diff options
Diffstat (limited to '3.13.2')
| -rw-r--r-- | 3.13.2/0000_README | 2 | ||||
| -rw-r--r-- | 3.13.2/4420_grsecurity-3.0-3.13.2-201402091134.patch (renamed from 3.13.2/4420_grsecurity-3.0-3.13.2-201402090002.patch) | 68 |
2 files changed, 34 insertions, 36 deletions
diff --git a/3.13.2/0000_README b/3.13.2/0000_README index a01567b..cb647cd 100644 --- a/3.13.2/0000_README +++ b/3.13.2/0000_README @@ -2,7 +2,7 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 4420_grsecurity-3.0-3.13.2-201402090002.patch +Patch: 4420_grsecurity-3.0-3.13.2-201402091134.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.13.2/4420_grsecurity-3.0-3.13.2-201402090002.patch b/3.13.2/4420_grsecurity-3.0-3.13.2-201402091134.patch index 76aaa29..df6cd99 100644 --- a/3.13.2/4420_grsecurity-3.0-3.13.2-201402090002.patch +++ b/3.13.2/4420_grsecurity-3.0-3.13.2-201402091134.patch @@ -1,5 +1,5 @@ diff --git a/Documentation/dontdiff b/Documentation/dontdiff -index b89a739..9aa2627 100644 +index b89a739..e289b9b 100644 --- a/Documentation/dontdiff +++ b/Documentation/dontdiff @@ -2,9 +2,11 @@ @@ -173,7 +173,7 @@ index b89a739..9aa2627 100644 r300_reg_safe.h r420_reg_safe.h r600_reg_safe.h -+randomize_layout_hash.data ++randomize_layout_hash.h +randomize_layout_seed.h +realmode.lds +realmode.relocs @@ -287,7 +287,7 @@ index b9e9bd8..bf49b92 100644 pcd. [PARIDE] diff --git a/Makefile b/Makefile -index a7fd5d9..84ed0df 100644 +index a7fd5d9..dc8e4db 100644 --- a/Makefile +++ b/Makefile @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -329,7 +329,7 @@ index a7fd5d9..84ed0df 100644 $(Q)$(MAKE) $(build)=scripts/basic $(Q)rm -f .tmp_quiet_recordmcount -@@ -579,6 +586,74 @@ else +@@ -579,6 +586,72 @@ else KBUILD_CFLAGS += -O2 endif @@ -357,8 +357,6 @@ index a7fd5d9..84ed0df 100644 +endif +ifdef CONFIG_GRKERNSEC_RANDSTRUCT +RANDSTRUCT_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/randomize_layout_plugin.so -DRANDSTRUCT_PLUGIN -+RANDSTRUCT_HASHED_SEED := $(shell cat "$(objtree)/tools/gcc/randomize_layout_hash.data") -+RANDSTRUCT_PLUGIN_CFLAGS += -DRANDSTRUCT_HASHED_SEED="\"$(RANDSTRUCT_HASHED_SEED)\"" +ifdef CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE +RANDSTRUCT_PLUGIN_CFLAGS += -fplugin-arg-randomize_layout_plugin-performance-mode +endif @@ -404,7 +402,7 @@ index a7fd5d9..84ed0df 100644 include $(srctree)/arch/$(SRCARCH)/Makefile ifdef CONFIG_READABLE_ASM -@@ -619,7 +694,7 @@ endif +@@ -619,7 +692,7 @@ endif ifdef CONFIG_DEBUG_INFO KBUILD_CFLAGS += -g @@ -413,7 +411,7 @@ index a7fd5d9..84ed0df 100644 endif ifdef CONFIG_DEBUG_INFO_REDUCED -@@ -754,7 +829,7 @@ export mod_sign_cmd +@@ -754,7 +827,7 @@ export mod_sign_cmd ifeq ($(KBUILD_EXTMOD),) @@ -422,7 +420,7 @@ index a7fd5d9..84ed0df 100644 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \ $(core-y) $(core-m) $(drivers-y) $(drivers-m) \ -@@ -803,6 +878,8 @@ endif +@@ -803,6 +876,8 @@ endif # The actual objects are generated when descending, # make sure no implicit rule kicks in @@ -431,7 +429,7 @@ index a7fd5d9..84ed0df 100644 $(sort $(vmlinux-deps)): $(vmlinux-dirs) ; # Handle descending into subdirectories listed in $(vmlinux-dirs) -@@ -812,7 +889,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ; +@@ -812,7 +887,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ; # Error messages still appears in the original language PHONY += $(vmlinux-dirs) @@ -440,7 +438,7 @@ index a7fd5d9..84ed0df 100644 $(Q)$(MAKE) $(build)=$@ define filechk_kernel.release -@@ -855,10 +932,13 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \ +@@ -855,10 +930,13 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \ archprepare: archheaders archscripts prepare1 scripts_basic @@ -454,7 +452,7 @@ index a7fd5d9..84ed0df 100644 prepare: prepare0 # Generate some files -@@ -966,6 +1046,8 @@ all: modules +@@ -966,6 +1044,8 @@ all: modules # using awk while concatenating to the final file. PHONY += modules @@ -463,7 +461,7 @@ index a7fd5d9..84ed0df 100644 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order @$(kecho) ' Building modules, stage 2.'; -@@ -981,7 +1063,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin) +@@ -981,7 +1061,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin) # Target to prepare building external modules PHONY += modules_prepare @@ -472,17 +470,17 @@ index a7fd5d9..84ed0df 100644 # Target to install modules PHONY += modules_install -@@ -1047,7 +1129,8 @@ MRPROPER_FILES += .config .config.old .version .old_version $(version_h) \ +@@ -1047,7 +1127,8 @@ MRPROPER_FILES += .config .config.old .version .old_version $(version_h) \ Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \ signing_key.priv signing_key.x509 x509.genkey \ extra_certificates signing_key.x509.keyid \ - signing_key.x509.signer + signing_key.x509.signer tools/gcc/size_overflow_hash.h \ -+ tools/gcc/randomize_layout_seed.h tools/gcc/randomize_layout_hash.data ++ tools/gcc/randomize_layout_seed.h # clean - Delete most, but leave enough to build external modules # -@@ -1087,6 +1170,7 @@ distclean: mrproper +@@ -1087,6 +1168,7 @@ distclean: mrproper \( -name '*.orig' -o -name '*.rej' -o -name '*~' \ -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \ -o -name '.*.rej' \ @@ -490,7 +488,7 @@ index a7fd5d9..84ed0df 100644 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \ -type f -print | xargs rm -f -@@ -1248,6 +1332,8 @@ PHONY += $(module-dirs) modules +@@ -1248,6 +1330,8 @@ PHONY += $(module-dirs) modules $(module-dirs): crmodverdir $(objtree)/Module.symvers $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) @@ -499,7 +497,7 @@ index a7fd5d9..84ed0df 100644 modules: $(module-dirs) @$(kecho) ' Building modules, stage 2.'; $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost -@@ -1387,17 +1473,21 @@ else +@@ -1387,17 +1471,21 @@ else target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@)) endif @@ -525,7 +523,7 @@ index a7fd5d9..84ed0df 100644 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) %.symtypes: %.c prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) -@@ -1407,11 +1497,15 @@ endif +@@ -1407,11 +1495,15 @@ endif $(cmd_crmodverdir) $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ $(build)=$(build-dir) @@ -81343,10 +81341,10 @@ index 239e277..22a5cf5 100644 #ifdef CONFIG_UTS_NS diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h -index 6f8fbcf..e2a0e61 100644 +index 6f8fbcf..4efc177 100644 --- a/include/linux/vermagic.h +++ b/include/linux/vermagic.h -@@ -25,9 +25,41 @@ +@@ -25,9 +25,42 @@ #define MODULE_ARCH_VERMAGIC "" #endif @@ -81369,6 +81367,7 @@ index 6f8fbcf..e2a0e61 100644 +#endif + +#ifdef RANDSTRUCT_PLUGIN ++#include <generated/randomize_layout_hash.h> +#define MODULE_RANDSTRUCT_PLUGIN "RANDSTRUCT_PLUGIN_" RANDSTRUCT_HASHED_SEED +#else +#define MODULE_RANDSTRUCT_PLUGIN @@ -103826,19 +103825,18 @@ index 7778b8e..3d619fc 100644 diff --git a/tools/gcc/.gitignore b/tools/gcc/.gitignore new file mode 100644 -index 0000000..54052c3 +index 0000000..4c2c45c --- /dev/null +++ b/tools/gcc/.gitignore -@@ -0,0 +1,3 @@ -+size_overflow_hash.h +@@ -0,0 +1,2 @@ +randomize_layout_seed.h -+randomize_layout_hash.data ++size_overflow_hash.h diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile new file mode 100644 -index 0000000..51a2ba2 +index 0000000..0d1d9d3 --- /dev/null +++ b/tools/gcc/Makefile -@@ -0,0 +1,55 @@ +@@ -0,0 +1,54 @@ +#CC := gcc +#PLUGIN_SOURCE_FILES := pax_plugin.c +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES)) @@ -103878,8 +103876,7 @@ index 0000000..51a2ba2 +randomize_layout_plugin-objs := randomize_layout_plugin.o + +$(obj)/size_overflow_plugin.o: $(objtree)/$(obj)/size_overflow_hash.h -+$(obj)/randomize_layout_plugin.o: $(objtree)/$(obj)/randomize_layout_seed.h \ -+ $(objtree)/$(obj)/randomize_layout_hash.data ++$(obj)/randomize_layout_plugin.o: $(objtree)/$(obj)/randomize_layout_seed.h + +quiet_cmd_build_size_overflow_hash = GENHASH $@ + cmd_build_size_overflow_hash = \ @@ -103889,11 +103886,11 @@ index 0000000..51a2ba2 + +quiet_cmd_create_randomize_layout_seed = GENSEED $@ + cmd_create_randomize_layout_seed = \ -+ $(CONFIG_SHELL) $(srctree)/$(src)/gen-random-seed.sh $@ $(objtree)/$(obj)/randomize_layout_hash.data -+$(objtree)/$(obj)/randomize_layout_seed.h $(objtree)/$(obj)/randomize_layout_hash.data: FORCE ++ $(CONFIG_SHELL) $(srctree)/$(src)/gen-random-seed.sh $@ $(objtree)/include/generated/randomize_layout_hash.h ++$(objtree)/$(obj)/randomize_layout_seed.h: FORCE + $(call if_changed,create_randomize_layout_seed) + -+targets += size_overflow_hash.h randomize_layout_seed.h randomize_layout_hash.data ++targets += size_overflow_hash.h randomize_layout_seed.h randomize_layout_hash.h diff --git a/tools/gcc/checker_plugin.c b/tools/gcc/checker_plugin.c new file mode 100644 index 0000000..5452feea @@ -105059,16 +105056,17 @@ index 0000000..312d3b6 +#endif diff --git a/tools/gcc/gen-random-seed.sh b/tools/gcc/gen-random-seed.sh new file mode 100644 -index 0000000..8030e6e +index 0000000..7514850 --- /dev/null +++ b/tools/gcc/gen-random-seed.sh -@@ -0,0 +1,7 @@ +@@ -0,0 +1,8 @@ +#!/bin/sh + +if [ ! -f "$1" ]; then + SEED=`od -A n -t x8 -N 32 /dev/urandom | tr -d ' \n'` + echo "const char *randstruct_seed = \"$SEED\";" > "$1" -+ echo -n "$SEED" | sha256sum | cut -d" " -f1 | tr -d "\n" > "$2" ++ HASH=`echo -n "$SEED" | sha256sum | cut -d" " -f1 | tr -d ' \n'` ++ echo "#define RANDSTRUCT_HASHED_SEED \"$HASH\"" > "$2" +fi diff --git a/tools/gcc/generate_size_overflow_hash.sh b/tools/gcc/generate_size_overflow_hash.sh new file mode 100644 |