iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[PATCH] selinux: add executable heap check

Browse Source 
This patch,based on sample code by Roland McGrath, adds an execheap
permission check that controls the ability to make the heap executable so
that this can be prevented in almost all cases (the X server is presently
an exception, but this will hopefully be resolved in the future) so that
even programs with execmem permission will need to have the anonymous
memory mapped in order to make it executable.

The only reason that we use a permission check for such restriction (vs.
making it unconditional) is that the X module loader presently needs it; it
could possibly be made unconditional in the future when X is changed.

The policy patch for the execheap permission is available at:
http://pearls.tuxedo-es.org/patches/selinux/policy-execheap.patch

Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
Acked-by: James Morris <jmorris@redhat.com>
Acked-by:  Stephen Smalley <sds@tycho.nsa.gov>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Lorenzo Hernndez Garca-Hierro 2005-06-25 14:54:35 -07:00 committed by Linus Torvalds
parent 6b9921976f
commit 09ffd94fb1
3 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
security/selinux/hooks.c
View File

@ -2477,6 +2477,17 @@ static int selinux_file_mprotect(struct vm_area_struct *vma,
prot = reqprot; prot = reqprot;
#ifndef CONFIG_PPC32 #ifndef CONFIG_PPC32
if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXECUTABLE) &&
(vma->vm_start >= vma->vm_mm->start_brk &&
vma->vm_end <= vma->vm_mm->brk)) {
/*
* We are making an executable mapping in the brk region.
* This has an additional execheap check.
*/
rc = task_has_perm(current, current, PROCESS__EXECHEAP);
if (rc)
return rc;
}
if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) { if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) {
/* /*
* We are making executable a file mapping that has * We are making executable a file mapping that has

1
security/selinux/include/av_perm_to_string.h
View File

@ -71,6 +71,7 @@
S_(SECCLASS_PROCESS, PROCESS__SETCURRENT, "setcurrent") S_(SECCLASS_PROCESS, PROCESS__SETCURRENT, "setcurrent")
S_(SECCLASS_PROCESS, PROCESS__EXECMEM, "execmem") S_(SECCLASS_PROCESS, PROCESS__EXECMEM, "execmem")
S_(SECCLASS_PROCESS, PROCESS__EXECSTACK, "execstack") S_(SECCLASS_PROCESS, PROCESS__EXECSTACK, "execstack")
S_(SECCLASS_PROCESS, PROCESS__EXECHEAP, "execheap")
S_(SECCLASS_MSGQ, MSGQ__ENQUEUE, "enqueue") S_(SECCLASS_MSGQ, MSGQ__ENQUEUE, "enqueue")
S_(SECCLASS_MSG, MSG__SEND, "send") S_(SECCLASS_MSG, MSG__SEND, "send")
S_(SECCLASS_MSG, MSG__RECEIVE, "receive") S_(SECCLASS_MSG, MSG__RECEIVE, "receive")

1
security/selinux/include/av_permissions.h
View File

@ -466,6 +466,7 @@
#define PROCESS__SETCURRENT 0x01000000UL #define PROCESS__SETCURRENT 0x01000000UL
#define PROCESS__EXECMEM 0x02000000UL #define PROCESS__EXECMEM 0x02000000UL
#define PROCESS__EXECSTACK 0x04000000UL #define PROCESS__EXECSTACK 0x04000000UL
#define PROCESS__EXECHEAP 0x08000000UL
#define IPC__CREATE 0x00000001UL #define IPC__CREATE 0x00000001UL
#define IPC__DESTROY 0x00000002UL #define IPC__DESTROY 0x00000002UL