cafkafk/nixpkgs
cafkafk/nixpkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

grsecurity: Fix module loading during boot due to path restrictions

Browse source
This commit is contained in:
Ricardo M. Correia 2013-11-26 23:08:51 +01:00
parent 36955aa721
commit 2106191003
3 changed files with 22 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
pkgs/os-specific/linux/kernel/grsec-path.patch Normal file
View file

@ -0,0 +1,15 @@
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 3227c2c..f32c944 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -246,8 +246,8 @@ static int ____call_usermodehelper(void *data)
out the path to be used prior to this point and are now operating
on that copy
*/
- if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
- strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7)) || strstr(sub_info->path, "..")) {
+ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) &&
+ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || strstr(sub_info->path, "..")) {
printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
retval = -EPERM;
goto fail;

5
pkgs/os-specific/linux/kernel/patches.nix
View file

@ -145,4 +145,9 @@ rec {
# The grsec kernel patch seems to include the apparmor patches as of 3.0-3.12.1
features.apparmor = true;
};
grsec_path =
{ name = "grsec-path";
patch = ./grsec-path.patch;
};
}

4
pkgs/top-level/all-packages.nix
View file

@ -6686,11 +6686,11 @@ let
# config options you need (e.g. by overriding extraConfig). See list of options here:
# https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options
linux_3_2_grsecurity = lowPrio (lib.overrideDerivation (linux_3_2.override (args: {
kernelPatches = args.kernelPatches ++ [ kernelPatches.grsecurity_3_0_3_2_52 ];
kernelPatches = args.kernelPatches ++ [ kernelPatches.grsecurity_3_0_3_2_52 kernelPatches.grsec_path ];
})) (args: grsecurityOverrider args));
linux_3_12_grsecurity = lowPrio (lib.overrideDerivation (linux_3_12.override (args: {
kernelPatches = args.kernelPatches ++ [ kernelPatches.grsecurity_3_0_3_12_1 ];
kernelPatches = args.kernelPatches ++ [ kernelPatches.grsecurity_3_0_3_12_1 kernelPatches.grsec_path ];
})) (args: grsecurityOverrider args));
linux_3_2_apparmor = lowPrio (linux_3_2.override {