summaryrefslogtreecommitdiffstats
path: root/sys-kernel/boest-v4.20.17/0007-This-patch-adds-support-for-a-restricted-user-contro.patch
blob: 38e3e5007976df86a07eceac6fe7987878aa44dc (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
From 1f9e4e07836dbed867c1df613fbbdd13ae56c4d9 Mon Sep 17 00:00:00 2001
From: "Anthony G. Basile" <blueness@gentoo.org>
Date: Sat, 17 Nov 2018 09:51:58 -0500
Subject: [PATCH 07/14] This patch adds support for a restricted
 user-controlled namespace on tmpfs filesystem used to house PaX flags.  The
 namespace must be of the form user.pax.* and its value cannot exceed a size
 of 8 bytes.


This is needed even on all Gentoo systems so that XATTR_PAX flags
are preserved for users who might build packages using portage on
a tmpfs system with a non-hardened kernel and then switch to a
hardened kernel with XATTR_PAX enabled.

The namespace is added to any user with Extended Attribute support
enabled for tmpfs.  Users who do not enable xattrs will not have
the XATTR_PAX flags preserved.
---
 include/uapi/linux/xattr.h |  4 ++++
 mm/shmem.c                 | 15 +++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
index c1395b5bd432..bac6d48eca8e 100644
--- a/include/uapi/linux/xattr.h
+++ b/include/uapi/linux/xattr.h
@@ -77,5 +77,9 @@
 #define XATTR_POSIX_ACL_DEFAULT  "posix_acl_default"
 #define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT

 
+/* User namespace */
+#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax."
+#define XATTR_PAX_FLAGS_SUFFIX "flags"
+#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
 
 #endif /* _UAPI_LINUX_XATTR_H */
diff --git a/mm/shmem.c b/mm/shmem.c
index 5d07e0b1352f..054a995a0cd2 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3134,6 +3134,14 @@ static int shmem_xattr_handler_set(const struct xattr_handler *handler,
 	struct shmem_inode_info *info = SHMEM_I(inode);

 
 	name = xattr_full_name(handler, name);
+
+	if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
+		if (strcmp(name, XATTR_NAME_PAX_FLAGS))
+			return -EOPNOTSUPP;
+		if (size > 8)
+			return -EINVAL;
+	}
+
 	return simple_xattr_set(&info->xattrs, name, value, size, flags);
 }

 
@@ -3149,6 +3157,12 @@ static const struct xattr_handler shmem_trusted_xattr_handler = {
 	.set = shmem_xattr_handler_set,
 };

 
+static const struct xattr_handler shmem_user_xattr_handler = {
+	.prefix = XATTR_USER_PREFIX,
+	.get = shmem_xattr_handler_get,
+	.set = shmem_xattr_handler_set,
+};
+
 static const struct xattr_handler *shmem_xattr_handlers[] = {
 #ifdef CONFIG_TMPFS_POSIX_ACL
 	&posix_acl_access_xattr_handler,
@@ -3156,6 +3170,7 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
 #endif
 	&shmem_security_xattr_handler,
 	&shmem_trusted_xattr_handler,
+	&shmem_user_xattr_handler,
 	NULL
 };