pyrox.dev
Merge pull request #7069 from taktoa/master
Fixed grsecurity path patch for testing (3.19)
+7
-6
pkgs/os-specific/linux/kernel/grsec-path.patch
+7
-6
pkgs/os-specific/linux/kernel/grsec-path.patch
···
1
1
diff --git a/kernel/kmod.c b/kernel/kmod.c
2
-
index 67f7981..03f127d 100644
2
+
index a26e825..29baec1 100644
3
3
--- a/kernel/kmod.c
4
4
+++ b/kernel/kmod.c
5
-
@@ -246,9 +246,9 @@ static int ____call_usermodehelper(void *data)
5
+
@@ -294,10 +294,9 @@ static int ____call_usermodehelper(void *data)
6
6
out the path to be used prior to this point and are now operating
7
7
on that copy
8
8
*/
9
9
- if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
10
10
- strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
11
+
- strncmp(sub_info->path, "/usr/libexec/", 13) &&
11
12
- strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
12
-
+ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) &&
13
-
+ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) ||
14
-
+ strstr(sub_info->path, "..")) {
13
+
+ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) &&
14
+
+ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) ||
15
+
+ strstr(sub_info->path, "..")) {
15
16
printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
16
17
retval = -EPERM;
17
-
goto fail;
18
+
goto out;