From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 0A7A513838B for ; Tue, 7 Oct 2014 01:43:51 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id AFF1DE0895; Tue, 7 Oct 2014 01:43:49 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 41333E0895 for ; Tue, 7 Oct 2014 01:43:49 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id F40CF340349 for ; Tue, 7 Oct 2014 01:43:46 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id A85E2731A for ; Tue, 7 Oct 2014 01:43:45 +0000 (UTC) From: "Anthony G. Basile" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Anthony G. Basile" Message-ID: <1412646067.7c6175afc50eb106b1dbb9712e638fe2cf976c85.blueness@gentoo> Subject: [gentoo-commits] proj/linux-patches:master commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1500_XATTR_USER_PREFIX.patch X-VCS-Directories: / X-VCS-Committer: blueness X-VCS-Committer-Name: Anthony G. Basile X-VCS-Revision: 7c6175afc50eb106b1dbb9712e638fe2cf976c85 X-VCS-Branch: master Date: Tue, 7 Oct 2014 01:43:45 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: fa059a5d-44dc-484a-80a2-f638c9df426e X-Archives-Hash: 5ad178d12b2ceafccbe2e183bae57dfa commit: 7c6175afc50eb106b1dbb9712e638fe2cf976c85 Author: Anthony G. Basile gentoo org> AuthorDate: Tue Oct 7 01:40:44 2014 +0000 Commit: Anthony G. Basile gentoo org> CommitDate: Tue Oct 7 01:41:07 2014 +0000 URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=7c6175af Add patch to support namespace user.pax.* on tmpfs, bug #470644 This patch is needed on all Gentoo to preserve end-to-end support of PaX flags held in the extended attribute namespace user.pax.* Even non-hardened Gentoo users need this in case they switch from a gentoo-sources kernel to hardened. With the XATTR_PAX markings already in place, they do not need to remake the PaX flags on all their ELF objects because it will already be done. --- 0000_README | 4 ++++ 1500_XATTR_USER_PREFIX.patch | 54 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 58 insertions(+) diff --git a/0000_README b/0000_README index 9018993..36c2b96 100644 --- a/0000_README +++ b/0000_README @@ -43,6 +43,10 @@ EXPERIMENTAL Individual Patch Descriptions: -------------------------------------------------------------------------- +Patch: 1500_XATTR_USER_PREFIX.patch +From: https://bugs.gentoo.org/show_bug.cgi?id=470644 +Desc: Support for namespace user.pax.* on tmpfs. + Patch: 4567_distro-Gentoo-Kconfig.patch From: Tom Wijsman Desc: Add Gentoo Linux support config settings and defaults. diff --git a/1500_XATTR_USER_PREFIX.patch b/1500_XATTR_USER_PREFIX.patch new file mode 100644 index 0000000..cc15cd5 --- /dev/null +++ b/1500_XATTR_USER_PREFIX.patch @@ -0,0 +1,54 @@ +From: Anthony G. Basile + +This patch adds support for a restricted user-controlled namespace on +tmpfs filesystem used to house PaX flags. The namespace must be of the +form user.pax.* and its value cannot exceed a size of 8 bytes. + +This is needed even on all Gentoo systems so that XATTR_PAX flags +are preserved for users who might build packages using portage on +a tmpfs system with a non-hardened kernel and then switch to a +hardened kernel with XATTR_PAX enabled. + +The namespace is added to any user with Extended Attribute support +enabled for tmpfs. Users who do not enable xattrs will not have +the XATTR_PAX flags preserved. + +diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h +index e4629b9..6958086 100644 +--- a/include/uapi/linux/xattr.h ++++ b/include/uapi/linux/xattr.h +@@ -63,5 +63,9 @@ + #define XATTR_POSIX_ACL_DEFAULT "posix_acl_default" + #define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT + ++/* User namespace */ ++#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax." ++#define XATTR_PAX_FLAGS_SUFFIX "flags" ++#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX + + #endif /* _UAPI_LINUX_XATTR_H */ +diff --git a/mm/shmem.c b/mm/shmem.c +index 1c44af7..f23bb1b 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2201,6 +2201,7 @@ static const struct xattr_handler *shmem_xattr_handlers[] = { + static int shmem_xattr_validate(const char *name) + { + struct { const char *prefix; size_t len; } arr[] = { ++ { XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN}, + { XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN }, + { XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN } + }; +@@ -2256,6 +2257,12 @@ static int shmem_setxattr(struct dentry *dentry, const char *name, + if (err) + return err; + ++ if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) { ++ if (strcmp(name, XATTR_NAME_PAX_FLAGS)) ++ return -EOPNOTSUPP; ++ if (size > 8) ++ return -EINVAL; ++ } + return simple_xattr_set(&info->xattrs, name, value, size, flags); + } +