cap_file_mmap() comments said "If the process is attempting to map
memory below mmap_min_addr", if CONFIG_LSM_MMAP_MIN_ADDR is set,
dac_mmap_min_addr is not equal mmap_min_addr, so replace dac_mmap_min_addr
to mmap_min_addr seems to be better.
Signed-off-by: Zhitong Wang <[email protected]>
---
include/linux/security.h | 1 +
security/commoncap.c | 2 +-
2 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/include/linux/security.h b/include/linux/security.h
index 233d20b..61fd9e7 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -101,6 +101,7 @@ void reset_security_ops(void);
extern unsigned long mmap_min_addr;
extern unsigned long dac_mmap_min_addr;
#else
+#define mmap_min_addr 0UL
#define dac_mmap_min_addr 0UL
#endif
diff --git a/security/commoncap.c b/security/commoncap.c
index 6166973..878cf89 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -942,7 +942,7 @@ int cap_file_mmap(struct file *file, unsigned long reqprot,
{
int ret = 0;
- if (addr < dac_mmap_min_addr) {
+ if (addr < mmap_min_addr) {
ret = cap_capable(current, current_cred(), CAP_SYS_RAWIO,
SECURITY_CAP_AUDIT);
/* set PF_SUPERPRIV if it turns out we allow the low mmap */
--
1.6.5.3
NAK NAK NAK
go back and reread the whole purpose for the separation.
-Eric
On Tue, Apr 13, 2010 at 10:48 PM, <[email protected]> wrote:
> cap_file_mmap() comments said "If the process is attempting to map
> memory below mmap_min_addr", if CONFIG_LSM_MMAP_MIN_ADDR is set,
> dac_mmap_min_addr is not equal mmap_min_addr, so replace dac_mmap_min_addr
> to mmap_min_addr seems to be better.
>
> Signed-off-by: Zhitong Wang <[email protected]>
>
> ---
> ?include/linux/security.h | ? ?1 +
> ?security/commoncap.c ? ? | ? ?2 +-
> ?2 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/include/linux/security.h b/include/linux/security.h
> index 233d20b..61fd9e7 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -101,6 +101,7 @@ void reset_security_ops(void);
> ?extern unsigned long mmap_min_addr;
> ?extern unsigned long dac_mmap_min_addr;
> ?#else
> +#define mmap_min_addr ? ? ? ? ?0UL
> ?#define dac_mmap_min_addr ? ? ?0UL
> ?#endif
>
> diff --git a/security/commoncap.c b/security/commoncap.c
> index 6166973..878cf89 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -942,7 +942,7 @@ int cap_file_mmap(struct file *file, unsigned long reqprot,
> ?{
> ? ? ? ?int ret = 0;
>
> - ? ? ? if (addr < dac_mmap_min_addr) {
> + ? ? ? if (addr < mmap_min_addr) {
> ? ? ? ? ? ? ? ?ret = cap_capable(current, current_cred(), CAP_SYS_RAWIO,
> ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?SECURITY_CAP_AUDIT);
> ? ? ? ? ? ? ? ?/* set PF_SUPERPRIV if it turns out we allow the low mmap */
> --
> 1.6.5.3
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to [email protected]
> More majordomo info at ?http://vger.kernel.org/majordomo-info.html
>
still not understand, if CONFIG_LSM_MMAP_MIN_ADDR is not set,
mmap_min_addr is equal dac_mmap_min_addr, right?
if not, mmap_min_addr is set as CONFIG_LSM_MMAP_MIN_ADDR. what's the
effect of mmap_min_addr? except round_hint_to_min() will use
mmap_min_addr, any other functions will call it?
Anyway, the comments need change mmap_min_addr as dac_mmap_min_addr,
right? If i'm wrong, please point it, thanks.
/*
* If the process is attempting to map memory below mmap_min_addr they need |{
* CAP_SYS_RAWIO.
*/
On Wed, Apr 14, 2010 at 11:02 AM, Eric Paris <[email protected]> wrote:
> NAK NAK NAK
>
> go back and reread the whole purpose for the separation.
>
> -Eric
>
> On Tue, Apr 13, 2010 at 10:48 PM, <[email protected]> wrote:
>> cap_file_mmap() comments said "If the process is attempting to map
>> memory below mmap_min_addr", if CONFIG_LSM_MMAP_MIN_ADDR is set,
>> dac_mmap_min_addr is not equal mmap_min_addr, so replace dac_mmap_min_addr
>> to mmap_min_addr seems to be better.
>>
>> Signed-off-by: Zhitong Wang <[email protected]>
>>
>> ---
>> include/linux/security.h | 1 +
>> security/commoncap.c | 2 +-
>> 2 files changed, 2 insertions(+), 1 deletions(-)
>>
>> diff --git a/include/linux/security.h b/include/linux/security.h
>> index 233d20b..61fd9e7 100644
>> --- a/include/linux/security.h
>> +++ b/include/linux/security.h
>> @@ -101,6 +101,7 @@ void reset_security_ops(void);
>> extern unsigned long mmap_min_addr;
>> extern unsigned long dac_mmap_min_addr;
>> #else
>> +#define mmap_min_addr 0UL
>> #define dac_mmap_min_addr 0UL
>> #endif
>>
>> diff --git a/security/commoncap.c b/security/commoncap.c
>> index 6166973..878cf89 100644
>> --- a/security/commoncap.c
>> +++ b/security/commoncap.c
>> @@ -942,7 +942,7 @@ int cap_file_mmap(struct file *file, unsigned long reqprot,
>> {
>> int ret = 0;
>>
>> - if (addr < dac_mmap_min_addr) {
>> + if (addr < mmap_min_addr) {
>> ret = cap_capable(current, current_cred(), CAP_SYS_RAWIO,
>> SECURITY_CAP_AUDIT);
>> /* set PF_SUPERPRIV if it turns out we allow the low mmap */
>> --
>> 1.6.5.3
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
>> the body of a message to [email protected]
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>>
>
On Wed, Apr 14, 2010 at 01:50:40PM +0800, wzt wzt wrote:
>still not understand, if CONFIG_LSM_MMAP_MIN_ADDR is not set,
>mmap_min_addr is equal dac_mmap_min_addr, right?
>if not, mmap_min_addr is set as CONFIG_LSM_MMAP_MIN_ADDR. what's the
>effect of mmap_min_addr? except round_hint_to_min() will use
>mmap_min_addr, any other functions will call it?
round_hint_to_min() will be called by mmap().
As the names tell you, mmap_min_addr will be checked by mmap(),
dac_mmap_min_addr will be checked for CAP_SYS_RAWIO.
Please check commit 788084ab, as Eric suggested.
>Anyway, the comments need change mmap_min_addr as dac_mmap_min_addr,
>right? If i'm wrong, please point it, thanks.
>/*
> * If the process is attempting to map memory below mmap_min_addr they need |{
> * CAP_SYS_RAWIO.
> */
>
Yes, I think the comment needs to be fixed.
Thanks.