Eric Paris
ed03218951
security: Protection for exploiting null dereference using mmap ...
Add a new security check on mmap operations to see if the user is attempting
to mmap to low area of the address space. The amount of space protected is
indicated by the new proc tunable /proc/sys/vm/mmap_min_addr and defaults to
0, preserving existing behavior.
This patch uses a new SELinux security class "memprotect." Policy already
contains a number of allow rules like a_t self:process * (unconfined_t being
one of them) which mean that putting this check in the process class (its
best current fit) would make it useless as all user processes, which we also
want to protect against, would be allowed. By taking the memprotect name of
the new class it will also make it possible for us to move some of the other
memory protect permissions out of 'process' and into the new class next time
we bump the policy version number (which I also think is a good future idea)
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
2007-07-11 22:52:29 -04:00
[PATCH] Allow NULL pointers in percpu_free
2006-12-07 08:39:22 -08:00
[PATCH] nfs: fix congestion control
2007-03-16 19:25:05 -07:00
[PATCH] remove EXPORT_UNUSED_SYMBOL'ed symbols
2006-12-07 08:39:44 -08:00
block: blk_max_pfn is somtimes wrong
2007-03-27 08:52:47 +02:00
[PATCH] mm: change uses of f_{dentry,vfsmnt} to use f_path
2006-12-08 08:28:43 -08:00
sendfile: kill generic_file_sendfile()
2007-07-10 08:04:14 +02:00
Remove all inclusions of <linux/config.h>
2006-10-04 03:38:54 -04:00
xip sendfile removal
2007-07-10 08:04:15 +02:00
[PATCH] mm: more rmap debugging
2006-12-22 08:55:49 -08:00
[PATCH] i386: PARAVIRT: add kmap_atomic_pte for mapping highpte pages
2007-05-02 19:27:15 +02:00
Rework ptep_set_access_flags and fix sun4c
2007-06-16 13:16:16 -07:00
Make page->private usable in compound pages
2007-05-07 12:12:53 -07:00
sh64: generic quicklist support.
2007-05-14 09:55:35 +09:00
Detach sched.h from mm.h
2007-05-21 09:18:19 -07:00
Quicklists for page table pages
2007-05-07 12:12:54 -07:00
Rework ptep_set_access_flags and fix sun4c
2007-06-16 13:16:16 -07:00
memory hotplug: fix unnecessary calling of init_currenty_empty_zone()
2007-06-01 08:18:29 -07:00
[PATCH] Page migration: Fix vma flag checking
2007-03-05 07:57:51 -08:00
[PATCH] Numerous fixes to kernel-doc info in source files.
2007-02-11 10:51:32 -08:00
page migration: fix NR_FILE_PAGES accounting
2007-04-24 08:23:08 -07:00
[PATCH] mincore: vma crossing fix
2007-02-15 09:57:03 -08:00
Detach sched.h from mm.h
2007-05-21 09:18:19 -07:00
security: Protection for exploiting null dereference using mmap
2007-07-11 22:52:29 -04:00
[PATCH] remove EXPORT_UNUSED_SYMBOL'ed symbols
2006-12-07 08:39:44 -08:00
[PATCH] paravirt: lazy mmu mode hooks.patch
2006-10-01 00:39:33 -07:00
security: Protection for exploiting null dereference using mmap
2007-07-11 22:52:29 -04:00
Detach sched.h from mm.h
2007-05-21 09:18:19 -07:00
security: Protection for exploiting null dereference using mmap
2007-07-11 22:52:29 -04:00
oom: fix constraint deadlock
2007-05-07 12:12:55 -07:00
consolidate generic_writepages and mpage_writepages
2007-05-11 08:29:35 -07:00
mm: Fix memory/cpu hotplug section mismatch and oops.
2007-06-15 16:18:08 -07:00
[PATCH] swsusp: use block device offsets to identify swap locations
2006-12-07 08:39:27 -08:00
[PATCH] Add include/linux/freezer.h and move definitions from sched.h
2006-12-07 08:39:27 -08:00
Linux-2.6.12-rc2
2005-04-16 15:20:36 -07:00
Quicklists for page table pages
2007-05-07 12:12:54 -07:00
readahead: code cleanup
2007-05-07 12:12:52 -07:00
mm: kill validate_anon_vma to avoid mapcount BUG
2007-06-28 11:34:53 -07:00
shmem: convert to using splice instead of sendfile()
2007-07-10 08:04:15 +02:00
[PATCH] Fix typos in mm/shmem_acl.c
2006-10-11 11:14:23 -07:00
Fix slab redzone alignment
2007-07-05 15:54:13 -07:00
Remove SLAB_CTOR_CONSTRUCTOR
2007-05-17 05:23:04 -07:00
slub: remove useless EXPORT_SYMBOL
2007-07-06 11:45:11 -07:00
Move three functions that are only needed for CONFIG_MEMORY_HOTPLUG
2007-06-08 17:23:33 -07:00
Add suspend-related notifications for CPU hotplug
2007-05-09 12:30:56 -07:00
[PATCH] lockdep: locking init debugging improvement
2006-07-03 15:27:02 -07:00
mm: make read_cache_page synchronous
2007-05-07 12:12:51 -07:00
Bug in mm/thrash.c function grab_swap_token()
2007-05-11 08:29:32 -07:00
[PATCH] mm/{,tiny-}shmem.c cleanups
2007-03-01 14:53:35 -08:00
fs: convert core functions to zero_user_page
2007-05-09 12:30:55 -07:00
[PATCH] slab: clean up leak tracking ifdefs a little bit
2006-10-04 07:55:13 -07:00
Make __vunmap static
2007-05-17 05:23:04 -07:00
Add suspend-related notifications for CPU hotplug
2007-05-09 12:30:56 -07:00
mm: fixup /proc/vmstat output
2007-07-06 10:26:50 -07:00
ed03218951