- Round up remaining security patches that appear to be missing in 2.4.28. - PaX...

diff --git a/sys-kernel/hardened-sources/Manifest b/sys-kernel/hardened-sources/Manifest
index 314ce0992f5f2675ad7734973c8f1066d674608d..9dbc287ad2916afc54421aa3b8e0b56fceabdc07 100644 (file)
--- a/sys-kernel/hardened-sources/Manifest
+++ b/sys-kernel/hardened-sources/Manifest
@@ -1,7 +1,7 @@
 MD5 ec13a8435dc6785ca17db91918579f3d hardened-sources-2.4.27-r2.ebuild 1027
 MD5 91d88b3126d4cc0b7cc5a22819808e68 hardened-sources-2.4.27-r3.ebuild 1028
-MD5 31b8de4d4159019c37339c7322563dcb hardened-sources-2.4.28.ebuild 1550
-MD5 e9f06218d6928c071fe2661ec9561f76 ChangeLog 10807
+MD5 3e2295502cd3f1513108ae4fee67d624 hardened-sources-2.4.28.ebuild 1655
+MD5 480ad33ed1ba9f53128a0afd5ab27ad7 ChangeLog 10807
 MD5 0a473e60c059cb41c96a6bbcbff84769 metadata.xml 459
 MD5 4a0215139f9aebfe2cc2747743763f08 files/2.4.28-grsec-binfmt_a.out.patch 1887
 MD5 c8985a5695cfda1c35d1b433d62604ce files/2.4.28-selinux-binfmt_a.out.patch 1743

diff --git a/sys-kernel/hardened-sources/files/2.4.28-grsec-binfmt_a.out.patch b/sys-kernel/hardened-sources/files/2.4.28-grsec-binfmt_a.out.patch
new file mode 100644 (file)
index 0000000..16e06c4
--- /dev/null
+++ b/sys-kernel/hardened-sources/files/2.4.28-grsec-binfmt_a.out.patch
@@ -0,0 +1,63 @@
+diff -Nru linux-2.4.28/fs/binfmt_aout.c linux-2.4.28-hardened/fs/binfmt_aout.c
+--- linux-2.4.28/fs/binfmt_aout.c      2004-11-28 15:44:03.000000000 -0500
++++ linux-2.4.28-hardened/fs/binfmt_aout.c     2004-11-28 16:05:16.000000000 -0500
+@@ -39,13 +39,18 @@
+       NULL, THIS_MODULE, load_aout_binary, load_aout_library, aout_core_dump, PAGE_SIZE
+ };
+ 
+-static void set_brk(unsigned long start, unsigned long end)
++#define BAD_ADDR(x)   ((unsigned long)(x) >= TASK_SIZE)
++
++static int set_brk(unsigned long start, unsigned long end)
+ {
+       start = PAGE_ALIGN(start);
+       end = PAGE_ALIGN(end);
+-      if (end <= start)
+-              return;
+-      do_brk(start, end - start);
++      if (end > start) {
++              unsigned long addr = do_brk(start, end - start);
++              if (BAD_ADDR(addr))
++                      return addr;
++      }
++      return 0;
+ }
+ 
+ /*
+@@ -429,7 +434,11 @@
+ beyond_if:
+       set_binfmt(&aout_format);
+ 
+-      set_brk(current->mm->start_brk, current->mm->brk);
++      retval = set_brk(current->mm->start_brk, current->mm->brk);
++      if (retval < 0) {
++              send_sig(SIGKILL, current, 0);
++              return retval;
++      }
+ 
+       retval = setup_arg_pages(bprm); 
+       if (retval < 0) { 
+diff -Nru linux-2.4.28/fs/exec.c linux-2.4.28-hardened/fs/exec.c
+--- linux-2.4.28/fs/exec.c     2004-11-28 15:44:03.000000000 -0500
++++ linux-2.4.28-hardened/fs/exec.c    2004-11-28 16:05:16.000000000 -0500
+@@ -387,6 +387,7 @@
+ 
+       down_write(&current->mm->mmap_sem);
+       {
++              struct vm_area_struct *vma;
+               mpnt->vm_mm = current->mm;
+               mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p;
+               mpnt->vm_end = STACK_TOP;
+@@ -401,6 +402,12 @@
+               mpnt->vm_pgoff = 0;
+               mpnt->vm_file = NULL;
+               mpnt->vm_private_data = (void *) 0;
++              vma = find_vma(current->mm, mpnt->vm_start);
++              if (vma) {
++                      up_write(&current->mm->mmap_sem);
++                      kmem_cache_free(vm_area_cachep, mpnt);
++                      return -ENOMEM;
++              }
+               insert_vm_struct(current->mm, mpnt);
+               current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
+ 

diff --git a/sys-kernel/hardened-sources/files/2.4.28-grsec-cmdline-race.patch b/sys-kernel/hardened-sources/files/2.4.28-grsec-cmdline-race.patch
new file mode 100644 (file)
index 0000000..a37e927
--- /dev/null
+++ b/sys-kernel/hardened-sources/files/2.4.28-grsec-cmdline-race.patch
@@ -0,0 +1,11 @@
+--- linux-2.4.28/fs/proc/base.c        2004-11-28 15:44:03.000000000 -0500
++++ linux-2.4.28-hardened/fs/proc/base.c       2004-11-28 16:02:18.439086184 -0500
+@@ -194,7 +194,7 @@
+       if (mm)
+               atomic_inc(&mm->mm_users);
+       task_unlock(task);
+-      if (mm) {
++      if (mm && mm->arg_end) {
+               int len = mm->arg_end - mm->arg_start;
+               if (len > PAGE_SIZE)
+                       len = PAGE_SIZE;

diff --git a/sys-kernel/hardened-sources/files/2.4.28-selinux-binfmt_a.out.patch b/sys-kernel/hardened-sources/files/2.4.28-selinux-binfmt_a.out.patch
new file mode 100644 (file)
index 0000000..cd1486f
--- /dev/null
+++ b/sys-kernel/hardened-sources/files/2.4.28-selinux-binfmt_a.out.patch
@@ -0,0 +1,61 @@
+--- linux-2.4.28/fs/binfmt_aout.c      2004-11-28 16:37:25.000000000 -0500
++++ linux-2.4.28-hardened/fs/binfmt_aout.c     2004-11-28 17:15:50.297381776 -0500
+@@ -39,13 +39,18 @@
+       NULL, THIS_MODULE, load_aout_binary, load_aout_library, aout_core_dump, PAGE_SIZE
+ };
+ 
+-static void set_brk(unsigned long start, unsigned long end)
++#define BAD_ADDR(x)   ((unsigned long)(x) >= TASK_SIZE)
++
++static int set_brk(unsigned long start, unsigned long end)
+ {
+       start = PAGE_ALIGN(start);
+       end = PAGE_ALIGN(end);
+-      if (end <= start)
+-              return;
+-      do_brk(start, end - start);
++      if (end > start) {
++              unsigned long addr = do_brk(start, end - start);
++              if (BAD_ADDR(addr))
++                      return addr;
++      }
++      return 0;
+ }
+ 
+ /*
+@@ -423,7 +428,11 @@
+ beyond_if:
+       set_binfmt(&aout_format);
+ 
+-      set_brk(current->mm->start_brk, current->mm->brk);
++      retval = set_brk(current->mm->start_brk, current->mm->brk);
++      if (retval < 0) {
++              send_sig(SIGKILL, current, 0);
++              return retval;
++      }
+ 
+       retval = setup_arg_pages(bprm); 
+       if (retval < 0) { 
+--- linux-2.4.28/fs/exec.c     2004-11-28 16:37:25.000000000 -0500
++++ linux-2.4.28-hardened/fs/exec.c    2004-11-28 17:15:50.298381624 -0500
+@@ -388,6 +388,7 @@
+ 
+       down_write(&current->mm->mmap_sem);
+       {
++              struct vm_area_struct *vma;
+               mpnt->vm_mm = current->mm;
+               mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p;
+               mpnt->vm_end = STACK_TOP;
+@@ -404,6 +405,12 @@
+               mpnt->vm_pgoff = 0;
+               mpnt->vm_file = NULL;
+               mpnt->vm_private_data = (void *) 0;
++              vma = find_vma(current->mm, mpnt->vm_start);
++              if (vma) {
++                      up_write(&current->mm->mmap_sem);
++                      kmem_cache_free(vm_area_cachep, mpnt);
++                      return -ENOMEM;
++              }
+               insert_vm_struct(current->mm, mpnt);
+               current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
+ 

diff --git a/sys-kernel/hardened-sources/files/2.4.28-selinux-cmdline-race.patch b/sys-kernel/hardened-sources/files/2.4.28-selinux-cmdline-race.patch
new file mode 100644 (file)
index 0000000..f4a759f
--- /dev/null
+++ b/sys-kernel/hardened-sources/files/2.4.28-selinux-cmdline-race.patch
@@ -0,0 +1,11 @@
+--- linux-2.4.28/fs/proc/base.c        2004-11-28 16:37:21.000000000 -0500
++++ linux-2.4.28-hardened/fs/proc/base.c       2004-11-28 17:10:36.593072080 -0500
+@@ -192,7 +192,7 @@
+       if (mm)
+               atomic_inc(&mm->mm_users);
+       task_unlock(task);
+-      if (mm) {
++      if (mm && mm->arg_end) {
+               int len = mm->arg_end - mm->arg_start;
+               if (len > PAGE_SIZE)
+                       len = PAGE_SIZE;

diff --git a/sys-kernel/hardened-sources/files/digest-hardened-sources-2.4.28 b/sys-kernel/hardened-sources/files/digest-hardened-sources-2.4.28
index 9691eab1f6f1d90f3d451809503a70a71950d7cd..ca564687aeb3d43eb2a43b8831ece00f13100df1 100644 (file)
--- a/sys-kernel/hardened-sources/files/digest-hardened-sources-2.4.28
+++ b/sys-kernel/hardened-sources/files/digest-hardened-sources-2.4.28
@@ -1,2 +1,2 @@
 MD5 ac7735000d185bc7778c08288760a8a3 linux-2.4.28.tar.bz2 31064046
-MD5 0685f747c491abe1b9eec1a1355ea0b4 hardened-patches-2.4-28.0.tar.bz2 527898
+MD5 89087134d26519e7137d7ab621addb3f hardened-patches-2.4-28.1.tar.bz2 528257

diff --git a/sys-kernel/hardened-sources/hardened-sources-2.4.28.ebuild b/sys-kernel/hardened-sources/hardened-sources-2.4.28.ebuild
index deab86105f1ba3fbe3ef2e5e294390962a927c29..3044cc4818b0fae6116e1f29d01a9256aa1b82c8 100644 (file)
--- a/sys-kernel/hardened-sources/hardened-sources-2.4.28.ebuild
+++ b/sys-kernel/hardened-sources/hardened-sources-2.4.28.ebuild
@@ -1,30 +1,36 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-sources/hardened-sources-2.4.28.ebuild,v 1.3 2004/11/28 18:14:57 solar Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-sources/hardened-sources-2.4.28.ebuild,v 1.4 2004/11/29 02:45:14 solar Exp $
 
 IUSE="selinux"
 ETYPE="sources"
 inherit kernel-2
 detect_version
 
-HGPV=28.0
+HGPV=28.1
 HGPV_SRC="mirror://gentoo/hardened-patches-${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}/hardened-patches-${KV_MAJOR}.${KV_MINOR}-${HGPV}.tar.bz2"
 
 UNIPATCH_STRICTORDER="yes"
 
+UNIPATCH_LIST=" ${DISTDIR}/hardened-patches-${KV_MAJOR}.${KV_MINOR}-${HGPV}.tar.bz2 \
+                               ${DISTDIR}/${PN}-grsec-${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-CAN-2004-0814.patch.gz \
+                               ${DISTDIR}/${PN}-selinux-${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-CAN-2004-0814.patch.gz \
+                               ${FILESDIR}/${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-grsec-cmdline-race.patch \
+                               ${FILESDIR}/${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-selinux-cmdline-race.patch \
+                               ${FILESDIR}/${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-grsec-binfmt_a.out.patch \
+                               ${FILESDIR}/${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-selinux-binfmt_a.out.patch"
+
+UNIPATCH_DOCS="${WORKDIR}/patches/hardened-patches-${KV_MAJOR}.${KV_MINOR}-${HGPV}/0000_README"
+
 # According to the patchset numbering scheme, 31xx patches are grsec related
 # while 32xx are SELinux related.
 
 if use selinux; then
-       UNIPATCH_EXCLUDE="31"
+       UNIPATCH_LIST="${UNIPATCH_LIST} 31 ${PN}-grsec ${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-grsec"
 else
-       UNIPATCH_EXCLUDE="32"
+       UNIPATCH_LIST="${UNIPATCH_LIST} 32 ${PN}-selinux ${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-selinux"
 fi
 
-UNIPATCH_LIST=" ${DISTDIR}/hardened-patches-${KV_MAJOR}.${KV_MINOR}-${HGPV}.tar.bz2"
-
-UNIPATCH_DOCS="${WORKDIR}/patches/hardened-patches-${KV_MAJOR}.${KV_MINOR}-${HGPV}/0000_README"
-
 DESCRIPTION="Hardened sources for the ${KV_MAJOR}.${KV_MINOR} kernel tree"
 
 SRC_URI="${KERNEL_URI} ${HGPV_SRC}"