Blame view
security/min_addr.c
1.35 KB
b24413180 License cleanup: ... |
1 |
// SPDX-License-Identifier: GPL-2.0 |
788084aba Security/SELinux:... |
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
#include <linux/init.h> #include <linux/mm.h> #include <linux/security.h> #include <linux/sysctl.h> /* amount of vm to protect from userspace access by both DAC and the LSM*/ unsigned long mmap_min_addr; /* amount of vm to protect from userspace using CAP_SYS_RAWIO (DAC) */ unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR; /* amount of vm to protect from userspace using the LSM = CONFIG_LSM_MMAP_MIN_ADDR */ /* * Update mmap_min_addr = max(dac_mmap_min_addr, CONFIG_LSM_MMAP_MIN_ADDR) */ static void update_mmap_min_addr(void) { #ifdef CONFIG_LSM_MMAP_MIN_ADDR if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR) mmap_min_addr = dac_mmap_min_addr; else mmap_min_addr = CONFIG_LSM_MMAP_MIN_ADDR; #else mmap_min_addr = dac_mmap_min_addr; #endif } /* * sysctl handler which just sets dac_mmap_min_addr = the new value and then * calls update_mmap_min_addr() so non MAP_FIXED hints get rounded properly */ |
8d65af789 sysctl: remove "s... |
32 |
int mmap_min_addr_handler(struct ctl_table *table, int write, |
788084aba Security/SELinux:... |
33 34 35 |
void __user *buffer, size_t *lenp, loff_t *ppos) { int ret; |
4ae69e6b7 mmap_min_addr che... |
36 |
if (write && !capable(CAP_SYS_RAWIO)) |
0e1a6ef2d sysctl: require C... |
37 |
return -EPERM; |
8d65af789 sysctl: remove "s... |
38 |
ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos); |
788084aba Security/SELinux:... |
39 40 41 42 43 |
update_mmap_min_addr(); return ret; } |
dd880fbe8 security/min_addr... |
44 |
static int __init init_mmap_min_addr(void) |
788084aba Security/SELinux:... |
45 46 47 48 49 50 |
{ update_mmap_min_addr(); return 0; } pure_initcall(init_mmap_min_addr); |