| 1 |
This is TOMOYO Linux patch for kernel 4.4.140. |
This is TOMOYO Linux patch for kernel 4.4.152. |
| 2 |
|
|
| 3 |
Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.4.140.tar.xz |
Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.4.152.tar.xz |
| 4 |
--- |
--- |
| 5 |
fs/exec.c | 2 - |
fs/exec.c | 2 - |
| 6 |
fs/open.c | 2 + |
fs/open.c | 2 + |
| 28 |
security/Makefile | 3 ++ |
security/Makefile | 3 ++ |
| 29 |
24 files changed, 150 insertions(+), 26 deletions(-) |
24 files changed, 150 insertions(+), 26 deletions(-) |
| 30 |
|
|
| 31 |
--- linux-4.4.140.orig/fs/exec.c |
--- linux-4.4.152.orig/fs/exec.c |
| 32 |
+++ linux-4.4.140/fs/exec.c |
+++ linux-4.4.152/fs/exec.c |
| 33 |
@@ -1508,7 +1508,7 @@ static int exec_binprm(struct linux_binp |
@@ -1508,7 +1508,7 @@ static int exec_binprm(struct linux_binp |
| 34 |
old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent)); |
old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent)); |
| 35 |
rcu_read_unlock(); |
rcu_read_unlock(); |
| 39 |
if (ret >= 0) { |
if (ret >= 0) { |
| 40 |
audit_bprm(bprm); |
audit_bprm(bprm); |
| 41 |
trace_sched_process_exec(current, old_pid, bprm); |
trace_sched_process_exec(current, old_pid, bprm); |
| 42 |
--- linux-4.4.140.orig/fs/open.c |
--- linux-4.4.152.orig/fs/open.c |
| 43 |
+++ linux-4.4.140/fs/open.c |
+++ linux-4.4.152/fs/open.c |
| 44 |
@@ -1117,6 +1117,8 @@ EXPORT_SYMBOL(sys_close); |
@@ -1117,6 +1117,8 @@ EXPORT_SYMBOL(sys_close); |
| 45 |
*/ |
*/ |
| 46 |
SYSCALL_DEFINE0(vhangup) |
SYSCALL_DEFINE0(vhangup) |
| 50 |
if (capable(CAP_SYS_TTY_CONFIG)) { |
if (capable(CAP_SYS_TTY_CONFIG)) { |
| 51 |
tty_vhangup_self(); |
tty_vhangup_self(); |
| 52 |
return 0; |
return 0; |
| 53 |
--- linux-4.4.140.orig/fs/proc/version.c |
--- linux-4.4.152.orig/fs/proc/version.c |
| 54 |
+++ linux-4.4.140/fs/proc/version.c |
+++ linux-4.4.152/fs/proc/version.c |
| 55 |
@@ -32,3 +32,10 @@ static int __init proc_version_init(void |
@@ -32,3 +32,10 @@ static int __init proc_version_init(void |
| 56 |
return 0; |
return 0; |
| 57 |
} |
} |
| 59 |
+ |
+ |
| 60 |
+static int __init ccs_show_version(void) |
+static int __init ccs_show_version(void) |
| 61 |
+{ |
+{ |
| 62 |
+ printk(KERN_INFO "Hook version: 4.4.140 2018/07/12\n"); |
+ printk(KERN_INFO "Hook version: 4.4.152 2018/08/25\n"); |
| 63 |
+ return 0; |
+ return 0; |
| 64 |
+} |
+} |
| 65 |
+fs_initcall(ccs_show_version); |
+fs_initcall(ccs_show_version); |
| 66 |
--- linux-4.4.140.orig/include/linux/init_task.h |
--- linux-4.4.152.orig/include/linux/init_task.h |
| 67 |
+++ linux-4.4.140/include/linux/init_task.h |
+++ linux-4.4.152/include/linux/init_task.h |
| 68 |
@@ -183,6 +183,14 @@ extern struct task_group root_task_group |
@@ -183,6 +183,14 @@ extern struct task_group root_task_group |
| 69 |
# define INIT_KASAN(tsk) |
# define INIT_KASAN(tsk) |
| 70 |
#endif |
#endif |
| 88 |
} |
} |
| 89 |
|
|
| 90 |
|
|
| 91 |
--- linux-4.4.140.orig/include/linux/sched.h |
--- linux-4.4.152.orig/include/linux/sched.h |
| 92 |
+++ linux-4.4.140/include/linux/sched.h |
+++ linux-4.4.152/include/linux/sched.h |
| 93 |
@@ -6,6 +6,8 @@ |
@@ -6,6 +6,8 @@ |
| 94 |
#include <linux/sched/prio.h> |
#include <linux/sched/prio.h> |
| 95 |
|
|
| 110 |
/* CPU-specific state of this task */ |
/* CPU-specific state of this task */ |
| 111 |
struct thread_struct thread; |
struct thread_struct thread; |
| 112 |
/* |
/* |
| 113 |
--- linux-4.4.140.orig/include/linux/security.h |
--- linux-4.4.152.orig/include/linux/security.h |
| 114 |
+++ linux-4.4.140/include/linux/security.h |
+++ linux-4.4.152/include/linux/security.h |
| 115 |
@@ -53,6 +53,7 @@ struct msg_queue; |
@@ -53,6 +53,7 @@ struct msg_queue; |
| 116 |
struct xattr; |
struct xattr; |
| 117 |
struct xfrm_sec_ctx; |
struct xfrm_sec_ctx; |
| 318 |
} |
} |
| 319 |
#endif /* CONFIG_SECURITY_PATH */ |
#endif /* CONFIG_SECURITY_PATH */ |
| 320 |
|
|
| 321 |
--- linux-4.4.140.orig/include/net/ip.h |
--- linux-4.4.152.orig/include/net/ip.h |
| 322 |
+++ linux-4.4.140/include/net/ip.h |
+++ linux-4.4.152/include/net/ip.h |
| 323 |
@@ -225,6 +225,8 @@ void inet_get_local_port_range(struct ne |
@@ -225,6 +225,8 @@ void inet_get_local_port_range(struct ne |
| 324 |
#ifdef CONFIG_SYSCTL |
#ifdef CONFIG_SYSCTL |
| 325 |
static inline int inet_is_local_reserved_port(struct net *net, int port) |
static inline int inet_is_local_reserved_port(struct net *net, int port) |
| 338 |
return 0; |
return 0; |
| 339 |
} |
} |
| 340 |
#endif |
#endif |
| 341 |
--- linux-4.4.140.orig/kernel/fork.c |
--- linux-4.4.152.orig/kernel/fork.c |
| 342 |
+++ linux-4.4.140/kernel/fork.c |
+++ linux-4.4.152/kernel/fork.c |
| 343 |
@@ -260,6 +260,7 @@ void __put_task_struct(struct task_struc |
@@ -260,6 +260,7 @@ void __put_task_struct(struct task_struc |
| 344 |
delayacct_tsk_free(tsk); |
delayacct_tsk_free(tsk); |
| 345 |
put_signal_struct(tsk->signal); |
put_signal_struct(tsk->signal); |
| 366 |
bad_fork_cleanup_perf: |
bad_fork_cleanup_perf: |
| 367 |
perf_event_free_task(p); |
perf_event_free_task(p); |
| 368 |
bad_fork_cleanup_policy: |
bad_fork_cleanup_policy: |
| 369 |
--- linux-4.4.140.orig/kernel/kexec.c |
--- linux-4.4.152.orig/kernel/kexec.c |
| 370 |
+++ linux-4.4.140/kernel/kexec.c |
+++ linux-4.4.152/kernel/kexec.c |
| 371 |
@@ -17,7 +17,7 @@ |
@@ -17,7 +17,7 @@ |
| 372 |
#include <linux/syscalls.h> |
#include <linux/syscalls.h> |
| 373 |
#include <linux/vmalloc.h> |
#include <linux/vmalloc.h> |
| 386 |
|
|
| 387 |
/* |
/* |
| 388 |
* Verify we have a legal set of flags |
* Verify we have a legal set of flags |
| 389 |
--- linux-4.4.140.orig/kernel/module.c |
--- linux-4.4.152.orig/kernel/module.c |
| 390 |
+++ linux-4.4.140/kernel/module.c |
+++ linux-4.4.152/kernel/module.c |
| 391 |
@@ -61,6 +61,7 @@ |
@@ -61,6 +61,7 @@ |
| 392 |
#include <linux/bsearch.h> |
#include <linux/bsearch.h> |
| 393 |
#include <uapi/linux/module.h> |
#include <uapi/linux/module.h> |
| 414 |
|
|
| 415 |
return 0; |
return 0; |
| 416 |
} |
} |
| 417 |
--- linux-4.4.140.orig/kernel/ptrace.c |
--- linux-4.4.152.orig/kernel/ptrace.c |
| 418 |
+++ linux-4.4.140/kernel/ptrace.c |
+++ linux-4.4.152/kernel/ptrace.c |
| 419 |
@@ -1085,6 +1085,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
@@ -1085,6 +1085,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
| 420 |
{ |
{ |
| 421 |
struct task_struct *child; |
struct task_struct *child; |
| 440 |
|
|
| 441 |
if (request == PTRACE_TRACEME) { |
if (request == PTRACE_TRACEME) { |
| 442 |
ret = ptrace_traceme(); |
ret = ptrace_traceme(); |
| 443 |
--- linux-4.4.140.orig/kernel/reboot.c |
--- linux-4.4.152.orig/kernel/reboot.c |
| 444 |
+++ linux-4.4.140/kernel/reboot.c |
+++ linux-4.4.152/kernel/reboot.c |
| 445 |
@@ -16,6 +16,7 @@ |
@@ -16,6 +16,7 @@ |
| 446 |
#include <linux/syscalls.h> |
#include <linux/syscalls.h> |
| 447 |
#include <linux/syscore_ops.h> |
#include <linux/syscore_ops.h> |
| 459 |
|
|
| 460 |
/* |
/* |
| 461 |
* If pid namespaces are enabled and the current task is in a child |
* If pid namespaces are enabled and the current task is in a child |
| 462 |
--- linux-4.4.140.orig/kernel/sched/core.c |
--- linux-4.4.152.orig/kernel/sched/core.c |
| 463 |
+++ linux-4.4.140/kernel/sched/core.c |
+++ linux-4.4.152/kernel/sched/core.c |
| 464 |
@@ -3549,6 +3549,8 @@ int can_nice(const struct task_struct *p |
@@ -3549,6 +3549,8 @@ int can_nice(const struct task_struct *p |
| 465 |
SYSCALL_DEFINE1(nice, int, increment) |
SYSCALL_DEFINE1(nice, int, increment) |
| 466 |
{ |
{ |
| 470 |
|
|
| 471 |
/* |
/* |
| 472 |
* Setpriority might change our priority at the same moment. |
* Setpriority might change our priority at the same moment. |
| 473 |
--- linux-4.4.140.orig/kernel/signal.c |
--- linux-4.4.152.orig/kernel/signal.c |
| 474 |
+++ linux-4.4.140/kernel/signal.c |
+++ linux-4.4.152/kernel/signal.c |
| 475 |
@@ -2868,6 +2868,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
@@ -2868,6 +2868,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
| 476 |
SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
| 477 |
{ |
{ |
| 517 |
|
|
| 518 |
return do_send_specific(tgid, pid, sig, info); |
return do_send_specific(tgid, pid, sig, info); |
| 519 |
} |
} |
| 520 |
--- linux-4.4.140.orig/kernel/sys.c |
--- linux-4.4.152.orig/kernel/sys.c |
| 521 |
+++ linux-4.4.140/kernel/sys.c |
+++ linux-4.4.152/kernel/sys.c |
| 522 |
@@ -185,6 +185,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
@@ -185,6 +185,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
| 523 |
|
|
| 524 |
if (which > PRIO_USER || which < PRIO_PROCESS) |
if (which > PRIO_USER || which < PRIO_PROCESS) |
| 548 |
|
|
| 549 |
down_write(&uts_sem); |
down_write(&uts_sem); |
| 550 |
errno = -EFAULT; |
errno = -EFAULT; |
| 551 |
--- linux-4.4.140.orig/kernel/time/ntp.c |
--- linux-4.4.152.orig/kernel/time/ntp.c |
| 552 |
+++ linux-4.4.140/kernel/time/ntp.c |
+++ linux-4.4.152/kernel/time/ntp.c |
| 553 |
@@ -16,6 +16,7 @@ |
@@ -16,6 +16,7 @@ |
| 554 |
#include <linux/mm.h> |
#include <linux/mm.h> |
| 555 |
#include <linux/module.h> |
#include <linux/module.h> |
| 583 |
|
|
| 584 |
if (txc->modes & ADJ_NANO) { |
if (txc->modes & ADJ_NANO) { |
| 585 |
struct timespec ts; |
struct timespec ts; |
| 586 |
--- linux-4.4.140.orig/net/ipv4/raw.c |
--- linux-4.4.152.orig/net/ipv4/raw.c |
| 587 |
+++ linux-4.4.140/net/ipv4/raw.c |
+++ linux-4.4.152/net/ipv4/raw.c |
| 588 |
@@ -747,6 +747,10 @@ static int raw_recvmsg(struct sock *sk, |
@@ -747,6 +747,10 @@ static int raw_recvmsg(struct sock *sk, |
| 589 |
skb = skb_recv_datagram(sk, flags, noblock, &err); |
skb = skb_recv_datagram(sk, flags, noblock, &err); |
| 590 |
if (!skb) |
if (!skb) |
| 596 |
|
|
| 597 |
copied = skb->len; |
copied = skb->len; |
| 598 |
if (len < copied) { |
if (len < copied) { |
| 599 |
--- linux-4.4.140.orig/net/ipv4/udp.c |
--- linux-4.4.152.orig/net/ipv4/udp.c |
| 600 |
+++ linux-4.4.140/net/ipv4/udp.c |
+++ linux-4.4.152/net/ipv4/udp.c |
| 601 |
@@ -1289,6 +1289,10 @@ try_again: |
@@ -1289,6 +1289,10 @@ try_again: |
| 602 |
&peeked, &off, &err); |
&peeked, &off, &err); |
| 603 |
if (!skb) |
if (!skb) |
| 609 |
|
|
| 610 |
ulen = skb->len - sizeof(struct udphdr); |
ulen = skb->len - sizeof(struct udphdr); |
| 611 |
copied = len; |
copied = len; |
| 612 |
--- linux-4.4.140.orig/net/ipv6/raw.c |
--- linux-4.4.152.orig/net/ipv6/raw.c |
| 613 |
+++ linux-4.4.140/net/ipv6/raw.c |
+++ linux-4.4.152/net/ipv6/raw.c |
| 614 |
@@ -478,6 +478,10 @@ static int rawv6_recvmsg(struct sock *sk |
@@ -478,6 +478,10 @@ static int rawv6_recvmsg(struct sock *sk |
| 615 |
skb = skb_recv_datagram(sk, flags, noblock, &err); |
skb = skb_recv_datagram(sk, flags, noblock, &err); |
| 616 |
if (!skb) |
if (!skb) |
| 622 |
|
|
| 623 |
copied = skb->len; |
copied = skb->len; |
| 624 |
if (copied > len) { |
if (copied > len) { |
| 625 |
--- linux-4.4.140.orig/net/ipv6/udp.c |
--- linux-4.4.152.orig/net/ipv6/udp.c |
| 626 |
+++ linux-4.4.140/net/ipv6/udp.c |
+++ linux-4.4.152/net/ipv6/udp.c |
| 627 |
@@ -417,6 +417,10 @@ try_again: |
@@ -417,6 +417,10 @@ try_again: |
| 628 |
&peeked, &off, &err); |
&peeked, &off, &err); |
| 629 |
if (!skb) |
if (!skb) |
| 635 |
|
|
| 636 |
ulen = skb->len - sizeof(struct udphdr); |
ulen = skb->len - sizeof(struct udphdr); |
| 637 |
copied = len; |
copied = len; |
| 638 |
--- linux-4.4.140.orig/net/socket.c |
--- linux-4.4.152.orig/net/socket.c |
| 639 |
+++ linux-4.4.140/net/socket.c |
+++ linux-4.4.152/net/socket.c |
| 640 |
@@ -1476,6 +1476,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct |
@@ -1477,6 +1477,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct |
| 641 |
if (err < 0) |
if (err < 0) |
| 642 |
goto out_fd; |
goto out_fd; |
| 643 |
|
|
| 648 |
if (upeer_sockaddr) { |
if (upeer_sockaddr) { |
| 649 |
if (newsock->ops->getname(newsock, (struct sockaddr *)&address, |
if (newsock->ops->getname(newsock, (struct sockaddr *)&address, |
| 650 |
&len, 2) < 0) { |
&len, 2) < 0) { |
| 651 |
--- linux-4.4.140.orig/net/unix/af_unix.c |
--- linux-4.4.152.orig/net/unix/af_unix.c |
| 652 |
+++ linux-4.4.140/net/unix/af_unix.c |
+++ linux-4.4.152/net/unix/af_unix.c |
| 653 |
@@ -2144,6 +2144,10 @@ static int unix_dgram_recvmsg(struct soc |
@@ -2144,6 +2144,10 @@ static int unix_dgram_recvmsg(struct soc |
| 654 |
wake_up_interruptible_sync_poll(&u->peer_wait, |
wake_up_interruptible_sync_poll(&u->peer_wait, |
| 655 |
POLLOUT | POLLWRNORM | POLLWRBAND); |
POLLOUT | POLLWRNORM | POLLWRBAND); |
| 661 |
if (msg->msg_name) |
if (msg->msg_name) |
| 662 |
unix_copy_addr(msg, skb->sk); |
unix_copy_addr(msg, skb->sk); |
| 663 |
|
|
| 664 |
--- linux-4.4.140.orig/security/Kconfig |
--- linux-4.4.152.orig/security/Kconfig |
| 665 |
+++ linux-4.4.140/security/Kconfig |
+++ linux-4.4.152/security/Kconfig |
| 666 |
@@ -173,5 +173,7 @@ config DEFAULT_SECURITY |
@@ -173,5 +173,7 @@ config DEFAULT_SECURITY |
| 667 |
default "apparmor" if DEFAULT_SECURITY_APPARMOR |
default "apparmor" if DEFAULT_SECURITY_APPARMOR |
| 668 |
default "" if DEFAULT_SECURITY_DAC |
default "" if DEFAULT_SECURITY_DAC |
| 671 |
+ |
+ |
| 672 |
endmenu |
endmenu |
| 673 |
|
|
| 674 |
--- linux-4.4.140.orig/security/Makefile |
--- linux-4.4.152.orig/security/Makefile |
| 675 |
+++ linux-4.4.140/security/Makefile |
+++ linux-4.4.152/security/Makefile |
| 676 |
@@ -27,3 +27,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
@@ -27,3 +27,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
| 677 |
# Object integrity file lists |
# Object integrity file lists |
| 678 |
subdir-$(CONFIG_INTEGRITY) += integrity |
subdir-$(CONFIG_INTEGRITY) += integrity |