* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/, 3.3.3/, 3.2.16/
@ 2012-04-30 11:32 Anthony G. Basile
0 siblings, 0 replies; only message in thread
From: Anthony G. Basile @ 2012-04-30 11:32 UTC (permalink / raw
To: gentoo-commits
commit: a8c2ec02358ccda733de078af3d945de2753d246
Author: Matthew Thode <prometheanfire <AT> gentoo <DOT> org>
AuthorDate: Fri Apr 27 03:52:48 2012 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Mon Apr 30 11:27:25 2012 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=a8c2ec02
4455_grsec-kconfig-gentoo.patch: fixed CONFIG_PAX_MEMORY_STACKLEAK
On xenserver guests and other systems, relaxing the constraints on
PAX_RANDKSTACK, PAX_KERNEXEC and PAX_MEMORY_UDEREF means that the user
can turn on these which will cause breakage. Restoring the constrainst
prevents this.
Signed-off-by: Matthew Thode <prometheanfire <AT> gentoo.org>
Signed-off-by: Anthony G. Basile <blueness <AT> gentoo.org>
---
2.6.32/4455_grsec-kconfig-gentoo.patch | 20 ++++++++++----------
3.2.16/4455_grsec-kconfig-gentoo.patch | 20 ++++++++++----------
3.3.3/4455_grsec-kconfig-gentoo.patch | 6 +++---
3 files changed, 23 insertions(+), 23 deletions(-)
diff --git a/2.6.32/4455_grsec-kconfig-gentoo.patch b/2.6.32/4455_grsec-kconfig-gentoo.patch
index e578aa6..e18ba0b 100644
--- a/2.6.32/4455_grsec-kconfig-gentoo.patch
+++ b/2.6.32/4455_grsec-kconfig-gentoo.patch
@@ -77,7 +77,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select GRKERNSEC_SYSCTL_ON
+ select PAX
+ select PAX_ASLR
-+ select PAX_RANDKSTACK
++ select PAX_RANDKSTACK if (X86_TSC && X86)
+ select PAX_RANDUSTACK
+ select PAX_RANDMMAP
+ select PAX_NOEXEC
@@ -85,8 +85,8 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_EI_PAX
+ select PAX_PT_PAX_FLAGS
+ select PAX_HAVE_ACL_FLAGS
-+ select PAX_KERNEXEC
-+ select PAX_MEMORY_UDEREF
++ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
++ select PAX_MEMORY_UDEREF if (X86 && !XEN)
+ select PAX_SEGMEXEC if (X86_32)
+ select PAX_PAGEEXEC
+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
@@ -95,7 +95,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_REFCOUNT if (X86 || SPARC64)
+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
+ select PAX_MEMORY_SANITIZE
-+ select PAX_MEMORY_STACKLEAK
++ select PAX_MEMORY_STACKLEAK if (!XEN)
+ help
+ If you say Y here, a configuration for grsecurity/PaX features
+ will be used that is endorsed by the Hardened Gentoo project.
@@ -162,7 +162,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select GRKERNSEC_SYSCTL_ON
+ select PAX
+ select PAX_ASLR
-+ select PAX_RANDKSTACK
++ select PAX_RANDKSTACK if (X86_TSC && X86)
+ select PAX_RANDUSTACK
+ select PAX_RANDMMAP
+ select PAX_NOEXEC
@@ -170,8 +170,8 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_EI_PAX
+ select PAX_PT_PAX_FLAGS
+ select PAX_HAVE_ACL_FLAGS
-+ select PAX_KERNEXEC
-+ select PAX_MEMORY_UDEREF
++ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
++ select PAX_MEMORY_UDEREF if (X86 && !XEN)
+ select PAX_SEGMEXEC if (X86_32)
+ select PAX_PAGEEXEC
+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
@@ -180,7 +180,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_REFCOUNT if (X86 || SPARC64)
+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
+ select PAX_MEMORY_SANITIZE
-+ select PAX_MEMORY_STACKLEAK
++ select PAX_MEMORY_STACKLEAK if (!XEN)
+ help
+ If you say Y here, a configuration for grsecurity/PaX features
+ will be used that is endorsed by the Hardened Gentoo project.
@@ -247,7 +247,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select GRKERNSEC_SYSCTL_ON
+ select PAX
+ select PAX_ASLR
-+ select PAX_RANDKSTACK
++ select PAX_RANDKSTACK if (X86_TSC && X86)
+ select PAX_RANDUSTACK
+ select PAX_RANDMMAP
+ select PAX_NOEXEC
@@ -263,7 +263,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_REFCOUNT if (X86 || SPARC64)
+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
+ select PAX_MEMORY_SANITIZE
-+ select PAX_MEMORY_STACKLEAK
++ select PAX_MEMORY_STACKLEAK if (!XEN)
+ help
+ If you say Y here, a configuration for grsecurity/PaX features
+ will be used that is endorsed by the Hardened Gentoo project.
diff --git a/3.2.16/4455_grsec-kconfig-gentoo.patch b/3.2.16/4455_grsec-kconfig-gentoo.patch
index 2527bad..87b5454 100644
--- a/3.2.16/4455_grsec-kconfig-gentoo.patch
+++ b/3.2.16/4455_grsec-kconfig-gentoo.patch
@@ -77,7 +77,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select GRKERNSEC_SYSCTL_ON
+ select PAX
+ select PAX_ASLR
-+ select PAX_RANDKSTACK
++ select PAX_RANDKSTACK if (X86_TSC && X86)
+ select PAX_RANDUSTACK
+ select PAX_RANDMMAP
+ select PAX_NOEXEC
@@ -85,8 +85,8 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_EI_PAX
+ select PAX_PT_PAX_FLAGS
+ select PAX_HAVE_ACL_FLAGS
-+ select PAX_KERNEXEC
-+ select PAX_MEMORY_UDEREF
++ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
++ select PAX_MEMORY_UDEREF if (X86 && !XEN)
+ select PAX_SEGMEXEC if (X86_32)
+ select PAX_PAGEEXEC
+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
@@ -95,7 +95,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_REFCOUNT if (X86 || SPARC64)
+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
+ select PAX_MEMORY_SANITIZE
-+ select PAX_MEMORY_STACKLEAK
++ select PAX_MEMORY_STACKLEAK if (!XEN)
+ help
+ If you say Y here, a configuration for grsecurity/PaX features
+ will be used that is endorsed by the Hardened Gentoo project.
@@ -162,7 +162,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select GRKERNSEC_SYSCTL_ON
+ select PAX
+ select PAX_ASLR
-+ select PAX_RANDKSTACK
++ select PAX_RANDKSTACK if (X86_TSC && X86)
+ select PAX_RANDUSTACK
+ select PAX_RANDMMAP
+ select PAX_NOEXEC
@@ -170,8 +170,8 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_EI_PAX
+ select PAX_PT_PAX_FLAGS
+ select PAX_HAVE_ACL_FLAGS
-+ select PAX_KERNEXEC
-+ select PAX_MEMORY_UDEREF
++ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
++ select PAX_MEMORY_UDEREF if (X86 && !XEN)
+ select PAX_SEGMEXEC if (X86_32)
+ select PAX_PAGEEXEC
+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
@@ -180,7 +180,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_REFCOUNT if (X86 || SPARC64)
+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
+ select PAX_MEMORY_SANITIZE
-+ select PAX_MEMORY_STACKLEAK
++ select PAX_MEMORY_STACKLEAK if (!XEN)
+ help
+ If you say Y here, a configuration for grsecurity/PaX features
+ will be used that is endorsed by the Hardened Gentoo project.
@@ -247,7 +247,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select GRKERNSEC_SYSCTL_ON
+ select PAX
+ select PAX_ASLR
-+ select PAX_RANDKSTACK
++ select PAX_RANDKSTACK if (X86_TSC && X86)
+ select PAX_RANDUSTACK
+ select PAX_RANDMMAP
+ select PAX_NOEXEC
@@ -263,7 +263,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_REFCOUNT if (X86 || SPARC64)
+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
+ select PAX_MEMORY_SANITIZE
-+ select PAX_MEMORY_STACKLEAK
++ select PAX_MEMORY_STACKLEAK if (!XEN)
+ help
+ If you say Y here, a configuration for grsecurity/PaX features
+ will be used that is endorsed by the Hardened Gentoo project.
diff --git a/3.3.3/4455_grsec-kconfig-gentoo.patch b/3.3.3/4455_grsec-kconfig-gentoo.patch
index ef59341..1ce4ccf 100644
--- a/3.3.3/4455_grsec-kconfig-gentoo.patch
+++ b/3.3.3/4455_grsec-kconfig-gentoo.patch
@@ -95,7 +95,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_REFCOUNT if (X86 || SPARC64)
+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
+ select PAX_MEMORY_SANITIZE
-+ select PAX_MEMORY_STACKLEAK
++ select PAX_MEMORY_STACKLEAK if (!XEN)
+ help
+ If you say Y here, a configuration for grsecurity/PaX features
+ will be used that is endorsed by the Hardened Gentoo project.
@@ -180,7 +180,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_REFCOUNT if (X86 || SPARC64)
+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
+ select PAX_MEMORY_SANITIZE
-+ select PAX_MEMORY_STACKLEAK
++ select PAX_MEMORY_STACKLEAK if (!XEN)
+ help
+ If you say Y here, a configuration for grsecurity/PaX features
+ will be used that is endorsed by the Hardened Gentoo project.
@@ -263,7 +263,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
+ select PAX_REFCOUNT if (X86 || SPARC64)
+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
+ select PAX_MEMORY_SANITIZE
-+ select PAX_MEMORY_STACKLEAK
++ select PAX_MEMORY_STACKLEAK if (!XEN)
+ help
+ If you say Y here, a configuration for grsecurity/PaX features
+ will be used that is endorsed by the Hardened Gentoo project.
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2012-04-30 11:32 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-04-30 11:32 [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/, 3.3.3/, 3.2.16/ Anthony G. Basile
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox