jolheiser/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

grsecurity: separate fix patches for testing & stable

Browse Source
This commit is contained in:
tg(x) 2016-02-27 19:54:55 +01:00
parent 75f353ffbd
commit 4e3d6d3e90
4 changed files with 31 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pkgs/build-support/grsecurity/default.nix
View File

@ -25,7 +25,7 @@ let
mkKernel = patch:
{
inherit patch;
inherit (patch) kernel grversion revision;
inherit (patch) kernel patches grversion revision;
};
test-patch = with pkgs.kernelPatches; grsecurity_testing;
@ -136,7 +136,7 @@ let
mkGrsecKern = grkern:
lowPrio (overrideDerivation (grkern.kernel.override (args: {
kernelPatches = args.kernelPatches ++ [ grkern.patch pkgs.kernelPatches.grsec_fix_path ];
kernelPatches = args.kernelPatches ++ [ grkern.patch ] ++ grkern.patches;
argsOverride = {
modDirVersion = "${grkern.kernel.modDirVersion}${localver grkern}";
};

17
pkgs/os-specific/linux/kernel/grsecurity-path-3.14.patch Normal file
View File

@ -0,0 +1,17 @@
diff --git a/kernel/kmod.c b/kernel/kmod.c
index a689506..30747b4 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -294,10 +294,8 @@ static int ____call_usermodehelper(void *data)
out the path to be used prior to this point and are now operating
on that copy
*/
- if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
- strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
- strncmp(sub_info->path, "/usr/libexec/", 13) && strncmp(sub_info->path, "/usr/bin/", 9) &&
- strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
+ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) &&
+ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || strstr(sub_info->path, "..")) {
printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of permitted system paths\n", sub_info->path);
retval = -EPERM;
goto out;

0
pkgs/os-specific/linux/kernel/grsec-path.patch → pkgs/os-specific/linux/kernel/grsecurity-path-4.4.patch
View File

17
pkgs/os-specific/linux/kernel/patches.nix
View File

@ -18,10 +18,10 @@ let
};
};
grsecPatch = { grversion ? "3.1", kernel, kversion, revision, branch, sha256 }:
grsecPatch = { grversion ? "3.1", kernel, patches, kversion, revision, branch, sha256 }:
assert kversion == kernel.version;
{ name = "grsecurity-${grversion}-${kversion}";
inherit grversion kernel kversion revision;
inherit grversion kernel patches kversion revision;
patch = fetchurl {
url = if branch == "stable"
then "https://github.com/kdave/grsecurity-patches/blob/master/grsecurity_patches/grsecurity-${grversion}-${kversion}-${revision}.patch?raw=true"
@ -84,6 +84,7 @@ rec {
grsecurity_stable = grsecPatch
{ kernel = pkgs.linux_grsecurity_3_14;
patches = [ grsecurity_fix_path_3_14 ];
kversion = "3.14.51";
revision = "201508181951";
branch = "stable";
@ -92,15 +93,21 @@ rec {
grsecurity_testing = grsecPatch
{ kernel = pkgs.linux_grsecurity_4_4;
patches = [ grsecurity_fix_path_4_4 ];
kversion = "4.4.2";
revision = "201602182048";
branch = "test";
sha256 = "0dm0nzzja6ynzdz2k5h0ckys7flw307i3w0k1lwjxfj80civ73wr";
};
grsec_fix_path =
{ name = "grsec-fix-path";
patch = ./grsec-path.patch;
grsecurity_fix_path_3_14 =
{ name = "grsecurity-fix-path-3.14";
patch = ./grsecurity-path-3.14.patch;
};
grsecurity_fix_path_4_4 =
{ name = "grsecurity-fix-path-4.4";
patch = ./grsecurity-path-4.4.patch;
};
crc_regression =