summaryrefslogtreecommitdiffstats
path: root/sys-kernel/boest-v4.4.198/0009-This-patch-adds-support-for-a-restricted-user-contro.patch
diff options
context:
space:
mode:
Diffstat (limited to 'sys-kernel/boest-v4.4.198/0009-This-patch-adds-support-for-a-restricted-user-contro.patch')
-rw-r--r--sys-kernel/boest-v4.4.198/0009-This-patch-adds-support-for-a-restricted-user-contro.patch60
1 files changed, 60 insertions, 0 deletions
diff --git a/sys-kernel/boest-v4.4.198/0009-This-patch-adds-support-for-a-restricted-user-contro.patch b/sys-kernel/boest-v4.4.198/0009-This-patch-adds-support-for-a-restricted-user-contro.patch
new file mode 100644
index 00000000..9eba9b75
--- /dev/null
+++ b/sys-kernel/boest-v4.4.198/0009-This-patch-adds-support-for-a-restricted-user-contro.patch
@@ -0,0 +1,60 @@
+From 8510c47da40c67f91709cbcfc640756cec82e83a Mon Sep 17 00:00:00 2001
+From: "Anthony G. Basile" <blueness@gentoo.org>
+Date: Sun, 10 Jan 2016 12:18:55 -0500
+Subject: [PATCH 09/20] This patch adds support for a restricted
+ user-controlled namespace on tmpfs filesystem used to house PaX flags. The
+ namespace must be of the form user.pax.* and its value cannot exceed a size
+ of 8 bytes.
+
+This is needed even on all Gentoo systems so that XATTR_PAX flags
+are preserved for users who might build packages using portage on
+a tmpfs system with a non-hardened kernel and then switch to a
+hardened kernel with XATTR_PAX enabled.
+
+The namespace is added to any user with Extended Attribute support
+enabled for tmpfs. Users who do not enable xattrs will not have
+the XATTR_PAX flags preserved.
+---
+ include/uapi/linux/xattr.h | 4 ++++
+ mm/shmem.c | 7 +++++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
+index 1590c49cae57..5eab4629a524 100644
+--- a/include/uapi/linux/xattr.h
++++ b/include/uapi/linux/xattr.h
+@@ -73,5 +73,9 @@
+ #define XATTR_POSIX_ACL_DEFAULT "posix_acl_default"
+ #define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT
+
++/* User namespace */
++#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax."
++#define XATTR_PAX_FLAGS_SUFFIX "flags"
++#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
+
+ #endif /* _UAPI_LINUX_XATTR_H */
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 62668379623b..30cdc678667a 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2572,6 +2572,7 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
+ static int shmem_xattr_validate(const char *name)
+ {
+ struct { const char *prefix; size_t len; } arr[] = {
++ { XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN},
+ { XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN },
+ { XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN }
+ };
+@@ -2627,6 +2628,12 @@ static int shmem_setxattr(struct dentry *dentry, const char *name,
+ if (err)
+ return err;
+
++ if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
++ if (strcmp(name, XATTR_NAME_PAX_FLAGS))
++ return -EOPNOTSUPP;
++ if (size > 8)
++ return -EINVAL;
++ }
+ return simple_xattr_set(&info->xattrs, name, value, size, flags);
+ }
+