_AUDIT_MOUNT -+ select GRKERNSEC_MODHARDEN if (MODULES) -+ select GRKERNSEC_HARDEN_PTRACE -+ select GRKERNSEC_VM86 if (X86_32) -+ # select GRKERNSEC_IO if (X86) -+ select GRKERNSEC_PROC_IPADDR -+ select GRKERNSEC_RWXMAP_LOG -+ select GRKERNSEC_SYSCTL -+ select GRKERNSEC_SYSCTL_ON -+ select PAX -+ select PAX_RANDUSTACK -+ select PAX_ASLR -+ select PAX_RANDMMAP -+ select PAX_NOEXEC -+ select PAX_MPROTECT -+ select PAX_PT_PAX_FLAGS -+ select PAX_HAVE_ACL_FLAGS -+ # select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN) -+ # select PAX_MEMORY_UDEREF if (X86 && !XEN) -+ select PAX_RANDKSTACK if (X86_TSC && !X86_64) -+ select PAX_SEGMEXEC if (X86_32) -+ select PAX_PAGEEXEC -+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64) -+ select PAX_EMUTRAMP if (PARISC) -+ select PAX_EMUSIGRT if (PARISC) -+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC) -+ select PAX_REFCOUNT if (X86 || SPARC64) -+ select PAX_USERCOPY if ((X86 || PPC || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB)) -+ select PAX_MEMORY_SANITIZE -+ help -+ If you say Y here, a configuration for grsecurity/PaX features -+ will be used that is endorsed by the Hardened Gentoo project. -+ These pre-defined security levels are designed to provide a high -+ level of security while minimizing incompatibilities with a majority -+ of Gentoo's available software. -+ -+ This "Hardened Gentoo [workstation]" level is identical to the -+ "Hardened Gentoo [server]" level, but with GRKERNSEC_IO and -+ GRKERNSEC_PROC_ADD disabled. Accordingly, this is the preferred -+ security level if the system will be utilizing software incompatible -+ with these features. -+ -+ When this level is selected, some security features will be forced on, -+ while others will default to their suggested values of off or on. The -+ later can be tweaked at the user's discretion, but may cause problems -+ in some situations. You can fully customize all grsecurity/PaX features -+ by choosing "Custom" in the Security Level menu. It may be helpful to -+ inherit the options selected by this security level as a starting point. -+ To accomplish this, select this security level, then exit the menuconfig -+ interface, saving changes when prompted. Run make menuconfig again and -+ select the "Custom" level. -+ -+config GRKERNSEC_HARDENED_VIRTUALIZATION -+ bool "Hardened Gentoo [virtualization]" -+ select GRKERNSEC_LINK -+ select GRKERNSEC_FIFO -+ select GRKERNSEC_EXECVE -+ select GRKERNSEC_DMESG -+ select GRKERNSEC_FORKFAIL -+ select GRKERNSEC_TIME -+ select GRKERNSEC_SIGNAL -+ select GRKERNSEC_CHROOT -+ select GRKERNSEC_CHROOT_SHMAT -+ select GRKERNSEC_CHROOT_UNIX -+ select GRKERNSEC_CHROOT_MOUNT -+ select GRKERNSEC_CHROOT_FCHDIR -+ select GRKERNSEC_CHROOT_PIVOT -+ select GRKERNSEC_CHROOT_DOUBLE -+ select GRKERNSEC_CHROOT_CHDIR -+ select GRKERNSEC_CHROOT_MKNOD -+ select GRKERNSEC_CHROOT_CAPS -+ select GRKERNSEC_CHROOT_SYSCTL -+ select GRKERNSEC_CHROOT_FINDTASK -+ select GRKERNSEC_PROC -+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR) -+ select GRKERNSEC_HIDESYM -+ select GRKERNSEC_BRUTE -+ select GRKERNSEC_PROC_USERGROUP -+ select GRKERNSEC_KMEM -+ select GRKERNSEC_RESLOG -+ select GRKERNSEC_RANDNET -+ # select GRKERNSEC_PROC_ADD -+ select GRKERNSEC_CHROOT_CHMOD -+ select GRKERNSEC_CHROOT_NICE -+ select GRKERNSEC_AUDIT_MOUNT -+ select GRKERNSEC_MODHARDEN if (MODULES) -+ select GRKERNSEC_HARDEN_PTRACE -+ select GRKERNSEC_VM86 if (X86_32) -+ # select GRKERNSEC_IO if (X86) -+ select GRKERNSEC_PROC_IPADDR -+ select GRKERNSEC_RWXMAP_LOG -+ select GRKERNSEC_SYSCTL -+ select GRKERNSEC_SYSCTL_ON -+ select PAX -+ select PAX_RANDUSTACK -+ select PAX_ASLR -+ select PAX_RANDMMAP -+ select PAX_NOEXEC -+ select PAX_MPROTECT -+ select PAX_PT_PAX_FLAGS -+ select PAX_HAVE_ACL_FLAGS -+ # select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN) -+ # select PAX_MEMORY_UDEREF if (X86 && !XEN) -+ select PAX_RANDKSTACK if (X86_TSC && !X86_64) -+ select PAX_SEGMEXEC if (X86_32) -+ select PAX_PAGEEXEC -+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64) -+ select PAX_EMUTRAMP if (PARISC) -+ select PAX_EMUSIGRT if (PARISC) -+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC) -+ select PAX_REFCOUNT if (X86 || SPARC64) -+ select PAX_USERCOPY if ((X86 || PPC || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB)) -+ select PAX_MEMORY_SANITIZE -+ help -+ If you say Y here, a configuration for grsecurity/PaX features -+ will be used that is endorsed by the Hardened Gentoo project. -+ These pre-defined security levels are designed to provide a high -+ level of security while minimizing incompatibilities with a majority -+ of Gentoo's available software. -+ -+ This "Hardened Gentoo [virtualization]" level is identical to the -+ "Hardened Gentoo [workstation]" level, but with the PAX_KERNEXEC and -+ PAX_MEMORY_UDEREF defaulting to off. Accordingly, this is the preferred -+ security level if the system will be utilizing virtualization software -+ incompatible with these features, like VirtualBox or kvm. -+ -+ When this level is selected, some security features will be forced on, -+ while others will default to their suggested values of off or on. The -+ later can be tweaked at the user's discretion, but may cause problems -+ in some situations. You can fully customize all grsecurity/PaX features -+ by choosing "Custom" in the Security Level menu. It may be helpful to -+ inherit the options selected by this security level as a starting point. -+ To accomplish this, select this security level, then exit the menuconfig -+ interface, saving changes when prompted. Run make menuconfig again and -+ select the "Custom" level. -+ - config GRKERNSEC_CUSTOM - bool "Custom" - help -diff -Naur linux-2.6.38-hardened-r1.orig/security/Kconfig linux-2.6.38-hardened-r1/security/Kconfig ---- linux-2.6.38-hardened-r1.orig/security/Kconfig 2011-04-17 19:25:02.000000000 -0400 -+++ linux-2.6.38-hardened-r1/security/Kconfig 2011-04-17 19:27:46.000000000 -0400 -@@ -305,8 +305,9 @@ - - config PAX_KERNEXEC - bool "Enforce non-executable kernel pages" -- depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN -+ depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN && !GRKERNSEC_HARDENED_VIRTUALIZATION - select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE) -+ default y if GRKERNSEC_HARDENED_WORKSTATION - help - This is the kernel land equivalent of PAGEEXEC and MPROTECT, - that is, enabling this option will make it harder to inject -@@ -469,8 +470,9 @@ - - config PAX_MEMORY_UDEREF - bool "Prevent invalid userland pointer dereference" -- depends on X86 && !UML_X86 && !XEN -+ depends on X86 && !UML_X86 && !XEN && !GRKERNSEC_HARDENED_VIRTUALIZATION - select PAX_PER_CPU_PGD if X86_64 -+ default y if GRKERNSEC_HARDENED_WORKSTATION - help - By saying Y here the kernel will be prevented from dereferencing - userland pointers in contexts where the kernel expects only kernel |