public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed grsec-path.patch

Browse Source
This commit is contained in:
Remy Goldschmidt 2015-03-29 13:15:31 -04:00
parent ba4f29aee6
commit d68e248418
1 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
pkgs/os-specific/linux/kernel/grsec-path.patch
View File

@ -1,17 +1,18 @@
diff --git a/kernel/kmod.c b/kernel/kmod.c diff --git a/a/kernel/kmod.c b/b/kernel/kmod.c
index 67f7981..03f127d 100644 index a26e825..29baec1 100644
--- a/kernel/kmod.c --- a/a/kernel/kmod.c
+++ b/kernel/kmod.c +++ b/b/kernel/kmod.c
@@ -246,9 +246,9 @@ static int ____call_usermodehelper(void *data) @@ -294,10 +294,9 @@ static int ____call_usermodehelper(void *data)
out the path to be used prior to this point and are now operating out the path to be used prior to this point and are now operating
on that copy on that copy
*/ */
- if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) && - if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
- strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) && - strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
- strncmp(sub_info->path, "/usr/libexec/", 13) &&
- strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) { - strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
+ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) && + if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) &&
+ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || + strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) ||
+ strstr(sub_info->path, "..")) { + strstr(sub_info->path, "..")) {
printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path); printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
retval = -EPERM; retval = -EPERM;
goto fail; goto out;