(メッセージはありません)
@@ -304,12 +304,12 @@ | ||
304 | 304 | <p>Run the following commands in order to extract source code of CaitSith:</p> |
305 | 305 | |
306 | 306 | <pre class="command"> |
307 | -# wget -O caitsith-patch-0.2-20170515.tar.gz 'http://osdn.jp/frs/redir.php?m=jaist&f=/caitsith/66537/caitsith-patch-0.2-20170515.tar.gz' | |
308 | -# wget -O caitsith-patch-0.2-20170515.tar.gz.asc 'http://osdn.jp/frs/redir.php?m=jaist&f=/caitsith/66537/caitsith-patch-0.2-20170515.tar.gz.asc' | |
307 | +# wget -O caitsith-patch-0.2-20170716.tar.gz 'http://osdn.jp/frs/redir.php?m=jaist&f=/caitsith/66537/caitsith-patch-0.2-20170716.tar.gz' | |
308 | +# wget -O caitsith-patch-0.2-20170716.tar.gz.asc 'http://osdn.jp/frs/redir.php?m=jaist&f=/caitsith/66537/caitsith-patch-0.2-20170716.tar.gz.asc' | |
309 | 309 | # wget https://tomoyo.osdn.jp/kumaneko-key |
310 | 310 | # gpg --import kumaneko-key |
311 | -# gpg caitsith-patch-0.2-20170515.tar.gz.asc | |
312 | -# tar -zxf caitsith-patch-0.2-20170515.tar.gz | |
311 | +# gpg caitsith-patch-0.2-20170716.tar.gz.asc | |
312 | +# tar -zxf caitsith-patch-0.2-20170716.tar.gz | |
313 | 313 | </pre> |
314 | 314 | |
315 | 315 | <hr> |
@@ -640,16 +640,16 @@ | ||
640 | 640 | Linux kernel 4.0 and later are supported from the linux-4 tree.</p> |
641 | 641 | |
642 | 642 | <p>Extract the kernel source and go to the extracted directory.<br> |
643 | -In the operations below, "$VERSION" should be replaced with appropriate kernel version. For example "4.10" if using Linux kernel 4.10.10, "2.6.27" if using Linux kernel 2.6.27.62.<br> | |
643 | +In the operations below, "$VERSION" should be replaced with appropriate kernel version. For example "4.12" if using Linux kernel 4.12.2, "2.6.27" if using Linux kernel 2.6.27.62.<br> | |
644 | 644 | Also, there are several patches which can be applied to distributor's latest kernels. For example "3.10-centos-7" if using CentOS 7's latest kernel:</p> |
645 | 645 | |
646 | 646 | <pre class="command"> |
647 | -$ wget -O caitsith-patch-0.2-20170515.tar.gz 'http://osdn.jp/frs/redir.php?m=jaist&f=/caitsith/66537/caitsith-patch-0.2-20170515.tar.gz' | |
648 | -$ wget -O caitsith-patch-0.2-20170515.tar.gz.asc 'http://osdn.jp/frs/redir.php?m=jaist&f=/caitsith/66537/caitsith-patch-0.2-20170515.tar.gz.asc' | |
647 | +$ wget -O caitsith-patch-0.2-20170716.tar.gz 'http://osdn.jp/frs/redir.php?m=jaist&f=/caitsith/66537/caitsith-patch-0.2-20170716.tar.gz' | |
648 | +$ wget -O caitsith-patch-0.2-20170716.tar.gz.asc 'http://osdn.jp/frs/redir.php?m=jaist&f=/caitsith/66537/caitsith-patch-0.2-20170716.tar.gz.asc' | |
649 | 649 | $ wget https://tomoyo.osdn.jp/kumaneko-key |
650 | 650 | $ gpg --import kumaneko-key |
651 | -$ gpg caitsith-patch-0.2-20170515.tar.gz.asc | |
652 | -$ tar -zxf caitsith-patch-0.2-20170515.tar.gz | |
651 | +$ gpg caitsith-patch-0.2-20170716.tar.gz.asc | |
652 | +$ tar -zxf caitsith-patch-0.2-20170716.tar.gz | |
653 | 653 | $ sed -i -e 's/CCSECURITY/CAITSITH/g' -e 's/ccsecurity/caitsith/g' -e 's/ccs_domain_info/cs_domain_info/g' -e 's/ccs_flags/cs_flags/g' -- patches/ccs-patch-*.diff |
654 | 654 | $ patch -sp1 < patches/ccs-patch-$VERSION.diff |
655 | 655 | </pre> |
@@ -1,6 +1,6 @@ | ||
1 | 1 | This is TOMOYO Linux patch for CentOS 6. |
2 | 2 | |
3 | -Source code for this patch is http://vault.centos.org/6.9/updates/Source/SPackages/kernel-2.6.32-696.3.2.el6.src.rpm | |
3 | +Source code for this patch is http://vault.centos.org/6.9/updates/Source/SPackages/kernel-2.6.32-696.6.3.el6.src.rpm | |
4 | 4 | --- |
5 | 5 | fs/compat.c | 2 +- |
6 | 6 | fs/compat_ioctl.c | 3 +++ |
@@ -37,8 +37,8 @@ | ||
37 | 37 | security/Makefile | 3 +++ |
38 | 38 | 33 files changed, 201 insertions(+), 2 deletions(-) |
39 | 39 | |
40 | ---- linux-2.6.32-696.3.2.el6.orig/fs/compat.c | |
41 | -+++ linux-2.6.32-696.3.2.el6/fs/compat.c | |
40 | +--- linux-2.6.32-696.6.3.el6.orig/fs/compat.c | |
41 | ++++ linux-2.6.32-696.6.3.el6/fs/compat.c | |
42 | 42 | @@ -1524,7 +1524,7 @@ int compat_do_execve(const char * filena |
43 | 43 | if (retval < 0) |
44 | 44 | goto out; |
@@ -48,8 +48,8 @@ | ||
48 | 48 | if (retval < 0) |
49 | 49 | goto out; |
50 | 50 | |
51 | ---- linux-2.6.32-696.3.2.el6.orig/fs/compat_ioctl.c | |
52 | -+++ linux-2.6.32-696.3.2.el6/fs/compat_ioctl.c | |
51 | +--- linux-2.6.32-696.6.3.el6.orig/fs/compat_ioctl.c | |
52 | ++++ linux-2.6.32-696.6.3.el6/fs/compat_ioctl.c | |
53 | 53 | @@ -114,6 +114,7 @@ |
54 | 54 | #ifdef CONFIG_SPARC |
55 | 55 | #include <asm/fbio.h> |
@@ -67,8 +67,8 @@ | ||
67 | 67 | if (error) |
68 | 68 | goto out_fput; |
69 | 69 | |
70 | ---- linux-2.6.32-696.3.2.el6.orig/fs/exec.c | |
71 | -+++ linux-2.6.32-696.3.2.el6/fs/exec.c | |
70 | +--- linux-2.6.32-696.6.3.el6.orig/fs/exec.c | |
71 | ++++ linux-2.6.32-696.6.3.el6/fs/exec.c | |
72 | 72 | @@ -1495,7 +1495,7 @@ int do_execve(const char * filename, |
73 | 73 | goto out; |
74 | 74 |
@@ -78,8 +78,8 @@ | ||
78 | 78 | if (retval < 0) |
79 | 79 | goto out; |
80 | 80 | |
81 | ---- linux-2.6.32-696.3.2.el6.orig/fs/fcntl.c | |
82 | -+++ linux-2.6.32-696.3.2.el6/fs/fcntl.c | |
81 | +--- linux-2.6.32-696.6.3.el6.orig/fs/fcntl.c | |
82 | ++++ linux-2.6.32-696.6.3.el6/fs/fcntl.c | |
83 | 83 | @@ -428,6 +428,8 @@ SYSCALL_DEFINE3(fcntl, unsigned int, fd, |
84 | 84 | goto out; |
85 | 85 |
@@ -98,8 +98,8 @@ | ||
98 | 98 | if (err) { |
99 | 99 | fput(filp); |
100 | 100 | return err; |
101 | ---- linux-2.6.32-696.3.2.el6.orig/fs/ioctl.c | |
102 | -+++ linux-2.6.32-696.3.2.el6/fs/ioctl.c | |
101 | +--- linux-2.6.32-696.6.3.el6.orig/fs/ioctl.c | |
102 | ++++ linux-2.6.32-696.6.3.el6/fs/ioctl.c | |
103 | 103 | @@ -639,6 +639,8 @@ SYSCALL_DEFINE3(ioctl, unsigned int, fd, |
104 | 104 | goto out; |
105 | 105 |
@@ -109,8 +109,8 @@ | ||
109 | 109 | if (error) |
110 | 110 | goto out_fput; |
111 | 111 | |
112 | ---- linux-2.6.32-696.3.2.el6.orig/fs/namei.c | |
113 | -+++ linux-2.6.32-696.3.2.el6/fs/namei.c | |
112 | +--- linux-2.6.32-696.6.3.el6.orig/fs/namei.c | |
113 | ++++ linux-2.6.32-696.6.3.el6/fs/namei.c | |
114 | 114 | @@ -2067,6 +2067,11 @@ int may_open(struct path *path, int acc_ |
115 | 115 | if (flag & O_NOATIME && !is_owner_or_cap(inode)) |
116 | 116 | return -EPERM; |
@@ -198,8 +198,8 @@ | ||
198 | 198 | if (error) |
199 | 199 | goto exit5; |
200 | 200 | error = vfs_rename(old_dir->d_inode, old_dentry, |
201 | ---- linux-2.6.32-696.3.2.el6.orig/fs/namespace.c | |
202 | -+++ linux-2.6.32-696.3.2.el6/fs/namespace.c | |
201 | +--- linux-2.6.32-696.6.3.el6.orig/fs/namespace.c | |
202 | ++++ linux-2.6.32-696.6.3.el6/fs/namespace.c | |
203 | 203 | @@ -1097,6 +1097,8 @@ static int do_umount(struct vfsmount *mn |
204 | 204 | LIST_HEAD(umount_list); |
205 | 205 |
@@ -236,8 +236,8 @@ | ||
236 | 236 | if (error) { |
237 | 237 | path_put(&old); |
238 | 238 | goto out1; |
239 | ---- linux-2.6.32-696.3.2.el6.orig/fs/open.c | |
240 | -+++ linux-2.6.32-696.3.2.el6/fs/open.c | |
239 | +--- linux-2.6.32-696.6.3.el6.orig/fs/open.c | |
240 | ++++ linux-2.6.32-696.6.3.el6/fs/open.c | |
241 | 241 | @@ -102,6 +102,8 @@ long vfs_truncate(struct path *path, lof |
242 | 242 | error = locks_verify_truncate(inode, NULL, length); |
243 | 243 | if (!error) |
@@ -328,8 +328,8 @@ | ||
328 | 328 | if (capable(CAP_SYS_TTY_CONFIG)) { |
329 | 329 | tty_vhangup_self(); |
330 | 330 | return 0; |
331 | ---- linux-2.6.32-696.3.2.el6.orig/fs/proc/version.c | |
332 | -+++ linux-2.6.32-696.3.2.el6/fs/proc/version.c | |
331 | +--- linux-2.6.32-696.6.3.el6.orig/fs/proc/version.c | |
332 | ++++ linux-2.6.32-696.6.3.el6/fs/proc/version.c | |
333 | 333 | @@ -32,3 +32,10 @@ static int __init proc_version_init(void |
334 | 334 | return 0; |
335 | 335 | } |
@@ -337,12 +337,12 @@ | ||
337 | 337 | + |
338 | 338 | +static int __init ccs_show_version(void) |
339 | 339 | +{ |
340 | -+ printk(KERN_INFO "Hook version: 2.6.32-696.3.2.el6 2017/06/24\n"); | |
340 | ++ printk(KERN_INFO "Hook version: 2.6.32-696.6.3.el6 2017/07/16\n"); | |
341 | 341 | + return 0; |
342 | 342 | +} |
343 | 343 | +module_init(ccs_show_version); |
344 | ---- linux-2.6.32-696.3.2.el6.orig/fs/stat.c | |
345 | -+++ linux-2.6.32-696.3.2.el6/fs/stat.c | |
344 | +--- linux-2.6.32-696.6.3.el6.orig/fs/stat.c | |
345 | ++++ linux-2.6.32-696.6.3.el6/fs/stat.c | |
346 | 346 | @@ -43,6 +43,8 @@ int vfs_getattr(struct vfsmount *mnt, st |
347 | 347 | int retval; |
348 | 348 |
@@ -352,8 +352,8 @@ | ||
352 | 352 | if (retval) |
353 | 353 | return retval; |
354 | 354 | |
355 | ---- linux-2.6.32-696.3.2.el6.orig/include/linux/init_task.h | |
356 | -+++ linux-2.6.32-696.3.2.el6/include/linux/init_task.h | |
355 | +--- linux-2.6.32-696.6.3.el6.orig/include/linux/init_task.h | |
356 | ++++ linux-2.6.32-696.6.3.el6/include/linux/init_task.h | |
357 | 357 | @@ -123,6 +123,14 @@ extern struct cred init_cred; |
358 | 358 | # define INIT_PERF_EVENTS(tsk) |
359 | 359 | #endif |
@@ -377,8 +377,8 @@ | ||
377 | 377 | } |
378 | 378 | |
379 | 379 | |
380 | ---- linux-2.6.32-696.3.2.el6.orig/include/linux/sched.h | |
381 | -+++ linux-2.6.32-696.3.2.el6/include/linux/sched.h | |
380 | +--- linux-2.6.32-696.6.3.el6.orig/include/linux/sched.h | |
381 | ++++ linux-2.6.32-696.6.3.el6/include/linux/sched.h | |
382 | 382 | @@ -43,6 +43,8 @@ |
383 | 383 | |
384 | 384 | #ifdef __KERNEL__ |
@@ -399,8 +399,8 @@ | ||
399 | 399 | }; |
400 | 400 | |
401 | 401 | /* Future-safe accessor for struct task_struct's cpus_allowed. */ |
402 | ---- linux-2.6.32-696.3.2.el6.orig/include/linux/security.h | |
403 | -+++ linux-2.6.32-696.3.2.el6/include/linux/security.h | |
402 | +--- linux-2.6.32-696.6.3.el6.orig/include/linux/security.h | |
403 | ++++ linux-2.6.32-696.6.3.el6/include/linux/security.h | |
404 | 404 | @@ -35,6 +35,7 @@ |
405 | 405 | #include <linux/xfrm.h> |
406 | 406 | #include <linux/gfp.h> |
@@ -409,8 +409,8 @@ | ||
409 | 409 | |
410 | 410 | /* Maximum number of letters for an LSM name string */ |
411 | 411 | #define SECURITY_NAME_MAX 10 |
412 | ---- linux-2.6.32-696.3.2.el6.orig/include/net/ip.h | |
413 | -+++ linux-2.6.32-696.3.2.el6/include/net/ip.h | |
412 | +--- linux-2.6.32-696.6.3.el6.orig/include/net/ip.h | |
413 | ++++ linux-2.6.32-696.6.3.el6/include/net/ip.h | |
414 | 414 | @@ -33,6 +33,7 @@ |
415 | 415 | #endif |
416 | 416 | #include <net/snmp.h> |
@@ -428,8 +428,8 @@ | ||
428 | 428 | return test_bit(port, sysctl_local_reserved_ports); |
429 | 429 | } |
430 | 430 | |
431 | ---- linux-2.6.32-696.3.2.el6.orig/kernel/compat.c | |
432 | -+++ linux-2.6.32-696.3.2.el6/kernel/compat.c | |
431 | +--- linux-2.6.32-696.6.3.el6.orig/kernel/compat.c | |
432 | ++++ linux-2.6.32-696.6.3.el6/kernel/compat.c | |
433 | 433 | @@ -1005,6 +1005,8 @@ asmlinkage long compat_sys_stime(compat_ |
434 | 434 | err = security_settime(&tv, NULL); |
435 | 435 | if (err) |
@@ -439,8 +439,8 @@ | ||
439 | 439 | |
440 | 440 | do_settimeofday(&tv); |
441 | 441 | return 0; |
442 | ---- linux-2.6.32-696.3.2.el6.orig/kernel/fork.c | |
443 | -+++ linux-2.6.32-696.3.2.el6/kernel/fork.c | |
442 | +--- linux-2.6.32-696.6.3.el6.orig/kernel/fork.c | |
443 | ++++ linux-2.6.32-696.6.3.el6/kernel/fork.c | |
444 | 444 | @@ -205,6 +205,7 @@ void __put_task_struct(struct task_struc |
445 | 445 | exit_creds(tsk); |
446 | 446 | delayacct_tsk_free(tsk); |
@@ -467,8 +467,8 @@ | ||
467 | 467 | bad_fork_cleanup_perf: |
468 | 468 | perf_event_free_task(p); |
469 | 469 | bad_fork_cleanup_policy: |
470 | ---- linux-2.6.32-696.3.2.el6.orig/kernel/kexec.c | |
471 | -+++ linux-2.6.32-696.3.2.el6/kernel/kexec.c | |
470 | +--- linux-2.6.32-696.6.3.el6.orig/kernel/kexec.c | |
471 | ++++ linux-2.6.32-696.6.3.el6/kernel/kexec.c | |
472 | 472 | @@ -41,6 +41,7 @@ |
473 | 473 | #include <asm/system.h> |
474 | 474 | #include <asm/sections.h> |
@@ -486,8 +486,8 @@ | ||
486 | 486 | |
487 | 487 | if (kexec_load_disabled) |
488 | 488 | return -EPERM; |
489 | ---- linux-2.6.32-696.3.2.el6.orig/kernel/module.c | |
490 | -+++ linux-2.6.32-696.3.2.el6/kernel/module.c | |
489 | +--- linux-2.6.32-696.6.3.el6.orig/kernel/module.c | |
490 | ++++ linux-2.6.32-696.6.3.el6/kernel/module.c | |
491 | 491 | @@ -56,6 +56,7 @@ |
492 | 492 | #include <linux/percpu.h> |
493 | 493 | #include <linux/kmemleak.h> |
@@ -514,8 +514,8 @@ | ||
514 | 514 | |
515 | 515 | /* Only one module load at a time, please */ |
516 | 516 | if (mutex_lock_interruptible(&module_mutex) != 0) |
517 | ---- linux-2.6.32-696.3.2.el6.orig/kernel/ptrace.c | |
518 | -+++ linux-2.6.32-696.3.2.el6/kernel/ptrace.c | |
517 | +--- linux-2.6.32-696.6.3.el6.orig/kernel/ptrace.c | |
518 | ++++ linux-2.6.32-696.6.3.el6/kernel/ptrace.c | |
519 | 519 | @@ -195,6 +195,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
520 | 520 | { |
521 | 521 | struct task_struct *child; |
@@ -540,8 +540,8 @@ | ||
540 | 540 | |
541 | 541 | if (request == PTRACE_TRACEME) { |
542 | 542 | ret = ptrace_traceme(); |
543 | ---- linux-2.6.32-696.3.2.el6.orig/kernel/sched.c | |
544 | -+++ linux-2.6.32-696.3.2.el6/kernel/sched.c | |
543 | +--- linux-2.6.32-696.6.3.el6.orig/kernel/sched.c | |
544 | ++++ linux-2.6.32-696.6.3.el6/kernel/sched.c | |
545 | 545 | @@ -6852,6 +6852,8 @@ int can_nice(const struct task_struct *p |
546 | 546 | SYSCALL_DEFINE1(nice, int, increment) |
547 | 547 | { |
@@ -551,8 +551,8 @@ | ||
551 | 551 | |
552 | 552 | /* |
553 | 553 | * Setpriority might change our priority at the same moment. |
554 | ---- linux-2.6.32-696.3.2.el6.orig/kernel/signal.c | |
555 | -+++ linux-2.6.32-696.3.2.el6/kernel/signal.c | |
554 | +--- linux-2.6.32-696.6.3.el6.orig/kernel/signal.c | |
555 | ++++ linux-2.6.32-696.6.3.el6/kernel/signal.c | |
556 | 556 | @@ -2312,6 +2312,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
557 | 557 | SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
558 | 558 | { |
@@ -598,8 +598,8 @@ | ||
598 | 598 | |
599 | 599 | return do_send_specific(tgid, pid, sig, info); |
600 | 600 | } |
601 | ---- linux-2.6.32-696.3.2.el6.orig/kernel/sys.c | |
602 | -+++ linux-2.6.32-696.3.2.el6/kernel/sys.c | |
601 | +--- linux-2.6.32-696.6.3.el6.orig/kernel/sys.c | |
602 | ++++ linux-2.6.32-696.6.3.el6/kernel/sys.c | |
603 | 603 | @@ -157,6 +157,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
604 | 604 | |
605 | 605 | if (which > PRIO_USER || which < PRIO_PROCESS) |
@@ -638,8 +638,8 @@ | ||
638 | 638 | |
639 | 639 | down_write(&uts_sem); |
640 | 640 | errno = -EFAULT; |
641 | ---- linux-2.6.32-696.3.2.el6.orig/kernel/sysctl.c | |
642 | -+++ linux-2.6.32-696.3.2.el6/kernel/sysctl.c | |
641 | +--- linux-2.6.32-696.6.3.el6.orig/kernel/sysctl.c | |
642 | ++++ linux-2.6.32-696.6.3.el6/kernel/sysctl.c | |
643 | 643 | @@ -2130,6 +2130,9 @@ int do_sysctl(int __user *name, int nlen |
644 | 644 | |
645 | 645 | for (head = sysctl_head_next(NULL); head; |
@@ -650,8 +650,8 @@ | ||
650 | 650 | error = parse_table(name, nlen, oldval, oldlenp, |
651 | 651 | newval, newlen, |
652 | 652 | head->root, head->ctl_table); |
653 | ---- linux-2.6.32-696.3.2.el6.orig/kernel/time.c | |
654 | -+++ linux-2.6.32-696.3.2.el6/kernel/time.c | |
653 | +--- linux-2.6.32-696.6.3.el6.orig/kernel/time.c | |
654 | ++++ linux-2.6.32-696.6.3.el6/kernel/time.c | |
655 | 655 | @@ -92,6 +92,8 @@ SYSCALL_DEFINE1(stime, time_t __user *, |
656 | 656 | err = security_settime(&tv, NULL); |
657 | 657 | if (err) |
@@ -670,8 +670,8 @@ | ||
670 | 670 | |
671 | 671 | if (tz) { |
672 | 672 | /* SMP safe, global irq locking makes it work. */ |
673 | ---- linux-2.6.32-696.3.2.el6.orig/kernel/time/ntp.c | |
674 | -+++ linux-2.6.32-696.3.2.el6/kernel/time/ntp.c | |
673 | +--- linux-2.6.32-696.6.3.el6.orig/kernel/time/ntp.c | |
674 | ++++ linux-2.6.32-696.6.3.el6/kernel/time/ntp.c | |
675 | 675 | @@ -14,6 +14,7 @@ |
676 | 676 | #include <linux/timex.h> |
677 | 677 | #include <linux/time.h> |
@@ -696,8 +696,8 @@ | ||
696 | 696 | |
697 | 697 | /* |
698 | 698 | * if the quartz is off by more than 10% then |
699 | ---- linux-2.6.32-696.3.2.el6.orig/net/ipv4/raw.c | |
700 | -+++ linux-2.6.32-696.3.2.el6/net/ipv4/raw.c | |
699 | +--- linux-2.6.32-696.6.3.el6.orig/net/ipv4/raw.c | |
700 | ++++ linux-2.6.32-696.6.3.el6/net/ipv4/raw.c | |
701 | 701 | @@ -77,6 +77,7 @@ |
702 | 702 | #include <linux/seq_file.h> |
703 | 703 | #include <linux/netfilter.h> |
@@ -717,8 +717,8 @@ | ||
717 | 717 | |
718 | 718 | copied = skb->len; |
719 | 719 | if (len < copied) { |
720 | ---- linux-2.6.32-696.3.2.el6.orig/net/ipv4/udp.c | |
721 | -+++ linux-2.6.32-696.3.2.el6/net/ipv4/udp.c | |
720 | +--- linux-2.6.32-696.6.3.el6.orig/net/ipv4/udp.c | |
721 | ++++ linux-2.6.32-696.6.3.el6/net/ipv4/udp.c | |
722 | 722 | @@ -108,6 +108,7 @@ |
723 | 723 | #include <trace/events/udp.h> |
724 | 724 | #include <net/busy_poll.h> |
@@ -738,8 +738,8 @@ | ||
738 | 738 | |
739 | 739 | ulen = skb->len - sizeof(struct udphdr); |
740 | 740 | copied = len; |
741 | ---- linux-2.6.32-696.3.2.el6.orig/net/ipv6/raw.c | |
742 | -+++ linux-2.6.32-696.3.2.el6/net/ipv6/raw.c | |
741 | +--- linux-2.6.32-696.6.3.el6.orig/net/ipv6/raw.c | |
742 | ++++ linux-2.6.32-696.6.3.el6/net/ipv6/raw.c | |
743 | 743 | @@ -59,6 +59,7 @@ |
744 | 744 | |
745 | 745 | #include <linux/proc_fs.h> |
@@ -759,8 +759,8 @@ | ||
759 | 759 | |
760 | 760 | copied = skb->len; |
761 | 761 | if (copied > len) { |
762 | ---- linux-2.6.32-696.3.2.el6.orig/net/ipv6/udp.c | |
763 | -+++ linux-2.6.32-696.3.2.el6/net/ipv6/udp.c | |
762 | +--- linux-2.6.32-696.6.3.el6.orig/net/ipv6/udp.c | |
763 | ++++ linux-2.6.32-696.6.3.el6/net/ipv6/udp.c | |
764 | 764 | @@ -50,6 +50,7 @@ |
765 | 765 | #include <linux/proc_fs.h> |
766 | 766 | #include <linux/seq_file.h> |
@@ -780,8 +780,8 @@ | ||
780 | 780 | |
781 | 781 | ulen = skb->len - sizeof(struct udphdr); |
782 | 782 | copied = len; |
783 | ---- linux-2.6.32-696.3.2.el6.orig/net/socket.c | |
784 | -+++ linux-2.6.32-696.3.2.el6/net/socket.c | |
783 | +--- linux-2.6.32-696.6.3.el6.orig/net/socket.c | |
784 | ++++ linux-2.6.32-696.6.3.el6/net/socket.c | |
785 | 785 | @@ -578,6 +578,8 @@ static inline int __sock_sendmsg(struct |
786 | 786 | struct msghdr *msg, size_t size) |
787 | 787 | { |
@@ -842,8 +842,8 @@ | ||
842 | 842 | if (err) |
843 | 843 | goto out_put; |
844 | 844 | |
845 | ---- linux-2.6.32-696.3.2.el6.orig/net/unix/af_unix.c | |
846 | -+++ linux-2.6.32-696.3.2.el6/net/unix/af_unix.c | |
845 | +--- linux-2.6.32-696.6.3.el6.orig/net/unix/af_unix.c | |
846 | ++++ linux-2.6.32-696.6.3.el6/net/unix/af_unix.c | |
847 | 847 | @@ -981,6 +981,9 @@ static int unix_bind(struct socket *sock |
848 | 848 | mode = S_IFSOCK | |
849 | 849 | (SOCK_INODE(sock)->i_mode & ~current_umask()); |
@@ -865,8 +865,8 @@ | ||
865 | 865 | if (msg->msg_name) |
866 | 866 | unix_copy_addr(msg, skb->sk); |
867 | 867 | |
868 | ---- linux-2.6.32-696.3.2.el6.orig/security/Kconfig | |
869 | -+++ linux-2.6.32-696.3.2.el6/security/Kconfig | |
868 | +--- linux-2.6.32-696.6.3.el6.orig/security/Kconfig | |
869 | ++++ linux-2.6.32-696.6.3.el6/security/Kconfig | |
870 | 870 | @@ -177,5 +177,7 @@ source security/tomoyo/Kconfig |
871 | 871 | |
872 | 872 | source security/integrity/ima/Kconfig |
@@ -875,8 +875,8 @@ | ||
875 | 875 | + |
876 | 876 | endmenu |
877 | 877 | |
878 | ---- linux-2.6.32-696.3.2.el6.orig/security/Makefile | |
879 | -+++ linux-2.6.32-696.3.2.el6/security/Makefile | |
878 | +--- linux-2.6.32-696.6.3.el6.orig/security/Makefile | |
879 | ++++ linux-2.6.32-696.6.3.el6/security/Makefile | |
880 | 880 | @@ -25,3 +25,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
881 | 881 | # Object integrity file lists |
882 | 882 | subdir-$(CONFIG_IMA) += integrity/ima |
@@ -1,6 +1,6 @@ | ||
1 | 1 | This is TOMOYO Linux patch for CentOS 7. |
2 | 2 | |
3 | -Source code for this patch is http://vault.centos.org/centos/7/updates/Source/SPackages/kernel-3.10.0-514.26.1.el7.src.rpm | |
3 | +Source code for this patch is http://vault.centos.org/centos/7/updates/Source/SPackages/kernel-3.10.0-514.26.2.el7.src.rpm | |
4 | 4 | --- |
5 | 5 | fs/exec.c | 2 |
6 | 6 | fs/open.c | 2 |
@@ -28,9 +28,9 @@ | ||
28 | 28 | security/security.c | 111 +++++++++++++++++++++++++++++++++++++++++----- |
29 | 29 | 24 files changed, 248 insertions(+), 37 deletions(-) |
30 | 30 | |
31 | ---- linux-3.10.0-514.26.1.el7.orig/fs/exec.c | |
32 | -+++ linux-3.10.0-514.26.1.el7/fs/exec.c | |
33 | -@@ -1586,7 +1586,7 @@ static int do_execve_common(struct filen | |
31 | +--- linux-3.10.0-514.26.2.el7.orig/fs/exec.c | |
32 | ++++ linux-3.10.0-514.26.2.el7/fs/exec.c | |
33 | +@@ -1580,7 +1580,7 @@ static int do_execve_common(struct filen | |
34 | 34 | if (retval < 0) |
35 | 35 | goto out; |
36 | 36 |
@@ -39,8 +39,8 @@ | ||
39 | 39 | if (retval < 0) |
40 | 40 | goto out; |
41 | 41 | |
42 | ---- linux-3.10.0-514.26.1.el7.orig/fs/open.c | |
43 | -+++ linux-3.10.0-514.26.1.el7/fs/open.c | |
42 | +--- linux-3.10.0-514.26.2.el7.orig/fs/open.c | |
43 | ++++ linux-3.10.0-514.26.2.el7/fs/open.c | |
44 | 44 | @@ -1120,6 +1120,8 @@ EXPORT_SYMBOL(sys_close); |
45 | 45 | */ |
46 | 46 | SYSCALL_DEFINE0(vhangup) |
@@ -50,8 +50,8 @@ | ||
50 | 50 | if (capable(CAP_SYS_TTY_CONFIG)) { |
51 | 51 | tty_vhangup_self(); |
52 | 52 | return 0; |
53 | ---- linux-3.10.0-514.26.1.el7.orig/fs/proc/version.c | |
54 | -+++ linux-3.10.0-514.26.1.el7/fs/proc/version.c | |
53 | +--- linux-3.10.0-514.26.2.el7.orig/fs/proc/version.c | |
54 | ++++ linux-3.10.0-514.26.2.el7/fs/proc/version.c | |
55 | 55 | @@ -32,3 +32,10 @@ static int __init proc_version_init(void |
56 | 56 | return 0; |
57 | 57 | } |
@@ -59,12 +59,12 @@ | ||
59 | 59 | + |
60 | 60 | +static int __init ccs_show_version(void) |
61 | 61 | +{ |
62 | -+ printk(KERN_INFO "Hook version: 3.10.0-514.26.1.el7 2017/07/02\n"); | |
62 | ++ printk(KERN_INFO "Hook version: 3.10.0-514.26.2.el7 2017/07/05\n"); | |
63 | 63 | + return 0; |
64 | 64 | +} |
65 | 65 | +module_init(ccs_show_version); |
66 | ---- linux-3.10.0-514.26.1.el7.orig/include/linux/init_task.h | |
67 | -+++ linux-3.10.0-514.26.1.el7/include/linux/init_task.h | |
66 | +--- linux-3.10.0-514.26.2.el7.orig/include/linux/init_task.h | |
67 | ++++ linux-3.10.0-514.26.2.el7/include/linux/init_task.h | |
68 | 68 | @@ -164,6 +164,14 @@ extern struct task_group root_task_group |
69 | 69 | # define INIT_RT_MUTEXES(tsk) |
70 | 70 | #endif |
@@ -88,8 +88,8 @@ | ||
88 | 88 | } |
89 | 89 | |
90 | 90 | |
91 | ---- linux-3.10.0-514.26.1.el7.orig/include/linux/sched.h | |
92 | -+++ linux-3.10.0-514.26.1.el7/include/linux/sched.h | |
91 | +--- linux-3.10.0-514.26.2.el7.orig/include/linux/sched.h | |
92 | ++++ linux-3.10.0-514.26.2.el7/include/linux/sched.h | |
93 | 93 | @@ -4,6 +4,8 @@ |
94 | 94 | #include <uapi/linux/sched.h> |
95 | 95 | #include <linux/rh_kabi.h> |
@@ -110,8 +110,8 @@ | ||
110 | 110 | }; |
111 | 111 | |
112 | 112 | /* Future-safe accessor for struct task_struct's cpus_allowed. */ |
113 | ---- linux-3.10.0-514.26.1.el7.orig/include/linux/security.h | |
114 | -+++ linux-3.10.0-514.26.1.el7/include/linux/security.h | |
113 | +--- linux-3.10.0-514.26.2.el7.orig/include/linux/security.h | |
114 | ++++ linux-3.10.0-514.26.2.el7/include/linux/security.h | |
115 | 115 | @@ -54,6 +54,7 @@ struct msg_queue; |
116 | 116 | struct xattr; |
117 | 117 | struct xfrm_sec_ctx; |
@@ -323,8 +323,8 @@ | ||
323 | 323 | } |
324 | 324 | #endif /* CONFIG_SECURITY_PATH */ |
325 | 325 | |
326 | ---- linux-3.10.0-514.26.1.el7.orig/include/net/ip.h | |
327 | -+++ linux-3.10.0-514.26.1.el7/include/net/ip.h | |
326 | +--- linux-3.10.0-514.26.2.el7.orig/include/net/ip.h | |
327 | ++++ linux-3.10.0-514.26.2.el7/include/net/ip.h | |
328 | 328 | @@ -228,6 +228,8 @@ void inet_get_local_port_range(struct ne |
329 | 329 | extern unsigned long *sysctl_local_reserved_ports; |
330 | 330 | static inline int inet_is_reserved_local_port(int port) |
@@ -334,8 +334,8 @@ | ||
334 | 334 | return test_bit(port, sysctl_local_reserved_ports); |
335 | 335 | } |
336 | 336 | |
337 | ---- linux-3.10.0-514.26.1.el7.orig/kernel/fork.c | |
338 | -+++ linux-3.10.0-514.26.1.el7/kernel/fork.c | |
337 | +--- linux-3.10.0-514.26.2.el7.orig/kernel/fork.c | |
338 | ++++ linux-3.10.0-514.26.2.el7/kernel/fork.c | |
339 | 339 | @@ -270,6 +270,7 @@ void __put_task_struct(struct task_struc |
340 | 340 | delayacct_tsk_free(tsk); |
341 | 341 | put_signal_struct(tsk->signal); |
@@ -362,8 +362,8 @@ | ||
362 | 362 | bad_fork_cleanup_perf: |
363 | 363 | perf_event_free_task(p); |
364 | 364 | bad_fork_cleanup_policy: |
365 | ---- linux-3.10.0-514.26.1.el7.orig/kernel/kexec.c | |
366 | -+++ linux-3.10.0-514.26.1.el7/kernel/kexec.c | |
365 | +--- linux-3.10.0-514.26.2.el7.orig/kernel/kexec.c | |
366 | ++++ linux-3.10.0-514.26.2.el7/kernel/kexec.c | |
367 | 367 | @@ -1250,6 +1250,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon |
368 | 368 | /* We only trust the superuser with rebooting the system. */ |
369 | 369 | if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) |
@@ -373,8 +373,8 @@ | ||
373 | 373 | |
374 | 374 | if (get_securelevel() > 0) |
375 | 375 | return -EPERM; |
376 | ---- linux-3.10.0-514.26.1.el7.orig/kernel/module.c | |
377 | -+++ linux-3.10.0-514.26.1.el7/kernel/module.c | |
376 | +--- linux-3.10.0-514.26.2.el7.orig/kernel/module.c | |
377 | ++++ linux-3.10.0-514.26.2.el7/kernel/module.c | |
378 | 378 | @@ -62,6 +62,7 @@ |
379 | 379 | #include <linux/bsearch.h> |
380 | 380 | #include <uapi/linux/module.h> |
@@ -401,8 +401,8 @@ | ||
401 | 401 | |
402 | 402 | return 0; |
403 | 403 | } |
404 | ---- linux-3.10.0-514.26.1.el7.orig/kernel/ptrace.c | |
405 | -+++ linux-3.10.0-514.26.1.el7/kernel/ptrace.c | |
404 | +--- linux-3.10.0-514.26.2.el7.orig/kernel/ptrace.c | |
405 | ++++ linux-3.10.0-514.26.2.el7/kernel/ptrace.c | |
406 | 406 | @@ -1038,6 +1038,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
407 | 407 | { |
408 | 408 | struct task_struct *child; |
@@ -427,8 +427,8 @@ | ||
427 | 427 | |
428 | 428 | if (request == PTRACE_TRACEME) { |
429 | 429 | ret = ptrace_traceme(); |
430 | ---- linux-3.10.0-514.26.1.el7.orig/kernel/sched/core.c | |
431 | -+++ linux-3.10.0-514.26.1.el7/kernel/sched/core.c | |
430 | +--- linux-3.10.0-514.26.2.el7.orig/kernel/sched/core.c | |
431 | ++++ linux-3.10.0-514.26.2.el7/kernel/sched/core.c | |
432 | 432 | @@ -4225,6 +4225,8 @@ int can_nice(const struct task_struct *p |
433 | 433 | SYSCALL_DEFINE1(nice, int, increment) |
434 | 434 | { |
@@ -438,8 +438,8 @@ | ||
438 | 438 | |
439 | 439 | /* |
440 | 440 | * Setpriority might change our priority at the same moment. |
441 | ---- linux-3.10.0-514.26.1.el7.orig/kernel/signal.c | |
442 | -+++ linux-3.10.0-514.26.1.el7/kernel/signal.c | |
441 | +--- linux-3.10.0-514.26.2.el7.orig/kernel/signal.c | |
442 | ++++ linux-3.10.0-514.26.2.el7/kernel/signal.c | |
443 | 443 | @@ -2914,6 +2914,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
444 | 444 | SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
445 | 445 | { |
@@ -485,8 +485,8 @@ | ||
485 | 485 | |
486 | 486 | return do_send_specific(tgid, pid, sig, info); |
487 | 487 | } |
488 | ---- linux-3.10.0-514.26.1.el7.orig/kernel/sys.c | |
489 | -+++ linux-3.10.0-514.26.1.el7/kernel/sys.c | |
488 | +--- linux-3.10.0-514.26.2.el7.orig/kernel/sys.c | |
489 | ++++ linux-3.10.0-514.26.2.el7/kernel/sys.c | |
490 | 490 | @@ -192,6 +192,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
491 | 491 | |
492 | 492 | if (which > PRIO_USER || which < PRIO_PROCESS) |
@@ -525,8 +525,8 @@ | ||
525 | 525 | |
526 | 526 | down_write(&uts_sem); |
527 | 527 | errno = -EFAULT; |
528 | ---- linux-3.10.0-514.26.1.el7.orig/kernel/time/ntp.c | |
529 | -+++ linux-3.10.0-514.26.1.el7/kernel/time/ntp.c | |
528 | +--- linux-3.10.0-514.26.2.el7.orig/kernel/time/ntp.c | |
529 | ++++ linux-3.10.0-514.26.2.el7/kernel/time/ntp.c | |
530 | 530 | @@ -16,6 +16,7 @@ |
531 | 531 | #include <linux/mm.h> |
532 | 532 | #include <linux/module.h> |
@@ -560,8 +560,8 @@ | ||
560 | 560 | |
561 | 561 | return 0; |
562 | 562 | } |
563 | ---- linux-3.10.0-514.26.1.el7.orig/net/ipv4/raw.c | |
564 | -+++ linux-3.10.0-514.26.1.el7/net/ipv4/raw.c | |
563 | +--- linux-3.10.0-514.26.2.el7.orig/net/ipv4/raw.c | |
564 | ++++ linux-3.10.0-514.26.2.el7/net/ipv4/raw.c | |
565 | 565 | @@ -702,6 +702,10 @@ static int raw_recvmsg(struct kiocb *ioc |
566 | 566 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
567 | 567 | if (!skb) |
@@ -573,8 +573,8 @@ | ||
573 | 573 | |
574 | 574 | copied = skb->len; |
575 | 575 | if (len < copied) { |
576 | ---- linux-3.10.0-514.26.1.el7.orig/net/ipv4/udp.c | |
577 | -+++ linux-3.10.0-514.26.1.el7/net/ipv4/udp.c | |
576 | +--- linux-3.10.0-514.26.2.el7.orig/net/ipv4/udp.c | |
577 | ++++ linux-3.10.0-514.26.2.el7/net/ipv4/udp.c | |
578 | 578 | @@ -1268,6 +1268,10 @@ try_again: |
579 | 579 | &peeked, &off, &err); |
580 | 580 | if (!skb) |
@@ -586,8 +586,8 @@ | ||
586 | 586 | |
587 | 587 | ulen = skb->len - sizeof(struct udphdr); |
588 | 588 | copied = len; |
589 | ---- linux-3.10.0-514.26.1.el7.orig/net/ipv6/raw.c | |
590 | -+++ linux-3.10.0-514.26.1.el7/net/ipv6/raw.c | |
589 | +--- linux-3.10.0-514.26.2.el7.orig/net/ipv6/raw.c | |
590 | ++++ linux-3.10.0-514.26.2.el7/net/ipv6/raw.c | |
591 | 591 | @@ -468,6 +468,10 @@ static int rawv6_recvmsg(struct kiocb *i |
592 | 592 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
593 | 593 | if (!skb) |
@@ -599,8 +599,8 @@ | ||
599 | 599 | |
600 | 600 | copied = skb->len; |
601 | 601 | if (copied > len) { |
602 | ---- linux-3.10.0-514.26.1.el7.orig/net/ipv6/udp.c | |
603 | -+++ linux-3.10.0-514.26.1.el7/net/ipv6/udp.c | |
602 | +--- linux-3.10.0-514.26.2.el7.orig/net/ipv6/udp.c | |
603 | ++++ linux-3.10.0-514.26.2.el7/net/ipv6/udp.c | |
604 | 604 | @@ -416,6 +416,10 @@ try_again: |
605 | 605 | &peeked, &off, &err); |
606 | 606 | if (!skb) |
@@ -612,8 +612,8 @@ | ||
612 | 612 | |
613 | 613 | ulen = skb->len - sizeof(struct udphdr); |
614 | 614 | copied = len; |
615 | ---- linux-3.10.0-514.26.1.el7.orig/net/socket.c | |
616 | -+++ linux-3.10.0-514.26.1.el7/net/socket.c | |
615 | +--- linux-3.10.0-514.26.2.el7.orig/net/socket.c | |
616 | ++++ linux-3.10.0-514.26.2.el7/net/socket.c | |
617 | 617 | @@ -1608,6 +1608,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct |
618 | 618 | if (err < 0) |
619 | 619 | goto out_fd; |
@@ -625,8 +625,8 @@ | ||
625 | 625 | if (upeer_sockaddr) { |
626 | 626 | if (newsock->ops->getname(newsock, (struct sockaddr *)&address, |
627 | 627 | &len, 2) < 0) { |
628 | ---- linux-3.10.0-514.26.1.el7.orig/net/unix/af_unix.c | |
629 | -+++ linux-3.10.0-514.26.1.el7/net/unix/af_unix.c | |
628 | +--- linux-3.10.0-514.26.2.el7.orig/net/unix/af_unix.c | |
629 | ++++ linux-3.10.0-514.26.2.el7/net/unix/af_unix.c | |
630 | 630 | @@ -2137,6 +2137,10 @@ static int unix_dgram_recvmsg(struct kio |
631 | 631 | wake_up_interruptible_sync_poll(&u->peer_wait, |
632 | 632 | POLLOUT | POLLWRNORM | POLLWRBAND); |
@@ -638,8 +638,8 @@ | ||
638 | 638 | if (msg->msg_name) |
639 | 639 | unix_copy_addr(msg, skb->sk); |
640 | 640 | |
641 | ---- linux-3.10.0-514.26.1.el7.orig/security/Kconfig | |
642 | -+++ linux-3.10.0-514.26.1.el7/security/Kconfig | |
641 | +--- linux-3.10.0-514.26.2.el7.orig/security/Kconfig | |
642 | ++++ linux-3.10.0-514.26.2.el7/security/Kconfig | |
643 | 643 | @@ -175,5 +175,7 @@ config DEFAULT_SECURITY |
644 | 644 | default "yama" if DEFAULT_SECURITY_YAMA |
645 | 645 | default "" if DEFAULT_SECURITY_DAC |
@@ -648,8 +648,8 @@ | ||
648 | 648 | + |
649 | 649 | endmenu |
650 | 650 | |
651 | ---- linux-3.10.0-514.26.1.el7.orig/security/Makefile | |
652 | -+++ linux-3.10.0-514.26.1.el7/security/Makefile | |
651 | +--- linux-3.10.0-514.26.2.el7.orig/security/Makefile | |
652 | ++++ linux-3.10.0-514.26.2.el7/security/Makefile | |
653 | 653 | @@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
654 | 654 | # Object integrity file lists |
655 | 655 | subdir-$(CONFIG_INTEGRITY) += integrity |
@@ -657,8 +657,8 @@ | ||
657 | 657 | + |
658 | 658 | +subdir-$(CONFIG_CCSECURITY) += ccsecurity |
659 | 659 | +obj-$(CONFIG_CCSECURITY) += ccsecurity/built-in.o |
660 | ---- linux-3.10.0-514.26.1.el7.orig/security/security.c | |
661 | -+++ linux-3.10.0-514.26.1.el7/security/security.c | |
660 | +--- linux-3.10.0-514.26.2.el7.orig/security/security.c | |
661 | ++++ linux-3.10.0-514.26.2.el7/security/security.c | |
662 | 662 | @@ -203,7 +203,10 @@ int security_syslog(int type) |
663 | 663 | |
664 | 664 | int security_settime(const struct timespec *ts, const struct timezone *tz) |
@@ -1,6 +1,6 @@ | ||
1 | -This is TOMOYO Linux patch for kernel 3.16.44. | |
1 | +This is TOMOYO Linux patch for kernel 3.16.45. | |
2 | 2 | |
3 | -Source code for this patch is https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.16.44.tar.xz | |
3 | +Source code for this patch is https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.16.45.tar.xz | |
4 | 4 | --- |
5 | 5 | fs/exec.c | 2 |
6 | 6 | fs/open.c | 2 |
@@ -29,8 +29,8 @@ | ||
29 | 29 | security/security.c | 111 +++++++++++++++++++++++++++++++++++++++++----- |
30 | 30 | 25 files changed, 252 insertions(+), 37 deletions(-) |
31 | 31 | |
32 | ---- linux-3.16.44.orig/fs/exec.c | |
33 | -+++ linux-3.16.44/fs/exec.c | |
32 | +--- linux-3.16.45.orig/fs/exec.c | |
33 | ++++ linux-3.16.45/fs/exec.c | |
34 | 34 | @@ -1447,7 +1447,7 @@ static int exec_binprm(struct linux_binp |
35 | 35 | old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent)); |
36 | 36 | rcu_read_unlock(); |
@@ -40,8 +40,8 @@ | ||
40 | 40 | if (ret >= 0) { |
41 | 41 | audit_bprm(bprm); |
42 | 42 | trace_sched_process_exec(current, old_pid, bprm); |
43 | ---- linux-3.16.44.orig/fs/open.c | |
44 | -+++ linux-3.16.44/fs/open.c | |
43 | +--- linux-3.16.45.orig/fs/open.c | |
44 | ++++ linux-3.16.45/fs/open.c | |
45 | 45 | @@ -1069,6 +1069,8 @@ EXPORT_SYMBOL(sys_close); |
46 | 46 | */ |
47 | 47 | SYSCALL_DEFINE0(vhangup) |
@@ -51,8 +51,8 @@ | ||
51 | 51 | if (capable(CAP_SYS_TTY_CONFIG)) { |
52 | 52 | tty_vhangup_self(); |
53 | 53 | return 0; |
54 | ---- linux-3.16.44.orig/fs/proc/version.c | |
55 | -+++ linux-3.16.44/fs/proc/version.c | |
54 | +--- linux-3.16.45.orig/fs/proc/version.c | |
55 | ++++ linux-3.16.45/fs/proc/version.c | |
56 | 56 | @@ -32,3 +32,10 @@ static int __init proc_version_init(void |
57 | 57 | return 0; |
58 | 58 | } |
@@ -60,12 +60,12 @@ | ||
60 | 60 | + |
61 | 61 | +static int __init ccs_show_version(void) |
62 | 62 | +{ |
63 | -+ printk(KERN_INFO "Hook version: 3.16.44 2017/06/12\n"); | |
63 | ++ printk(KERN_INFO "Hook version: 3.16.45 2017/07/03\n"); | |
64 | 64 | + return 0; |
65 | 65 | +} |
66 | 66 | +fs_initcall(ccs_show_version); |
67 | ---- linux-3.16.44.orig/include/linux/init_task.h | |
68 | -+++ linux-3.16.44/include/linux/init_task.h | |
67 | +--- linux-3.16.45.orig/include/linux/init_task.h | |
68 | ++++ linux-3.16.45/include/linux/init_task.h | |
69 | 69 | @@ -164,6 +164,14 @@ extern struct task_group root_task_group |
70 | 70 | # define INIT_RT_MUTEXES(tsk) |
71 | 71 | #endif |
@@ -89,8 +89,8 @@ | ||
89 | 89 | } |
90 | 90 | |
91 | 91 | |
92 | ---- linux-3.16.44.orig/include/linux/sched.h | |
93 | -+++ linux-3.16.44/include/linux/sched.h | |
92 | +--- linux-3.16.45.orig/include/linux/sched.h | |
93 | ++++ linux-3.16.45/include/linux/sched.h | |
94 | 94 | @@ -6,6 +6,8 @@ |
95 | 95 | #include <linux/sched/prio.h> |
96 | 96 |
@@ -111,8 +111,8 @@ | ||
111 | 111 | }; |
112 | 112 | |
113 | 113 | /* Future-safe accessor for struct task_struct's cpus_allowed. */ |
114 | ---- linux-3.16.44.orig/include/linux/security.h | |
115 | -+++ linux-3.16.44/include/linux/security.h | |
114 | +--- linux-3.16.45.orig/include/linux/security.h | |
115 | ++++ linux-3.16.45/include/linux/security.h | |
116 | 116 | @@ -53,6 +53,7 @@ struct msg_queue; |
117 | 117 | struct xattr; |
118 | 118 | struct xfrm_sec_ctx; |
@@ -324,8 +324,8 @@ | ||
324 | 324 | } |
325 | 325 | #endif /* CONFIG_SECURITY_PATH */ |
326 | 326 | |
327 | ---- linux-3.16.44.orig/include/net/ip.h | |
328 | -+++ linux-3.16.44/include/net/ip.h | |
327 | +--- linux-3.16.45.orig/include/net/ip.h | |
328 | ++++ linux-3.16.45/include/net/ip.h | |
329 | 329 | @@ -213,6 +213,8 @@ void inet_get_local_port_range(struct ne |
330 | 330 | #ifdef CONFIG_SYSCTL |
331 | 331 | static inline int inet_is_local_reserved_port(struct net *net, int port) |
@@ -344,8 +344,8 @@ | ||
344 | 344 | return 0; |
345 | 345 | } |
346 | 346 | #endif |
347 | ---- linux-3.16.44.orig/kernel/fork.c | |
348 | -+++ linux-3.16.44/kernel/fork.c | |
347 | +--- linux-3.16.45.orig/kernel/fork.c | |
348 | ++++ linux-3.16.45/kernel/fork.c | |
349 | 349 | @@ -246,6 +246,7 @@ void __put_task_struct(struct task_struc |
350 | 350 | delayacct_tsk_free(tsk); |
351 | 351 | put_signal_struct(tsk->signal); |
@@ -372,8 +372,8 @@ | ||
372 | 372 | bad_fork_cleanup_perf: |
373 | 373 | perf_event_free_task(p); |
374 | 374 | bad_fork_cleanup_policy: |
375 | ---- linux-3.16.44.orig/kernel/kexec.c | |
376 | -+++ linux-3.16.44/kernel/kexec.c | |
375 | +--- linux-3.16.45.orig/kernel/kexec.c | |
376 | ++++ linux-3.16.45/kernel/kexec.c | |
377 | 377 | @@ -39,6 +39,7 @@ |
378 | 378 | #include <asm/uaccess.h> |
379 | 379 | #include <asm/io.h> |
@@ -391,8 +391,8 @@ | ||
391 | 391 | |
392 | 392 | /* |
393 | 393 | * Verify we have a legal set of flags |
394 | ---- linux-3.16.44.orig/kernel/module.c | |
395 | -+++ linux-3.16.44/kernel/module.c | |
394 | +--- linux-3.16.45.orig/kernel/module.c | |
395 | ++++ linux-3.16.45/kernel/module.c | |
396 | 396 | @@ -63,6 +63,7 @@ |
397 | 397 | #include <linux/fips.h> |
398 | 398 | #include <uapi/linux/module.h> |
@@ -419,8 +419,8 @@ | ||
419 | 419 | |
420 | 420 | return 0; |
421 | 421 | } |
422 | ---- linux-3.16.44.orig/kernel/ptrace.c | |
423 | -+++ linux-3.16.44/kernel/ptrace.c | |
422 | +--- linux-3.16.45.orig/kernel/ptrace.c | |
423 | ++++ linux-3.16.45/kernel/ptrace.c | |
424 | 424 | @@ -1058,6 +1058,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
425 | 425 | { |
426 | 426 | struct task_struct *child; |
@@ -445,8 +445,8 @@ | ||
445 | 445 | |
446 | 446 | if (request == PTRACE_TRACEME) { |
447 | 447 | ret = ptrace_traceme(); |
448 | ---- linux-3.16.44.orig/kernel/reboot.c | |
449 | -+++ linux-3.16.44/kernel/reboot.c | |
448 | +--- linux-3.16.45.orig/kernel/reboot.c | |
449 | ++++ linux-3.16.45/kernel/reboot.c | |
450 | 450 | @@ -16,6 +16,7 @@ |
451 | 451 | #include <linux/syscalls.h> |
452 | 452 | #include <linux/syscore_ops.h> |
@@ -464,8 +464,8 @@ | ||
464 | 464 | |
465 | 465 | /* |
466 | 466 | * If pid namespaces are enabled and the current task is in a child |
467 | ---- linux-3.16.44.orig/kernel/sched/core.c | |
468 | -+++ linux-3.16.44/kernel/sched/core.c | |
467 | +--- linux-3.16.45.orig/kernel/sched/core.c | |
468 | ++++ linux-3.16.45/kernel/sched/core.c | |
469 | 469 | @@ -3164,6 +3164,8 @@ int can_nice(const struct task_struct *p |
470 | 470 | SYSCALL_DEFINE1(nice, int, increment) |
471 | 471 | { |
@@ -475,8 +475,8 @@ | ||
475 | 475 | |
476 | 476 | /* |
477 | 477 | * Setpriority might change our priority at the same moment. |
478 | ---- linux-3.16.44.orig/kernel/signal.c | |
479 | -+++ linux-3.16.44/kernel/signal.c | |
478 | +--- linux-3.16.45.orig/kernel/signal.c | |
479 | ++++ linux-3.16.45/kernel/signal.c | |
480 | 480 | @@ -2887,6 +2887,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
481 | 481 | SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
482 | 482 | { |
@@ -522,8 +522,8 @@ | ||
522 | 522 | |
523 | 523 | return do_send_specific(tgid, pid, sig, info); |
524 | 524 | } |
525 | ---- linux-3.16.44.orig/kernel/sys.c | |
526 | -+++ linux-3.16.44/kernel/sys.c | |
525 | +--- linux-3.16.45.orig/kernel/sys.c | |
526 | ++++ linux-3.16.45/kernel/sys.c | |
527 | 527 | @@ -171,6 +171,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
528 | 528 | |
529 | 529 | if (which > PRIO_USER || which < PRIO_PROCESS) |
@@ -553,8 +553,8 @@ | ||
553 | 553 | |
554 | 554 | down_write(&uts_sem); |
555 | 555 | errno = -EFAULT; |
556 | ---- linux-3.16.44.orig/kernel/time/ntp.c | |
557 | -+++ linux-3.16.44/kernel/time/ntp.c | |
556 | +--- linux-3.16.45.orig/kernel/time/ntp.c | |
557 | ++++ linux-3.16.45/kernel/time/ntp.c | |
558 | 558 | @@ -16,6 +16,7 @@ |
559 | 559 | #include <linux/mm.h> |
560 | 560 | #include <linux/module.h> |
@@ -588,8 +588,8 @@ | ||
588 | 588 | |
589 | 589 | /* |
590 | 590 | * Check for potential multiplication overflows that can |
591 | ---- linux-3.16.44.orig/net/ipv4/raw.c | |
592 | -+++ linux-3.16.44/net/ipv4/raw.c | |
591 | +--- linux-3.16.45.orig/net/ipv4/raw.c | |
592 | ++++ linux-3.16.45/net/ipv4/raw.c | |
593 | 593 | @@ -706,6 +706,10 @@ static int raw_recvmsg(struct kiocb *ioc |
594 | 594 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
595 | 595 | if (!skb) |
@@ -601,8 +601,8 @@ | ||
601 | 601 | |
602 | 602 | copied = skb->len; |
603 | 603 | if (len < copied) { |
604 | ---- linux-3.16.44.orig/net/ipv4/udp.c | |
605 | -+++ linux-3.16.44/net/ipv4/udp.c | |
604 | +--- linux-3.16.45.orig/net/ipv4/udp.c | |
605 | ++++ linux-3.16.45/net/ipv4/udp.c | |
606 | 606 | @@ -1285,6 +1285,10 @@ try_again: |
607 | 607 | &peeked, &off, &err); |
608 | 608 | if (!skb) |
@@ -614,8 +614,8 @@ | ||
614 | 614 | |
615 | 615 | ulen = skb->len - sizeof(struct udphdr); |
616 | 616 | copied = len; |
617 | ---- linux-3.16.44.orig/net/ipv6/raw.c | |
618 | -+++ linux-3.16.44/net/ipv6/raw.c | |
617 | +--- linux-3.16.45.orig/net/ipv6/raw.c | |
618 | ++++ linux-3.16.45/net/ipv6/raw.c | |
619 | 619 | @@ -478,6 +478,10 @@ static int rawv6_recvmsg(struct kiocb *i |
620 | 620 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
621 | 621 | if (!skb) |
@@ -627,8 +627,8 @@ | ||
627 | 627 | |
628 | 628 | copied = skb->len; |
629 | 629 | if (copied > len) { |
630 | ---- linux-3.16.44.orig/net/ipv6/udp.c | |
631 | -+++ linux-3.16.44/net/ipv6/udp.c | |
630 | +--- linux-3.16.45.orig/net/ipv6/udp.c | |
631 | ++++ linux-3.16.45/net/ipv6/udp.c | |
632 | 632 | @@ -404,6 +404,10 @@ try_again: |
633 | 633 | &peeked, &off, &err); |
634 | 634 | if (!skb) |
@@ -640,8 +640,8 @@ | ||
640 | 640 | |
641 | 641 | ulen = skb->len - sizeof(struct udphdr); |
642 | 642 | copied = len; |
643 | ---- linux-3.16.44.orig/net/socket.c | |
644 | -+++ linux-3.16.44/net/socket.c | |
643 | +--- linux-3.16.45.orig/net/socket.c | |
644 | ++++ linux-3.16.45/net/socket.c | |
645 | 645 | @@ -1631,6 +1631,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct |
646 | 646 | if (err < 0) |
647 | 647 | goto out_fd; |
@@ -653,8 +653,8 @@ | ||
653 | 653 | if (upeer_sockaddr) { |
654 | 654 | if (newsock->ops->getname(newsock, (struct sockaddr *)&address, |
655 | 655 | &len, 2) < 0) { |
656 | ---- linux-3.16.44.orig/net/unix/af_unix.c | |
657 | -+++ linux-3.16.44/net/unix/af_unix.c | |
656 | +--- linux-3.16.45.orig/net/unix/af_unix.c | |
657 | ++++ linux-3.16.45/net/unix/af_unix.c | |
658 | 658 | @@ -1981,6 +1981,10 @@ static int unix_dgram_recvmsg(struct kio |
659 | 659 | wake_up_interruptible_sync_poll(&u->peer_wait, |
660 | 660 | POLLOUT | POLLWRNORM | POLLWRBAND); |
@@ -666,8 +666,8 @@ | ||
666 | 666 | if (msg->msg_name) |
667 | 667 | unix_copy_addr(msg, skb->sk); |
668 | 668 | |
669 | ---- linux-3.16.44.orig/security/Kconfig | |
670 | -+++ linux-3.16.44/security/Kconfig | |
669 | +--- linux-3.16.45.orig/security/Kconfig | |
670 | ++++ linux-3.16.45/security/Kconfig | |
671 | 671 | @@ -167,5 +167,7 @@ config DEFAULT_SECURITY |
672 | 672 | default "yama" if DEFAULT_SECURITY_YAMA |
673 | 673 | default "" if DEFAULT_SECURITY_DAC |
@@ -676,8 +676,8 @@ | ||
676 | 676 | + |
677 | 677 | endmenu |
678 | 678 | |
679 | ---- linux-3.16.44.orig/security/Makefile | |
680 | -+++ linux-3.16.44/security/Makefile | |
679 | +--- linux-3.16.45.orig/security/Makefile | |
680 | ++++ linux-3.16.45/security/Makefile | |
681 | 681 | @@ -27,3 +27,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
682 | 682 | # Object integrity file lists |
683 | 683 | subdir-$(CONFIG_INTEGRITY) += integrity |
@@ -685,8 +685,8 @@ | ||
685 | 685 | + |
686 | 686 | +subdir-$(CONFIG_CCSECURITY) += ccsecurity |
687 | 687 | +obj-$(CONFIG_CCSECURITY) += ccsecurity/ |
688 | ---- linux-3.16.44.orig/security/security.c | |
689 | -+++ linux-3.16.44/security/security.c | |
688 | +--- linux-3.16.45.orig/security/security.c | |
689 | ++++ linux-3.16.45/security/security.c | |
690 | 690 | @@ -203,7 +203,10 @@ int security_syslog(int type) |
691 | 691 | |
692 | 692 | int security_settime(const struct timespec *ts, const struct timezone *tz) |
@@ -1,6 +1,6 @@ | ||
1 | -This is TOMOYO Linux patch for kernel 3.18.59. | |
1 | +This is TOMOYO Linux patch for kernel 3.18.61. | |
2 | 2 | |
3 | -Source code for this patch is https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.18.59.tar.xz | |
3 | +Source code for this patch is https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.18.61.tar.xz | |
4 | 4 | --- |
5 | 5 | fs/exec.c | 2 |
6 | 6 | fs/open.c | 2 |
@@ -29,8 +29,8 @@ | ||
29 | 29 | security/security.c | 111 +++++++++++++++++++++++++++++++++++++++++----- |
30 | 30 | 25 files changed, 252 insertions(+), 37 deletions(-) |
31 | 31 | |
32 | ---- linux-3.18.59.orig/fs/exec.c | |
33 | -+++ linux-3.18.59/fs/exec.c | |
32 | +--- linux-3.18.61.orig/fs/exec.c | |
33 | ++++ linux-3.18.61/fs/exec.c | |
34 | 34 | @@ -1462,7 +1462,7 @@ static int exec_binprm(struct linux_binp |
35 | 35 | old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent)); |
36 | 36 | rcu_read_unlock(); |
@@ -40,8 +40,8 @@ | ||
40 | 40 | if (ret >= 0) { |
41 | 41 | audit_bprm(bprm); |
42 | 42 | trace_sched_process_exec(current, old_pid, bprm); |
43 | ---- linux-3.18.59.orig/fs/open.c | |
44 | -+++ linux-3.18.59/fs/open.c | |
43 | +--- linux-3.18.61.orig/fs/open.c | |
44 | ++++ linux-3.18.61/fs/open.c | |
45 | 45 | @@ -1091,6 +1091,8 @@ EXPORT_SYMBOL(sys_close); |
46 | 46 | */ |
47 | 47 | SYSCALL_DEFINE0(vhangup) |
@@ -51,8 +51,8 @@ | ||
51 | 51 | if (capable(CAP_SYS_TTY_CONFIG)) { |
52 | 52 | tty_vhangup_self(); |
53 | 53 | return 0; |
54 | ---- linux-3.18.59.orig/fs/proc/version.c | |
55 | -+++ linux-3.18.59/fs/proc/version.c | |
54 | +--- linux-3.18.61.orig/fs/proc/version.c | |
55 | ++++ linux-3.18.61/fs/proc/version.c | |
56 | 56 | @@ -32,3 +32,10 @@ static int __init proc_version_init(void |
57 | 57 | return 0; |
58 | 58 | } |
@@ -60,12 +60,12 @@ | ||
60 | 60 | + |
61 | 61 | +static int __init ccs_show_version(void) |
62 | 62 | +{ |
63 | -+ printk(KERN_INFO "Hook version: 3.18.59 2017/06/29\n"); | |
63 | ++ printk(KERN_INFO "Hook version: 3.18.61 2017/07/16\n"); | |
64 | 64 | + return 0; |
65 | 65 | +} |
66 | 66 | +fs_initcall(ccs_show_version); |
67 | ---- linux-3.18.59.orig/include/linux/init_task.h | |
68 | -+++ linux-3.18.59/include/linux/init_task.h | |
67 | +--- linux-3.18.61.orig/include/linux/init_task.h | |
68 | ++++ linux-3.18.61/include/linux/init_task.h | |
69 | 69 | @@ -166,6 +166,14 @@ extern struct task_group root_task_group |
70 | 70 | # define INIT_RT_MUTEXES(tsk) |
71 | 71 | #endif |
@@ -89,8 +89,8 @@ | ||
89 | 89 | } |
90 | 90 | |
91 | 91 | |
92 | ---- linux-3.18.59.orig/include/linux/sched.h | |
93 | -+++ linux-3.18.59/include/linux/sched.h | |
92 | +--- linux-3.18.61.orig/include/linux/sched.h | |
93 | ++++ linux-3.18.61/include/linux/sched.h | |
94 | 94 | @@ -6,6 +6,8 @@ |
95 | 95 | #include <linux/sched/prio.h> |
96 | 96 |
@@ -111,8 +111,8 @@ | ||
111 | 111 | }; |
112 | 112 | |
113 | 113 | /* Future-safe accessor for struct task_struct's cpus_allowed. */ |
114 | ---- linux-3.18.59.orig/include/linux/security.h | |
115 | -+++ linux-3.18.59/include/linux/security.h | |
114 | +--- linux-3.18.61.orig/include/linux/security.h | |
115 | ++++ linux-3.18.61/include/linux/security.h | |
116 | 116 | @@ -53,6 +53,7 @@ struct msg_queue; |
117 | 117 | struct xattr; |
118 | 118 | struct xfrm_sec_ctx; |
@@ -324,8 +324,8 @@ | ||
324 | 324 | } |
325 | 325 | #endif /* CONFIG_SECURITY_PATH */ |
326 | 326 | |
327 | ---- linux-3.18.59.orig/include/net/ip.h | |
328 | -+++ linux-3.18.59/include/net/ip.h | |
327 | +--- linux-3.18.61.orig/include/net/ip.h | |
328 | ++++ linux-3.18.61/include/net/ip.h | |
329 | 329 | @@ -216,6 +216,8 @@ void inet_get_local_port_range(struct ne |
330 | 330 | #ifdef CONFIG_SYSCTL |
331 | 331 | static inline int inet_is_local_reserved_port(struct net *net, int port) |
@@ -344,8 +344,8 @@ | ||
344 | 344 | return 0; |
345 | 345 | } |
346 | 346 | #endif |
347 | ---- linux-3.18.59.orig/kernel/fork.c | |
348 | -+++ linux-3.18.59/kernel/fork.c | |
347 | +--- linux-3.18.61.orig/kernel/fork.c | |
348 | ++++ linux-3.18.61/kernel/fork.c | |
349 | 349 | @@ -246,6 +246,7 @@ void __put_task_struct(struct task_struc |
350 | 350 | delayacct_tsk_free(tsk); |
351 | 351 | put_signal_struct(tsk->signal); |
@@ -372,8 +372,8 @@ | ||
372 | 372 | bad_fork_cleanup_perf: |
373 | 373 | perf_event_free_task(p); |
374 | 374 | bad_fork_cleanup_policy: |
375 | ---- linux-3.18.59.orig/kernel/kexec.c | |
376 | -+++ linux-3.18.59/kernel/kexec.c | |
375 | +--- linux-3.18.61.orig/kernel/kexec.c | |
376 | ++++ linux-3.18.61/kernel/kexec.c | |
377 | 377 | @@ -41,6 +41,7 @@ |
378 | 378 | #include <asm/uaccess.h> |
379 | 379 | #include <asm/io.h> |
@@ -391,8 +391,8 @@ | ||
391 | 391 | |
392 | 392 | /* |
393 | 393 | * Verify we have a legal set of flags |
394 | ---- linux-3.18.59.orig/kernel/module.c | |
395 | -+++ linux-3.18.59/kernel/module.c | |
394 | +--- linux-3.18.61.orig/kernel/module.c | |
395 | ++++ linux-3.18.61/kernel/module.c | |
396 | 396 | @@ -62,6 +62,7 @@ |
397 | 397 | #include <linux/bsearch.h> |
398 | 398 | #include <uapi/linux/module.h> |
@@ -419,8 +419,8 @@ | ||
419 | 419 | |
420 | 420 | return 0; |
421 | 421 | } |
422 | ---- linux-3.18.59.orig/kernel/ptrace.c | |
423 | -+++ linux-3.18.59/kernel/ptrace.c | |
422 | +--- linux-3.18.61.orig/kernel/ptrace.c | |
423 | ++++ linux-3.18.61/kernel/ptrace.c | |
424 | 424 | @@ -1081,6 +1081,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
425 | 425 | { |
426 | 426 | struct task_struct *child; |
@@ -445,8 +445,8 @@ | ||
445 | 445 | |
446 | 446 | if (request == PTRACE_TRACEME) { |
447 | 447 | ret = ptrace_traceme(); |
448 | ---- linux-3.18.59.orig/kernel/reboot.c | |
449 | -+++ linux-3.18.59/kernel/reboot.c | |
448 | +--- linux-3.18.61.orig/kernel/reboot.c | |
449 | ++++ linux-3.18.61/kernel/reboot.c | |
450 | 450 | @@ -16,6 +16,7 @@ |
451 | 451 | #include <linux/syscalls.h> |
452 | 452 | #include <linux/syscore_ops.h> |
@@ -464,8 +464,8 @@ | ||
464 | 464 | |
465 | 465 | /* |
466 | 466 | * If pid namespaces are enabled and the current task is in a child |
467 | ---- linux-3.18.59.orig/kernel/sched/core.c | |
468 | -+++ linux-3.18.59/kernel/sched/core.c | |
467 | +--- linux-3.18.61.orig/kernel/sched/core.c | |
468 | ++++ linux-3.18.61/kernel/sched/core.c | |
469 | 469 | @@ -3218,6 +3218,8 @@ int can_nice(const struct task_struct *p |
470 | 470 | SYSCALL_DEFINE1(nice, int, increment) |
471 | 471 | { |
@@ -475,8 +475,8 @@ | ||
475 | 475 | |
476 | 476 | /* |
477 | 477 | * Setpriority might change our priority at the same moment. |
478 | ---- linux-3.18.59.orig/kernel/signal.c | |
479 | -+++ linux-3.18.59/kernel/signal.c | |
478 | +--- linux-3.18.61.orig/kernel/signal.c | |
479 | ++++ linux-3.18.61/kernel/signal.c | |
480 | 480 | @@ -2895,6 +2895,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
481 | 481 | SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
482 | 482 | { |
@@ -522,8 +522,8 @@ | ||
522 | 522 | |
523 | 523 | return do_send_specific(tgid, pid, sig, info); |
524 | 524 | } |
525 | ---- linux-3.18.59.orig/kernel/sys.c | |
526 | -+++ linux-3.18.59/kernel/sys.c | |
525 | +--- linux-3.18.61.orig/kernel/sys.c | |
526 | ++++ linux-3.18.61/kernel/sys.c | |
527 | 527 | @@ -171,6 +171,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
528 | 528 | |
529 | 529 | if (which > PRIO_USER || which < PRIO_PROCESS) |
@@ -553,8 +553,8 @@ | ||
553 | 553 | |
554 | 554 | down_write(&uts_sem); |
555 | 555 | errno = -EFAULT; |
556 | ---- linux-3.18.59.orig/kernel/time/ntp.c | |
557 | -+++ linux-3.18.59/kernel/time/ntp.c | |
556 | +--- linux-3.18.61.orig/kernel/time/ntp.c | |
557 | ++++ linux-3.18.61/kernel/time/ntp.c | |
558 | 558 | @@ -16,6 +16,7 @@ |
559 | 559 | #include <linux/mm.h> |
560 | 560 | #include <linux/module.h> |
@@ -588,8 +588,8 @@ | ||
588 | 588 | |
589 | 589 | /* |
590 | 590 | * Check for potential multiplication overflows that can |
591 | ---- linux-3.18.59.orig/net/ipv4/raw.c | |
592 | -+++ linux-3.18.59/net/ipv4/raw.c | |
591 | +--- linux-3.18.61.orig/net/ipv4/raw.c | |
592 | ++++ linux-3.18.61/net/ipv4/raw.c | |
593 | 593 | @@ -714,6 +714,10 @@ static int raw_recvmsg(struct kiocb *ioc |
594 | 594 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
595 | 595 | if (!skb) |
@@ -601,8 +601,8 @@ | ||
601 | 601 | |
602 | 602 | copied = skb->len; |
603 | 603 | if (len < copied) { |
604 | ---- linux-3.18.59.orig/net/ipv4/udp.c | |
605 | -+++ linux-3.18.59/net/ipv4/udp.c | |
604 | +--- linux-3.18.61.orig/net/ipv4/udp.c | |
605 | ++++ linux-3.18.61/net/ipv4/udp.c | |
606 | 606 | @@ -1263,6 +1263,10 @@ try_again: |
607 | 607 | &peeked, &off, &err); |
608 | 608 | if (!skb) |
@@ -614,8 +614,8 @@ | ||
614 | 614 | |
615 | 615 | ulen = skb->len - sizeof(struct udphdr); |
616 | 616 | copied = len; |
617 | ---- linux-3.18.59.orig/net/ipv6/raw.c | |
618 | -+++ linux-3.18.59/net/ipv6/raw.c | |
617 | +--- linux-3.18.61.orig/net/ipv6/raw.c | |
618 | ++++ linux-3.18.61/net/ipv6/raw.c | |
619 | 619 | @@ -478,6 +478,10 @@ static int rawv6_recvmsg(struct kiocb *i |
620 | 620 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
621 | 621 | if (!skb) |
@@ -627,8 +627,8 @@ | ||
627 | 627 | |
628 | 628 | copied = skb->len; |
629 | 629 | if (copied > len) { |
630 | ---- linux-3.18.59.orig/net/ipv6/udp.c | |
631 | -+++ linux-3.18.59/net/ipv6/udp.c | |
630 | +--- linux-3.18.61.orig/net/ipv6/udp.c | |
631 | ++++ linux-3.18.61/net/ipv6/udp.c | |
632 | 632 | @@ -403,6 +403,10 @@ try_again: |
633 | 633 | &peeked, &off, &err); |
634 | 634 | if (!skb) |
@@ -640,8 +640,8 @@ | ||
640 | 640 | |
641 | 641 | ulen = skb->len - sizeof(struct udphdr); |
642 | 642 | copied = len; |
643 | ---- linux-3.18.59.orig/net/socket.c | |
644 | -+++ linux-3.18.59/net/socket.c | |
643 | +--- linux-3.18.61.orig/net/socket.c | |
644 | ++++ linux-3.18.61/net/socket.c | |
645 | 645 | @@ -1637,6 +1637,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct |
646 | 646 | if (err < 0) |
647 | 647 | goto out_fd; |
@@ -653,8 +653,8 @@ | ||
653 | 653 | if (upeer_sockaddr) { |
654 | 654 | if (newsock->ops->getname(newsock, (struct sockaddr *)&address, |
655 | 655 | &len, 2) < 0) { |
656 | ---- linux-3.18.59.orig/net/unix/af_unix.c | |
657 | -+++ linux-3.18.59/net/unix/af_unix.c | |
656 | +--- linux-3.18.61.orig/net/unix/af_unix.c | |
657 | ++++ linux-3.18.61/net/unix/af_unix.c | |
658 | 658 | @@ -1981,6 +1981,10 @@ static int unix_dgram_recvmsg(struct kio |
659 | 659 | wake_up_interruptible_sync_poll(&u->peer_wait, |
660 | 660 | POLLOUT | POLLWRNORM | POLLWRBAND); |
@@ -666,8 +666,8 @@ | ||
666 | 666 | if (msg->msg_name) |
667 | 667 | unix_copy_addr(msg, skb->sk); |
668 | 668 | |
669 | ---- linux-3.18.59.orig/security/Kconfig | |
670 | -+++ linux-3.18.59/security/Kconfig | |
669 | +--- linux-3.18.61.orig/security/Kconfig | |
670 | ++++ linux-3.18.61/security/Kconfig | |
671 | 671 | @@ -167,5 +167,7 @@ config DEFAULT_SECURITY |
672 | 672 | default "yama" if DEFAULT_SECURITY_YAMA |
673 | 673 | default "" if DEFAULT_SECURITY_DAC |
@@ -676,8 +676,8 @@ | ||
676 | 676 | + |
677 | 677 | endmenu |
678 | 678 | |
679 | ---- linux-3.18.59.orig/security/Makefile | |
680 | -+++ linux-3.18.59/security/Makefile | |
679 | +--- linux-3.18.61.orig/security/Makefile | |
680 | ++++ linux-3.18.61/security/Makefile | |
681 | 681 | @@ -27,3 +27,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
682 | 682 | # Object integrity file lists |
683 | 683 | subdir-$(CONFIG_INTEGRITY) += integrity |
@@ -685,8 +685,8 @@ | ||
685 | 685 | + |
686 | 686 | +subdir-$(CONFIG_CCSECURITY) += ccsecurity |
687 | 687 | +obj-$(CONFIG_CCSECURITY) += ccsecurity/ |
688 | ---- linux-3.18.59.orig/security/security.c | |
689 | -+++ linux-3.18.59/security/security.c | |
688 | +--- linux-3.18.61.orig/security/security.c | |
689 | ++++ linux-3.18.61/security/security.c | |
690 | 690 | @@ -203,7 +203,10 @@ int security_syslog(int type) |
691 | 691 | |
692 | 692 | int security_settime(const struct timespec *ts, const struct timezone *tz) |
@@ -1,6 +1,6 @@ | ||
1 | -This is TOMOYO Linux patch for kernel 3.2.89. | |
1 | +This is TOMOYO Linux patch for kernel 3.2.90. | |
2 | 2 | |
3 | -Source code for this patch is https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.2.89.tar.xz | |
3 | +Source code for this patch is https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.2.90.tar.xz | |
4 | 4 | --- |
5 | 5 | fs/exec.c | 2 |
6 | 6 | fs/open.c | 2 |
@@ -28,8 +28,8 @@ | ||
28 | 28 | security/security.c | 134 +++++++++++++++++++++++++++++++++++++--------- |
29 | 29 | 24 files changed, 247 insertions(+), 49 deletions(-) |
30 | 30 | |
31 | ---- linux-3.2.89.orig/fs/exec.c | |
32 | -+++ linux-3.2.89/fs/exec.c | |
31 | +--- linux-3.2.90.orig/fs/exec.c | |
32 | ++++ linux-3.2.90/fs/exec.c | |
33 | 33 | @@ -1572,7 +1572,7 @@ static int do_execve_common(const char * |
34 | 34 | if (retval < 0) |
35 | 35 | goto out; |
@@ -39,8 +39,8 @@ | ||
39 | 39 | if (retval < 0) |
40 | 40 | goto out; |
41 | 41 | |
42 | ---- linux-3.2.89.orig/fs/open.c | |
43 | -+++ linux-3.2.89/fs/open.c | |
42 | +--- linux-3.2.90.orig/fs/open.c | |
43 | ++++ linux-3.2.90/fs/open.c | |
44 | 44 | @@ -1105,6 +1105,8 @@ EXPORT_SYMBOL(sys_close); |
45 | 45 | */ |
46 | 46 | SYSCALL_DEFINE0(vhangup) |
@@ -50,8 +50,8 @@ | ||
50 | 50 | if (capable(CAP_SYS_TTY_CONFIG)) { |
51 | 51 | tty_vhangup_self(); |
52 | 52 | return 0; |
53 | ---- linux-3.2.89.orig/fs/proc/version.c | |
54 | -+++ linux-3.2.89/fs/proc/version.c | |
53 | +--- linux-3.2.90.orig/fs/proc/version.c | |
54 | ++++ linux-3.2.90/fs/proc/version.c | |
55 | 55 | @@ -32,3 +32,10 @@ static int __init proc_version_init(void |
56 | 56 | return 0; |
57 | 57 | } |
@@ -59,12 +59,12 @@ | ||
59 | 59 | + |
60 | 60 | +static int __init ccs_show_version(void) |
61 | 61 | +{ |
62 | -+ printk(KERN_INFO "Hook version: 3.2.89 2017/06/12\n"); | |
62 | ++ printk(KERN_INFO "Hook version: 3.2.90 2017/07/03\n"); | |
63 | 63 | + return 0; |
64 | 64 | +} |
65 | 65 | +module_init(ccs_show_version); |
66 | ---- linux-3.2.89.orig/include/linux/init_task.h | |
67 | -+++ linux-3.2.89/include/linux/init_task.h | |
66 | +--- linux-3.2.90.orig/include/linux/init_task.h | |
67 | ++++ linux-3.2.90/include/linux/init_task.h | |
68 | 68 | @@ -144,6 +144,14 @@ extern struct task_group root_task_group |
69 | 69 | |
70 | 70 | #define INIT_TASK_COMM "swapper" |
@@ -88,8 +88,8 @@ | ||
88 | 88 | } |
89 | 89 | |
90 | 90 | |
91 | ---- linux-3.2.89.orig/include/linux/sched.h | |
92 | -+++ linux-3.2.89/include/linux/sched.h | |
91 | +--- linux-3.2.90.orig/include/linux/sched.h | |
92 | ++++ linux-3.2.90/include/linux/sched.h | |
93 | 93 | @@ -44,6 +44,8 @@ |
94 | 94 | |
95 | 95 | #ifdef __KERNEL__ |
@@ -110,8 +110,8 @@ | ||
110 | 110 | }; |
111 | 111 | |
112 | 112 | /* Future-safe accessor for struct task_struct's cpus_allowed. */ |
113 | ---- linux-3.2.89.orig/include/linux/security.h | |
114 | -+++ linux-3.2.89/include/linux/security.h | |
113 | +--- linux-3.2.90.orig/include/linux/security.h | |
114 | ++++ linux-3.2.90/include/linux/security.h | |
115 | 115 | @@ -38,6 +38,7 @@ |
116 | 116 | #include <linux/slab.h> |
117 | 117 | #include <linux/xattr.h> |
@@ -310,8 +310,8 @@ | ||
310 | 310 | } |
311 | 311 | #endif /* CONFIG_SECURITY_PATH */ |
312 | 312 | |
313 | ---- linux-3.2.89.orig/include/net/ip.h | |
314 | -+++ linux-3.2.89/include/net/ip.h | |
313 | +--- linux-3.2.90.orig/include/net/ip.h | |
314 | ++++ linux-3.2.90/include/net/ip.h | |
315 | 315 | @@ -218,6 +218,8 @@ extern void inet_get_local_port_range(in |
316 | 316 | extern unsigned long *sysctl_local_reserved_ports; |
317 | 317 | static inline int inet_is_reserved_local_port(int port) |
@@ -321,8 +321,8 @@ | ||
321 | 321 | return test_bit(port, sysctl_local_reserved_ports); |
322 | 322 | } |
323 | 323 | |
324 | ---- linux-3.2.89.orig/kernel/fork.c | |
325 | -+++ linux-3.2.89/kernel/fork.c | |
324 | +--- linux-3.2.90.orig/kernel/fork.c | |
325 | ++++ linux-3.2.90/kernel/fork.c | |
326 | 326 | @@ -195,6 +195,7 @@ void __put_task_struct(struct task_struc |
327 | 327 | delayacct_tsk_free(tsk); |
328 | 328 | put_signal_struct(tsk->signal); |
@@ -349,8 +349,8 @@ | ||
349 | 349 | bad_fork_cleanup_perf: |
350 | 350 | perf_event_free_task(p); |
351 | 351 | bad_fork_cleanup_policy: |
352 | ---- linux-3.2.89.orig/kernel/kexec.c | |
353 | -+++ linux-3.2.89/kernel/kexec.c | |
352 | +--- linux-3.2.90.orig/kernel/kexec.c | |
353 | ++++ linux-3.2.90/kernel/kexec.c | |
354 | 354 | @@ -40,6 +40,7 @@ |
355 | 355 | #include <asm/io.h> |
356 | 356 | #include <asm/system.h> |
@@ -368,8 +368,8 @@ | ||
368 | 368 | |
369 | 369 | /* |
370 | 370 | * Verify we have a legal set of flags |
371 | ---- linux-3.2.89.orig/kernel/module.c | |
372 | -+++ linux-3.2.89/kernel/module.c | |
371 | +--- linux-3.2.90.orig/kernel/module.c | |
372 | ++++ linux-3.2.90/kernel/module.c | |
373 | 373 | @@ -58,6 +58,7 @@ |
374 | 374 | #include <linux/jump_label.h> |
375 | 375 | #include <linux/pfn.h> |
@@ -396,8 +396,8 @@ | ||
396 | 396 | |
397 | 397 | /* Do all the hard work */ |
398 | 398 | mod = load_module(umod, len, uargs); |
399 | ---- linux-3.2.89.orig/kernel/ptrace.c | |
400 | -+++ linux-3.2.89/kernel/ptrace.c | |
399 | +--- linux-3.2.90.orig/kernel/ptrace.c | |
400 | ++++ linux-3.2.90/kernel/ptrace.c | |
401 | 401 | @@ -928,6 +928,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
402 | 402 | { |
403 | 403 | struct task_struct *child; |
@@ -422,8 +422,8 @@ | ||
422 | 422 | |
423 | 423 | if (request == PTRACE_TRACEME) { |
424 | 424 | ret = ptrace_traceme(); |
425 | ---- linux-3.2.89.orig/kernel/sched.c | |
426 | -+++ linux-3.2.89/kernel/sched.c | |
425 | +--- linux-3.2.90.orig/kernel/sched.c | |
426 | ++++ linux-3.2.90/kernel/sched.c | |
427 | 427 | @@ -5342,6 +5342,8 @@ int can_nice(const struct task_struct *p |
428 | 428 | SYSCALL_DEFINE1(nice, int, increment) |
429 | 429 | { |
@@ -433,8 +433,8 @@ | ||
433 | 433 | |
434 | 434 | /* |
435 | 435 | * Setpriority might change our priority at the same moment. |
436 | ---- linux-3.2.89.orig/kernel/signal.c | |
437 | -+++ linux-3.2.89/kernel/signal.c | |
436 | +--- linux-3.2.90.orig/kernel/signal.c | |
437 | ++++ linux-3.2.90/kernel/signal.c | |
438 | 438 | @@ -2748,6 +2748,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
439 | 439 | SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
440 | 440 | { |
@@ -480,8 +480,8 @@ | ||
480 | 480 | |
481 | 481 | return do_send_specific(tgid, pid, sig, info); |
482 | 482 | } |
483 | ---- linux-3.2.89.orig/kernel/sys.c | |
484 | -+++ linux-3.2.89/kernel/sys.c | |
483 | +--- linux-3.2.90.orig/kernel/sys.c | |
484 | ++++ linux-3.2.90/kernel/sys.c | |
485 | 485 | @@ -180,6 +180,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
486 | 486 | |
487 | 487 | if (which > PRIO_USER || which < PRIO_PROCESS) |
@@ -520,8 +520,8 @@ | ||
520 | 520 | |
521 | 521 | down_write(&uts_sem); |
522 | 522 | errno = -EFAULT; |
523 | ---- linux-3.2.89.orig/kernel/time/ntp.c | |
524 | -+++ linux-3.2.89/kernel/time/ntp.c | |
523 | +--- linux-3.2.90.orig/kernel/time/ntp.c | |
524 | ++++ linux-3.2.90/kernel/time/ntp.c | |
525 | 525 | @@ -15,6 +15,7 @@ |
526 | 526 | #include <linux/time.h> |
527 | 527 | #include <linux/mm.h> |
@@ -555,8 +555,8 @@ | ||
555 | 555 | if (!(txc->modes & ADJ_NANO)) |
556 | 556 | delta.tv_nsec *= 1000; |
557 | 557 | result = timekeeping_inject_offset(&delta); |
558 | ---- linux-3.2.89.orig/net/ipv4/raw.c | |
559 | -+++ linux-3.2.89/net/ipv4/raw.c | |
558 | +--- linux-3.2.90.orig/net/ipv4/raw.c | |
559 | ++++ linux-3.2.90/net/ipv4/raw.c | |
560 | 560 | @@ -699,6 +699,10 @@ static int raw_recvmsg(struct kiocb *ioc |
561 | 561 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
562 | 562 | if (!skb) |
@@ -568,8 +568,8 @@ | ||
568 | 568 | |
569 | 569 | copied = skb->len; |
570 | 570 | if (len < copied) { |
571 | ---- linux-3.2.89.orig/net/ipv4/udp.c | |
572 | -+++ linux-3.2.89/net/ipv4/udp.c | |
571 | +--- linux-3.2.90.orig/net/ipv4/udp.c | |
572 | ++++ linux-3.2.90/net/ipv4/udp.c | |
573 | 573 | @@ -1185,6 +1185,10 @@ try_again: |
574 | 574 | &peeked, &err); |
575 | 575 | if (!skb) |
@@ -581,8 +581,8 @@ | ||
581 | 581 | |
582 | 582 | ulen = skb->len - sizeof(struct udphdr); |
583 | 583 | copied = len; |
584 | ---- linux-3.2.89.orig/net/ipv6/raw.c | |
585 | -+++ linux-3.2.89/net/ipv6/raw.c | |
584 | +--- linux-3.2.90.orig/net/ipv6/raw.c | |
585 | ++++ linux-3.2.90/net/ipv6/raw.c | |
586 | 586 | @@ -465,6 +465,10 @@ static int rawv6_recvmsg(struct kiocb *i |
587 | 587 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
588 | 588 | if (!skb) |
@@ -594,8 +594,8 @@ | ||
594 | 594 | |
595 | 595 | copied = skb->len; |
596 | 596 | if (copied > len) { |
597 | ---- linux-3.2.89.orig/net/ipv6/udp.c | |
598 | -+++ linux-3.2.89/net/ipv6/udp.c | |
597 | +--- linux-3.2.90.orig/net/ipv6/udp.c | |
598 | ++++ linux-3.2.90/net/ipv6/udp.c | |
599 | 599 | @@ -359,6 +359,10 @@ try_again: |
600 | 600 | &peeked, &err); |
601 | 601 | if (!skb) |
@@ -607,8 +607,8 @@ | ||
607 | 607 | |
608 | 608 | ulen = skb->len - sizeof(struct udphdr); |
609 | 609 | copied = len; |
610 | ---- linux-3.2.89.orig/net/socket.c | |
611 | -+++ linux-3.2.89/net/socket.c | |
610 | +--- linux-3.2.90.orig/net/socket.c | |
611 | ++++ linux-3.2.90/net/socket.c | |
612 | 612 | @@ -1531,6 +1531,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct |
613 | 613 | if (err < 0) |
614 | 614 | goto out_fd; |
@@ -620,8 +620,8 @@ | ||
620 | 620 | if (upeer_sockaddr) { |
621 | 621 | if (newsock->ops->getname(newsock, (struct sockaddr *)&address, |
622 | 622 | &len, 2) < 0) { |
623 | ---- linux-3.2.89.orig/net/unix/af_unix.c | |
624 | -+++ linux-3.2.89/net/unix/af_unix.c | |
623 | +--- linux-3.2.90.orig/net/unix/af_unix.c | |
624 | ++++ linux-3.2.90/net/unix/af_unix.c | |
625 | 625 | @@ -1957,6 +1957,10 @@ static int unix_dgram_recvmsg(struct kio |
626 | 626 | wake_up_interruptible_sync_poll(&u->peer_wait, |
627 | 627 | POLLOUT | POLLWRNORM | POLLWRBAND); |
@@ -633,8 +633,8 @@ | ||
633 | 633 | if (msg->msg_name) |
634 | 634 | unix_copy_addr(msg, skb->sk); |
635 | 635 | |
636 | ---- linux-3.2.89.orig/security/Kconfig | |
637 | -+++ linux-3.2.89/security/Kconfig | |
636 | +--- linux-3.2.90.orig/security/Kconfig | |
637 | ++++ linux-3.2.90/security/Kconfig | |
638 | 638 | @@ -227,5 +227,7 @@ config DEFAULT_SECURITY |
639 | 639 | default "apparmor" if DEFAULT_SECURITY_APPARMOR |
640 | 640 | default "" if DEFAULT_SECURITY_DAC |
@@ -643,8 +643,8 @@ | ||
643 | 643 | + |
644 | 644 | endmenu |
645 | 645 | |
646 | ---- linux-3.2.89.orig/security/Makefile | |
647 | -+++ linux-3.2.89/security/Makefile | |
646 | +--- linux-3.2.90.orig/security/Makefile | |
647 | ++++ linux-3.2.90/security/Makefile | |
648 | 648 | @@ -26,3 +26,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
649 | 649 | # Object integrity file lists |
650 | 650 | subdir-$(CONFIG_INTEGRITY) += integrity |
@@ -652,8 +652,8 @@ | ||
652 | 652 | + |
653 | 653 | +subdir-$(CONFIG_CCSECURITY) += ccsecurity |
654 | 654 | +obj-$(CONFIG_CCSECURITY) += ccsecurity/built-in.o |
655 | ---- linux-3.2.89.orig/security/security.c | |
656 | -+++ linux-3.2.89/security/security.c | |
655 | +--- linux-3.2.90.orig/security/security.c | |
656 | ++++ linux-3.2.90/security/security.c | |
657 | 657 | @@ -203,7 +203,10 @@ int security_syslog(int type) |
658 | 658 | |
659 | 659 | int security_settime(const struct timespec *ts, const struct timezone *tz) |
@@ -1,6 +1,6 @@ | ||
1 | -This is TOMOYO Linux patch for kernel 4.11.8. | |
1 | +This is TOMOYO Linux patch for kernel 4.11.11. | |
2 | 2 | |
3 | -Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.11.8.tar.xz | |
3 | +Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.11.11.tar.xz | |
4 | 4 | --- |
5 | 5 | fs/exec.c | 2 - |
6 | 6 | fs/open.c | 2 + |
@@ -28,8 +28,8 @@ | ||
28 | 28 | security/Makefile | 3 ++ |
29 | 29 | 24 files changed, 146 insertions(+), 26 deletions(-) |
30 | 30 | |
31 | ---- linux-4.11.8.orig/fs/exec.c | |
32 | -+++ linux-4.11.8/fs/exec.c | |
31 | +--- linux-4.11.11.orig/fs/exec.c | |
32 | ++++ linux-4.11.11/fs/exec.c | |
33 | 33 | @@ -1663,7 +1663,7 @@ static int exec_binprm(struct linux_binp |
34 | 34 | old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent)); |
35 | 35 | rcu_read_unlock(); |
@@ -39,9 +39,9 @@ | ||
39 | 39 | if (ret >= 0) { |
40 | 40 | audit_bprm(bprm); |
41 | 41 | trace_sched_process_exec(current, old_pid, bprm); |
42 | ---- linux-4.11.8.orig/fs/open.c | |
43 | -+++ linux-4.11.8/fs/open.c | |
44 | -@@ -1143,6 +1143,8 @@ EXPORT_SYMBOL(sys_close); | |
42 | +--- linux-4.11.11.orig/fs/open.c | |
43 | ++++ linux-4.11.11/fs/open.c | |
44 | +@@ -1149,6 +1149,8 @@ EXPORT_SYMBOL(sys_close); | |
45 | 45 | */ |
46 | 46 | SYSCALL_DEFINE0(vhangup) |
47 | 47 | { |
@@ -50,8 +50,8 @@ | ||
50 | 50 | if (capable(CAP_SYS_TTY_CONFIG)) { |
51 | 51 | tty_vhangup_self(); |
52 | 52 | return 0; |
53 | ---- linux-4.11.8.orig/fs/proc/version.c | |
54 | -+++ linux-4.11.8/fs/proc/version.c | |
53 | +--- linux-4.11.11.orig/fs/proc/version.c | |
54 | ++++ linux-4.11.11/fs/proc/version.c | |
55 | 55 | @@ -32,3 +32,10 @@ static int __init proc_version_init(void |
56 | 56 | return 0; |
57 | 57 | } |
@@ -59,12 +59,12 @@ | ||
59 | 59 | + |
60 | 60 | +static int __init ccs_show_version(void) |
61 | 61 | +{ |
62 | -+ printk(KERN_INFO "Hook version: 4.11.8 2017/06/29\n"); | |
62 | ++ printk(KERN_INFO "Hook version: 4.11.11 2017/07/16\n"); | |
63 | 63 | + return 0; |
64 | 64 | +} |
65 | 65 | +fs_initcall(ccs_show_version); |
66 | ---- linux-4.11.8.orig/include/linux/init_task.h | |
67 | -+++ linux-4.11.8/include/linux/init_task.h | |
66 | +--- linux-4.11.11.orig/include/linux/init_task.h | |
67 | ++++ linux-4.11.11/include/linux/init_task.h | |
68 | 68 | @@ -210,6 +210,14 @@ extern struct cred init_cred; |
69 | 69 | # define INIT_TASK_TI(tsk) |
70 | 70 | #endif |
@@ -88,8 +88,8 @@ | ||
88 | 88 | } |
89 | 89 | |
90 | 90 | |
91 | ---- linux-4.11.8.orig/include/linux/sched.h | |
92 | -+++ linux-4.11.8/include/linux/sched.h | |
91 | +--- linux-4.11.11.orig/include/linux/sched.h | |
92 | ++++ linux-4.11.11/include/linux/sched.h | |
93 | 93 | @@ -32,6 +32,7 @@ struct audit_context; |
94 | 94 | struct backing_dev_info; |
95 | 95 | struct bio_list; |
@@ -109,8 +109,8 @@ | ||
109 | 109 | /* CPU-specific state of this task: */ |
110 | 110 | struct thread_struct thread; |
111 | 111 | |
112 | ---- linux-4.11.8.orig/include/linux/security.h | |
113 | -+++ linux-4.11.8/include/linux/security.h | |
112 | +--- linux-4.11.11.orig/include/linux/security.h | |
113 | ++++ linux-4.11.11/include/linux/security.h | |
114 | 114 | @@ -55,6 +55,7 @@ struct msg_queue; |
115 | 115 | struct xattr; |
116 | 116 | struct xfrm_sec_ctx; |
@@ -317,8 +317,8 @@ | ||
317 | 317 | } |
318 | 318 | #endif /* CONFIG_SECURITY_PATH */ |
319 | 319 | |
320 | ---- linux-4.11.8.orig/include/net/ip.h | |
321 | -+++ linux-4.11.8/include/net/ip.h | |
320 | +--- linux-4.11.11.orig/include/net/ip.h | |
321 | ++++ linux-4.11.11/include/net/ip.h | |
322 | 322 | @@ -253,6 +253,8 @@ void inet_get_local_port_range(struct ne |
323 | 323 | #ifdef CONFIG_SYSCTL |
324 | 324 | static inline int inet_is_local_reserved_port(struct net *net, int port) |
@@ -337,8 +337,8 @@ | ||
337 | 337 | return 0; |
338 | 338 | } |
339 | 339 | |
340 | ---- linux-4.11.8.orig/kernel/fork.c | |
341 | -+++ linux-4.11.8/kernel/fork.c | |
340 | +--- linux-4.11.11.orig/kernel/fork.c | |
341 | ++++ linux-4.11.11/kernel/fork.c | |
342 | 342 | @@ -403,6 +403,7 @@ void __put_task_struct(struct task_struc |
343 | 343 | delayacct_tsk_free(tsk); |
344 | 344 | put_signal_struct(tsk->signal); |
@@ -365,8 +365,8 @@ | ||
365 | 365 | bad_fork_cleanup_perf: |
366 | 366 | perf_event_free_task(p); |
367 | 367 | bad_fork_cleanup_policy: |
368 | ---- linux-4.11.8.orig/kernel/kexec.c | |
369 | -+++ linux-4.11.8/kernel/kexec.c | |
368 | +--- linux-4.11.11.orig/kernel/kexec.c | |
369 | ++++ linux-4.11.11/kernel/kexec.c | |
370 | 370 | @@ -17,7 +17,7 @@ |
371 | 371 | #include <linux/syscalls.h> |
372 | 372 | #include <linux/vmalloc.h> |
@@ -385,8 +385,8 @@ | ||
385 | 385 | |
386 | 386 | /* |
387 | 387 | * Verify we have a legal set of flags |
388 | ---- linux-4.11.8.orig/kernel/module.c | |
389 | -+++ linux-4.11.8/kernel/module.c | |
388 | +--- linux-4.11.11.orig/kernel/module.c | |
389 | ++++ linux-4.11.11/kernel/module.c | |
390 | 390 | @@ -65,6 +65,7 @@ |
391 | 391 | #include <linux/audit.h> |
392 | 392 | #include <uapi/linux/module.h> |
@@ -413,8 +413,8 @@ | ||
413 | 413 | |
414 | 414 | return 0; |
415 | 415 | } |
416 | ---- linux-4.11.8.orig/kernel/ptrace.c | |
417 | -+++ linux-4.11.8/kernel/ptrace.c | |
416 | +--- linux-4.11.11.orig/kernel/ptrace.c | |
417 | ++++ linux-4.11.11/kernel/ptrace.c | |
418 | 418 | @@ -1125,6 +1125,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
419 | 419 | { |
420 | 420 | struct task_struct *child; |
@@ -439,8 +439,8 @@ | ||
439 | 439 | |
440 | 440 | if (request == PTRACE_TRACEME) { |
441 | 441 | ret = ptrace_traceme(); |
442 | ---- linux-4.11.8.orig/kernel/reboot.c | |
443 | -+++ linux-4.11.8/kernel/reboot.c | |
442 | +--- linux-4.11.11.orig/kernel/reboot.c | |
443 | ++++ linux-4.11.11/kernel/reboot.c | |
444 | 444 | @@ -16,6 +16,7 @@ |
445 | 445 | #include <linux/syscalls.h> |
446 | 446 | #include <linux/syscore_ops.h> |
@@ -458,8 +458,8 @@ | ||
458 | 458 | |
459 | 459 | /* |
460 | 460 | * If pid namespaces are enabled and the current task is in a child |
461 | ---- linux-4.11.8.orig/kernel/sched/core.c | |
462 | -+++ linux-4.11.8/kernel/sched/core.c | |
461 | +--- linux-4.11.11.orig/kernel/sched/core.c | |
462 | ++++ linux-4.11.11/kernel/sched/core.c | |
463 | 463 | @@ -3857,6 +3857,8 @@ int can_nice(const struct task_struct *p |
464 | 464 | SYSCALL_DEFINE1(nice, int, increment) |
465 | 465 | { |
@@ -469,8 +469,8 @@ | ||
469 | 469 | |
470 | 470 | /* |
471 | 471 | * Setpriority might change our priority at the same moment. |
472 | ---- linux-4.11.8.orig/kernel/signal.c | |
473 | -+++ linux-4.11.8/kernel/signal.c | |
472 | +--- linux-4.11.11.orig/kernel/signal.c | |
473 | ++++ linux-4.11.11/kernel/signal.c | |
474 | 474 | @@ -2873,6 +2873,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
475 | 475 | SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
476 | 476 | { |
@@ -516,8 +516,8 @@ | ||
516 | 516 | |
517 | 517 | return do_send_specific(tgid, pid, sig, info); |
518 | 518 | } |
519 | ---- linux-4.11.8.orig/kernel/sys.c | |
520 | -+++ linux-4.11.8/kernel/sys.c | |
519 | +--- linux-4.11.11.orig/kernel/sys.c | |
520 | ++++ linux-4.11.11/kernel/sys.c | |
521 | 521 | @@ -190,6 +190,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
522 | 522 | |
523 | 523 | if (which > PRIO_USER || which < PRIO_PROCESS) |
@@ -547,8 +547,8 @@ | ||
547 | 547 | |
548 | 548 | down_write(&uts_sem); |
549 | 549 | errno = -EFAULT; |
550 | ---- linux-4.11.8.orig/kernel/time/ntp.c | |
551 | -+++ linux-4.11.8/kernel/time/ntp.c | |
550 | +--- linux-4.11.11.orig/kernel/time/ntp.c | |
551 | ++++ linux-4.11.11/kernel/time/ntp.c | |
552 | 552 | @@ -17,6 +17,7 @@ |
553 | 553 | #include <linux/module.h> |
554 | 554 | #include <linux/rtc.h> |
@@ -582,8 +582,8 @@ | ||
582 | 582 | |
583 | 583 | if (txc->modes & ADJ_NANO) { |
584 | 584 | struct timespec ts; |
585 | ---- linux-4.11.8.orig/net/ipv4/raw.c | |
586 | -+++ linux-4.11.8/net/ipv4/raw.c | |
585 | +--- linux-4.11.11.orig/net/ipv4/raw.c | |
586 | ++++ linux-4.11.11/net/ipv4/raw.c | |
587 | 587 | @@ -755,6 +755,10 @@ static int raw_recvmsg(struct sock *sk, |
588 | 588 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
589 | 589 | if (!skb) |
@@ -595,8 +595,8 @@ | ||
595 | 595 | |
596 | 596 | copied = skb->len; |
597 | 597 | if (len < copied) { |
598 | ---- linux-4.11.8.orig/net/ipv4/udp.c | |
599 | -+++ linux-4.11.8/net/ipv4/udp.c | |
598 | +--- linux-4.11.11.orig/net/ipv4/udp.c | |
599 | ++++ linux-4.11.11/net/ipv4/udp.c | |
600 | 600 | @@ -1425,6 +1425,8 @@ try_again: |
601 | 601 | skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err); |
602 | 602 | if (!skb) |
@@ -606,8 +606,8 @@ | ||
606 | 606 | |
607 | 607 | ulen = skb->len; |
608 | 608 | copied = len; |
609 | ---- linux-4.11.8.orig/net/ipv6/raw.c | |
610 | -+++ linux-4.11.8/net/ipv6/raw.c | |
609 | +--- linux-4.11.11.orig/net/ipv6/raw.c | |
610 | ++++ linux-4.11.11/net/ipv6/raw.c | |
611 | 611 | @@ -480,6 +480,10 @@ static int rawv6_recvmsg(struct sock *sk |
612 | 612 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
613 | 613 | if (!skb) |
@@ -619,8 +619,8 @@ | ||
619 | 619 | |
620 | 620 | copied = skb->len; |
621 | 621 | if (copied > len) { |
622 | ---- linux-4.11.8.orig/net/ipv6/udp.c | |
623 | -+++ linux-4.11.8/net/ipv6/udp.c | |
622 | +--- linux-4.11.11.orig/net/ipv6/udp.c | |
623 | ++++ linux-4.11.11/net/ipv6/udp.c | |
624 | 624 | @@ -360,6 +360,8 @@ try_again: |
625 | 625 | skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err); |
626 | 626 | if (!skb) |
@@ -630,8 +630,8 @@ | ||
630 | 630 | |
631 | 631 | ulen = skb->len; |
632 | 632 | copied = len; |
633 | ---- linux-4.11.8.orig/net/socket.c | |
634 | -+++ linux-4.11.8/net/socket.c | |
633 | +--- linux-4.11.11.orig/net/socket.c | |
634 | ++++ linux-4.11.11/net/socket.c | |
635 | 635 | @@ -1521,6 +1521,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct |
636 | 636 | if (err < 0) |
637 | 637 | goto out_fd; |
@@ -643,9 +643,9 @@ | ||
643 | 643 | if (upeer_sockaddr) { |
644 | 644 | if (newsock->ops->getname(newsock, (struct sockaddr *)&address, |
645 | 645 | &len, 2) < 0) { |
646 | ---- linux-4.11.8.orig/net/unix/af_unix.c | |
647 | -+++ linux-4.11.8/net/unix/af_unix.c | |
648 | -@@ -2147,6 +2147,10 @@ static int unix_dgram_recvmsg(struct soc | |
646 | +--- linux-4.11.11.orig/net/unix/af_unix.c | |
647 | ++++ linux-4.11.11/net/unix/af_unix.c | |
648 | +@@ -2152,6 +2152,10 @@ static int unix_dgram_recvmsg(struct soc | |
649 | 649 | POLLOUT | POLLWRNORM | |
650 | 650 | POLLWRBAND); |
651 | 651 |
@@ -656,7 +656,7 @@ | ||
656 | 656 | if (msg->msg_name) |
657 | 657 | unix_copy_addr(msg, skb->sk); |
658 | 658 | |
659 | -@@ -2197,6 +2201,7 @@ static int unix_dgram_recvmsg(struct soc | |
659 | +@@ -2202,6 +2206,7 @@ static int unix_dgram_recvmsg(struct soc | |
660 | 660 | |
661 | 661 | out_free: |
662 | 662 | skb_free_datagram(sk, skb); |
@@ -664,8 +664,8 @@ | ||
664 | 664 | mutex_unlock(&u->iolock); |
665 | 665 | out: |
666 | 666 | return err; |
667 | ---- linux-4.11.8.orig/security/Kconfig | |
668 | -+++ linux-4.11.8/security/Kconfig | |
667 | +--- linux-4.11.11.orig/security/Kconfig | |
668 | ++++ linux-4.11.11/security/Kconfig | |
669 | 669 | @@ -239,5 +239,7 @@ config DEFAULT_SECURITY |
670 | 670 | default "apparmor" if DEFAULT_SECURITY_APPARMOR |
671 | 671 | default "" if DEFAULT_SECURITY_DAC |
@@ -674,8 +674,8 @@ | ||
674 | 674 | + |
675 | 675 | endmenu |
676 | 676 | |
677 | ---- linux-4.11.8.orig/security/Makefile | |
678 | -+++ linux-4.11.8/security/Makefile | |
677 | +--- linux-4.11.11.orig/security/Makefile | |
678 | ++++ linux-4.11.11/security/Makefile | |
679 | 679 | @@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
680 | 680 | # Object integrity file lists |
681 | 681 | subdir-$(CONFIG_INTEGRITY) += integrity |
@@ -1,6 +1,6 @@ | ||
1 | -This is TOMOYO Linux patch for kernel 4.12-rc7. | |
1 | +This is TOMOYO Linux patch for kernel 4.12.2. | |
2 | 2 | |
3 | -Source code for this patch is https://git.kernel.org/torvalds/t/linux-4.12-rc7.tar.gz | |
3 | +Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.12.2.tar.xz | |
4 | 4 | --- |
5 | 5 | fs/exec.c | 2 - |
6 | 6 | fs/open.c | 2 + |
@@ -28,8 +28,8 @@ | ||
28 | 28 | security/security.c | 9 +++++- |
29 | 29 | 24 files changed, 153 insertions(+), 29 deletions(-) |
30 | 30 | |
31 | ---- linux-4.12-rc7.orig/fs/exec.c | |
32 | -+++ linux-4.12-rc7/fs/exec.c | |
31 | +--- linux-4.12.2.orig/fs/exec.c | |
32 | ++++ linux-4.12.2/fs/exec.c | |
33 | 33 | @@ -1664,7 +1664,7 @@ static int exec_binprm(struct linux_binp |
34 | 34 | old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent)); |
35 | 35 | rcu_read_unlock(); |
@@ -39,8 +39,8 @@ | ||
39 | 39 | if (ret >= 0) { |
40 | 40 | audit_bprm(bprm); |
41 | 41 | trace_sched_process_exec(current, old_pid, bprm); |
42 | ---- linux-4.12-rc7.orig/fs/open.c | |
43 | -+++ linux-4.12-rc7/fs/open.c | |
42 | +--- linux-4.12.2.orig/fs/open.c | |
43 | ++++ linux-4.12.2/fs/open.c | |
44 | 44 | @@ -1167,6 +1167,8 @@ EXPORT_SYMBOL(sys_close); |
45 | 45 | */ |
46 | 46 | SYSCALL_DEFINE0(vhangup) |
@@ -50,8 +50,8 @@ | ||
50 | 50 | if (capable(CAP_SYS_TTY_CONFIG)) { |
51 | 51 | tty_vhangup_self(); |
52 | 52 | return 0; |
53 | ---- linux-4.12-rc7.orig/fs/proc/version.c | |
54 | -+++ linux-4.12-rc7/fs/proc/version.c | |
53 | +--- linux-4.12.2.orig/fs/proc/version.c | |
54 | ++++ linux-4.12.2/fs/proc/version.c | |
55 | 55 | @@ -32,3 +32,10 @@ static int __init proc_version_init(void |
56 | 56 | return 0; |
57 | 57 | } |
@@ -59,12 +59,12 @@ | ||
59 | 59 | + |
60 | 60 | +static int __init ccs_show_version(void) |
61 | 61 | +{ |
62 | -+ printk(KERN_INFO "Hook version: 4.12-rc7 2017/06/29\n"); | |
62 | ++ printk(KERN_INFO "Hook version: 4.12.2 2017/07/16\n"); | |
63 | 63 | + return 0; |
64 | 64 | +} |
65 | 65 | +fs_initcall(ccs_show_version); |
66 | ---- linux-4.12-rc7.orig/include/linux/init_task.h | |
67 | -+++ linux-4.12-rc7/include/linux/init_task.h | |
66 | +--- linux-4.12.2.orig/include/linux/init_task.h | |
67 | ++++ linux-4.12.2/include/linux/init_task.h | |
68 | 68 | @@ -225,6 +225,14 @@ extern struct cred init_cred; |
69 | 69 | #define INIT_TASK_SECURITY |
70 | 70 | #endif |
@@ -88,8 +88,8 @@ | ||
88 | 88 | } |
89 | 89 | |
90 | 90 | |
91 | ---- linux-4.12-rc7.orig/include/linux/sched.h | |
92 | -+++ linux-4.12-rc7/include/linux/sched.h | |
91 | +--- linux-4.12.2.orig/include/linux/sched.h | |
92 | ++++ linux-4.12.2/include/linux/sched.h | |
93 | 93 | @@ -32,6 +32,7 @@ struct audit_context; |
94 | 94 | struct backing_dev_info; |
95 | 95 | struct bio_list; |
@@ -109,8 +109,8 @@ | ||
109 | 109 | /* CPU-specific state of this task: */ |
110 | 110 | struct thread_struct thread; |
111 | 111 | |
112 | ---- linux-4.12-rc7.orig/include/linux/security.h | |
113 | -+++ linux-4.12-rc7/include/linux/security.h | |
112 | +--- linux-4.12.2.orig/include/linux/security.h | |
113 | ++++ linux-4.12.2/include/linux/security.h | |
114 | 114 | @@ -55,6 +55,7 @@ struct msg_queue; |
115 | 115 | struct xattr; |
116 | 116 | struct xfrm_sec_ctx; |
@@ -333,8 +333,8 @@ | ||
333 | 333 | } |
334 | 334 | #endif /* CONFIG_SECURITY_PATH */ |
335 | 335 | |
336 | ---- linux-4.12-rc7.orig/include/net/ip.h | |
337 | -+++ linux-4.12-rc7/include/net/ip.h | |
336 | +--- linux-4.12.2.orig/include/net/ip.h | |
337 | ++++ linux-4.12.2/include/net/ip.h | |
338 | 338 | @@ -255,6 +255,8 @@ void inet_get_local_port_range(struct ne |
339 | 339 | #ifdef CONFIG_SYSCTL |
340 | 340 | static inline int inet_is_local_reserved_port(struct net *net, int port) |
@@ -353,8 +353,8 @@ | ||
353 | 353 | return 0; |
354 | 354 | } |
355 | 355 | |
356 | ---- linux-4.12-rc7.orig/kernel/kexec.c | |
357 | -+++ linux-4.12-rc7/kernel/kexec.c | |
356 | +--- linux-4.12.2.orig/kernel/kexec.c | |
357 | ++++ linux-4.12.2/kernel/kexec.c | |
358 | 358 | @@ -17,7 +17,7 @@ |
359 | 359 | #include <linux/syscalls.h> |
360 | 360 | #include <linux/vmalloc.h> |
@@ -373,8 +373,8 @@ | ||
373 | 373 | |
374 | 374 | /* |
375 | 375 | * Verify we have a legal set of flags |
376 | ---- linux-4.12-rc7.orig/kernel/module.c | |
377 | -+++ linux-4.12-rc7/kernel/module.c | |
376 | +--- linux-4.12.2.orig/kernel/module.c | |
377 | ++++ linux-4.12.2/kernel/module.c | |
378 | 378 | @@ -68,6 +68,7 @@ |
379 | 379 | #include <linux/audit.h> |
380 | 380 | #include <uapi/linux/module.h> |
@@ -401,8 +401,8 @@ | ||
401 | 401 | |
402 | 402 | return 0; |
403 | 403 | } |
404 | ---- linux-4.12-rc7.orig/kernel/ptrace.c | |
405 | -+++ linux-4.12-rc7/kernel/ptrace.c | |
404 | +--- linux-4.12.2.orig/kernel/ptrace.c | |
405 | ++++ linux-4.12.2/kernel/ptrace.c | |
406 | 406 | @@ -1125,6 +1125,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
407 | 407 | { |
408 | 408 | struct task_struct *child; |
@@ -427,8 +427,8 @@ | ||
427 | 427 | |
428 | 428 | if (request == PTRACE_TRACEME) { |
429 | 429 | ret = ptrace_traceme(); |
430 | ---- linux-4.12-rc7.orig/kernel/reboot.c | |
431 | -+++ linux-4.12-rc7/kernel/reboot.c | |
430 | +--- linux-4.12.2.orig/kernel/reboot.c | |
431 | ++++ linux-4.12.2/kernel/reboot.c | |
432 | 432 | @@ -16,6 +16,7 @@ |
433 | 433 | #include <linux/syscalls.h> |
434 | 434 | #include <linux/syscore_ops.h> |
@@ -446,8 +446,8 @@ | ||
446 | 446 | |
447 | 447 | /* |
448 | 448 | * If pid namespaces are enabled and the current task is in a child |
449 | ---- linux-4.12-rc7.orig/kernel/sched/core.c | |
450 | -+++ linux-4.12-rc7/kernel/sched/core.c | |
449 | +--- linux-4.12.2.orig/kernel/sched/core.c | |
450 | ++++ linux-4.12.2/kernel/sched/core.c | |
451 | 451 | @@ -3926,6 +3926,8 @@ int can_nice(const struct task_struct *p |
452 | 452 | SYSCALL_DEFINE1(nice, int, increment) |
453 | 453 | { |
@@ -457,8 +457,8 @@ | ||
457 | 457 | |
458 | 458 | /* |
459 | 459 | * Setpriority might change our priority at the same moment. |
460 | ---- linux-4.12-rc7.orig/kernel/signal.c | |
461 | -+++ linux-4.12-rc7/kernel/signal.c | |
460 | +--- linux-4.12.2.orig/kernel/signal.c | |
461 | ++++ linux-4.12.2/kernel/signal.c | |
462 | 462 | @@ -2873,6 +2873,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
463 | 463 | SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
464 | 464 | { |
@@ -504,8 +504,8 @@ | ||
504 | 504 | |
505 | 505 | return do_send_specific(tgid, pid, sig, info); |
506 | 506 | } |
507 | ---- linux-4.12-rc7.orig/kernel/sys.c | |
508 | -+++ linux-4.12-rc7/kernel/sys.c | |
507 | +--- linux-4.12.2.orig/kernel/sys.c | |
508 | ++++ linux-4.12.2/kernel/sys.c | |
509 | 509 | @@ -190,6 +190,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
510 | 510 | |
511 | 511 | if (which > PRIO_USER || which < PRIO_PROCESS) |
@@ -535,8 +535,8 @@ | ||
535 | 535 | |
536 | 536 | down_write(&uts_sem); |
537 | 537 | errno = -EFAULT; |
538 | ---- linux-4.12-rc7.orig/kernel/time/ntp.c | |
539 | -+++ linux-4.12-rc7/kernel/time/ntp.c | |
538 | +--- linux-4.12.2.orig/kernel/time/ntp.c | |
539 | ++++ linux-4.12.2/kernel/time/ntp.c | |
540 | 540 | @@ -17,6 +17,7 @@ |
541 | 541 | #include <linux/module.h> |
542 | 542 | #include <linux/rtc.h> |
@@ -570,8 +570,8 @@ | ||
570 | 570 | |
571 | 571 | if (txc->modes & ADJ_NANO) { |
572 | 572 | struct timespec ts; |
573 | ---- linux-4.12-rc7.orig/net/ipv4/raw.c | |
574 | -+++ linux-4.12-rc7/net/ipv4/raw.c | |
573 | +--- linux-4.12.2.orig/net/ipv4/raw.c | |
574 | ++++ linux-4.12.2/net/ipv4/raw.c | |
575 | 575 | @@ -755,6 +755,10 @@ static int raw_recvmsg(struct sock *sk, |
576 | 576 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
577 | 577 | if (!skb) |
@@ -583,8 +583,8 @@ | ||
583 | 583 | |
584 | 584 | copied = skb->len; |
585 | 585 | if (len < copied) { |
586 | ---- linux-4.12-rc7.orig/net/ipv4/udp.c | |
587 | -+++ linux-4.12-rc7/net/ipv4/udp.c | |
586 | +--- linux-4.12.2.orig/net/ipv4/udp.c | |
587 | ++++ linux-4.12.2/net/ipv4/udp.c | |
588 | 588 | @@ -1425,6 +1425,8 @@ try_again: |
589 | 589 | skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err); |
590 | 590 | if (!skb) |
@@ -594,8 +594,8 @@ | ||
594 | 594 | |
595 | 595 | ulen = skb->len; |
596 | 596 | copied = len; |
597 | ---- linux-4.12-rc7.orig/net/ipv6/raw.c | |
598 | -+++ linux-4.12-rc7/net/ipv6/raw.c | |
597 | +--- linux-4.12.2.orig/net/ipv6/raw.c | |
598 | ++++ linux-4.12.2/net/ipv6/raw.c | |
599 | 599 | @@ -480,6 +480,10 @@ static int rawv6_recvmsg(struct sock *sk |
600 | 600 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
601 | 601 | if (!skb) |
@@ -607,8 +607,8 @@ | ||
607 | 607 | |
608 | 608 | copied = skb->len; |
609 | 609 | if (copied > len) { |
610 | ---- linux-4.12-rc7.orig/net/ipv6/udp.c | |
611 | -+++ linux-4.12-rc7/net/ipv6/udp.c | |
610 | +--- linux-4.12.2.orig/net/ipv6/udp.c | |
611 | ++++ linux-4.12.2/net/ipv6/udp.c | |
612 | 612 | @@ -361,6 +361,8 @@ try_again: |
613 | 613 | skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err); |
614 | 614 | if (!skb) |
@@ -618,8 +618,8 @@ | ||
618 | 618 | |
619 | 619 | ulen = skb->len; |
620 | 620 | copied = len; |
621 | ---- linux-4.12-rc7.orig/net/socket.c | |
622 | -+++ linux-4.12-rc7/net/socket.c | |
621 | +--- linux-4.12.2.orig/net/socket.c | |
622 | ++++ linux-4.12.2/net/socket.c | |
623 | 623 | @@ -1521,6 +1521,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct |
624 | 624 | if (err < 0) |
625 | 625 | goto out_fd; |
@@ -631,8 +631,8 @@ | ||
631 | 631 | if (upeer_sockaddr) { |
632 | 632 | if (newsock->ops->getname(newsock, (struct sockaddr *)&address, |
633 | 633 | &len, 2) < 0) { |
634 | ---- linux-4.12-rc7.orig/net/unix/af_unix.c | |
635 | -+++ linux-4.12-rc7/net/unix/af_unix.c | |
634 | +--- linux-4.12.2.orig/net/unix/af_unix.c | |
635 | ++++ linux-4.12.2/net/unix/af_unix.c | |
636 | 636 | @@ -2152,6 +2152,10 @@ static int unix_dgram_recvmsg(struct soc |
637 | 637 | POLLOUT | POLLWRNORM | |
638 | 638 | POLLWRBAND); |
@@ -652,8 +652,8 @@ | ||
652 | 652 | mutex_unlock(&u->iolock); |
653 | 653 | out: |
654 | 654 | return err; |
655 | ---- linux-4.12-rc7.orig/security/Kconfig | |
656 | -+++ linux-4.12-rc7/security/Kconfig | |
655 | +--- linux-4.12.2.orig/security/Kconfig | |
656 | ++++ linux-4.12.2/security/Kconfig | |
657 | 657 | @@ -235,5 +235,7 @@ config DEFAULT_SECURITY |
658 | 658 | default "apparmor" if DEFAULT_SECURITY_APPARMOR |
659 | 659 | default "" if DEFAULT_SECURITY_DAC |
@@ -662,8 +662,8 @@ | ||
662 | 662 | + |
663 | 663 | endmenu |
664 | 664 | |
665 | ---- linux-4.12-rc7.orig/security/Makefile | |
666 | -+++ linux-4.12-rc7/security/Makefile | |
665 | +--- linux-4.12.2.orig/security/Makefile | |
666 | ++++ linux-4.12.2/security/Makefile | |
667 | 667 | @@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
668 | 668 | # Object integrity file lists |
669 | 669 | subdir-$(CONFIG_INTEGRITY) += integrity |
@@ -671,8 +671,8 @@ | ||
671 | 671 | + |
672 | 672 | +subdir-$(CONFIG_CCSECURITY) += ccsecurity |
673 | 673 | +obj-$(CONFIG_CCSECURITY) += ccsecurity/ |
674 | ---- linux-4.12-rc7.orig/security/security.c | |
675 | -+++ linux-4.12-rc7/security/security.c | |
674 | +--- linux-4.12.2.orig/security/security.c | |
675 | ++++ linux-4.12.2/security/security.c | |
676 | 676 | @@ -943,12 +943,19 @@ int security_task_create(unsigned long c |
677 | 677 | |
678 | 678 | int security_task_alloc(struct task_struct *task, unsigned long clone_flags) |
@@ -0,0 +1,696 @@ | ||
1 | +This is TOMOYO Linux patch for kernel 4.13-rc1. | |
2 | + | |
3 | +Source code for this patch is https://git.kernel.org/torvalds/t/linux-4.13-rc1.tar.gz | |
4 | +--- | |
5 | + fs/exec.c | 2 - | |
6 | + fs/open.c | 2 + | |
7 | + fs/proc/version.c | 7 ++++ | |
8 | + include/linux/init_task.h | 9 ++++++ | |
9 | + include/linux/sched.h | 5 +++ | |
10 | + include/linux/security.h | 68 ++++++++++++++++++++++++++++------------------ | |
11 | + include/net/ip.h | 4 ++ | |
12 | + kernel/kexec.c | 4 ++ | |
13 | + kernel/module.c | 5 +++ | |
14 | + kernel/ptrace.c | 10 ++++++ | |
15 | + kernel/reboot.c | 3 ++ | |
16 | + kernel/sched/core.c | 2 + | |
17 | + kernel/signal.c | 10 ++++++ | |
18 | + kernel/sys.c | 8 +++++ | |
19 | + kernel/time/ntp.c | 8 +++++ | |
20 | + net/ipv4/raw.c | 4 ++ | |
21 | + net/ipv4/udp.c | 2 + | |
22 | + net/ipv6/raw.c | 4 ++ | |
23 | + net/ipv6/udp.c | 2 + | |
24 | + net/socket.c | 4 ++ | |
25 | + net/unix/af_unix.c | 5 +++ | |
26 | + security/Kconfig | 2 + | |
27 | + security/Makefile | 3 ++ | |
28 | + security/security.c | 9 +++++- | |
29 | + 24 files changed, 153 insertions(+), 29 deletions(-) | |
30 | + | |
31 | +--- linux-4.13-rc1.orig/fs/exec.c | |
32 | ++++ linux-4.13-rc1/fs/exec.c | |
33 | +@@ -1665,7 +1665,7 @@ static int exec_binprm(struct linux_binp | |
34 | + old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent)); | |
35 | + rcu_read_unlock(); | |
36 | + | |
37 | +- ret = search_binary_handler(bprm); | |
38 | ++ ret = ccs_search_binary_handler(bprm); | |
39 | + if (ret >= 0) { | |
40 | + audit_bprm(bprm); | |
41 | + trace_sched_process_exec(current, old_pid, bprm); | |
42 | +--- linux-4.13-rc1.orig/fs/open.c | |
43 | ++++ linux-4.13-rc1/fs/open.c | |
44 | +@@ -1171,6 +1171,8 @@ EXPORT_SYMBOL(sys_close); | |
45 | + */ | |
46 | + SYSCALL_DEFINE0(vhangup) | |
47 | + { | |
48 | ++ if (!ccs_capable(CCS_SYS_VHANGUP)) | |
49 | ++ return -EPERM; | |
50 | + if (capable(CAP_SYS_TTY_CONFIG)) { | |
51 | + tty_vhangup_self(); | |
52 | + return 0; | |
53 | +--- linux-4.13-rc1.orig/fs/proc/version.c | |
54 | ++++ linux-4.13-rc1/fs/proc/version.c | |
55 | +@@ -32,3 +32,10 @@ static int __init proc_version_init(void | |
56 | + return 0; | |
57 | + } | |
58 | + fs_initcall(proc_version_init); | |
59 | ++ | |
60 | ++static int __init ccs_show_version(void) | |
61 | ++{ | |
62 | ++ printk(KERN_INFO "Hook version: 4.13-rc1 2017/07/16\n"); | |
63 | ++ return 0; | |
64 | ++} | |
65 | ++fs_initcall(ccs_show_version); | |
66 | +--- linux-4.13-rc1.orig/include/linux/init_task.h | |
67 | ++++ linux-4.13-rc1/include/linux/init_task.h | |
68 | +@@ -225,6 +225,14 @@ extern struct cred init_cred; | |
69 | + #define INIT_TASK_SECURITY | |
70 | + #endif | |
71 | + | |
72 | ++#if defined(CONFIG_CCSECURITY) && !defined(CONFIG_CCSECURITY_USE_EXTERNAL_TASK_SECURITY) | |
73 | ++#define INIT_CCSECURITY \ | |
74 | ++ .ccs_domain_info = NULL, \ | |
75 | ++ .ccs_flags = 0, | |
76 | ++#else | |
77 | ++#define INIT_CCSECURITY | |
78 | ++#endif | |
79 | ++ | |
80 | + /* | |
81 | + * INIT_TASK is used to set up the first task table, touch at | |
82 | + * your own risk!. Base=0, limit=0x1fffff (=2MB) | |
83 | +@@ -305,6 +313,7 @@ extern struct cred init_cred; | |
84 | + INIT_KASAN(tsk) \ | |
85 | + INIT_LIVEPATCH(tsk) \ | |
86 | + INIT_TASK_SECURITY \ | |
87 | ++ INIT_CCSECURITY \ | |
88 | + } | |
89 | + | |
90 | + | |
91 | +--- linux-4.13-rc1.orig/include/linux/sched.h | |
92 | ++++ linux-4.13-rc1/include/linux/sched.h | |
93 | +@@ -32,6 +32,7 @@ struct audit_context; | |
94 | + struct backing_dev_info; | |
95 | + struct bio_list; | |
96 | + struct blk_plug; | |
97 | ++struct ccs_domain_info; | |
98 | + struct cfs_rq; | |
99 | + struct fs_struct; | |
100 | + struct futex_pi_state; | |
101 | +@@ -1079,6 +1080,10 @@ struct task_struct { | |
102 | + /* Used by LSM modules for access restriction: */ | |
103 | + void *security; | |
104 | + #endif | |
105 | ++#if defined(CONFIG_CCSECURITY) && !defined(CONFIG_CCSECURITY_USE_EXTERNAL_TASK_SECURITY) | |
106 | ++ struct ccs_domain_info *ccs_domain_info; | |
107 | ++ u32 ccs_flags; | |
108 | ++#endif | |
109 | + /* CPU-specific state of this task: */ | |
110 | + struct thread_struct thread; | |
111 | + | |
112 | +--- linux-4.13-rc1.orig/include/linux/security.h | |
113 | ++++ linux-4.13-rc1/include/linux/security.h | |
114 | +@@ -56,6 +56,7 @@ struct msg_queue; | |
115 | + struct xattr; | |
116 | + struct xfrm_sec_ctx; | |
117 | + struct mm_struct; | |
118 | ++#include <linux/ccsecurity.h> | |
119 | + | |
120 | + /* If capable should audit the security request */ | |
121 | + #define SECURITY_CAP_NOAUDIT 0 | |
122 | +@@ -507,7 +508,10 @@ static inline int security_syslog(int ty | |
123 | + static inline int security_settime64(const struct timespec64 *ts, | |
124 | + const struct timezone *tz) | |
125 | + { | |
126 | +- return cap_settime(ts, tz); | |
127 | ++ int error = cap_settime(ts, tz); | |
128 | ++ if (!error) | |
129 | ++ error = ccs_settime(ts, tz); | |
130 | ++ return error; | |
131 | + } | |
132 | + | |
133 | + static inline int security_settime(const struct timespec *ts, | |
134 | +@@ -584,18 +588,18 @@ static inline int security_sb_mount(cons | |
135 | + const char *type, unsigned long flags, | |
136 | + void *data) | |
137 | + { | |
138 | +- return 0; | |
139 | ++ return ccs_sb_mount(dev_name, path, type, flags, data); | |
140 | + } | |
141 | + | |
142 | + static inline int security_sb_umount(struct vfsmount *mnt, int flags) | |
143 | + { | |
144 | +- return 0; | |
145 | ++ return ccs_sb_umount(mnt, flags); | |
146 | + } | |
147 | + | |
148 | + static inline int security_sb_pivotroot(const struct path *old_path, | |
149 | + const struct path *new_path) | |
150 | + { | |
151 | +- return 0; | |
152 | ++ return ccs_sb_pivotroot(old_path, new_path); | |
153 | + } | |
154 | + | |
155 | + static inline int security_sb_set_mnt_opts(struct super_block *sb, | |
156 | +@@ -744,7 +748,7 @@ static inline int security_inode_setattr | |
157 | + | |
158 | + static inline int security_inode_getattr(const struct path *path) | |
159 | + { | |
160 | +- return 0; | |
161 | ++ return ccs_inode_getattr(path); | |
162 | + } | |
163 | + | |
164 | + static inline int security_inode_setxattr(struct dentry *dentry, | |
165 | +@@ -830,7 +834,7 @@ static inline void security_file_free(st | |
166 | + static inline int security_file_ioctl(struct file *file, unsigned int cmd, | |
167 | + unsigned long arg) | |
168 | + { | |
169 | +- return 0; | |
170 | ++ return ccs_file_ioctl(file, cmd, arg); | |
171 | + } | |
172 | + | |
173 | + static inline int security_mmap_file(struct file *file, unsigned long prot, | |
174 | +@@ -859,7 +863,7 @@ static inline int security_file_lock(str | |
175 | + static inline int security_file_fcntl(struct file *file, unsigned int cmd, | |
176 | + unsigned long arg) | |
177 | + { | |
178 | +- return 0; | |
179 | ++ return ccs_file_fcntl(file, cmd, arg); | |
180 | + } | |
181 | + | |
182 | + static inline void security_file_set_fowner(struct file *file) | |
183 | +@@ -882,7 +886,7 @@ static inline int security_file_receive( | |
184 | + static inline int security_file_open(struct file *file, | |
185 | + const struct cred *cred) | |
186 | + { | |
187 | +- return 0; | |
188 | ++ return ccs_file_open(file, cred); | |
189 | + } | |
190 | + | |
191 | + static inline int security_task_create(unsigned long clone_flags) | |
192 | +@@ -893,11 +897,13 @@ static inline int security_task_create(u | |
193 | + static inline int security_task_alloc(struct task_struct *task, | |
194 | + unsigned long clone_flags) | |
195 | + { | |
196 | +- return 0; | |
197 | ++ return ccs_alloc_task_security(task); | |
198 | + } | |
199 | + | |
200 | + static inline void security_task_free(struct task_struct *task) | |
201 | +-{ } | |
202 | ++{ | |
203 | ++ ccs_free_task_security(task); | |
204 | ++} | |
205 | + | |
206 | + static inline int security_cred_alloc_blank(struct cred *cred, gfp_t gfp) | |
207 | + { | |
208 | +@@ -1258,7 +1264,7 @@ static inline int security_unix_may_send | |
209 | + static inline int security_socket_create(int family, int type, | |
210 | + int protocol, int kern) | |
211 | + { | |
212 | +- return 0; | |
213 | ++ return ccs_socket_create(family, type, protocol, kern); | |
214 | + } | |
215 | + | |
216 | + static inline int security_socket_post_create(struct socket *sock, | |
217 | +@@ -1273,19 +1279,19 @@ static inline int security_socket_bind(s | |
218 | + struct sockaddr *address, | |
219 | + int addrlen) | |
220 | + { | |
221 | +- return 0; | |
222 | ++ return ccs_socket_bind(sock, address, addrlen); | |
223 | + } | |
224 | + | |
225 | + static inline int security_socket_connect(struct socket *sock, | |
226 | + struct sockaddr *address, | |
227 | + int addrlen) | |
228 | + { | |
229 | +- return 0; | |
230 | ++ return ccs_socket_connect(sock, address, addrlen); | |
231 | + } | |
232 | + | |
233 | + static inline int security_socket_listen(struct socket *sock, int backlog) | |
234 | + { | |
235 | +- return 0; | |
236 | ++ return ccs_socket_listen(sock, backlog); | |
237 | + } | |
238 | + | |
239 | + static inline int security_socket_accept(struct socket *sock, | |
240 | +@@ -1297,7 +1303,7 @@ static inline int security_socket_accept | |
241 | + static inline int security_socket_sendmsg(struct socket *sock, | |
242 | + struct msghdr *msg, int size) | |
243 | + { | |
244 | +- return 0; | |
245 | ++ return ccs_socket_sendmsg(sock, msg, size); | |
246 | + } | |
247 | + | |
248 | + static inline int security_socket_recvmsg(struct socket *sock, | |
249 | +@@ -1565,42 +1571,42 @@ int security_path_chroot(const struct pa | |
250 | + #else /* CONFIG_SECURITY_PATH */ | |
251 | + static inline int security_path_unlink(const struct path *dir, struct dentry *dentry) | |
252 | + { | |
253 | +- return 0; | |
254 | ++ return ccs_path_unlink(dir, dentry); | |
255 | + } | |
256 | + | |
257 | + static inline int security_path_mkdir(const struct path *dir, struct dentry *dentry, | |
258 | + umode_t mode) | |
259 | + { | |
260 | +- return 0; | |
261 | ++ return ccs_path_mkdir(dir, dentry, mode); | |
262 | + } | |
263 | + | |
264 | + static inline int security_path_rmdir(const struct path *dir, struct dentry *dentry) | |
265 | + { | |
266 | +- return 0; | |
267 | ++ return ccs_path_rmdir(dir, dentry); | |
268 | + } | |
269 | + | |
270 | + static inline int security_path_mknod(const struct path *dir, struct dentry *dentry, | |
271 | + umode_t mode, unsigned int dev) | |
272 | + { | |
273 | +- return 0; | |
274 | ++ return ccs_path_mknod(dir, dentry, mode, dev); | |
275 | + } | |
276 | + | |
277 | + static inline int security_path_truncate(const struct path *path) | |
278 | + { | |
279 | +- return 0; | |
280 | ++ return ccs_path_truncate(path); | |
281 | + } | |
282 | + | |
283 | + static inline int security_path_symlink(const struct path *dir, struct dentry *dentry, | |
284 | + const char *old_name) | |
285 | + { | |
286 | +- return 0; | |
287 | ++ return ccs_path_symlink(dir, dentry, old_name); | |
288 | + } | |
289 | + | |
290 | + static inline int security_path_link(struct dentry *old_dentry, | |
291 | + const struct path *new_dir, | |
292 | + struct dentry *new_dentry) | |
293 | + { | |
294 | +- return 0; | |
295 | ++ return ccs_path_link(old_dentry, new_dir, new_dentry); | |
296 | + } | |
297 | + | |
298 | + static inline int security_path_rename(const struct path *old_dir, | |
299 | +@@ -1609,22 +1615,32 @@ static inline int security_path_rename(c | |
300 | + struct dentry *new_dentry, | |
301 | + unsigned int flags) | |
302 | + { | |
303 | +- return 0; | |
304 | ++ /* | |
305 | ++ * Not using RENAME_EXCHANGE here in order to avoid KABI breakage | |
306 | ++ * by doing "#include <uapi/linux/fs.h>" . | |
307 | ++ */ | |
308 | ++ if (flags & (1 << 1)) { | |
309 | ++ int err = ccs_path_rename(new_dir, new_dentry, old_dir, | |
310 | ++ old_dentry); | |
311 | ++ if (err) | |
312 | ++ return err; | |
313 | ++ } | |
314 | ++ return ccs_path_rename(old_dir, old_dentry, new_dir, new_dentry); | |
315 | + } | |
316 | + | |
317 | + static inline int security_path_chmod(const struct path *path, umode_t mode) | |
318 | + { | |
319 | +- return 0; | |
320 | ++ return ccs_path_chmod(path, mode); | |
321 | + } | |
322 | + | |
323 | + static inline int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid) | |
324 | + { | |
325 | +- return 0; | |
326 | ++ return ccs_path_chown(path, uid, gid); | |
327 | + } | |
328 | + | |
329 | + static inline int security_path_chroot(const struct path *path) | |
330 | + { | |
331 | +- return 0; | |
332 | ++ return ccs_path_chroot(path); | |
333 | + } | |
334 | + #endif /* CONFIG_SECURITY_PATH */ | |
335 | + | |
336 | +--- linux-4.13-rc1.orig/include/net/ip.h | |
337 | ++++ linux-4.13-rc1/include/net/ip.h | |
338 | +@@ -255,6 +255,8 @@ void inet_get_local_port_range(struct ne | |
339 | + #ifdef CONFIG_SYSCTL | |
340 | + static inline int inet_is_local_reserved_port(struct net *net, int port) | |
341 | + { | |
342 | ++ if (ccs_lport_reserved(port)) | |
343 | ++ return 1; | |
344 | + if (!net->ipv4.sysctl_local_reserved_ports) | |
345 | + return 0; | |
346 | + return test_bit(port, net->ipv4.sysctl_local_reserved_ports); | |
347 | +@@ -273,6 +275,8 @@ static inline int inet_prot_sock(struct | |
348 | + #else | |
349 | + static inline int inet_is_local_reserved_port(struct net *net, int port) | |
350 | + { | |
351 | ++ if (ccs_lport_reserved(port)) | |
352 | ++ return 1; | |
353 | + return 0; | |
354 | + } | |
355 | + | |
356 | +--- linux-4.13-rc1.orig/kernel/kexec.c | |
357 | ++++ linux-4.13-rc1/kernel/kexec.c | |
358 | +@@ -17,7 +17,7 @@ | |
359 | + #include <linux/syscalls.h> | |
360 | + #include <linux/vmalloc.h> | |
361 | + #include <linux/slab.h> | |
362 | +- | |
363 | ++#include <linux/ccsecurity.h> | |
364 | + #include "kexec_internal.h" | |
365 | + | |
366 | + static int copy_user_segment_list(struct kimage *image, | |
367 | +@@ -200,6 +200,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon | |
368 | + /* We only trust the superuser with rebooting the system. */ | |
369 | + if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) | |
370 | + return -EPERM; | |
371 | ++ if (!ccs_capable(CCS_SYS_KEXEC_LOAD)) | |
372 | ++ return -EPERM; | |
373 | + | |
374 | + /* | |
375 | + * Verify we have a legal set of flags | |
376 | +--- linux-4.13-rc1.orig/kernel/module.c | |
377 | ++++ linux-4.13-rc1/kernel/module.c | |
378 | +@@ -66,6 +66,7 @@ | |
379 | + #include <linux/audit.h> | |
380 | + #include <uapi/linux/module.h> | |
381 | + #include "module-internal.h" | |
382 | ++#include <linux/ccsecurity.h> | |
383 | + | |
384 | + #define CREATE_TRACE_POINTS | |
385 | + #include <trace/events/module.h> | |
386 | +@@ -960,6 +961,8 @@ SYSCALL_DEFINE2(delete_module, const cha | |
387 | + | |
388 | + if (!capable(CAP_SYS_MODULE) || modules_disabled) | |
389 | + return -EPERM; | |
390 | ++ if (!ccs_capable(CCS_USE_KERNEL_MODULE)) | |
391 | ++ return -EPERM; | |
392 | + | |
393 | + if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0) | |
394 | + return -EFAULT; | |
395 | +@@ -3522,6 +3525,8 @@ static int may_init_module(void) | |
396 | + { | |
397 | + if (!capable(CAP_SYS_MODULE) || modules_disabled) | |
398 | + return -EPERM; | |
399 | ++ if (!ccs_capable(CCS_USE_KERNEL_MODULE)) | |
400 | ++ return -EPERM; | |
401 | + | |
402 | + return 0; | |
403 | + } | |
404 | +--- linux-4.13-rc1.orig/kernel/ptrace.c | |
405 | ++++ linux-4.13-rc1/kernel/ptrace.c | |
406 | +@@ -1125,6 +1125,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l | |
407 | + { | |
408 | + struct task_struct *child; | |
409 | + long ret; | |
410 | ++ { | |
411 | ++ const int rc = ccs_ptrace_permission(request, pid); | |
412 | ++ if (rc) | |
413 | ++ return rc; | |
414 | ++ } | |
415 | + | |
416 | + if (request == PTRACE_TRACEME) { | |
417 | + ret = ptrace_traceme(); | |
418 | +@@ -1274,6 +1279,11 @@ COMPAT_SYSCALL_DEFINE4(ptrace, compat_lo | |
419 | + { | |
420 | + struct task_struct *child; | |
421 | + long ret; | |
422 | ++ { | |
423 | ++ const int rc = ccs_ptrace_permission(request, pid); | |
424 | ++ if (rc) | |
425 | ++ return rc; | |
426 | ++ } | |
427 | + | |
428 | + if (request == PTRACE_TRACEME) { | |
429 | + ret = ptrace_traceme(); | |
430 | +--- linux-4.13-rc1.orig/kernel/reboot.c | |
431 | ++++ linux-4.13-rc1/kernel/reboot.c | |
432 | +@@ -16,6 +16,7 @@ | |
433 | + #include <linux/syscalls.h> | |
434 | + #include <linux/syscore_ops.h> | |
435 | + #include <linux/uaccess.h> | |
436 | ++#include <linux/ccsecurity.h> | |
437 | + | |
438 | + /* | |
439 | + * this indicates whether you can reboot with ctrl-alt-del: the default is yes | |
440 | +@@ -295,6 +296,8 @@ SYSCALL_DEFINE4(reboot, int, magic1, int | |
441 | + magic2 != LINUX_REBOOT_MAGIC2B && | |
442 | + magic2 != LINUX_REBOOT_MAGIC2C)) | |
443 | + return -EINVAL; | |
444 | ++ if (!ccs_capable(CCS_SYS_REBOOT)) | |
445 | ++ return -EPERM; | |
446 | + | |
447 | + /* | |
448 | + * If pid namespaces are enabled and the current task is in a child | |
449 | +--- linux-4.13-rc1.orig/kernel/sched/core.c | |
450 | ++++ linux-4.13-rc1/kernel/sched/core.c | |
451 | +@@ -3818,6 +3818,8 @@ int can_nice(const struct task_struct *p | |
452 | + SYSCALL_DEFINE1(nice, int, increment) | |
453 | + { | |
454 | + long nice, retval; | |
455 | ++ if (!ccs_capable(CCS_SYS_NICE)) | |
456 | ++ return -EPERM; | |
457 | + | |
458 | + /* | |
459 | + * Setpriority might change our priority at the same moment. | |
460 | +--- linux-4.13-rc1.orig/kernel/signal.c | |
461 | ++++ linux-4.13-rc1/kernel/signal.c | |
462 | +@@ -2911,6 +2911,8 @@ COMPAT_SYSCALL_DEFINE4(rt_sigtimedwait, | |
463 | + SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) | |
464 | + { | |
465 | + struct siginfo info; | |
466 | ++ if (ccs_kill_permission(pid, sig)) | |
467 | ++ return -EPERM; | |
468 | + | |
469 | + info.si_signo = sig; | |
470 | + info.si_errno = 0; | |
471 | +@@ -2979,6 +2981,8 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid | |
472 | + /* This is only valid for single tasks */ | |
473 | + if (pid <= 0 || tgid <= 0) | |
474 | + return -EINVAL; | |
475 | ++ if (ccs_tgkill_permission(tgid, pid, sig)) | |
476 | ++ return -EPERM; | |
477 | + | |
478 | + return do_tkill(tgid, pid, sig); | |
479 | + } | |
480 | +@@ -2995,6 +2999,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int, | |
481 | + /* This is only valid for single tasks */ | |
482 | + if (pid <= 0) | |
483 | + return -EINVAL; | |
484 | ++ if (ccs_tkill_permission(pid, sig)) | |
485 | ++ return -EPERM; | |
486 | + | |
487 | + return do_tkill(0, pid, sig); | |
488 | + } | |
489 | +@@ -3009,6 +3015,8 @@ static int do_rt_sigqueueinfo(pid_t pid, | |
490 | + return -EPERM; | |
491 | + | |
492 | + info->si_signo = sig; | |
493 | ++ if (ccs_sigqueue_permission(pid, sig)) | |
494 | ++ return -EPERM; | |
495 | + | |
496 | + /* POSIX.1b doesn't mention process groups. */ | |
497 | + return kill_proc_info(sig, info, pid); | |
498 | +@@ -3057,6 +3065,8 @@ static int do_rt_tgsigqueueinfo(pid_t tg | |
499 | + return -EPERM; | |
500 | + | |
501 | + info->si_signo = sig; | |
502 | ++ if (ccs_tgsigqueue_permission(tgid, pid, sig)) | |
503 | ++ return -EPERM; | |
504 | + | |
505 | + return do_send_specific(tgid, pid, sig, info); | |
506 | + } | |
507 | +--- linux-4.13-rc1.orig/kernel/sys.c | |
508 | ++++ linux-4.13-rc1/kernel/sys.c | |
509 | +@@ -190,6 +190,10 @@ SYSCALL_DEFINE3(setpriority, int, which, | |
510 | + | |
511 | + if (which > PRIO_USER || which < PRIO_PROCESS) | |
512 | + goto out; | |
513 | ++ if (!ccs_capable(CCS_SYS_NICE)) { | |
514 | ++ error = -EPERM; | |
515 | ++ goto out; | |
516 | ++ } | |
517 | + | |
518 | + /* normalize: avoid signed division (rounding problems) */ | |
519 | + error = -ESRCH; | |
520 | +@@ -1255,6 +1259,8 @@ SYSCALL_DEFINE2(sethostname, char __user | |
521 | + | |
522 | + if (len < 0 || len > __NEW_UTS_LEN) | |
523 | + return -EINVAL; | |
524 | ++ if (!ccs_capable(CCS_SYS_SETHOSTNAME)) | |
525 | ++ return -EPERM; | |
526 | + down_write(&uts_sem); | |
527 | + errno = -EFAULT; | |
528 | + if (!copy_from_user(tmp, name, len)) { | |
529 | +@@ -1305,6 +1311,8 @@ SYSCALL_DEFINE2(setdomainname, char __us | |
530 | + return -EPERM; | |
531 | + if (len < 0 || len > __NEW_UTS_LEN) | |
532 | + return -EINVAL; | |
533 | ++ if (!ccs_capable(CCS_SYS_SETHOSTNAME)) | |
534 | ++ return -EPERM; | |
535 | + | |
536 | + down_write(&uts_sem); | |
537 | + errno = -EFAULT; | |
538 | +--- linux-4.13-rc1.orig/kernel/time/ntp.c | |
539 | ++++ linux-4.13-rc1/kernel/time/ntp.c | |
540 | +@@ -17,6 +17,7 @@ | |
541 | + #include <linux/module.h> | |
542 | + #include <linux/rtc.h> | |
543 | + #include <linux/math64.h> | |
544 | ++#include <linux/ccsecurity.h> | |
545 | + | |
546 | + #include "ntp_internal.h" | |
547 | + #include "timekeeping_internal.h" | |
548 | +@@ -666,10 +667,15 @@ int ntp_validate_timex(struct timex *txc | |
549 | + if (!(txc->modes & ADJ_OFFSET_READONLY) && | |
550 | + !capable(CAP_SYS_TIME)) | |
551 | + return -EPERM; | |
552 | ++ if (!(txc->modes & ADJ_OFFSET_READONLY) && | |
553 | ++ !ccs_capable(CCS_SYS_SETTIME)) | |
554 | ++ return -EPERM; | |
555 | + } else { | |
556 | + /* In order to modify anything, you gotta be super-user! */ | |
557 | + if (txc->modes && !capable(CAP_SYS_TIME)) | |
558 | + return -EPERM; | |
559 | ++ if (txc->modes && !ccs_capable(CCS_SYS_SETTIME)) | |
560 | ++ return -EPERM; | |
561 | + /* | |
562 | + * if the quartz is off by more than 10% then | |
563 | + * something is VERY wrong! | |
564 | +@@ -684,6 +690,8 @@ int ntp_validate_timex(struct timex *txc | |
565 | + /* In order to inject time, you gotta be super-user! */ | |
566 | + if (!capable(CAP_SYS_TIME)) | |
567 | + return -EPERM; | |
568 | ++ if (!ccs_capable(CCS_SYS_SETTIME)) | |
569 | ++ return -EPERM; | |
570 | + | |
571 | + if (txc->modes & ADJ_NANO) { | |
572 | + struct timespec ts; | |
573 | +--- linux-4.13-rc1.orig/net/ipv4/raw.c | |
574 | ++++ linux-4.13-rc1/net/ipv4/raw.c | |
575 | +@@ -755,6 +755,10 @@ static int raw_recvmsg(struct sock *sk, | |
576 | + skb = skb_recv_datagram(sk, flags, noblock, &err); | |
577 | + if (!skb) | |
578 | + goto out; | |
579 | ++ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) { | |
580 | ++ err = -EAGAIN; /* Hope less harmful than -EPERM. */ | |
581 | ++ goto out; | |
582 | ++ } | |
583 | + | |
584 | + copied = skb->len; | |
585 | + if (len < copied) { | |
586 | +--- linux-4.13-rc1.orig/net/ipv4/udp.c | |
587 | ++++ linux-4.13-rc1/net/ipv4/udp.c | |
588 | +@@ -1575,6 +1575,8 @@ try_again: | |
589 | + skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err); | |
590 | + if (!skb) | |
591 | + return err; | |
592 | ++ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) | |
593 | ++ return -EAGAIN; /* Hope less harmful than -EPERM. */ | |
594 | + | |
595 | + ulen = udp_skb_len(skb); | |
596 | + copied = len; | |
597 | +--- linux-4.13-rc1.orig/net/ipv6/raw.c | |
598 | ++++ linux-4.13-rc1/net/ipv6/raw.c | |
599 | +@@ -480,6 +480,10 @@ static int rawv6_recvmsg(struct sock *sk | |
600 | + skb = skb_recv_datagram(sk, flags, noblock, &err); | |
601 | + if (!skb) | |
602 | + goto out; | |
603 | ++ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) { | |
604 | ++ err = -EAGAIN; /* Hope less harmful than -EPERM. */ | |
605 | ++ goto out; | |
606 | ++ } | |
607 | + | |
608 | + copied = skb->len; | |
609 | + if (copied > len) { | |
610 | +--- linux-4.13-rc1.orig/net/ipv6/udp.c | |
611 | ++++ linux-4.13-rc1/net/ipv6/udp.c | |
612 | +@@ -361,6 +361,8 @@ try_again: | |
613 | + skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err); | |
614 | + if (!skb) | |
615 | + return err; | |
616 | ++ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) | |
617 | ++ return -EAGAIN; /* Hope less harmful than -EPERM. */ | |
618 | + | |
619 | + ulen = udp_skb_len(skb); | |
620 | + copied = len; | |
621 | +--- linux-4.13-rc1.orig/net/socket.c | |
622 | ++++ linux-4.13-rc1/net/socket.c | |
623 | +@@ -1561,6 +1561,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct | |
624 | + if (err < 0) | |
625 | + goto out_fd; | |
626 | + | |
627 | ++ if (ccs_socket_post_accept_permission(sock, newsock)) { | |
628 | ++ err = -EAGAIN; /* Hope less harmful than -EPERM. */ | |
629 | ++ goto out_fd; | |
630 | ++ } | |
631 | + if (upeer_sockaddr) { | |
632 | + if (newsock->ops->getname(newsock, (struct sockaddr *)&address, | |
633 | + &len, 2) < 0) { | |
634 | +--- linux-4.13-rc1.orig/net/unix/af_unix.c | |
635 | ++++ linux-4.13-rc1/net/unix/af_unix.c | |
636 | +@@ -2152,6 +2152,10 @@ static int unix_dgram_recvmsg(struct soc | |
637 | + POLLOUT | POLLWRNORM | | |
638 | + POLLWRBAND); | |
639 | + | |
640 | ++ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) { | |
641 | ++ err = -EAGAIN; /* Hope less harmful than -EPERM. */ | |
642 | ++ goto out_unlock; | |
643 | ++ } | |
644 | + if (msg->msg_name) | |
645 | + unix_copy_addr(msg, skb->sk); | |
646 | + | |
647 | +@@ -2202,6 +2206,7 @@ static int unix_dgram_recvmsg(struct soc | |
648 | + | |
649 | + out_free: | |
650 | + skb_free_datagram(sk, skb); | |
651 | ++out_unlock: | |
652 | + mutex_unlock(&u->iolock); | |
653 | + out: | |
654 | + return err; | |
655 | +--- linux-4.13-rc1.orig/security/Kconfig | |
656 | ++++ linux-4.13-rc1/security/Kconfig | |
657 | +@@ -251,5 +251,7 @@ config DEFAULT_SECURITY | |
658 | + default "apparmor" if DEFAULT_SECURITY_APPARMOR | |
659 | + default "" if DEFAULT_SECURITY_DAC | |
660 | + | |
661 | ++source security/ccsecurity/Kconfig | |
662 | ++ | |
663 | + endmenu | |
664 | + | |
665 | +--- linux-4.13-rc1.orig/security/Makefile | |
666 | ++++ linux-4.13-rc1/security/Makefile | |
667 | +@@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c | |
668 | + # Object integrity file lists | |
669 | + subdir-$(CONFIG_INTEGRITY) += integrity | |
670 | + obj-$(CONFIG_INTEGRITY) += integrity/ | |
671 | ++ | |
672 | ++subdir-$(CONFIG_CCSECURITY) += ccsecurity | |
673 | ++obj-$(CONFIG_CCSECURITY) += ccsecurity/ | |
674 | +--- linux-4.13-rc1.orig/security/security.c | |
675 | ++++ linux-4.13-rc1/security/security.c | |
676 | +@@ -986,12 +986,19 @@ int security_task_create(unsigned long c | |
677 | + | |
678 | + int security_task_alloc(struct task_struct *task, unsigned long clone_flags) | |
679 | + { | |
680 | +- return call_int_hook(task_alloc, 0, task, clone_flags); | |
681 | ++ int ret = ccs_alloc_task_security(task); | |
682 | ++ if (ret) | |
683 | ++ return ret; | |
684 | ++ ret = call_int_hook(task_alloc, 0, task, clone_flags); | |
685 | ++ if (ret) | |
686 | ++ ccs_free_task_security(task); | |
687 | ++ return ret; | |
688 | + } | |
689 | + | |
690 | + void security_task_free(struct task_struct *task) | |
691 | + { | |
692 | + call_void_hook(task_free, task); | |
693 | ++ ccs_free_task_security(task); | |
694 | + } | |
695 | + | |
696 | + int security_cred_alloc_blank(struct cred *cred, gfp_t gfp) |
@@ -1,6 +1,6 @@ | ||
1 | -This is TOMOYO Linux patch for kernel 4.4.75. | |
1 | +This is TOMOYO Linux patch for kernel 4.4.77. | |
2 | 2 | |
3 | -Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.4.75.tar.xz | |
3 | +Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.4.77.tar.xz | |
4 | 4 | --- |
5 | 5 | fs/exec.c | 2 - |
6 | 6 | fs/open.c | 2 + |
@@ -28,8 +28,8 @@ | ||
28 | 28 | security/Makefile | 3 ++ |
29 | 29 | 24 files changed, 150 insertions(+), 26 deletions(-) |
30 | 30 | |
31 | ---- linux-4.4.75.orig/fs/exec.c | |
32 | -+++ linux-4.4.75/fs/exec.c | |
31 | +--- linux-4.4.77.orig/fs/exec.c | |
32 | ++++ linux-4.4.77/fs/exec.c | |
33 | 33 | @@ -1507,7 +1507,7 @@ static int exec_binprm(struct linux_binp |
34 | 34 | old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent)); |
35 | 35 | rcu_read_unlock(); |
@@ -39,9 +39,9 @@ | ||
39 | 39 | if (ret >= 0) { |
40 | 40 | audit_bprm(bprm); |
41 | 41 | trace_sched_process_exec(current, old_pid, bprm); |
42 | ---- linux-4.4.75.orig/fs/open.c | |
43 | -+++ linux-4.4.75/fs/open.c | |
44 | -@@ -1111,6 +1111,8 @@ EXPORT_SYMBOL(sys_close); | |
42 | +--- linux-4.4.77.orig/fs/open.c | |
43 | ++++ linux-4.4.77/fs/open.c | |
44 | +@@ -1117,6 +1117,8 @@ EXPORT_SYMBOL(sys_close); | |
45 | 45 | */ |
46 | 46 | SYSCALL_DEFINE0(vhangup) |
47 | 47 | { |
@@ -50,8 +50,8 @@ | ||
50 | 50 | if (capable(CAP_SYS_TTY_CONFIG)) { |
51 | 51 | tty_vhangup_self(); |
52 | 52 | return 0; |
53 | ---- linux-4.4.75.orig/fs/proc/version.c | |
54 | -+++ linux-4.4.75/fs/proc/version.c | |
53 | +--- linux-4.4.77.orig/fs/proc/version.c | |
54 | ++++ linux-4.4.77/fs/proc/version.c | |
55 | 55 | @@ -32,3 +32,10 @@ static int __init proc_version_init(void |
56 | 56 | return 0; |
57 | 57 | } |
@@ -59,12 +59,12 @@ | ||
59 | 59 | + |
60 | 60 | +static int __init ccs_show_version(void) |
61 | 61 | +{ |
62 | -+ printk(KERN_INFO "Hook version: 4.4.75 2017/06/29\n"); | |
62 | ++ printk(KERN_INFO "Hook version: 4.4.77 2017/07/16\n"); | |
63 | 63 | + return 0; |
64 | 64 | +} |
65 | 65 | +fs_initcall(ccs_show_version); |
66 | ---- linux-4.4.75.orig/include/linux/init_task.h | |
67 | -+++ linux-4.4.75/include/linux/init_task.h | |
66 | +--- linux-4.4.77.orig/include/linux/init_task.h | |
67 | ++++ linux-4.4.77/include/linux/init_task.h | |
68 | 68 | @@ -183,6 +183,14 @@ extern struct task_group root_task_group |
69 | 69 | # define INIT_KASAN(tsk) |
70 | 70 | #endif |
@@ -88,8 +88,8 @@ | ||
88 | 88 | } |
89 | 89 | |
90 | 90 | |
91 | ---- linux-4.4.75.orig/include/linux/sched.h | |
92 | -+++ linux-4.4.75/include/linux/sched.h | |
91 | +--- linux-4.4.77.orig/include/linux/sched.h | |
92 | ++++ linux-4.4.77/include/linux/sched.h | |
93 | 93 | @@ -6,6 +6,8 @@ |
94 | 94 | #include <linux/sched/prio.h> |
95 | 95 |
@@ -110,8 +110,8 @@ | ||
110 | 110 | /* CPU-specific state of this task */ |
111 | 111 | struct thread_struct thread; |
112 | 112 | /* |
113 | ---- linux-4.4.75.orig/include/linux/security.h | |
114 | -+++ linux-4.4.75/include/linux/security.h | |
113 | +--- linux-4.4.77.orig/include/linux/security.h | |
114 | ++++ linux-4.4.77/include/linux/security.h | |
115 | 115 | @@ -53,6 +53,7 @@ struct msg_queue; |
116 | 116 | struct xattr; |
117 | 117 | struct xfrm_sec_ctx; |
@@ -318,8 +318,8 @@ | ||
318 | 318 | } |
319 | 319 | #endif /* CONFIG_SECURITY_PATH */ |
320 | 320 | |
321 | ---- linux-4.4.75.orig/include/net/ip.h | |
322 | -+++ linux-4.4.75/include/net/ip.h | |
321 | +--- linux-4.4.77.orig/include/net/ip.h | |
322 | ++++ linux-4.4.77/include/net/ip.h | |
323 | 323 | @@ -223,6 +223,8 @@ void inet_get_local_port_range(struct ne |
324 | 324 | #ifdef CONFIG_SYSCTL |
325 | 325 | static inline int inet_is_local_reserved_port(struct net *net, int port) |
@@ -338,8 +338,8 @@ | ||
338 | 338 | return 0; |
339 | 339 | } |
340 | 340 | #endif |
341 | ---- linux-4.4.75.orig/kernel/fork.c | |
342 | -+++ linux-4.4.75/kernel/fork.c | |
341 | +--- linux-4.4.77.orig/kernel/fork.c | |
342 | ++++ linux-4.4.77/kernel/fork.c | |
343 | 343 | @@ -258,6 +258,7 @@ void __put_task_struct(struct task_struc |
344 | 344 | delayacct_tsk_free(tsk); |
345 | 345 | put_signal_struct(tsk->signal); |
@@ -366,8 +366,8 @@ | ||
366 | 366 | bad_fork_cleanup_perf: |
367 | 367 | perf_event_free_task(p); |
368 | 368 | bad_fork_cleanup_policy: |
369 | ---- linux-4.4.75.orig/kernel/kexec.c | |
370 | -+++ linux-4.4.75/kernel/kexec.c | |
369 | +--- linux-4.4.77.orig/kernel/kexec.c | |
370 | ++++ linux-4.4.77/kernel/kexec.c | |
371 | 371 | @@ -17,7 +17,7 @@ |
372 | 372 | #include <linux/syscalls.h> |
373 | 373 | #include <linux/vmalloc.h> |
@@ -386,8 +386,8 @@ | ||
386 | 386 | |
387 | 387 | /* |
388 | 388 | * Verify we have a legal set of flags |
389 | ---- linux-4.4.75.orig/kernel/module.c | |
390 | -+++ linux-4.4.75/kernel/module.c | |
389 | +--- linux-4.4.77.orig/kernel/module.c | |
390 | ++++ linux-4.4.77/kernel/module.c | |
391 | 391 | @@ -61,6 +61,7 @@ |
392 | 392 | #include <linux/bsearch.h> |
393 | 393 | #include <uapi/linux/module.h> |
@@ -414,8 +414,8 @@ | ||
414 | 414 | |
415 | 415 | return 0; |
416 | 416 | } |
417 | ---- linux-4.4.75.orig/kernel/ptrace.c | |
418 | -+++ linux-4.4.75/kernel/ptrace.c | |
417 | +--- linux-4.4.77.orig/kernel/ptrace.c | |
418 | ++++ linux-4.4.77/kernel/ptrace.c | |
419 | 419 | @@ -1085,6 +1085,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
420 | 420 | { |
421 | 421 | struct task_struct *child; |
@@ -440,8 +440,8 @@ | ||
440 | 440 | |
441 | 441 | if (request == PTRACE_TRACEME) { |
442 | 442 | ret = ptrace_traceme(); |
443 | ---- linux-4.4.75.orig/kernel/reboot.c | |
444 | -+++ linux-4.4.75/kernel/reboot.c | |
443 | +--- linux-4.4.77.orig/kernel/reboot.c | |
444 | ++++ linux-4.4.77/kernel/reboot.c | |
445 | 445 | @@ -16,6 +16,7 @@ |
446 | 446 | #include <linux/syscalls.h> |
447 | 447 | #include <linux/syscore_ops.h> |
@@ -459,8 +459,8 @@ | ||
459 | 459 | |
460 | 460 | /* |
461 | 461 | * If pid namespaces are enabled and the current task is in a child |
462 | ---- linux-4.4.75.orig/kernel/sched/core.c | |
463 | -+++ linux-4.4.75/kernel/sched/core.c | |
462 | +--- linux-4.4.77.orig/kernel/sched/core.c | |
463 | ++++ linux-4.4.77/kernel/sched/core.c | |
464 | 464 | @@ -3548,6 +3548,8 @@ int can_nice(const struct task_struct *p |
465 | 465 | SYSCALL_DEFINE1(nice, int, increment) |
466 | 466 | { |
@@ -470,8 +470,8 @@ | ||
470 | 470 | |
471 | 471 | /* |
472 | 472 | * Setpriority might change our priority at the same moment. |
473 | ---- linux-4.4.75.orig/kernel/signal.c | |
474 | -+++ linux-4.4.75/kernel/signal.c | |
473 | +--- linux-4.4.77.orig/kernel/signal.c | |
474 | ++++ linux-4.4.77/kernel/signal.c | |
475 | 475 | @@ -2855,6 +2855,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
476 | 476 | SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
477 | 477 | { |
@@ -517,8 +517,8 @@ | ||
517 | 517 | |
518 | 518 | return do_send_specific(tgid, pid, sig, info); |
519 | 519 | } |
520 | ---- linux-4.4.75.orig/kernel/sys.c | |
521 | -+++ linux-4.4.75/kernel/sys.c | |
520 | +--- linux-4.4.77.orig/kernel/sys.c | |
521 | ++++ linux-4.4.77/kernel/sys.c | |
522 | 522 | @@ -183,6 +183,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
523 | 523 | |
524 | 524 | if (which > PRIO_USER || which < PRIO_PROCESS) |
@@ -548,8 +548,8 @@ | ||
548 | 548 | |
549 | 549 | down_write(&uts_sem); |
550 | 550 | errno = -EFAULT; |
551 | ---- linux-4.4.75.orig/kernel/time/ntp.c | |
552 | -+++ linux-4.4.75/kernel/time/ntp.c | |
551 | +--- linux-4.4.77.orig/kernel/time/ntp.c | |
552 | ++++ linux-4.4.77/kernel/time/ntp.c | |
553 | 553 | @@ -16,6 +16,7 @@ |
554 | 554 | #include <linux/mm.h> |
555 | 555 | #include <linux/module.h> |
@@ -583,8 +583,8 @@ | ||
583 | 583 | |
584 | 584 | if (txc->modes & ADJ_NANO) { |
585 | 585 | struct timespec ts; |
586 | ---- linux-4.4.75.orig/net/ipv4/raw.c | |
587 | -+++ linux-4.4.75/net/ipv4/raw.c | |
586 | +--- linux-4.4.77.orig/net/ipv4/raw.c | |
587 | ++++ linux-4.4.77/net/ipv4/raw.c | |
588 | 588 | @@ -742,6 +742,10 @@ static int raw_recvmsg(struct sock *sk, |
589 | 589 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
590 | 590 | if (!skb) |
@@ -596,8 +596,8 @@ | ||
596 | 596 | |
597 | 597 | copied = skb->len; |
598 | 598 | if (len < copied) { |
599 | ---- linux-4.4.75.orig/net/ipv4/udp.c | |
600 | -+++ linux-4.4.75/net/ipv4/udp.c | |
599 | +--- linux-4.4.77.orig/net/ipv4/udp.c | |
600 | ++++ linux-4.4.77/net/ipv4/udp.c | |
601 | 601 | @@ -1286,6 +1286,10 @@ try_again: |
602 | 602 | &peeked, &off, &err); |
603 | 603 | if (!skb) |
@@ -609,8 +609,8 @@ | ||
609 | 609 | |
610 | 610 | ulen = skb->len - sizeof(struct udphdr); |
611 | 611 | copied = len; |
612 | ---- linux-4.4.75.orig/net/ipv6/raw.c | |
613 | -+++ linux-4.4.75/net/ipv6/raw.c | |
612 | +--- linux-4.4.77.orig/net/ipv6/raw.c | |
613 | ++++ linux-4.4.77/net/ipv6/raw.c | |
614 | 614 | @@ -478,6 +478,10 @@ static int rawv6_recvmsg(struct sock *sk |
615 | 615 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
616 | 616 | if (!skb) |
@@ -622,8 +622,8 @@ | ||
622 | 622 | |
623 | 623 | copied = skb->len; |
624 | 624 | if (copied > len) { |
625 | ---- linux-4.4.75.orig/net/ipv6/udp.c | |
626 | -+++ linux-4.4.75/net/ipv6/udp.c | |
625 | +--- linux-4.4.77.orig/net/ipv6/udp.c | |
626 | ++++ linux-4.4.77/net/ipv6/udp.c | |
627 | 627 | @@ -417,6 +417,10 @@ try_again: |
628 | 628 | &peeked, &off, &err); |
629 | 629 | if (!skb) |
@@ -635,8 +635,8 @@ | ||
635 | 635 | |
636 | 636 | ulen = skb->len - sizeof(struct udphdr); |
637 | 637 | copied = len; |
638 | ---- linux-4.4.75.orig/net/socket.c | |
639 | -+++ linux-4.4.75/net/socket.c | |
638 | +--- linux-4.4.77.orig/net/socket.c | |
639 | ++++ linux-4.4.77/net/socket.c | |
640 | 640 | @@ -1476,6 +1476,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct |
641 | 641 | if (err < 0) |
642 | 642 | goto out_fd; |
@@ -648,9 +648,9 @@ | ||
648 | 648 | if (upeer_sockaddr) { |
649 | 649 | if (newsock->ops->getname(newsock, (struct sockaddr *)&address, |
650 | 650 | &len, 2) < 0) { |
651 | ---- linux-4.4.75.orig/net/unix/af_unix.c | |
652 | -+++ linux-4.4.75/net/unix/af_unix.c | |
653 | -@@ -2139,6 +2139,10 @@ static int unix_dgram_recvmsg(struct soc | |
651 | +--- linux-4.4.77.orig/net/unix/af_unix.c | |
652 | ++++ linux-4.4.77/net/unix/af_unix.c | |
653 | +@@ -2144,6 +2144,10 @@ static int unix_dgram_recvmsg(struct soc | |
654 | 654 | wake_up_interruptible_sync_poll(&u->peer_wait, |
655 | 655 | POLLOUT | POLLWRNORM | POLLWRBAND); |
656 | 656 |
@@ -661,8 +661,8 @@ | ||
661 | 661 | if (msg->msg_name) |
662 | 662 | unix_copy_addr(msg, skb->sk); |
663 | 663 | |
664 | ---- linux-4.4.75.orig/security/Kconfig | |
665 | -+++ linux-4.4.75/security/Kconfig | |
664 | +--- linux-4.4.77.orig/security/Kconfig | |
665 | ++++ linux-4.4.77/security/Kconfig | |
666 | 666 | @@ -163,5 +163,7 @@ config DEFAULT_SECURITY |
667 | 667 | default "apparmor" if DEFAULT_SECURITY_APPARMOR |
668 | 668 | default "" if DEFAULT_SECURITY_DAC |
@@ -671,8 +671,8 @@ | ||
671 | 671 | + |
672 | 672 | endmenu |
673 | 673 | |
674 | ---- linux-4.4.75.orig/security/Makefile | |
675 | -+++ linux-4.4.75/security/Makefile | |
674 | +--- linux-4.4.77.orig/security/Makefile | |
675 | ++++ linux-4.4.77/security/Makefile | |
676 | 676 | @@ -27,3 +27,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
677 | 677 | # Object integrity file lists |
678 | 678 | subdir-$(CONFIG_INTEGRITY) += integrity |
@@ -1,6 +1,6 @@ | ||
1 | -This is TOMOYO Linux patch for kernel 4.9.35. | |
1 | +This is TOMOYO Linux patch for kernel 4.9.38. | |
2 | 2 | |
3 | -Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.9.35.tar.xz | |
3 | +Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.9.38.tar.xz | |
4 | 4 | --- |
5 | 5 | fs/exec.c | 2 - |
6 | 6 | fs/open.c | 2 + |
@@ -28,8 +28,8 @@ | ||
28 | 28 | security/Makefile | 3 ++ |
29 | 29 | 24 files changed, 147 insertions(+), 26 deletions(-) |
30 | 30 | |
31 | ---- linux-4.9.35.orig/fs/exec.c | |
32 | -+++ linux-4.9.35/fs/exec.c | |
31 | +--- linux-4.9.38.orig/fs/exec.c | |
32 | ++++ linux-4.9.38/fs/exec.c | |
33 | 33 | @@ -1660,7 +1660,7 @@ static int exec_binprm(struct linux_binp |
34 | 34 | old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent)); |
35 | 35 | rcu_read_unlock(); |
@@ -39,9 +39,9 @@ | ||
39 | 39 | if (ret >= 0) { |
40 | 40 | audit_bprm(bprm); |
41 | 41 | trace_sched_process_exec(current, old_pid, bprm); |
42 | ---- linux-4.9.35.orig/fs/open.c | |
43 | -+++ linux-4.9.35/fs/open.c | |
44 | -@@ -1145,6 +1145,8 @@ EXPORT_SYMBOL(sys_close); | |
42 | +--- linux-4.9.38.orig/fs/open.c | |
43 | ++++ linux-4.9.38/fs/open.c | |
44 | +@@ -1151,6 +1151,8 @@ EXPORT_SYMBOL(sys_close); | |
45 | 45 | */ |
46 | 46 | SYSCALL_DEFINE0(vhangup) |
47 | 47 | { |
@@ -50,8 +50,8 @@ | ||
50 | 50 | if (capable(CAP_SYS_TTY_CONFIG)) { |
51 | 51 | tty_vhangup_self(); |
52 | 52 | return 0; |
53 | ---- linux-4.9.35.orig/fs/proc/version.c | |
54 | -+++ linux-4.9.35/fs/proc/version.c | |
53 | +--- linux-4.9.38.orig/fs/proc/version.c | |
54 | ++++ linux-4.9.38/fs/proc/version.c | |
55 | 55 | @@ -32,3 +32,10 @@ static int __init proc_version_init(void |
56 | 56 | return 0; |
57 | 57 | } |
@@ -59,12 +59,12 @@ | ||
59 | 59 | + |
60 | 60 | +static int __init ccs_show_version(void) |
61 | 61 | +{ |
62 | -+ printk(KERN_INFO "Hook version: 4.9.35 2017/06/29\n"); | |
62 | ++ printk(KERN_INFO "Hook version: 4.9.38 2017/07/16\n"); | |
63 | 63 | + return 0; |
64 | 64 | +} |
65 | 65 | +fs_initcall(ccs_show_version); |
66 | ---- linux-4.9.35.orig/include/linux/init_task.h | |
67 | -+++ linux-4.9.35/include/linux/init_task.h | |
66 | +--- linux-4.9.38.orig/include/linux/init_task.h | |
67 | ++++ linux-4.9.38/include/linux/init_task.h | |
68 | 68 | @@ -193,6 +193,14 @@ extern struct task_group root_task_group |
69 | 69 | # define INIT_TASK_TI(tsk) |
70 | 70 | #endif |
@@ -88,8 +88,8 @@ | ||
88 | 88 | } |
89 | 89 | |
90 | 90 | |
91 | ---- linux-4.9.35.orig/include/linux/sched.h | |
92 | -+++ linux-4.9.35/include/linux/sched.h | |
91 | +--- linux-4.9.38.orig/include/linux/sched.h | |
92 | ++++ linux-4.9.38/include/linux/sched.h | |
93 | 93 | @@ -6,6 +6,8 @@ |
94 | 94 | #include <linux/sched/prio.h> |
95 | 95 |
@@ -110,8 +110,8 @@ | ||
110 | 110 | /* CPU-specific state of this task */ |
111 | 111 | struct thread_struct thread; |
112 | 112 | /* |
113 | ---- linux-4.9.35.orig/include/linux/security.h | |
114 | -+++ linux-4.9.35/include/linux/security.h | |
113 | +--- linux-4.9.38.orig/include/linux/security.h | |
114 | ++++ linux-4.9.38/include/linux/security.h | |
115 | 115 | @@ -55,6 +55,7 @@ struct msg_queue; |
116 | 116 | struct xattr; |
117 | 117 | struct xfrm_sec_ctx; |
@@ -318,8 +318,8 @@ | ||
318 | 318 | } |
319 | 319 | #endif /* CONFIG_SECURITY_PATH */ |
320 | 320 | |
321 | ---- linux-4.9.35.orig/include/net/ip.h | |
322 | -+++ linux-4.9.35/include/net/ip.h | |
321 | +--- linux-4.9.38.orig/include/net/ip.h | |
322 | ++++ linux-4.9.38/include/net/ip.h | |
323 | 323 | @@ -252,6 +252,8 @@ void inet_get_local_port_range(struct ne |
324 | 324 | #ifdef CONFIG_SYSCTL |
325 | 325 | static inline int inet_is_local_reserved_port(struct net *net, int port) |
@@ -338,8 +338,8 @@ | ||
338 | 338 | return 0; |
339 | 339 | } |
340 | 340 | #endif |
341 | ---- linux-4.9.35.orig/kernel/fork.c | |
342 | -+++ linux-4.9.35/kernel/fork.c | |
341 | +--- linux-4.9.38.orig/kernel/fork.c | |
342 | ++++ linux-4.9.38/kernel/fork.c | |
343 | 343 | @@ -390,6 +390,7 @@ void __put_task_struct(struct task_struc |
344 | 344 | delayacct_tsk_free(tsk); |
345 | 345 | put_signal_struct(tsk->signal); |
@@ -366,8 +366,8 @@ | ||
366 | 366 | bad_fork_cleanup_perf: |
367 | 367 | perf_event_free_task(p); |
368 | 368 | bad_fork_cleanup_policy: |
369 | ---- linux-4.9.35.orig/kernel/kexec.c | |
370 | -+++ linux-4.9.35/kernel/kexec.c | |
369 | +--- linux-4.9.38.orig/kernel/kexec.c | |
370 | ++++ linux-4.9.38/kernel/kexec.c | |
371 | 371 | @@ -17,7 +17,7 @@ |
372 | 372 | #include <linux/syscalls.h> |
373 | 373 | #include <linux/vmalloc.h> |
@@ -386,8 +386,8 @@ | ||
386 | 386 | |
387 | 387 | /* |
388 | 388 | * Verify we have a legal set of flags |
389 | ---- linux-4.9.35.orig/kernel/module.c | |
390 | -+++ linux-4.9.35/kernel/module.c | |
389 | +--- linux-4.9.38.orig/kernel/module.c | |
390 | ++++ linux-4.9.38/kernel/module.c | |
391 | 391 | @@ -63,6 +63,7 @@ |
392 | 392 | #include <linux/dynamic_debug.h> |
393 | 393 | #include <uapi/linux/module.h> |
@@ -414,8 +414,8 @@ | ||
414 | 414 | |
415 | 415 | return 0; |
416 | 416 | } |
417 | ---- linux-4.9.35.orig/kernel/ptrace.c | |
418 | -+++ linux-4.9.35/kernel/ptrace.c | |
417 | +--- linux-4.9.38.orig/kernel/ptrace.c | |
418 | ++++ linux-4.9.38/kernel/ptrace.c | |
419 | 419 | @@ -1122,6 +1122,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
420 | 420 | { |
421 | 421 | struct task_struct *child; |
@@ -440,8 +440,8 @@ | ||
440 | 440 | |
441 | 441 | if (request == PTRACE_TRACEME) { |
442 | 442 | ret = ptrace_traceme(); |
443 | ---- linux-4.9.35.orig/kernel/reboot.c | |
444 | -+++ linux-4.9.35/kernel/reboot.c | |
443 | +--- linux-4.9.38.orig/kernel/reboot.c | |
444 | ++++ linux-4.9.38/kernel/reboot.c | |
445 | 445 | @@ -16,6 +16,7 @@ |
446 | 446 | #include <linux/syscalls.h> |
447 | 447 | #include <linux/syscore_ops.h> |
@@ -459,8 +459,8 @@ | ||
459 | 459 | |
460 | 460 | /* |
461 | 461 | * If pid namespaces are enabled and the current task is in a child |
462 | ---- linux-4.9.35.orig/kernel/sched/core.c | |
463 | -+++ linux-4.9.35/kernel/sched/core.c | |
462 | +--- linux-4.9.38.orig/kernel/sched/core.c | |
463 | ++++ linux-4.9.38/kernel/sched/core.c | |
464 | 464 | @@ -3811,6 +3811,8 @@ int can_nice(const struct task_struct *p |
465 | 465 | SYSCALL_DEFINE1(nice, int, increment) |
466 | 466 | { |
@@ -470,8 +470,8 @@ | ||
470 | 470 | |
471 | 471 | /* |
472 | 472 | * Setpriority might change our priority at the same moment. |
473 | ---- linux-4.9.35.orig/kernel/signal.c | |
474 | -+++ linux-4.9.35/kernel/signal.c | |
473 | +--- linux-4.9.38.orig/kernel/signal.c | |
474 | ++++ linux-4.9.38/kernel/signal.c | |
475 | 475 | @@ -2855,6 +2855,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
476 | 476 | SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
477 | 477 | { |
@@ -517,8 +517,8 @@ | ||
517 | 517 | |
518 | 518 | return do_send_specific(tgid, pid, sig, info); |
519 | 519 | } |
520 | ---- linux-4.9.35.orig/kernel/sys.c | |
521 | -+++ linux-4.9.35/kernel/sys.c | |
520 | +--- linux-4.9.38.orig/kernel/sys.c | |
521 | ++++ linux-4.9.38/kernel/sys.c | |
522 | 522 | @@ -183,6 +183,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
523 | 523 | |
524 | 524 | if (which > PRIO_USER || which < PRIO_PROCESS) |
@@ -548,8 +548,8 @@ | ||
548 | 548 | |
549 | 549 | down_write(&uts_sem); |
550 | 550 | errno = -EFAULT; |
551 | ---- linux-4.9.35.orig/kernel/time/ntp.c | |
552 | -+++ linux-4.9.35/kernel/time/ntp.c | |
551 | +--- linux-4.9.38.orig/kernel/time/ntp.c | |
552 | ++++ linux-4.9.38/kernel/time/ntp.c | |
553 | 553 | @@ -17,6 +17,7 @@ |
554 | 554 | #include <linux/module.h> |
555 | 555 | #include <linux/rtc.h> |
@@ -583,8 +583,8 @@ | ||
583 | 583 | |
584 | 584 | if (txc->modes & ADJ_NANO) { |
585 | 585 | struct timespec ts; |
586 | ---- linux-4.9.35.orig/net/ipv4/raw.c | |
587 | -+++ linux-4.9.35/net/ipv4/raw.c | |
586 | +--- linux-4.9.38.orig/net/ipv4/raw.c | |
587 | ++++ linux-4.9.38/net/ipv4/raw.c | |
588 | 588 | @@ -739,6 +739,10 @@ static int raw_recvmsg(struct sock *sk, |
589 | 589 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
590 | 590 | if (!skb) |
@@ -596,8 +596,8 @@ | ||
596 | 596 | |
597 | 597 | copied = skb->len; |
598 | 598 | if (len < copied) { |
599 | ---- linux-4.9.35.orig/net/ipv4/udp.c | |
600 | -+++ linux-4.9.35/net/ipv4/udp.c | |
599 | +--- linux-4.9.38.orig/net/ipv4/udp.c | |
600 | ++++ linux-4.9.38/net/ipv4/udp.c | |
601 | 601 | @@ -1267,6 +1267,8 @@ try_again: |
602 | 602 | &peeked, &off, &err); |
603 | 603 | if (!skb) |
@@ -607,8 +607,8 @@ | ||
607 | 607 | |
608 | 608 | ulen = skb->len; |
609 | 609 | copied = len; |
610 | ---- linux-4.9.35.orig/net/ipv6/raw.c | |
611 | -+++ linux-4.9.35/net/ipv6/raw.c | |
610 | +--- linux-4.9.38.orig/net/ipv6/raw.c | |
611 | ++++ linux-4.9.38/net/ipv6/raw.c | |
612 | 612 | @@ -478,6 +478,10 @@ static int rawv6_recvmsg(struct sock *sk |
613 | 613 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
614 | 614 | if (!skb) |
@@ -620,8 +620,8 @@ | ||
620 | 620 | |
621 | 621 | copied = skb->len; |
622 | 622 | if (copied > len) { |
623 | ---- linux-4.9.35.orig/net/ipv6/udp.c | |
624 | -+++ linux-4.9.35/net/ipv6/udp.c | |
623 | +--- linux-4.9.38.orig/net/ipv6/udp.c | |
624 | ++++ linux-4.9.38/net/ipv6/udp.c | |
625 | 625 | @@ -348,6 +348,8 @@ try_again: |
626 | 626 | &peeked, &off, &err); |
627 | 627 | if (!skb) |
@@ -631,8 +631,8 @@ | ||
631 | 631 | |
632 | 632 | ulen = skb->len; |
633 | 633 | copied = len; |
634 | ---- linux-4.9.35.orig/net/socket.c | |
635 | -+++ linux-4.9.35/net/socket.c | |
634 | +--- linux-4.9.38.orig/net/socket.c | |
635 | ++++ linux-4.9.38/net/socket.c | |
636 | 636 | @@ -1481,6 +1481,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct |
637 | 637 | if (err < 0) |
638 | 638 | goto out_fd; |
@@ -644,9 +644,9 @@ | ||
644 | 644 | if (upeer_sockaddr) { |
645 | 645 | if (newsock->ops->getname(newsock, (struct sockaddr *)&address, |
646 | 646 | &len, 2) < 0) { |
647 | ---- linux-4.9.35.orig/net/unix/af_unix.c | |
648 | -+++ linux-4.9.35/net/unix/af_unix.c | |
649 | -@@ -2145,6 +2145,10 @@ static int unix_dgram_recvmsg(struct soc | |
647 | +--- linux-4.9.38.orig/net/unix/af_unix.c | |
648 | ++++ linux-4.9.38/net/unix/af_unix.c | |
649 | +@@ -2150,6 +2150,10 @@ static int unix_dgram_recvmsg(struct soc | |
650 | 650 | POLLOUT | POLLWRNORM | |
651 | 651 | POLLWRBAND); |
652 | 652 |
@@ -657,7 +657,7 @@ | ||
657 | 657 | if (msg->msg_name) |
658 | 658 | unix_copy_addr(msg, skb->sk); |
659 | 659 | |
660 | -@@ -2195,6 +2199,7 @@ static int unix_dgram_recvmsg(struct soc | |
660 | +@@ -2200,6 +2204,7 @@ static int unix_dgram_recvmsg(struct soc | |
661 | 661 | |
662 | 662 | out_free: |
663 | 663 | skb_free_datagram(sk, skb); |
@@ -665,8 +665,8 @@ | ||
665 | 665 | mutex_unlock(&u->iolock); |
666 | 666 | out: |
667 | 667 | return err; |
668 | ---- linux-4.9.35.orig/security/Kconfig | |
669 | -+++ linux-4.9.35/security/Kconfig | |
668 | +--- linux-4.9.38.orig/security/Kconfig | |
669 | ++++ linux-4.9.38/security/Kconfig | |
670 | 670 | @@ -204,5 +204,7 @@ config DEFAULT_SECURITY |
671 | 671 | default "apparmor" if DEFAULT_SECURITY_APPARMOR |
672 | 672 | default "" if DEFAULT_SECURITY_DAC |
@@ -675,8 +675,8 @@ | ||
675 | 675 | + |
676 | 676 | endmenu |
677 | 677 | |
678 | ---- linux-4.9.35.orig/security/Makefile | |
679 | -+++ linux-4.9.35/security/Makefile | |
678 | +--- linux-4.9.38.orig/security/Makefile | |
679 | ++++ linux-4.9.38/security/Makefile | |
680 | 680 | @@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
681 | 681 | # Object integrity file lists |
682 | 682 | subdir-$(CONFIG_INTEGRITY) += integrity |
@@ -10,17 +10,17 @@ | ||
10 | 10 | |
11 | 11 | cd /tmp/ || die "Can't chdir to /tmp/ ." |
12 | 12 | |
13 | -if [ ! -r kernel-2.6.32-696.3.2.el6.src.rpm ] | |
13 | +if [ ! -r kernel-2.6.32-696.6.3.el6.src.rpm ] | |
14 | 14 | then |
15 | - wget http://vault.centos.org/6.9/updates/Source/SPackages/kernel-2.6.32-696.3.2.el6.src.rpm || die "Can't download source package." | |
15 | + wget http://vault.centos.org/6.9/updates/Source/SPackages/kernel-2.6.32-696.6.3.el6.src.rpm || die "Can't download source package." | |
16 | 16 | fi |
17 | -LANG=C rpm --checksig kernel-2.6.32-696.3.2.el6.src.rpm | grep -F ': rsa sha1 (md5) pgp md5 OK' || die "Can't verify signature." | |
18 | -rpm -ivh kernel-2.6.32-696.3.2.el6.src.rpm || die "Can't install source package." | |
17 | +LANG=C rpm --checksig kernel-2.6.32-696.6.3.el6.src.rpm | grep -F ': rsa sha1 (md5) pgp md5 OK' || die "Can't verify signature." | |
18 | +rpm -ivh kernel-2.6.32-696.6.3.el6.src.rpm || die "Can't install source package." | |
19 | 19 | |
20 | 20 | cd ~/rpmbuild/SOURCES/ || die "Can't chdir to ~/rpmbuild/SOURCES/ ." |
21 | -if [ ! -r caitsith-patch-0.2-20170515.tar.gz ] | |
21 | +if [ ! -r caitsith-patch-0.2-20170716.tar.gz ] | |
22 | 22 | then |
23 | - wget -O caitsith-patch-0.2-20170515.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170515.tar.gz' || die "Can't download patch." | |
23 | + wget -O caitsith-patch-0.2-20170716.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170716.tar.gz' || die "Can't download patch." | |
24 | 24 | fi |
25 | 25 | |
26 | 26 | cd ~/rpmbuild/SPECS/ || die "Can't chdir to ~/rpmbuild/SPECS/ ." |
@@ -35,7 +35,7 @@ | ||
35 | 35 | -# % define buildid .local |
36 | 36 | +%define buildid _caitsith_0.2.1 |
37 | 37 | |
38 | - %define distro_build 696.3.2 | |
38 | + %define distro_build 696.6.3 | |
39 | 39 | %define signmodules 1 |
40 | 40 | @@ -437,7 +437,7 @@ |
41 | 41 | # Packages that need to be installed before the kernel is, because the %post |
@@ -69,7 +69,7 @@ | ||
69 | 69 | ApplyOptionalPatch linux-kernel-test.patch |
70 | 70 | |
71 | 71 | +# CaitSith |
72 | -+tar -zxf %_sourcedir/caitsith-patch-0.2-20170515.tar.gz | |
72 | ++tar -zxf %_sourcedir/caitsith-patch-0.2-20170716.tar.gz | |
73 | 73 | +sed -i -e 's/CCSECURITY/CAITSITH/g' -e 's/ccsecurity/caitsith/g' -e 's/ccs_domain_info/cs_domain_info/g' -e 's/ccs_flags/cs_flags/g' patches/ccs-patch-*.diff |
74 | 74 | +patch -sp1 < patches/ccs-patch-2.6.32-centos-6.diff |
75 | 75 | # Any further pre-build tree manipulations happen here. |
@@ -10,17 +10,17 @@ | ||
10 | 10 | |
11 | 11 | cd /tmp/ || die "Can't chdir to /tmp/ ." |
12 | 12 | |
13 | -if [ ! -r kernel-3.10.0-514.26.1.el7.src.rpm ] | |
13 | +if [ ! -r kernel-3.10.0-514.26.2.el7.src.rpm ] | |
14 | 14 | then |
15 | - wget http://vault.centos.org/centos/7/updates/Source/SPackages/kernel-3.10.0-514.26.1.el7.src.rpm || die "Can't download source package." | |
15 | + wget http://vault.centos.org/centos/7/updates/Source/SPackages/kernel-3.10.0-514.26.2.el7.src.rpm || die "Can't download source package." | |
16 | 16 | fi |
17 | -LANG=C rpm --checksig kernel-3.10.0-514.26.1.el7.src.rpm | grep -F ': rsa sha1 (md5) pgp md5 OK' || die "Can't verify signature." | |
18 | -rpm -ivh kernel-3.10.0-514.26.1.el7.src.rpm || die "Can't install source package." | |
17 | +LANG=C rpm --checksig kernel-3.10.0-514.26.2.el7.src.rpm | grep -F ': rsa sha1 (md5) pgp md5 OK' || die "Can't verify signature." | |
18 | +rpm -ivh kernel-3.10.0-514.26.2.el7.src.rpm || die "Can't install source package." | |
19 | 19 | |
20 | 20 | cd ~/rpmbuild/SOURCES/ || die "Can't chdir to ~/rpmbuild/SOURCES/ ." |
21 | -if [ ! -r caitsith-patch-0.2-20170515.tar.gz ] | |
21 | +if [ ! -r caitsith-patch-0.2-20170716.tar.gz ] | |
22 | 22 | then |
23 | - wget -O caitsith-patch-0.2-20170515.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170515.tar.gz' || die "Can't download patch." | |
23 | + wget -O caitsith-patch-0.2-20170716.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170716.tar.gz' || die "Can't download patch." | |
24 | 24 | fi |
25 | 25 | |
26 | 26 | cd ~/rpmbuild/SPECS/ || die "Can't chdir to ~/rpmbuild/SPECS/ ." |
@@ -69,7 +69,7 @@ | ||
69 | 69 | ApplyOptionalPatch debrand-rh-i686-cpu.patch |
70 | 70 | |
71 | 71 | +# CaitSith |
72 | -+tar -zxf %_sourcedir/caitsith-patch-0.2-20170515.tar.gz | |
72 | ++tar -zxf %_sourcedir/caitsith-patch-0.2-20170716.tar.gz | |
73 | 73 | +sed -i -e 's/CCSECURITY/CAITSITH/g' -e 's/ccsecurity/caitsith/g' -e 's/ccs_domain_info/cs_domain_info/g' -e 's/ccs_flags/cs_flags/g' patches/ccs-patch-*.diff |
74 | 74 | +patch -sp1 < patches/ccs-patch-3.10-centos-7.diff |
75 | 75 | # Any further pre-build tree manipulations happen here. |
@@ -23,10 +23,10 @@ | ||
23 | 23 | # Download CaitSith patches. |
24 | 24 | mkdir -p ~/rpmbuild/SOURCES/ |
25 | 25 | cd ~/rpmbuild/SOURCES/ || die "Can't chdir to ~/rpmbuild/SOURCES/ ." |
26 | -if [ ! -r caitsith-patch-0.2-20170515.tar.gz ] | |
26 | +if [ ! -r caitsith-patch-0.2-20170716.tar.gz ] | |
27 | 27 | then |
28 | 28 | apt-get -y install wget |
29 | - wget -O caitsith-patch-0.2-20170515.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170515.tar.gz' || die "Can't download patch." | |
29 | + wget -O caitsith-patch-0.2-20170716.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170716.tar.gz' || die "Can't download patch." | |
30 | 30 | fi |
31 | 31 | |
32 | 32 | # Install kernel source packages. |
@@ -38,7 +38,7 @@ | ||
38 | 38 | |
39 | 39 | # Apply patches and create kernel config. |
40 | 40 | cd linux-source-3.2 || die "Can't chdir to linux-source-3.2/ ." |
41 | -tar -zxf ~/rpmbuild/SOURCES/caitsith-patch-0.2-20170515.tar.gz || die "Can't extract patch." | |
41 | +tar -zxf ~/rpmbuild/SOURCES/caitsith-patch-0.2-20170716.tar.gz || die "Can't extract patch." | |
42 | 42 | sed -i -e 's/CCSECURITY/CAITSITH/g' -e 's/ccsecurity/caitsith/g' -e 's/ccs_domain_info/cs_domain_info/g' -e 's/ccs_flags/cs_flags/g' patches/ccs-patch-*.diff |
43 | 43 | patch -p1 < patches/ccs-patch-3.2-debian-wheezy.diff || die "Can't apply patch." |
44 | 44 | cat /boot/config-3.2.0-$ABI_VERSION-$ORIGINAL_FLAVOUR config.caitsith > .config || die "Can't create config." |
@@ -29,9 +29,9 @@ | ||
29 | 29 | # Download CaitSith patches. |
30 | 30 | mkdir -p ~/rpmbuild/SOURCES/ |
31 | 31 | cd ~/rpmbuild/SOURCES/ || die "Can't chdir to ~/rpmbuild/SOURCES/ ." |
32 | -if [ ! -r caitsith-patch-0.2-20170515.tar.gz ] | |
32 | +if [ ! -r caitsith-patch-0.2-20170716.tar.gz ] | |
33 | 33 | then |
34 | - wget -O caitsith-patch-0.2-20170515.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170515.tar.gz' || die "Can't download patch." | |
34 | + wget -O caitsith-patch-0.2-20170716.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170716.tar.gz' || die "Can't download patch." | |
35 | 35 | fi |
36 | 36 | |
37 | 37 | # Install kernel source packages. |
@@ -44,7 +44,7 @@ | ||
44 | 44 | # Apply patches and create kernel config. |
45 | 45 | cd linux-3.2.0/ || die "Can't chdir to linux-3.2.0/ ." |
46 | 46 | update_maintainer |
47 | -tar -zxf ~/rpmbuild/SOURCES/caitsith-patch-0.2-20170515.tar.gz || die "Can't extract patch." | |
47 | +tar -zxf ~/rpmbuild/SOURCES/caitsith-patch-0.2-20170716.tar.gz || die "Can't extract patch." | |
48 | 48 | sed -i -e 's/CCSECURITY/CAITSITH/g' -e 's/ccsecurity/caitsith/g' -e 's/ccs_domain_info/cs_domain_info/g' -e 's/ccs_flags/cs_flags/g' patches/ccs-patch-*.diff |
49 | 49 | patch -p1 < patches/ccs-patch-3.2-ubuntu-12.04.diff || die "Can't apply patch." |
50 | 50 | rm -fR patches/ specs/ || die "Can't delete patch." |
@@ -29,9 +29,9 @@ | ||
29 | 29 | # Download CaitSith patches. |
30 | 30 | mkdir -p ~/rpmbuild/SOURCES/ |
31 | 31 | cd ~/rpmbuild/SOURCES/ || die "Can't chdir to ~/rpmbuild/SOURCES/ ." |
32 | -if [ ! -r caitsith-patch-0.2-20170515.tar.gz ] | |
32 | +if [ ! -r caitsith-patch-0.2-20170716.tar.gz ] | |
33 | 33 | then |
34 | - wget -O caitsith-patch-0.2-20170515.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170515.tar.gz' || die "Can't download patch." | |
34 | + wget -O caitsith-patch-0.2-20170716.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170716.tar.gz' || die "Can't download patch." | |
35 | 35 | fi |
36 | 36 | |
37 | 37 | # Install kernel source packages. |
@@ -44,7 +44,7 @@ | ||
44 | 44 | # Apply patches and create kernel config. |
45 | 45 | cd linux-3.13.0/ || die "Can't chdir to linux-3.13.0/ ." |
46 | 46 | update_maintainer |
47 | -tar -zxf ~/rpmbuild/SOURCES/caitsith-patch-0.2-20170515.tar.gz || die "Can't extract patch." | |
47 | +tar -zxf ~/rpmbuild/SOURCES/caitsith-patch-0.2-20170716.tar.gz || die "Can't extract patch." | |
48 | 48 | sed -i -e 's/CCSECURITY/CAITSITH/g' -e 's/ccsecurity/caitsith/g' -e 's/ccs_domain_info/cs_domain_info/g' -e 's/ccs_flags/cs_flags/g' patches/ccs-patch-*.diff |
49 | 49 | patch -p1 < patches/ccs-patch-3.13-ubuntu-14.04.diff || die "Can't apply patch." |
50 | 50 | rm -fR patches/ specs/ || die "Can't delete patch." |
@@ -18,9 +18,9 @@ | ||
18 | 18 | rpm -ivh kernel-3.4.110-4vl6.src.rpm || die "Can't install source package." |
19 | 19 | |
20 | 20 | cd ~/rpm/SOURCES/ || die "Can't chdir to ~/rpm/SOURCES/ ." |
21 | -if [ ! -r caitsith-patch-0.2-20170515.tar.gz ] | |
21 | +if [ ! -r caitsith-patch-0.2-20170716.tar.gz ] | |
22 | 22 | then |
23 | - wget -O caitsith-patch-0.2-20170515.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170515.tar.gz' || die "Can't download patch." | |
23 | + wget -O caitsith-patch-0.2-20170716.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170716.tar.gz' || die "Can't download patch." | |
24 | 24 | fi |
25 | 25 | |
26 | 26 | cd /tmp/ || die "Can't chdir to /tmp/ ." |
@@ -61,7 +61,7 @@ | ||
61 | 61 | # END OF PATCH APPLICATIONS |
62 | 62 | |
63 | 63 | +# CaitSith |
64 | -+tar -zxf %_sourcedir/caitsith-patch-0.2-20170515.tar.gz | |
64 | ++tar -zxf %_sourcedir/caitsith-patch-0.2-20170716.tar.gz | |
65 | 65 | +sed -i -e 's/CCSECURITY/CAITSITH/g' -e 's/ccsecurity/caitsith/g' -e 's/ccs_domain_info/cs_domain_info/g' -e 's/ccs_flags/cs_flags/g' patches/ccs-patch-*.diff |
66 | 66 | +patch -sp1 < patches/ccs-patch-3.4-vine-linux-6.diff |
67 | 67 | cp %{SOURCE10} Documentation/ |