diff options
| author | Ricardo M. Correia <rcorreia@wizy.org> | 2013-11-26 23:08:51 +0100 |
|---|---|---|
| committer | Ricardo M. Correia <rcorreia@wizy.org> | 2013-11-27 01:32:50 +0100 |
| commit | 2106191003dd549e1c4cfc95e26e658f9c5babbe (patch) | |
| tree | 475477bd8856eec8363658999e339f7c65843312 /pkgs/os-specific/linux/kernel/grsec-path.patch | |
| parent | 36955aa721f0d96d5685d544a173366e5565a639 (diff) | |
| download | nixlib-2106191003dd549e1c4cfc95e26e658f9c5babbe.tar nixlib-2106191003dd549e1c4cfc95e26e658f9c5babbe.tar.gz nixlib-2106191003dd549e1c4cfc95e26e658f9c5babbe.tar.bz2 nixlib-2106191003dd549e1c4cfc95e26e658f9c5babbe.tar.lz nixlib-2106191003dd549e1c4cfc95e26e658f9c5babbe.tar.xz nixlib-2106191003dd549e1c4cfc95e26e658f9c5babbe.tar.zst nixlib-2106191003dd549e1c4cfc95e26e658f9c5babbe.zip | |
grsecurity: Fix module loading during boot due to path restrictions
Diffstat (limited to 'pkgs/os-specific/linux/kernel/grsec-path.patch')
| -rw-r--r-- | pkgs/os-specific/linux/kernel/grsec-path.patch | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/pkgs/os-specific/linux/kernel/grsec-path.patch b/pkgs/os-specific/linux/kernel/grsec-path.patch new file mode 100644 index 000000000000..be242779548f --- /dev/null +++ b/pkgs/os-specific/linux/kernel/grsec-path.patch @@ -0,0 +1,15 @@ +diff --git a/kernel/kmod.c b/kernel/kmod.c +index 3227c2c..f32c944 100644 +--- a/kernel/kmod.c ++++ b/kernel/kmod.c +@@ -246,8 +246,8 @@ static int ____call_usermodehelper(void *data) + out the path to be used prior to this point and are now operating + on that copy + */ +- if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) && +- strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7)) || strstr(sub_info->path, "..")) { ++ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) && ++ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || strstr(sub_info->path, "..")) { + printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path); + retval = -EPERM; + goto fail; |