1. 28 Apr, 2010 1 commit
    • Stephen Smalley's avatar
      selinux: generalize disabling of execmem for plt-in-heap archs · fcaaade1
      Stephen Smalley authored
      
      
      On Tue, 2010-04-27 at 11:47 -0700, David Miller wrote:
      > From: "Tom \"spot\" Callaway" <tcallawa@redhat.com>
      > Date: Tue, 27 Apr 2010 14:20:21 -0400
      >
      > > [root@apollo ~]$ cat /proc/2174/maps
      > > 00010000-00014000 r-xp 00000000 fd:00 15466577
      > >  /sbin/mingetty
      > > 00022000-00024000 rwxp 00002000 fd:00 15466577
      > >  /sbin/mingetty
      > > 00024000-00046000 rwxp 00000000 00:00 0
      > >  [heap]
      >
      > SELINUX probably barfs on the executable heap, the PLT is in the HEAP
      > just like powerpc32 and that's why VM_DATA_DEFAULT_FLAGS has to set
      > both executable and writable.
      >
      > You also can't remove the CONFIG_PPC32 ifdefs in selinux, since
      > because of the VM_DATA_DEFAULT_FLAGS setting used still in that arch,
      > the heap will always have executable permission, just like sparc does.
      > You have to support those binaries forever, whether you like it or not.
      >
      > Let's just replace the CONFIG_PPC32 ifdef in SELINUX with CONFIG_PPC32
      > || CONFIG_SPARC as in Tom's original patch and let's be done with
      > this.
      >
      > In fact I would go through all the arch/ header files and check the
      > VM_DATA_DEFAULT_FLAGS settings and add the necessary new ifdefs to the
      > SELINUX code so that other platforms don't have the pain of having to
      > go through this process too.
      
      To avoid maintaining per-arch ifdefs, it seems that we could just
      directly use (VM_DATA_DEFAULT_FLAGS & VM_EXEC) as the basis for deciding
      whether to enable or disable these checks.   VM_DATA_DEFAULT_FLAGS isn't
      constant on some architectures but instead depends on
      current->personality, but we want this applied uniformly.  So we'll just
      use the initial task state to determine whether or not to enable these
      checks.
      Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
      Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      fcaaade1
  2. 27 Apr, 2010 1 commit
  3. 26 Apr, 2010 2 commits
  4. 23 Apr, 2010 1 commit
  5. 22 Apr, 2010 2 commits
  6. 20 Apr, 2010 9 commits
  7. 19 Apr, 2010 1 commit
  8. 12 Apr, 2010 13 commits
  9. 09 Apr, 2010 1 commit
  10. 07 Apr, 2010 2 commits
  11. 30 Mar, 2010 7 commits