summaryrefslogtreecommitdiffstats
path: root/Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch
diff options
context:
space:
mode:
Diffstat (limited to 'Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch')
-rw-r--r--Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch42
1 files changed, 42 insertions, 0 deletions
diff --git a/Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch b/Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch
new file mode 100644
index 000000000..5c8f248fd
--- /dev/null
+++ b/Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch
@@ -0,0 +1,42 @@
+From b5eb26c8283e04ddc93419c4403442a3dae1c581 Mon Sep 17 00:00:00 2001
+From: Matthew Garrett <matthew.garrett@nebula.com>
+Date: Fri, 9 Mar 2012 09:28:15 -0500
+Subject: [PATCH] Restrict /dev/mem and /dev/kmem when module loading is
+ restricted
+
+Allowing users to write to address space makes it possible for the kernel
+to be subverted, avoiding module loading restrictions. Prevent this when
+any restrictions have been imposed on loading modules.
+
+Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
+---
+ drivers/char/mem.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/char/mem.c b/drivers/char/mem.c
+index cdf839f9defe..c63cf93b00eb 100644
+--- a/drivers/char/mem.c
++++ b/drivers/char/mem.c
+@@ -164,6 +164,9 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
+ if (p != *ppos)
+ return -EFBIG;
+
++ if (secure_modules())
++ return -EPERM;
++
+ if (!valid_phys_addr_range(p, count))
+ return -EFAULT;
+
+@@ -502,6 +505,9 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
+ char *kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
+ int err = 0;
+
++ if (secure_modules())
++ return -EPERM;
++
+ if (p < (unsigned long) high_memory) {
+ unsigned long to_write = min_t(unsigned long, count,
+ (unsigned long)high_memory - p);
+--
+1.9.3
+