From e76c059b2370294a369bb5c9297668c3f37c3f5c Mon Sep 17 00:00:00 2001 From: "Ricardo M. Correia" Date: Sat, 15 Mar 2014 17:31:39 +0100 Subject: [PATCH] grsecurity: Fix grsec-path.patch to apply with newest patches --- pkgs/os-specific/linux/kernel/grsec-path.patch | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/grsec-path.patch b/pkgs/os-specific/linux/kernel/grsec-path.patch index be242779548..6f59cf8d80b 100644 --- a/pkgs/os-specific/linux/kernel/grsec-path.patch +++ b/pkgs/os-specific/linux/kernel/grsec-path.patch @@ -1,15 +1,17 @@ diff --git a/kernel/kmod.c b/kernel/kmod.c -index 3227c2c..f32c944 100644 +index 67f7981..03f127d 100644 --- a/kernel/kmod.c +++ b/kernel/kmod.c -@@ -246,8 +246,8 @@ static int ____call_usermodehelper(void *data) +@@ -246,9 +246,9 @@ static int ____call_usermodehelper(void *data) out the path to be used prior to this point and are now operating on that copy */ - if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) && -- strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7)) || strstr(sub_info->path, "..")) { +- strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) && +- strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) { + if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) && -+ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || strstr(sub_info->path, "..")) { ++ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || ++ strstr(sub_info->path, "..")) { printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path); retval = -EPERM; goto fail;