public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

grsecurity: Fix grsec-path.patch to apply with newest patches

Browse Source
This commit is contained in:
Ricardo M. Correia 2014-03-15 17:31:39 +01:00
parent 7f39579931
commit e76c059b23
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkgs/os-specific/linux/kernel/grsec-path.patch
View File

@ -1,15 +1,17 @@
diff --git a/kernel/kmod.c b/kernel/kmod.c diff --git a/kernel/kmod.c b/kernel/kmod.c
index 3227c2c..f32c944 100644 index 67f7981..03f127d 100644
--- a/kernel/kmod.c --- a/kernel/kmod.c
+++ b/kernel/kmod.c +++ b/kernel/kmod.c
@@ -246,8 +246,8 @@ static int ____call_usermodehelper(void *data) @@ -246,9 +246,9 @@ static int ____call_usermodehelper(void *data)
out the path to be used prior to this point and are now operating out the path to be used prior to this point and are now operating
on that copy on that copy
*/ */
- if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) && - if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
- strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7)) || strstr(sub_info->path, "..")) { - strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
- strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
+ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) && + if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) &&
+ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || strstr(sub_info->path, "..")) { + strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) ||
+ strstr(sub_info->path, "..")) {
printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path); printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
retval = -EPERM; retval = -EPERM;
goto fail; goto fail;