(empty log message)
@@ -1,6 +1,6 @@ | ||
1 | 1 | This is TOMOYO Linux patch for CentOS 6. |
2 | 2 | |
3 | -Source code for this patch is http://vault.centos.org/6.10/updates/Source/SPackages/kernel-2.6.32-754.15.3.el6.src.rpm | |
3 | +Source code for this patch is http://vault.centos.org/6.10/updates/Source/SPackages/kernel-2.6.32-754.17.1.el6.src.rpm | |
4 | 4 | --- |
5 | 5 | fs/compat.c | 3 ++- |
6 | 6 | fs/compat_ioctl.c | 7 +++++++ |
@@ -35,8 +35,8 @@ | ||
35 | 35 | security/Makefile | 3 +++ |
36 | 36 | 31 files changed, 228 insertions(+), 2 deletions(-) |
37 | 37 | |
38 | ---- linux-2.6.32-754.15.3.el6.orig/fs/compat.c | |
39 | -+++ linux-2.6.32-754.15.3.el6/fs/compat.c | |
38 | +--- linux-2.6.32-754.17.1.el6.orig/fs/compat.c | |
39 | ++++ linux-2.6.32-754.17.1.el6/fs/compat.c | |
40 | 40 | @@ -55,6 +55,7 @@ |
41 | 41 | #include <asm/mmu_context.h> |
42 | 42 | #include <asm/ioctls.h> |
@@ -54,8 +54,8 @@ | ||
54 | 54 | if (retval < 0) |
55 | 55 | goto out; |
56 | 56 | |
57 | ---- linux-2.6.32-754.15.3.el6.orig/fs/compat_ioctl.c | |
58 | -+++ linux-2.6.32-754.15.3.el6/fs/compat_ioctl.c | |
57 | +--- linux-2.6.32-754.17.1.el6.orig/fs/compat_ioctl.c | |
58 | ++++ linux-2.6.32-754.17.1.el6/fs/compat_ioctl.c | |
59 | 59 | @@ -114,6 +114,7 @@ |
60 | 60 | #ifdef CONFIG_SPARC |
61 | 61 | #include <asm/fbio.h> |
@@ -84,8 +84,8 @@ | ||
84 | 84 | if (filp->f_op && filp->f_op->compat_ioctl) { |
85 | 85 | error = filp->f_op->compat_ioctl(filp, cmd, arg); |
86 | 86 | if (error != -ENOIOCTLCMD) |
87 | ---- linux-2.6.32-754.15.3.el6.orig/fs/exec.c | |
88 | -+++ linux-2.6.32-754.15.3.el6/fs/exec.c | |
87 | +--- linux-2.6.32-754.17.1.el6.orig/fs/exec.c | |
88 | ++++ linux-2.6.32-754.17.1.el6/fs/exec.c | |
89 | 89 | @@ -61,6 +61,7 @@ |
90 | 90 | #include <asm/mmu_context.h> |
91 | 91 | #include <asm/tlb.h> |
@@ -103,8 +103,8 @@ | ||
103 | 103 | if (retval < 0) |
104 | 104 | goto out; |
105 | 105 | |
106 | ---- linux-2.6.32-754.15.3.el6.orig/fs/fcntl.c | |
107 | -+++ linux-2.6.32-754.15.3.el6/fs/fcntl.c | |
106 | +--- linux-2.6.32-754.17.1.el6.orig/fs/fcntl.c | |
107 | ++++ linux-2.6.32-754.17.1.el6/fs/fcntl.c | |
108 | 108 | @@ -24,6 +24,7 @@ |
109 | 109 | #include <asm/poll.h> |
110 | 110 | #include <asm/siginfo.h> |
@@ -123,8 +123,8 @@ | ||
123 | 123 | /* O_NOATIME can only be set by the owner or superuser */ |
124 | 124 | if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME)) |
125 | 125 | if (!is_owner_or_cap(inode)) |
126 | ---- linux-2.6.32-754.15.3.el6.orig/fs/ioctl.c | |
127 | -+++ linux-2.6.32-754.15.3.el6/fs/ioctl.c | |
126 | +--- linux-2.6.32-754.17.1.el6.orig/fs/ioctl.c | |
127 | ++++ linux-2.6.32-754.17.1.el6/fs/ioctl.c | |
128 | 128 | @@ -18,6 +18,7 @@ |
129 | 129 | #include <linux/falloc.h> |
130 | 130 |
@@ -151,8 +151,8 @@ | ||
151 | 151 | if (error) |
152 | 152 | goto out_fput; |
153 | 153 | |
154 | ---- linux-2.6.32-754.15.3.el6.orig/fs/namei.c | |
155 | -+++ linux-2.6.32-754.15.3.el6/fs/namei.c | |
154 | +--- linux-2.6.32-754.17.1.el6.orig/fs/namei.c | |
155 | ++++ linux-2.6.32-754.17.1.el6/fs/namei.c | |
156 | 156 | @@ -40,6 +40,8 @@ |
157 | 157 | |
158 | 158 | #define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE]) |
@@ -256,8 +256,8 @@ | ||
256 | 256 | if (error) |
257 | 257 | goto exit5; |
258 | 258 | error = vfs_rename(old_dir->d_inode, old_dentry, |
259 | ---- linux-2.6.32-754.15.3.el6.orig/fs/namespace.c | |
260 | -+++ linux-2.6.32-754.15.3.el6/fs/namespace.c | |
259 | +--- linux-2.6.32-754.17.1.el6.orig/fs/namespace.c | |
260 | ++++ linux-2.6.32-754.17.1.el6/fs/namespace.c | |
261 | 261 | @@ -34,6 +34,7 @@ |
262 | 262 | #include <asm/unistd.h> |
263 | 263 | #include "pnode.h" |
@@ -341,8 +341,8 @@ | ||
341 | 341 | if (error) { |
342 | 342 | path_put(&old); |
343 | 343 | goto out1; |
344 | ---- linux-2.6.32-754.15.3.el6.orig/fs/open.c | |
345 | -+++ linux-2.6.32-754.15.3.el6/fs/open.c | |
344 | +--- linux-2.6.32-754.17.1.el6.orig/fs/open.c | |
345 | ++++ linux-2.6.32-754.17.1.el6/fs/open.c | |
346 | 346 | @@ -32,6 +32,7 @@ |
347 | 347 | #include <linux/fs_struct.h> |
348 | 348 | #include <linux/ima.h> |
@@ -443,8 +443,8 @@ | ||
443 | 443 | if (capable(CAP_SYS_TTY_CONFIG)) { |
444 | 444 | tty_vhangup_self(); |
445 | 445 | return 0; |
446 | ---- linux-2.6.32-754.15.3.el6.orig/fs/proc/version.c | |
447 | -+++ linux-2.6.32-754.15.3.el6/fs/proc/version.c | |
446 | +--- linux-2.6.32-754.17.1.el6.orig/fs/proc/version.c | |
447 | ++++ linux-2.6.32-754.17.1.el6/fs/proc/version.c | |
448 | 448 | @@ -32,3 +32,10 @@ static int __init proc_version_init(void |
449 | 449 | return 0; |
450 | 450 | } |
@@ -452,12 +452,12 @@ | ||
452 | 452 | + |
453 | 453 | +static int __init ccs_show_version(void) |
454 | 454 | +{ |
455 | -+ printk(KERN_INFO "Hook version: 2.6.32-754.15.3.el6 2019/06/19\n"); | |
455 | ++ printk(KERN_INFO "Hook version: 2.6.32-754.17.1.el6 2019/08/04\n"); | |
456 | 456 | + return 0; |
457 | 457 | +} |
458 | 458 | +module_init(ccs_show_version); |
459 | ---- linux-2.6.32-754.15.3.el6.orig/include/linux/init_task.h | |
460 | -+++ linux-2.6.32-754.15.3.el6/include/linux/init_task.h | |
459 | +--- linux-2.6.32-754.17.1.el6.orig/include/linux/init_task.h | |
460 | ++++ linux-2.6.32-754.17.1.el6/include/linux/init_task.h | |
461 | 461 | @@ -123,6 +123,14 @@ extern struct cred init_cred; |
462 | 462 | # define INIT_PERF_EVENTS(tsk) |
463 | 463 | #endif |
@@ -481,8 +481,8 @@ | ||
481 | 481 | } |
482 | 482 | |
483 | 483 | |
484 | ---- linux-2.6.32-754.15.3.el6.orig/include/linux/sched.h | |
485 | -+++ linux-2.6.32-754.15.3.el6/include/linux/sched.h | |
484 | +--- linux-2.6.32-754.17.1.el6.orig/include/linux/sched.h | |
485 | ++++ linux-2.6.32-754.17.1.el6/include/linux/sched.h | |
486 | 486 | @@ -43,6 +43,8 @@ |
487 | 487 | |
488 | 488 | #ifdef __KERNEL__ |
@@ -503,8 +503,8 @@ | ||
503 | 503 | }; |
504 | 504 | |
505 | 505 | /* Future-safe accessor for struct task_struct's cpus_allowed. */ |
506 | ---- linux-2.6.32-754.15.3.el6.orig/include/net/ip.h | |
507 | -+++ linux-2.6.32-754.15.3.el6/include/net/ip.h | |
506 | +--- linux-2.6.32-754.17.1.el6.orig/include/net/ip.h | |
507 | ++++ linux-2.6.32-754.17.1.el6/include/net/ip.h | |
508 | 508 | @@ -33,6 +33,7 @@ |
509 | 509 | #endif |
510 | 510 | #include <net/snmp.h> |
@@ -522,8 +522,8 @@ | ||
522 | 522 | return test_bit(port, sysctl_local_reserved_ports); |
523 | 523 | } |
524 | 524 | |
525 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/compat.c | |
526 | -+++ linux-2.6.32-754.15.3.el6/kernel/compat.c | |
525 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/compat.c | |
526 | ++++ linux-2.6.32-754.17.1.el6/kernel/compat.c | |
527 | 527 | @@ -28,6 +28,7 @@ |
528 | 528 | #include <linux/module.h> |
529 | 529 |
@@ -541,8 +541,8 @@ | ||
541 | 541 | |
542 | 542 | do_settimeofday(&tv); |
543 | 543 | return 0; |
544 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/kexec.c | |
545 | -+++ linux-2.6.32-754.15.3.el6/kernel/kexec.c | |
544 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/kexec.c | |
545 | ++++ linux-2.6.32-754.17.1.el6/kernel/kexec.c | |
546 | 546 | @@ -41,6 +41,7 @@ |
547 | 547 | #include <asm/system.h> |
548 | 548 | #include <asm/sections.h> |
@@ -560,8 +560,8 @@ | ||
560 | 560 | |
561 | 561 | if (kexec_load_disabled) |
562 | 562 | return -EPERM; |
563 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/kmod.c | |
564 | -+++ linux-2.6.32-754.15.3.el6/kernel/kmod.c | |
563 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/kmod.c | |
564 | ++++ linux-2.6.32-754.17.1.el6/kernel/kmod.c | |
565 | 565 | @@ -210,6 +210,11 @@ static int ____call_usermodehelper(void |
566 | 566 | */ |
567 | 567 | set_user_nice(current, 0); |
@@ -574,8 +574,8 @@ | ||
574 | 574 | retval = kernel_execve(sub_info->path, sub_info->argv, sub_info->envp); |
575 | 575 | |
576 | 576 | /* Exec failed? */ |
577 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/module.c | |
578 | -+++ linux-2.6.32-754.15.3.el6/kernel/module.c | |
577 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/module.c | |
578 | ++++ linux-2.6.32-754.17.1.el6/kernel/module.c | |
579 | 579 | @@ -57,6 +57,7 @@ |
580 | 580 | #include <linux/percpu.h> |
581 | 581 | #include <linux/kmemleak.h> |
@@ -602,8 +602,8 @@ | ||
602 | 602 | |
603 | 603 | /* |
604 | 604 | * Make sure we don't speculate past the CAP_SYS_MODULE check. The |
605 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/ptrace.c | |
606 | -+++ linux-2.6.32-754.15.3.el6/kernel/ptrace.c | |
605 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/ptrace.c | |
606 | ++++ linux-2.6.32-754.17.1.el6/kernel/ptrace.c | |
607 | 607 | @@ -23,6 +23,7 @@ |
608 | 608 | #include <linux/uaccess.h> |
609 | 609 | #include <linux/regset.h> |
@@ -630,8 +630,8 @@ | ||
630 | 630 | |
631 | 631 | if (request == PTRACE_TRACEME) { |
632 | 632 | ret = ptrace_traceme(); |
633 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/sched.c | |
634 | -+++ linux-2.6.32-754.15.3.el6/kernel/sched.c | |
633 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/sched.c | |
634 | ++++ linux-2.6.32-754.17.1.el6/kernel/sched.c | |
635 | 635 | @@ -79,6 +79,7 @@ |
636 | 636 | #ifdef CONFIG_PARAVIRT |
637 | 637 | #include <asm/paravirt.h> |
@@ -649,8 +649,8 @@ | ||
649 | 649 | |
650 | 650 | /* |
651 | 651 | * Setpriority might change our priority at the same moment. |
652 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/signal.c | |
653 | -+++ linux-2.6.32-754.15.3.el6/kernel/signal.c | |
652 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/signal.c | |
653 | ++++ linux-2.6.32-754.17.1.el6/kernel/signal.c | |
654 | 654 | @@ -36,6 +36,7 @@ |
655 | 655 | #include <asm/unistd.h> |
656 | 656 | #include <asm/siginfo.h> |
@@ -704,8 +704,8 @@ | ||
704 | 704 | |
705 | 705 | return do_send_specific(tgid, pid, sig, info); |
706 | 706 | } |
707 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/sys.c | |
708 | -+++ linux-2.6.32-754.15.3.el6/kernel/sys.c | |
707 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/sys.c | |
708 | ++++ linux-2.6.32-754.17.1.el6/kernel/sys.c | |
709 | 709 | @@ -50,6 +50,7 @@ |
710 | 710 | #include <asm/uaccess.h> |
711 | 711 | #include <asm/io.h> |
@@ -752,8 +752,8 @@ | ||
752 | 752 | |
753 | 753 | down_write(&uts_sem); |
754 | 754 | errno = -EFAULT; |
755 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/sysctl.c | |
756 | -+++ linux-2.6.32-754.15.3.el6/kernel/sysctl.c | |
755 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/sysctl.c | |
756 | ++++ linux-2.6.32-754.17.1.el6/kernel/sysctl.c | |
757 | 757 | @@ -57,6 +57,7 @@ |
758 | 758 | |
759 | 759 | #include <asm/uaccess.h> |
@@ -772,8 +772,8 @@ | ||
772 | 772 | error = parse_table(name, nlen, oldval, oldlenp, |
773 | 773 | newval, newlen, |
774 | 774 | head->root, head->ctl_table); |
775 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/time.c | |
776 | -+++ linux-2.6.32-754.15.3.el6/kernel/time.c | |
775 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/time.c | |
776 | ++++ linux-2.6.32-754.17.1.el6/kernel/time.c | |
777 | 777 | @@ -41,6 +41,7 @@ |
778 | 778 | |
779 | 779 | #include <asm/uaccess.h> |
@@ -800,8 +800,8 @@ | ||
800 | 800 | |
801 | 801 | if (tz) { |
802 | 802 | /* SMP safe, global irq locking makes it work. */ |
803 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/time/ntp.c | |
804 | -+++ linux-2.6.32-754.15.3.el6/kernel/time/ntp.c | |
803 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/time/ntp.c | |
804 | ++++ linux-2.6.32-754.17.1.el6/kernel/time/ntp.c | |
805 | 805 | @@ -14,6 +14,7 @@ |
806 | 806 | #include <linux/timex.h> |
807 | 807 | #include <linux/time.h> |
@@ -826,8 +826,8 @@ | ||
826 | 826 | |
827 | 827 | /* |
828 | 828 | * if the quartz is off by more than 10% then |
829 | ---- linux-2.6.32-754.15.3.el6.orig/net/ipv4/raw.c | |
830 | -+++ linux-2.6.32-754.15.3.el6/net/ipv4/raw.c | |
829 | +--- linux-2.6.32-754.17.1.el6.orig/net/ipv4/raw.c | |
830 | ++++ linux-2.6.32-754.17.1.el6/net/ipv4/raw.c | |
831 | 831 | @@ -77,6 +77,7 @@ |
832 | 832 | #include <linux/seq_file.h> |
833 | 833 | #include <linux/netfilter.h> |
@@ -846,8 +846,8 @@ | ||
846 | 846 | |
847 | 847 | copied = skb->len; |
848 | 848 | if (len < copied) { |
849 | ---- linux-2.6.32-754.15.3.el6.orig/net/ipv4/udp.c | |
850 | -+++ linux-2.6.32-754.15.3.el6/net/ipv4/udp.c | |
849 | +--- linux-2.6.32-754.17.1.el6.orig/net/ipv4/udp.c | |
850 | ++++ linux-2.6.32-754.17.1.el6/net/ipv4/udp.c | |
851 | 851 | @@ -108,6 +108,7 @@ |
852 | 852 | #include <trace/events/udp.h> |
853 | 853 | #include <net/busy_poll.h> |
@@ -866,8 +866,8 @@ | ||
866 | 866 | |
867 | 867 | ulen = skb->len - sizeof(struct udphdr); |
868 | 868 | copied = len; |
869 | ---- linux-2.6.32-754.15.3.el6.orig/net/ipv6/raw.c | |
870 | -+++ linux-2.6.32-754.15.3.el6/net/ipv6/raw.c | |
869 | +--- linux-2.6.32-754.17.1.el6.orig/net/ipv6/raw.c | |
870 | ++++ linux-2.6.32-754.17.1.el6/net/ipv6/raw.c | |
871 | 871 | @@ -59,6 +59,7 @@ |
872 | 872 | |
873 | 873 | #include <linux/proc_fs.h> |
@@ -886,8 +886,8 @@ | ||
886 | 886 | |
887 | 887 | copied = skb->len; |
888 | 888 | if (copied > len) { |
889 | ---- linux-2.6.32-754.15.3.el6.orig/net/ipv6/udp.c | |
890 | -+++ linux-2.6.32-754.15.3.el6/net/ipv6/udp.c | |
889 | +--- linux-2.6.32-754.17.1.el6.orig/net/ipv6/udp.c | |
890 | ++++ linux-2.6.32-754.17.1.el6/net/ipv6/udp.c | |
891 | 891 | @@ -50,6 +50,7 @@ |
892 | 892 | #include <linux/proc_fs.h> |
893 | 893 | #include <linux/seq_file.h> |
@@ -906,8 +906,8 @@ | ||
906 | 906 | |
907 | 907 | ulen = skb->len - sizeof(struct udphdr); |
908 | 908 | copied = len; |
909 | ---- linux-2.6.32-754.15.3.el6.orig/net/socket.c | |
910 | -+++ linux-2.6.32-754.15.3.el6/net/socket.c | |
909 | +--- linux-2.6.32-754.17.1.el6.orig/net/socket.c | |
910 | ++++ linux-2.6.32-754.17.1.el6/net/socket.c | |
911 | 911 | @@ -101,6 +101,7 @@ |
912 | 912 | #ifndef __GENKSYMS__ |
913 | 913 | #include <net/busy_poll.h> |
@@ -977,8 +977,8 @@ | ||
977 | 977 | if (err) |
978 | 978 | goto out_put; |
979 | 979 | |
980 | ---- linux-2.6.32-754.15.3.el6.orig/net/unix/af_unix.c | |
981 | -+++ linux-2.6.32-754.15.3.el6/net/unix/af_unix.c | |
980 | +--- linux-2.6.32-754.17.1.el6.orig/net/unix/af_unix.c | |
981 | ++++ linux-2.6.32-754.17.1.el6/net/unix/af_unix.c | |
982 | 982 | @@ -115,6 +115,7 @@ |
983 | 983 | #include <linux/mount.h> |
984 | 984 | #include <net/checksum.h> |
@@ -998,8 +998,8 @@ | ||
998 | 998 | if (err) |
999 | 999 | goto out_mknod_dput; |
1000 | 1000 | err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0); |
1001 | ---- linux-2.6.32-754.15.3.el6.orig/security/Kconfig | |
1002 | -+++ linux-2.6.32-754.15.3.el6/security/Kconfig | |
1001 | +--- linux-2.6.32-754.17.1.el6.orig/security/Kconfig | |
1002 | ++++ linux-2.6.32-754.17.1.el6/security/Kconfig | |
1003 | 1003 | @@ -188,5 +188,7 @@ source security/tomoyo/Kconfig |
1004 | 1004 | |
1005 | 1005 | source security/integrity/ima/Kconfig |
@@ -1008,8 +1008,8 @@ | ||
1008 | 1008 | + |
1009 | 1009 | endmenu |
1010 | 1010 | |
1011 | ---- linux-2.6.32-754.15.3.el6.orig/security/Makefile | |
1012 | -+++ linux-2.6.32-754.15.3.el6/security/Makefile | |
1011 | +--- linux-2.6.32-754.17.1.el6.orig/security/Makefile | |
1012 | ++++ linux-2.6.32-754.17.1.el6/security/Makefile | |
1013 | 1013 | @@ -25,3 +25,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
1014 | 1014 | # Object integrity file lists |
1015 | 1015 | subdir-$(CONFIG_IMA) += integrity/ima |
@@ -10,12 +10,12 @@ | ||
10 | 10 | |
11 | 11 | cd /tmp/ || die "Can't chdir to /tmp/ ." |
12 | 12 | |
13 | -if [ ! -r kernel-2.6.32-754.15.3.el6.src.rpm ] | |
13 | +if [ ! -r kernel-2.6.32-754.17.1.el6.src.rpm ] | |
14 | 14 | then |
15 | - wget http://vault.centos.org/6.10/updates/Source/SPackages/kernel-2.6.32-754.15.3.el6.src.rpm || die "Can't download source package." | |
15 | + wget http://vault.centos.org/6.10/updates/Source/SPackages/kernel-2.6.32-754.17.1.el6.src.rpm || die "Can't download source package." | |
16 | 16 | fi |
17 | -LANG=C rpm --checksig kernel-2.6.32-754.15.3.el6.src.rpm | grep -F ': rsa sha1 (md5) pgp md5 OK' || die "Can't verify signature." | |
18 | -rpm -ivh kernel-2.6.32-754.15.3.el6.src.rpm || die "Can't install source package." | |
17 | +LANG=C rpm --checksig kernel-2.6.32-754.17.1.el6.src.rpm | grep -F ': rsa sha1 (md5) pgp md5 OK' || die "Can't verify signature." | |
18 | +rpm -ivh kernel-2.6.32-754.17.1.el6.src.rpm || die "Can't install source package." | |
19 | 19 | |
20 | 20 | cd ~/rpmbuild/SOURCES/ || die "Can't chdir to ~/rpmbuild/SOURCES/ ." |
21 | 21 | if [ ! -r ccs-patch-1.7.3-20171111.tar.gz ] |
@@ -35,7 +35,7 @@ | ||
35 | 35 | -# % define buildid .local |
36 | 36 | +%define buildid _tomoyo_1.7.3p5 |
37 | 37 | |
38 | - %define distro_build 754.15.3 | |
38 | + %define distro_build 754.17.1 | |
39 | 39 | %define kabi_build 754 |
40 | 40 | @@ -438,7 +438,7 @@ |
41 | 41 | # Packages that need to be installed before the kernel is, because the %post |
@@ -1,6 +1,6 @@ | ||
1 | 1 | This is TOMOYO Linux patch for CentOS 6. |
2 | 2 | |
3 | -Source code for this patch is http://vault.centos.org/6.10/updates/Source/SPackages/kernel-2.6.32-754.15.3.el6.src.rpm | |
3 | +Source code for this patch is http://vault.centos.org/6.10/updates/Source/SPackages/kernel-2.6.32-754.17.1.el6.src.rpm | |
4 | 4 | --- |
5 | 5 | fs/compat.c | 2 +- |
6 | 6 | fs/compat_ioctl.c | 3 +++ |
@@ -37,8 +37,8 @@ | ||
37 | 37 | security/Makefile | 3 +++ |
38 | 38 | 33 files changed, 201 insertions(+), 2 deletions(-) |
39 | 39 | |
40 | ---- linux-2.6.32-754.15.3.el6.orig/fs/compat.c | |
41 | -+++ linux-2.6.32-754.15.3.el6/fs/compat.c | |
40 | +--- linux-2.6.32-754.17.1.el6.orig/fs/compat.c | |
41 | ++++ linux-2.6.32-754.17.1.el6/fs/compat.c | |
42 | 42 | @@ -1524,7 +1524,7 @@ int compat_do_execve(const char * filena |
43 | 43 | if (retval < 0) |
44 | 44 | goto out; |
@@ -48,8 +48,8 @@ | ||
48 | 48 | if (retval < 0) |
49 | 49 | goto out; |
50 | 50 | |
51 | ---- linux-2.6.32-754.15.3.el6.orig/fs/compat_ioctl.c | |
52 | -+++ linux-2.6.32-754.15.3.el6/fs/compat_ioctl.c | |
51 | +--- linux-2.6.32-754.17.1.el6.orig/fs/compat_ioctl.c | |
52 | ++++ linux-2.6.32-754.17.1.el6/fs/compat_ioctl.c | |
53 | 53 | @@ -114,6 +114,7 @@ |
54 | 54 | #ifdef CONFIG_SPARC |
55 | 55 | #include <asm/fbio.h> |
@@ -67,8 +67,8 @@ | ||
67 | 67 | if (error) |
68 | 68 | goto out_fput; |
69 | 69 | |
70 | ---- linux-2.6.32-754.15.3.el6.orig/fs/exec.c | |
71 | -+++ linux-2.6.32-754.15.3.el6/fs/exec.c | |
70 | +--- linux-2.6.32-754.17.1.el6.orig/fs/exec.c | |
71 | ++++ linux-2.6.32-754.17.1.el6/fs/exec.c | |
72 | 72 | @@ -1511,7 +1511,7 @@ int do_execve(const char * filename, |
73 | 73 | goto out; |
74 | 74 |
@@ -78,8 +78,8 @@ | ||
78 | 78 | if (retval < 0) |
79 | 79 | goto out; |
80 | 80 | |
81 | ---- linux-2.6.32-754.15.3.el6.orig/fs/fcntl.c | |
82 | -+++ linux-2.6.32-754.15.3.el6/fs/fcntl.c | |
81 | +--- linux-2.6.32-754.17.1.el6.orig/fs/fcntl.c | |
82 | ++++ linux-2.6.32-754.17.1.el6/fs/fcntl.c | |
83 | 83 | @@ -431,6 +431,8 @@ SYSCALL_DEFINE3(fcntl, unsigned int, fd, |
84 | 84 | goto out; |
85 | 85 |
@@ -98,8 +98,8 @@ | ||
98 | 98 | if (err) { |
99 | 99 | fput(filp); |
100 | 100 | return err; |
101 | ---- linux-2.6.32-754.15.3.el6.orig/fs/ioctl.c | |
102 | -+++ linux-2.6.32-754.15.3.el6/fs/ioctl.c | |
101 | +--- linux-2.6.32-754.17.1.el6.orig/fs/ioctl.c | |
102 | ++++ linux-2.6.32-754.17.1.el6/fs/ioctl.c | |
103 | 103 | @@ -639,6 +639,8 @@ SYSCALL_DEFINE3(ioctl, unsigned int, fd, |
104 | 104 | goto out; |
105 | 105 |
@@ -109,8 +109,8 @@ | ||
109 | 109 | if (error) |
110 | 110 | goto out_fput; |
111 | 111 | |
112 | ---- linux-2.6.32-754.15.3.el6.orig/fs/namei.c | |
113 | -+++ linux-2.6.32-754.15.3.el6/fs/namei.c | |
112 | +--- linux-2.6.32-754.17.1.el6.orig/fs/namei.c | |
113 | ++++ linux-2.6.32-754.17.1.el6/fs/namei.c | |
114 | 114 | @@ -2070,6 +2070,11 @@ int may_open(struct path *path, int acc_ |
115 | 115 | if (flag & O_NOATIME && !is_owner_or_cap(inode)) |
116 | 116 | return -EPERM; |
@@ -198,8 +198,8 @@ | ||
198 | 198 | if (error) |
199 | 199 | goto exit5; |
200 | 200 | error = vfs_rename(old_dir->d_inode, old_dentry, |
201 | ---- linux-2.6.32-754.15.3.el6.orig/fs/namespace.c | |
202 | -+++ linux-2.6.32-754.15.3.el6/fs/namespace.c | |
201 | +--- linux-2.6.32-754.17.1.el6.orig/fs/namespace.c | |
202 | ++++ linux-2.6.32-754.17.1.el6/fs/namespace.c | |
203 | 203 | @@ -1097,6 +1097,8 @@ static int do_umount(struct vfsmount *mn |
204 | 204 | LIST_HEAD(umount_list); |
205 | 205 |
@@ -236,8 +236,8 @@ | ||
236 | 236 | if (error) { |
237 | 237 | path_put(&old); |
238 | 238 | goto out1; |
239 | ---- linux-2.6.32-754.15.3.el6.orig/fs/open.c | |
240 | -+++ linux-2.6.32-754.15.3.el6/fs/open.c | |
239 | +--- linux-2.6.32-754.17.1.el6.orig/fs/open.c | |
240 | ++++ linux-2.6.32-754.17.1.el6/fs/open.c | |
241 | 241 | @@ -103,6 +103,8 @@ long vfs_truncate(struct path *path, lof |
242 | 242 | error = locks_verify_truncate(inode, NULL, length); |
243 | 243 | if (!error) |
@@ -328,8 +328,8 @@ | ||
328 | 328 | if (capable(CAP_SYS_TTY_CONFIG)) { |
329 | 329 | tty_vhangup_self(); |
330 | 330 | return 0; |
331 | ---- linux-2.6.32-754.15.3.el6.orig/fs/proc/version.c | |
332 | -+++ linux-2.6.32-754.15.3.el6/fs/proc/version.c | |
331 | +--- linux-2.6.32-754.17.1.el6.orig/fs/proc/version.c | |
332 | ++++ linux-2.6.32-754.17.1.el6/fs/proc/version.c | |
333 | 333 | @@ -32,3 +32,10 @@ static int __init proc_version_init(void |
334 | 334 | return 0; |
335 | 335 | } |
@@ -337,12 +337,12 @@ | ||
337 | 337 | + |
338 | 338 | +static int __init ccs_show_version(void) |
339 | 339 | +{ |
340 | -+ printk(KERN_INFO "Hook version: 2.6.32-754.15.3.el6 2019/06/19\n"); | |
340 | ++ printk(KERN_INFO "Hook version: 2.6.32-754.17.1.el6 2019/08/04\n"); | |
341 | 341 | + return 0; |
342 | 342 | +} |
343 | 343 | +module_init(ccs_show_version); |
344 | ---- linux-2.6.32-754.15.3.el6.orig/fs/stat.c | |
345 | -+++ linux-2.6.32-754.15.3.el6/fs/stat.c | |
344 | +--- linux-2.6.32-754.17.1.el6.orig/fs/stat.c | |
345 | ++++ linux-2.6.32-754.17.1.el6/fs/stat.c | |
346 | 346 | @@ -43,6 +43,8 @@ int vfs_getattr(struct vfsmount *mnt, st |
347 | 347 | int retval; |
348 | 348 |
@@ -352,8 +352,8 @@ | ||
352 | 352 | if (retval) |
353 | 353 | return retval; |
354 | 354 | |
355 | ---- linux-2.6.32-754.15.3.el6.orig/include/linux/init_task.h | |
356 | -+++ linux-2.6.32-754.15.3.el6/include/linux/init_task.h | |
355 | +--- linux-2.6.32-754.17.1.el6.orig/include/linux/init_task.h | |
356 | ++++ linux-2.6.32-754.17.1.el6/include/linux/init_task.h | |
357 | 357 | @@ -123,6 +123,14 @@ extern struct cred init_cred; |
358 | 358 | # define INIT_PERF_EVENTS(tsk) |
359 | 359 | #endif |
@@ -377,8 +377,8 @@ | ||
377 | 377 | } |
378 | 378 | |
379 | 379 | |
380 | ---- linux-2.6.32-754.15.3.el6.orig/include/linux/sched.h | |
381 | -+++ linux-2.6.32-754.15.3.el6/include/linux/sched.h | |
380 | +--- linux-2.6.32-754.17.1.el6.orig/include/linux/sched.h | |
381 | ++++ linux-2.6.32-754.17.1.el6/include/linux/sched.h | |
382 | 382 | @@ -43,6 +43,8 @@ |
383 | 383 | |
384 | 384 | #ifdef __KERNEL__ |
@@ -399,8 +399,8 @@ | ||
399 | 399 | }; |
400 | 400 | |
401 | 401 | /* Future-safe accessor for struct task_struct's cpus_allowed. */ |
402 | ---- linux-2.6.32-754.15.3.el6.orig/include/linux/security.h | |
403 | -+++ linux-2.6.32-754.15.3.el6/include/linux/security.h | |
402 | +--- linux-2.6.32-754.17.1.el6.orig/include/linux/security.h | |
403 | ++++ linux-2.6.32-754.17.1.el6/include/linux/security.h | |
404 | 404 | @@ -35,6 +35,7 @@ |
405 | 405 | #include <linux/xfrm.h> |
406 | 406 | #include <linux/gfp.h> |
@@ -409,8 +409,8 @@ | ||
409 | 409 | |
410 | 410 | /* Maximum number of letters for an LSM name string */ |
411 | 411 | #define SECURITY_NAME_MAX 10 |
412 | ---- linux-2.6.32-754.15.3.el6.orig/include/net/ip.h | |
413 | -+++ linux-2.6.32-754.15.3.el6/include/net/ip.h | |
412 | +--- linux-2.6.32-754.17.1.el6.orig/include/net/ip.h | |
413 | ++++ linux-2.6.32-754.17.1.el6/include/net/ip.h | |
414 | 414 | @@ -33,6 +33,7 @@ |
415 | 415 | #endif |
416 | 416 | #include <net/snmp.h> |
@@ -428,8 +428,8 @@ | ||
428 | 428 | return test_bit(port, sysctl_local_reserved_ports); |
429 | 429 | } |
430 | 430 | |
431 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/compat.c | |
432 | -+++ linux-2.6.32-754.15.3.el6/kernel/compat.c | |
431 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/compat.c | |
432 | ++++ linux-2.6.32-754.17.1.el6/kernel/compat.c | |
433 | 433 | @@ -1005,6 +1005,8 @@ asmlinkage long compat_sys_stime(compat_ |
434 | 434 | err = security_settime(&tv, NULL); |
435 | 435 | if (err) |
@@ -439,8 +439,8 @@ | ||
439 | 439 | |
440 | 440 | do_settimeofday(&tv); |
441 | 441 | return 0; |
442 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/fork.c | |
443 | -+++ linux-2.6.32-754.15.3.el6/kernel/fork.c | |
442 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/fork.c | |
443 | ++++ linux-2.6.32-754.17.1.el6/kernel/fork.c | |
444 | 444 | @@ -206,6 +206,7 @@ void __put_task_struct(struct task_struc |
445 | 445 | exit_creds(tsk); |
446 | 446 | delayacct_tsk_free(tsk); |
@@ -467,8 +467,8 @@ | ||
467 | 467 | bad_fork_cleanup_perf: |
468 | 468 | perf_event_free_task(p); |
469 | 469 | bad_fork_cleanup_policy: |
470 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/kexec.c | |
471 | -+++ linux-2.6.32-754.15.3.el6/kernel/kexec.c | |
470 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/kexec.c | |
471 | ++++ linux-2.6.32-754.17.1.el6/kernel/kexec.c | |
472 | 472 | @@ -41,6 +41,7 @@ |
473 | 473 | #include <asm/system.h> |
474 | 474 | #include <asm/sections.h> |
@@ -486,8 +486,8 @@ | ||
486 | 486 | |
487 | 487 | if (kexec_load_disabled) |
488 | 488 | return -EPERM; |
489 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/module.c | |
490 | -+++ linux-2.6.32-754.15.3.el6/kernel/module.c | |
489 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/module.c | |
490 | ++++ linux-2.6.32-754.17.1.el6/kernel/module.c | |
491 | 491 | @@ -57,6 +57,7 @@ |
492 | 492 | #include <linux/percpu.h> |
493 | 493 | #include <linux/kmemleak.h> |
@@ -514,8 +514,8 @@ | ||
514 | 514 | |
515 | 515 | /* |
516 | 516 | * Make sure we don't speculate past the CAP_SYS_MODULE check. The |
517 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/ptrace.c | |
518 | -+++ linux-2.6.32-754.15.3.el6/kernel/ptrace.c | |
517 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/ptrace.c | |
518 | ++++ linux-2.6.32-754.17.1.el6/kernel/ptrace.c | |
519 | 519 | @@ -199,6 +199,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
520 | 520 | { |
521 | 521 | struct task_struct *child; |
@@ -540,8 +540,8 @@ | ||
540 | 540 | |
541 | 541 | if (request == PTRACE_TRACEME) { |
542 | 542 | ret = ptrace_traceme(); |
543 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/sched.c | |
544 | -+++ linux-2.6.32-754.15.3.el6/kernel/sched.c | |
543 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/sched.c | |
544 | ++++ linux-2.6.32-754.17.1.el6/kernel/sched.c | |
545 | 545 | @@ -6869,6 +6869,8 @@ int can_nice(const struct task_struct *p |
546 | 546 | SYSCALL_DEFINE1(nice, int, increment) |
547 | 547 | { |
@@ -551,8 +551,8 @@ | ||
551 | 551 | |
552 | 552 | /* |
553 | 553 | * Setpriority might change our priority at the same moment. |
554 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/signal.c | |
555 | -+++ linux-2.6.32-754.15.3.el6/kernel/signal.c | |
554 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/signal.c | |
555 | ++++ linux-2.6.32-754.17.1.el6/kernel/signal.c | |
556 | 556 | @@ -2316,6 +2316,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
557 | 557 | SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
558 | 558 | { |
@@ -598,8 +598,8 @@ | ||
598 | 598 | |
599 | 599 | return do_send_specific(tgid, pid, sig, info); |
600 | 600 | } |
601 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/sys.c | |
602 | -+++ linux-2.6.32-754.15.3.el6/kernel/sys.c | |
601 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/sys.c | |
602 | ++++ linux-2.6.32-754.17.1.el6/kernel/sys.c | |
603 | 603 | @@ -163,6 +163,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
604 | 604 | |
605 | 605 | if (which > PRIO_USER || which < PRIO_PROCESS) |
@@ -638,8 +638,8 @@ | ||
638 | 638 | |
639 | 639 | down_write(&uts_sem); |
640 | 640 | errno = -EFAULT; |
641 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/sysctl.c | |
642 | -+++ linux-2.6.32-754.15.3.el6/kernel/sysctl.c | |
641 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/sysctl.c | |
642 | ++++ linux-2.6.32-754.17.1.el6/kernel/sysctl.c | |
643 | 643 | @@ -2131,6 +2131,9 @@ int do_sysctl(int __user *name, int nlen |
644 | 644 | |
645 | 645 | for (head = sysctl_head_next(NULL); head; |
@@ -650,8 +650,8 @@ | ||
650 | 650 | error = parse_table(name, nlen, oldval, oldlenp, |
651 | 651 | newval, newlen, |
652 | 652 | head->root, head->ctl_table); |
653 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/time.c | |
654 | -+++ linux-2.6.32-754.15.3.el6/kernel/time.c | |
653 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/time.c | |
654 | ++++ linux-2.6.32-754.17.1.el6/kernel/time.c | |
655 | 655 | @@ -92,6 +92,8 @@ SYSCALL_DEFINE1(stime, time_t __user *, |
656 | 656 | err = security_settime(&tv, NULL); |
657 | 657 | if (err) |
@@ -670,8 +670,8 @@ | ||
670 | 670 | |
671 | 671 | if (tz) { |
672 | 672 | /* SMP safe, global irq locking makes it work. */ |
673 | ---- linux-2.6.32-754.15.3.el6.orig/kernel/time/ntp.c | |
674 | -+++ linux-2.6.32-754.15.3.el6/kernel/time/ntp.c | |
673 | +--- linux-2.6.32-754.17.1.el6.orig/kernel/time/ntp.c | |
674 | ++++ linux-2.6.32-754.17.1.el6/kernel/time/ntp.c | |
675 | 675 | @@ -14,6 +14,7 @@ |
676 | 676 | #include <linux/timex.h> |
677 | 677 | #include <linux/time.h> |
@@ -696,8 +696,8 @@ | ||
696 | 696 | |
697 | 697 | /* |
698 | 698 | * if the quartz is off by more than 10% then |
699 | ---- linux-2.6.32-754.15.3.el6.orig/net/ipv4/raw.c | |
700 | -+++ linux-2.6.32-754.15.3.el6/net/ipv4/raw.c | |
699 | +--- linux-2.6.32-754.17.1.el6.orig/net/ipv4/raw.c | |
700 | ++++ linux-2.6.32-754.17.1.el6/net/ipv4/raw.c | |
701 | 701 | @@ -77,6 +77,7 @@ |
702 | 702 | #include <linux/seq_file.h> |
703 | 703 | #include <linux/netfilter.h> |
@@ -717,8 +717,8 @@ | ||
717 | 717 | |
718 | 718 | copied = skb->len; |
719 | 719 | if (len < copied) { |
720 | ---- linux-2.6.32-754.15.3.el6.orig/net/ipv4/udp.c | |
721 | -+++ linux-2.6.32-754.15.3.el6/net/ipv4/udp.c | |
720 | +--- linux-2.6.32-754.17.1.el6.orig/net/ipv4/udp.c | |
721 | ++++ linux-2.6.32-754.17.1.el6/net/ipv4/udp.c | |
722 | 722 | @@ -108,6 +108,7 @@ |
723 | 723 | #include <trace/events/udp.h> |
724 | 724 | #include <net/busy_poll.h> |
@@ -738,8 +738,8 @@ | ||
738 | 738 | |
739 | 739 | ulen = skb->len - sizeof(struct udphdr); |
740 | 740 | copied = len; |
741 | ---- linux-2.6.32-754.15.3.el6.orig/net/ipv6/raw.c | |
742 | -+++ linux-2.6.32-754.15.3.el6/net/ipv6/raw.c | |
741 | +--- linux-2.6.32-754.17.1.el6.orig/net/ipv6/raw.c | |
742 | ++++ linux-2.6.32-754.17.1.el6/net/ipv6/raw.c | |
743 | 743 | @@ -59,6 +59,7 @@ |
744 | 744 | |
745 | 745 | #include <linux/proc_fs.h> |
@@ -759,8 +759,8 @@ | ||
759 | 759 | |
760 | 760 | copied = skb->len; |
761 | 761 | if (copied > len) { |
762 | ---- linux-2.6.32-754.15.3.el6.orig/net/ipv6/udp.c | |
763 | -+++ linux-2.6.32-754.15.3.el6/net/ipv6/udp.c | |
762 | +--- linux-2.6.32-754.17.1.el6.orig/net/ipv6/udp.c | |
763 | ++++ linux-2.6.32-754.17.1.el6/net/ipv6/udp.c | |
764 | 764 | @@ -50,6 +50,7 @@ |
765 | 765 | #include <linux/proc_fs.h> |
766 | 766 | #include <linux/seq_file.h> |
@@ -780,8 +780,8 @@ | ||
780 | 780 | |
781 | 781 | ulen = skb->len - sizeof(struct udphdr); |
782 | 782 | copied = len; |
783 | ---- linux-2.6.32-754.15.3.el6.orig/net/socket.c | |
784 | -+++ linux-2.6.32-754.15.3.el6/net/socket.c | |
783 | +--- linux-2.6.32-754.17.1.el6.orig/net/socket.c | |
784 | ++++ linux-2.6.32-754.17.1.el6/net/socket.c | |
785 | 785 | @@ -579,6 +579,8 @@ static inline int __sock_sendmsg(struct |
786 | 786 | struct msghdr *msg, size_t size) |
787 | 787 | { |
@@ -842,8 +842,8 @@ | ||
842 | 842 | if (err) |
843 | 843 | goto out_put; |
844 | 844 | |
845 | ---- linux-2.6.32-754.15.3.el6.orig/net/unix/af_unix.c | |
846 | -+++ linux-2.6.32-754.15.3.el6/net/unix/af_unix.c | |
845 | +--- linux-2.6.32-754.17.1.el6.orig/net/unix/af_unix.c | |
846 | ++++ linux-2.6.32-754.17.1.el6/net/unix/af_unix.c | |
847 | 847 | @@ -984,6 +984,9 @@ static int unix_bind(struct socket *sock |
848 | 848 | mode = S_IFSOCK | |
849 | 849 | (SOCK_INODE(sock)->i_mode & ~current_umask()); |
@@ -865,8 +865,8 @@ | ||
865 | 865 | if (msg->msg_name) |
866 | 866 | unix_copy_addr(msg, skb->sk); |
867 | 867 | |
868 | ---- linux-2.6.32-754.15.3.el6.orig/security/Kconfig | |
869 | -+++ linux-2.6.32-754.15.3.el6/security/Kconfig | |
868 | +--- linux-2.6.32-754.17.1.el6.orig/security/Kconfig | |
869 | ++++ linux-2.6.32-754.17.1.el6/security/Kconfig | |
870 | 870 | @@ -188,5 +188,7 @@ source security/tomoyo/Kconfig |
871 | 871 | |
872 | 872 | source security/integrity/ima/Kconfig |
@@ -875,8 +875,8 @@ | ||
875 | 875 | + |
876 | 876 | endmenu |
877 | 877 | |
878 | ---- linux-2.6.32-754.15.3.el6.orig/security/Makefile | |
879 | -+++ linux-2.6.32-754.15.3.el6/security/Makefile | |
878 | +--- linux-2.6.32-754.17.1.el6.orig/security/Makefile | |
879 | ++++ linux-2.6.32-754.17.1.el6/security/Makefile | |
880 | 880 | @@ -25,3 +25,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
881 | 881 | # Object integrity file lists |
882 | 882 | subdir-$(CONFIG_IMA) += integrity/ima |
@@ -1,6 +1,6 @@ | ||
1 | 1 | This is TOMOYO Linux patch for CentOS 7. |
2 | 2 | |
3 | -Source code for this patch is http://vault.centos.org/centos/7/updates/Source/SPackages/kernel-3.10.0-957.21.3.el7.src.rpm | |
3 | +Source code for this patch is http://vault.centos.org/centos/7/updates/Source/SPackages/kernel-3.10.0-957.27.2.el7.src.rpm | |
4 | 4 | --- |
5 | 5 | fs/exec.c | 2 |
6 | 6 | fs/open.c | 2 |
@@ -28,8 +28,8 @@ | ||
28 | 28 | security/security.c | 111 +++++++++++++++++++++++++++++++++++++++++----- |
29 | 29 | 24 files changed, 248 insertions(+), 37 deletions(-) |
30 | 30 | |
31 | ---- linux-3.10.0-957.21.3.el7.orig/fs/exec.c | |
32 | -+++ linux-3.10.0-957.21.3.el7/fs/exec.c | |
31 | +--- linux-3.10.0-957.27.2.el7.orig/fs/exec.c | |
32 | ++++ linux-3.10.0-957.27.2.el7/fs/exec.c | |
33 | 33 | @@ -1507,7 +1507,7 @@ static int exec_binprm(struct linux_binp |
34 | 34 | old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent)); |
35 | 35 | rcu_read_unlock(); |
@@ -39,8 +39,8 @@ | ||
39 | 39 | if (ret >= 0) { |
40 | 40 | audit_bprm(bprm); |
41 | 41 | trace_sched_process_exec(current, old_pid, bprm); |
42 | ---- linux-3.10.0-957.21.3.el7.orig/fs/open.c | |
43 | -+++ linux-3.10.0-957.21.3.el7/fs/open.c | |
42 | +--- linux-3.10.0-957.27.2.el7.orig/fs/open.c | |
43 | ++++ linux-3.10.0-957.27.2.el7/fs/open.c | |
44 | 44 | @@ -1142,6 +1142,8 @@ EXPORT_SYMBOL(sys_close); |
45 | 45 | */ |
46 | 46 | SYSCALL_DEFINE0(vhangup) |
@@ -50,8 +50,8 @@ | ||
50 | 50 | if (capable(CAP_SYS_TTY_CONFIG)) { |
51 | 51 | tty_vhangup_self(); |
52 | 52 | return 0; |
53 | ---- linux-3.10.0-957.21.3.el7.orig/fs/proc/version.c | |
54 | -+++ linux-3.10.0-957.21.3.el7/fs/proc/version.c | |
53 | +--- linux-3.10.0-957.27.2.el7.orig/fs/proc/version.c | |
54 | ++++ linux-3.10.0-957.27.2.el7/fs/proc/version.c | |
55 | 55 | @@ -32,3 +32,10 @@ static int __init proc_version_init(void |
56 | 56 | return 0; |
57 | 57 | } |
@@ -59,12 +59,12 @@ | ||
59 | 59 | + |
60 | 60 | +static int __init ccs_show_version(void) |
61 | 61 | +{ |
62 | -+ printk(KERN_INFO "Hook version: 3.10.0-957.21.3.el7 2019/06/19\n"); | |
62 | ++ printk(KERN_INFO "Hook version: 3.10.0-957.27.2.el7 2019/08/04\n"); | |
63 | 63 | + return 0; |
64 | 64 | +} |
65 | 65 | +module_init(ccs_show_version); |
66 | ---- linux-3.10.0-957.21.3.el7.orig/include/linux/init_task.h | |
67 | -+++ linux-3.10.0-957.21.3.el7/include/linux/init_task.h | |
66 | +--- linux-3.10.0-957.27.2.el7.orig/include/linux/init_task.h | |
67 | ++++ linux-3.10.0-957.27.2.el7/include/linux/init_task.h | |
68 | 68 | @@ -173,6 +173,14 @@ extern struct task_group root_task_group |
69 | 69 | # define INIT_RT_MUTEXES(tsk) |
70 | 70 | #endif |
@@ -88,8 +88,8 @@ | ||
88 | 88 | } |
89 | 89 | |
90 | 90 | |
91 | ---- linux-3.10.0-957.21.3.el7.orig/include/linux/sched.h | |
92 | -+++ linux-3.10.0-957.21.3.el7/include/linux/sched.h | |
91 | +--- linux-3.10.0-957.27.2.el7.orig/include/linux/sched.h | |
92 | ++++ linux-3.10.0-957.27.2.el7/include/linux/sched.h | |
93 | 93 | @@ -4,6 +4,8 @@ |
94 | 94 | #include <uapi/linux/sched.h> |
95 | 95 | #include <linux/rh_kabi.h> |
@@ -110,8 +110,8 @@ | ||
110 | 110 | }; |
111 | 111 | |
112 | 112 | /* Future-safe accessor for struct task_struct's cpus_allowed. */ |
113 | ---- linux-3.10.0-957.21.3.el7.orig/include/linux/security.h | |
114 | -+++ linux-3.10.0-957.21.3.el7/include/linux/security.h | |
113 | +--- linux-3.10.0-957.27.2.el7.orig/include/linux/security.h | |
114 | ++++ linux-3.10.0-957.27.2.el7/include/linux/security.h | |
115 | 115 | @@ -56,6 +56,7 @@ struct msg_queue; |
116 | 116 | struct xattr; |
117 | 117 | struct xfrm_sec_ctx; |
@@ -323,8 +323,8 @@ | ||
323 | 323 | } |
324 | 324 | #endif /* CONFIG_SECURITY_PATH */ |
325 | 325 | |
326 | ---- linux-3.10.0-957.21.3.el7.orig/include/net/ip.h | |
327 | -+++ linux-3.10.0-957.21.3.el7/include/net/ip.h | |
326 | +--- linux-3.10.0-957.27.2.el7.orig/include/net/ip.h | |
327 | ++++ linux-3.10.0-957.27.2.el7/include/net/ip.h | |
328 | 328 | @@ -232,6 +232,8 @@ void inet_get_local_port_range(struct ne |
329 | 329 | extern unsigned long *sysctl_local_reserved_ports; |
330 | 330 | static inline int inet_is_reserved_local_port(int port) |
@@ -334,8 +334,8 @@ | ||
334 | 334 | return test_bit(port, sysctl_local_reserved_ports); |
335 | 335 | } |
336 | 336 | |
337 | ---- linux-3.10.0-957.21.3.el7.orig/kernel/fork.c | |
338 | -+++ linux-3.10.0-957.21.3.el7/kernel/fork.c | |
337 | +--- linux-3.10.0-957.27.2.el7.orig/kernel/fork.c | |
338 | ++++ linux-3.10.0-957.27.2.el7/kernel/fork.c | |
339 | 339 | @@ -278,6 +278,7 @@ void __put_task_struct(struct task_struc |
340 | 340 | delayacct_tsk_free(tsk); |
341 | 341 | put_signal_struct(tsk->signal); |
@@ -362,8 +362,8 @@ | ||
362 | 362 | bad_fork_cleanup_perf: |
363 | 363 | perf_event_free_task(p); |
364 | 364 | bad_fork_cleanup_policy: |
365 | ---- linux-3.10.0-957.21.3.el7.orig/kernel/kexec.c | |
366 | -+++ linux-3.10.0-957.21.3.el7/kernel/kexec.c | |
365 | +--- linux-3.10.0-957.27.2.el7.orig/kernel/kexec.c | |
366 | ++++ linux-3.10.0-957.27.2.el7/kernel/kexec.c | |
367 | 367 | @@ -190,6 +190,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon |
368 | 368 | /* We only trust the superuser with rebooting the system. */ |
369 | 369 | if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) |
@@ -373,8 +373,8 @@ | ||
373 | 373 | |
374 | 374 | if (get_securelevel() > 0) |
375 | 375 | return -EPERM; |
376 | ---- linux-3.10.0-957.21.3.el7.orig/kernel/module.c | |
377 | -+++ linux-3.10.0-957.21.3.el7/kernel/module.c | |
376 | +--- linux-3.10.0-957.27.2.el7.orig/kernel/module.c | |
377 | ++++ linux-3.10.0-957.27.2.el7/kernel/module.c | |
378 | 378 | @@ -66,6 +66,7 @@ |
379 | 379 | #endif /* __GENKSYMS__ */ |
380 | 380 | #include <uapi/linux/module.h> |
@@ -401,8 +401,8 @@ | ||
401 | 401 | |
402 | 402 | return 0; |
403 | 403 | } |
404 | ---- linux-3.10.0-957.21.3.el7.orig/kernel/ptrace.c | |
405 | -+++ linux-3.10.0-957.21.3.el7/kernel/ptrace.c | |
404 | +--- linux-3.10.0-957.27.2.el7.orig/kernel/ptrace.c | |
405 | ++++ linux-3.10.0-957.27.2.el7/kernel/ptrace.c | |
406 | 406 | @@ -1082,6 +1082,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l |
407 | 407 | { |
408 | 408 | struct task_struct *child; |
@@ -427,8 +427,8 @@ | ||
427 | 427 | |
428 | 428 | if (request == PTRACE_TRACEME) { |
429 | 429 | ret = ptrace_traceme(); |
430 | ---- linux-3.10.0-957.21.3.el7.orig/kernel/sched/core.c | |
431 | -+++ linux-3.10.0-957.21.3.el7/kernel/sched/core.c | |
430 | +--- linux-3.10.0-957.27.2.el7.orig/kernel/sched/core.c | |
431 | ++++ linux-3.10.0-957.27.2.el7/kernel/sched/core.c | |
432 | 432 | @@ -4355,6 +4355,8 @@ int can_nice(const struct task_struct *p |
433 | 433 | SYSCALL_DEFINE1(nice, int, increment) |
434 | 434 | { |
@@ -438,8 +438,8 @@ | ||
438 | 438 | |
439 | 439 | /* |
440 | 440 | * Setpriority might change our priority at the same moment. |
441 | ---- linux-3.10.0-957.21.3.el7.orig/kernel/signal.c | |
442 | -+++ linux-3.10.0-957.21.3.el7/kernel/signal.c | |
441 | +--- linux-3.10.0-957.27.2.el7.orig/kernel/signal.c | |
442 | ++++ linux-3.10.0-957.27.2.el7/kernel/signal.c | |
443 | 443 | @@ -2942,6 +2942,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s |
444 | 444 | SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) |
445 | 445 | { |
@@ -485,8 +485,8 @@ | ||
485 | 485 | |
486 | 486 | return do_send_specific(tgid, pid, sig, info); |
487 | 487 | } |
488 | ---- linux-3.10.0-957.21.3.el7.orig/kernel/sys.c | |
489 | -+++ linux-3.10.0-957.21.3.el7/kernel/sys.c | |
488 | +--- linux-3.10.0-957.27.2.el7.orig/kernel/sys.c | |
489 | ++++ linux-3.10.0-957.27.2.el7/kernel/sys.c | |
490 | 490 | @@ -197,6 +197,10 @@ SYSCALL_DEFINE3(setpriority, int, which, |
491 | 491 | |
492 | 492 | if (which > PRIO_USER || which < PRIO_PROCESS) |
@@ -525,8 +525,8 @@ | ||
525 | 525 | |
526 | 526 | down_write(&uts_sem); |
527 | 527 | errno = -EFAULT; |
528 | ---- linux-3.10.0-957.21.3.el7.orig/kernel/time/ntp.c | |
529 | -+++ linux-3.10.0-957.21.3.el7/kernel/time/ntp.c | |
528 | +--- linux-3.10.0-957.27.2.el7.orig/kernel/time/ntp.c | |
529 | ++++ linux-3.10.0-957.27.2.el7/kernel/time/ntp.c | |
530 | 530 | @@ -16,6 +16,7 @@ |
531 | 531 | #include <linux/mm.h> |
532 | 532 | #include <linux/module.h> |
@@ -560,8 +560,8 @@ | ||
560 | 560 | |
561 | 561 | return 0; |
562 | 562 | } |
563 | ---- linux-3.10.0-957.21.3.el7.orig/net/ipv4/raw.c | |
564 | -+++ linux-3.10.0-957.21.3.el7/net/ipv4/raw.c | |
563 | +--- linux-3.10.0-957.27.2.el7.orig/net/ipv4/raw.c | |
564 | ++++ linux-3.10.0-957.27.2.el7/net/ipv4/raw.c | |
565 | 565 | @@ -706,6 +706,10 @@ static int raw_recvmsg(struct kiocb *ioc |
566 | 566 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
567 | 567 | if (!skb) |
@@ -573,8 +573,8 @@ | ||
573 | 573 | |
574 | 574 | copied = skb->len; |
575 | 575 | if (len < copied) { |
576 | ---- linux-3.10.0-957.21.3.el7.orig/net/ipv4/udp.c | |
577 | -+++ linux-3.10.0-957.21.3.el7/net/ipv4/udp.c | |
576 | +--- linux-3.10.0-957.27.2.el7.orig/net/ipv4/udp.c | |
577 | ++++ linux-3.10.0-957.27.2.el7/net/ipv4/udp.c | |
578 | 578 | @@ -1393,6 +1393,10 @@ try_again: |
579 | 579 | skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err); |
580 | 580 | if (!skb) |
@@ -586,8 +586,8 @@ | ||
586 | 586 | |
587 | 587 | ulen = skb->len - sizeof(struct udphdr); |
588 | 588 | copied = len; |
589 | ---- linux-3.10.0-957.21.3.el7.orig/net/ipv6/raw.c | |
590 | -+++ linux-3.10.0-957.21.3.el7/net/ipv6/raw.c | |
589 | +--- linux-3.10.0-957.27.2.el7.orig/net/ipv6/raw.c | |
590 | ++++ linux-3.10.0-957.27.2.el7/net/ipv6/raw.c | |
591 | 591 | @@ -468,6 +468,10 @@ static int rawv6_recvmsg(struct kiocb *i |
592 | 592 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
593 | 593 | if (!skb) |
@@ -599,8 +599,8 @@ | ||
599 | 599 | |
600 | 600 | copied = skb->len; |
601 | 601 | if (copied > len) { |
602 | ---- linux-3.10.0-957.21.3.el7.orig/net/ipv6/udp.c | |
603 | -+++ linux-3.10.0-957.21.3.el7/net/ipv6/udp.c | |
602 | +--- linux-3.10.0-957.27.2.el7.orig/net/ipv6/udp.c | |
603 | ++++ linux-3.10.0-957.27.2.el7/net/ipv6/udp.c | |
604 | 604 | @@ -384,6 +384,10 @@ try_again: |
605 | 605 | skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err); |
606 | 606 | if (!skb) |
@@ -612,8 +612,8 @@ | ||
612 | 612 | |
613 | 613 | ulen = skb->len - sizeof(struct udphdr); |
614 | 614 | copied = len; |
615 | ---- linux-3.10.0-957.21.3.el7.orig/net/socket.c | |
616 | -+++ linux-3.10.0-957.21.3.el7/net/socket.c | |
615 | +--- linux-3.10.0-957.27.2.el7.orig/net/socket.c | |
616 | ++++ linux-3.10.0-957.27.2.el7/net/socket.c | |
617 | 617 | @@ -1660,6 +1660,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct |
618 | 618 | if (err < 0) |
619 | 619 | goto out_fd; |
@@ -625,8 +625,8 @@ | ||
625 | 625 | if (upeer_sockaddr) { |
626 | 626 | if (newsock->ops->getname(newsock, (struct sockaddr *)&address, |
627 | 627 | &len, 2) < 0) { |
628 | ---- linux-3.10.0-957.21.3.el7.orig/net/unix/af_unix.c | |
629 | -+++ linux-3.10.0-957.21.3.el7/net/unix/af_unix.c | |
628 | +--- linux-3.10.0-957.27.2.el7.orig/net/unix/af_unix.c | |
629 | ++++ linux-3.10.0-957.27.2.el7/net/unix/af_unix.c | |
630 | 630 | @@ -2137,6 +2137,10 @@ static int unix_dgram_recvmsg(struct kio |
631 | 631 | wake_up_interruptible_sync_poll(&u->peer_wait, |
632 | 632 | POLLOUT | POLLWRNORM | POLLWRBAND); |
@@ -638,8 +638,8 @@ | ||
638 | 638 | if (msg->msg_name) |
639 | 639 | unix_copy_addr(msg, skb->sk); |
640 | 640 | |
641 | ---- linux-3.10.0-957.21.3.el7.orig/security/Kconfig | |
642 | -+++ linux-3.10.0-957.21.3.el7/security/Kconfig | |
641 | +--- linux-3.10.0-957.27.2.el7.orig/security/Kconfig | |
642 | ++++ linux-3.10.0-957.27.2.el7/security/Kconfig | |
643 | 643 | @@ -226,5 +226,7 @@ config DEFAULT_SECURITY |
644 | 644 | default "yama" if DEFAULT_SECURITY_YAMA |
645 | 645 | default "" if DEFAULT_SECURITY_DAC |
@@ -648,8 +648,8 @@ | ||
648 | 648 | + |
649 | 649 | endmenu |
650 | 650 | |
651 | ---- linux-3.10.0-957.21.3.el7.orig/security/Makefile | |
652 | -+++ linux-3.10.0-957.21.3.el7/security/Makefile | |
651 | +--- linux-3.10.0-957.27.2.el7.orig/security/Makefile | |
652 | ++++ linux-3.10.0-957.27.2.el7/security/Makefile | |
653 | 653 | @@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c |
654 | 654 | # Object integrity file lists |
655 | 655 | subdir-$(CONFIG_INTEGRITY) += integrity |
@@ -657,8 +657,8 @@ | ||
657 | 657 | + |
658 | 658 | +subdir-$(CONFIG_CCSECURITY) += ccsecurity |
659 | 659 | +obj-$(CONFIG_CCSECURITY) += ccsecurity/built-in.o |
660 | ---- linux-3.10.0-957.21.3.el7.orig/security/security.c | |
661 | -+++ linux-3.10.0-957.21.3.el7/security/security.c | |
660 | +--- linux-3.10.0-957.27.2.el7.orig/security/security.c | |
661 | ++++ linux-3.10.0-957.27.2.el7/security/security.c | |
662 | 662 | @@ -229,7 +229,10 @@ int security_syslog(int type) |
663 | 663 | |
664 | 664 | int security_settime(const struct timespec *ts, const struct timezone *tz) |
@@ -10,12 +10,12 @@ | ||
10 | 10 | |
11 | 11 | cd /tmp/ || die "Can't chdir to /tmp/ ." |
12 | 12 | |
13 | -if [ ! -r kernel-2.6.32-754.15.3.el6.src.rpm ] | |
13 | +if [ ! -r kernel-2.6.32-754.17.1.el6.src.rpm ] | |
14 | 14 | then |
15 | - wget http://vault.centos.org/6.10/updates/Source/SPackages/kernel-2.6.32-754.15.3.el6.src.rpm || die "Can't download source package." | |
15 | + wget http://vault.centos.org/6.10/updates/Source/SPackages/kernel-2.6.32-754.17.1.el6.src.rpm || die "Can't download source package." | |
16 | 16 | fi |
17 | -LANG=C rpm --checksig kernel-2.6.32-754.15.3.el6.src.rpm | grep -F ': rsa sha1 (md5) pgp md5 OK' || die "Can't verify signature." | |
18 | -rpm -ivh kernel-2.6.32-754.15.3.el6.src.rpm || die "Can't install source package." | |
17 | +LANG=C rpm --checksig kernel-2.6.32-754.17.1.el6.src.rpm | grep -F ': rsa sha1 (md5) pgp md5 OK' || die "Can't verify signature." | |
18 | +rpm -ivh kernel-2.6.32-754.17.1.el6.src.rpm || die "Can't install source package." | |
19 | 19 | |
20 | 20 | cd ~/rpmbuild/SOURCES/ || die "Can't chdir to ~/rpmbuild/SOURCES/ ." |
21 | 21 | if [ ! -r ccs-patch-1.8.5-20190506.tar.gz ] |
@@ -35,7 +35,7 @@ | ||
35 | 35 | -# % define buildid .local |
36 | 36 | +%define buildid _tomoyo_1.8.5p2 |
37 | 37 | |
38 | - %define distro_build 754.15.3 | |
38 | + %define distro_build 754.17.1 | |
39 | 39 | %define kabi_build 754 |
40 | 40 | @@ -438,7 +438,7 @@ |
41 | 41 | # Packages that need to be installed before the kernel is, because the %post |
@@ -10,12 +10,12 @@ | ||
10 | 10 | |
11 | 11 | cd /tmp/ || die "Can't chdir to /tmp/ ." |
12 | 12 | |
13 | -if [ ! -r kernel-3.10.0-957.21.3.el7.src.rpm ] | |
13 | +if [ ! -r kernel-3.10.0-957.27.2.el7.src.rpm ] | |
14 | 14 | then |
15 | - wget http://vault.centos.org/centos/7/updates/Source/SPackages/kernel-3.10.0-957.21.3.el7.src.rpm || die "Can't download source package." | |
15 | + wget http://vault.centos.org/centos/7/updates/Source/SPackages/kernel-3.10.0-957.27.2.el7.src.rpm || die "Can't download source package." | |
16 | 16 | fi |
17 | -LANG=C rpm --checksig kernel-3.10.0-957.21.3.el7.src.rpm | grep -F ': rsa sha1 (md5) pgp md5 OK' || die "Can't verify signature." | |
18 | -rpm -ivh kernel-3.10.0-957.21.3.el7.src.rpm || die "Can't install source package." | |
17 | +LANG=C rpm --checksig kernel-3.10.0-957.27.2.el7.src.rpm | grep -F ': rsa sha1 (md5) pgp md5 OK' || die "Can't verify signature." | |
18 | +rpm -ivh kernel-3.10.0-957.27.2.el7.src.rpm || die "Can't install source package." | |
19 | 19 | |
20 | 20 | cd ~/rpmbuild/SOURCES/ || die "Can't chdir to ~/rpmbuild/SOURCES/ ." |
21 | 21 | if [ ! -r ccs-patch-1.8.5-20190506.tar.gz ] |