- Round up remaining security patches that appear to be missing in 2.4.28. - PaX standalone updated to current. hgpv=28.1

8 files changed, 171 insertions, 12 deletions

diff --git a/sys-kernel/hardened-sources/ChangeLog b/sys-kernel/hardened-sources/ChangeLog
index 415556738170..a34ef4d466a8 100644
--- a/sys-kernel/hardened-sources/ChangeLog
+++ b/sys-kernel/hardened-sources/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for sys-kernel/hardened-sources
 # Copyright 2000-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-sources/ChangeLog,v 1.39 2004/11/28 18:10:26 solar Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-sources/ChangeLog,v 1.40 2004/11/29 02:45:14 solar Exp $
+
+  28 Nov 2004; <solar@gentoo.org> +files/2.4.28-grsec-binfmt_a.out.patch,
+  +files/2.4.28-grsec-cmdline-race.patch,
+  +files/2.4.28-selinux-binfmt_a.out.patch,
+  +files/2.4.28-selinux-cmdline-race.patch, hardened-sources-2.4.28.ebuild:
+  - Round up remaining security patches that appear to be missing in 2.4.28. -
+  PaX standalone updated to current. hgpv=28.1
 
 *hardened-sources-2.4.28 (28 Nov 2004)
 
diff --git a/sys-kernel/hardened-sources/Manifest b/sys-kernel/hardened-sources/Manifest
index 314ce0992f5f..9dbc287ad291 100644
--- a/sys-kernel/hardened-sources/Manifest
+++ b/sys-kernel/hardened-sources/Manifest
@@ -1,7 +1,7 @@
 MD5 ec13a8435dc6785ca17db91918579f3d hardened-sources-2.4.27-r2.ebuild 1027
 MD5 91d88b3126d4cc0b7cc5a22819808e68 hardened-sources-2.4.27-r3.ebuild 1028
-MD5 31b8de4d4159019c37339c7322563dcb hardened-sources-2.4.28.ebuild 1550
-MD5 e9f06218d6928c071fe2661ec9561f76 ChangeLog 10807
+MD5 3e2295502cd3f1513108ae4fee67d624 hardened-sources-2.4.28.ebuild 1655
+MD5 480ad33ed1ba9f53128a0afd5ab27ad7 ChangeLog 10807
 MD5 0a473e60c059cb41c96a6bbcbff84769 metadata.xml 459
 MD5 4a0215139f9aebfe2cc2747743763f08 files/2.4.28-grsec-binfmt_a.out.patch 1887
 MD5 c8985a5695cfda1c35d1b433d62604ce files/2.4.28-selinux-binfmt_a.out.patch 1743
diff --git a/sys-kernel/hardened-sources/files/2.4.28-grsec-binfmt_a.out.patch b/sys-kernel/hardened-sources/files/2.4.28-grsec-binfmt_a.out.patch
new file mode 100644
index 000000000000..16e06c44b5b4
--- /dev/null
+++ b/sys-kernel/hardened-sources/files/2.4.28-grsec-binfmt_a.out.patch
@@ -0,0 +1,63 @@
+diff -Nru linux-2.4.28/fs/binfmt_aout.c linux-2.4.28-hardened/fs/binfmt_aout.c
+--- linux-2.4.28/fs/binfmt_aout.c	2004-11-28 15:44:03.000000000 -0500
++++ linux-2.4.28-hardened/fs/binfmt_aout.c	2004-11-28 16:05:16.000000000 -0500
+@@ -39,13 +39,18 @@
+ 	NULL, THIS_MODULE, load_aout_binary, load_aout_library, aout_core_dump, PAGE_SIZE
+ };
+ 
+-static void set_brk(unsigned long start, unsigned long end)
++#define BAD_ADDR(x)	((unsigned long)(x) >= TASK_SIZE)
++
++static int set_brk(unsigned long start, unsigned long end)
+ {
+ 	start = PAGE_ALIGN(start);
+ 	end = PAGE_ALIGN(end);
+-	if (end <= start)
+-		return;
+-	do_brk(start, end - start);
++	if (end > start) {
++		unsigned long addr = do_brk(start, end - start);
++		if (BAD_ADDR(addr))
++			return addr;
++	}
++	return 0;
+ }
+ 
+ /*
+@@ -429,7 +434,11 @@
+ beyond_if:
+ 	set_binfmt(&aout_format);
+ 
+-	set_brk(current->mm->start_brk, current->mm->brk);
++	retval = set_brk(current->mm->start_brk, current->mm->brk);
++	if (retval < 0) {
++		send_sig(SIGKILL, current, 0);
++		return retval;
++	}
+ 
+ 	retval = setup_arg_pages(bprm); 
+ 	if (retval < 0) { 
+diff -Nru linux-2.4.28/fs/exec.c linux-2.4.28-hardened/fs/exec.c
+--- linux-2.4.28/fs/exec.c	2004-11-28 15:44:03.000000000 -0500
++++ linux-2.4.28-hardened/fs/exec.c	2004-11-28 16:05:16.000000000 -0500
+@@ -387,6 +387,7 @@
+ 
+ 	down_write(&current->mm->mmap_sem);
+ 	{
++		struct vm_area_struct *vma;
+ 		mpnt->vm_mm = current->mm;
+ 		mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p;
+ 		mpnt->vm_end = STACK_TOP;
+@@ -401,6 +402,12 @@
+ 		mpnt->vm_pgoff = 0;
+ 		mpnt->vm_file = NULL;
+ 		mpnt->vm_private_data = (void *) 0;
++		vma = find_vma(current->mm, mpnt->vm_start);
++		if (vma) {
++			up_write(&current->mm->mmap_sem);
++			kmem_cache_free(vm_area_cachep, mpnt);
++			return -ENOMEM;
++		}
+ 		insert_vm_struct(current->mm, mpnt);
+ 		current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
+ 
diff --git a/sys-kernel/hardened-sources/files/2.4.28-grsec-cmdline-race.patch b/sys-kernel/hardened-sources/files/2.4.28-grsec-cmdline-race.patch
new file mode 100644
index 000000000000..a37e92755b15
--- /dev/null
+++ b/sys-kernel/hardened-sources/files/2.4.28-grsec-cmdline-race.patch
@@ -0,0 +1,11 @@
+--- linux-2.4.28/fs/proc/base.c	2004-11-28 15:44:03.000000000 -0500
++++ linux-2.4.28-hardened/fs/proc/base.c	2004-11-28 16:02:18.439086184 -0500
+@@ -194,7 +194,7 @@
+ 	if (mm)
+ 		atomic_inc(&mm->mm_users);
+ 	task_unlock(task);
+-	if (mm) {
++	if (mm && mm->arg_end) {
+ 		int len = mm->arg_end - mm->arg_start;
+ 		if (len > PAGE_SIZE)
+ 			len = PAGE_SIZE;
diff --git a/sys-kernel/hardened-sources/files/2.4.28-selinux-binfmt_a.out.patch b/sys-kernel/hardened-sources/files/2.4.28-selinux-binfmt_a.out.patch
new file mode 100644
index 000000000000..cd1486f94e02
--- /dev/null
+++ b/sys-kernel/hardened-sources/files/2.4.28-selinux-binfmt_a.out.patch
@@ -0,0 +1,61 @@
+--- linux-2.4.28/fs/binfmt_aout.c	2004-11-28 16:37:25.000000000 -0500
++++ linux-2.4.28-hardened/fs/binfmt_aout.c	2004-11-28 17:15:50.297381776 -0500
+@@ -39,13 +39,18 @@
+ 	NULL, THIS_MODULE, load_aout_binary, load_aout_library, aout_core_dump, PAGE_SIZE
+ };
+ 
+-static void set_brk(unsigned long start, unsigned long end)
++#define BAD_ADDR(x)	((unsigned long)(x) >= TASK_SIZE)
++
++static int set_brk(unsigned long start, unsigned long end)
+ {
+ 	start = PAGE_ALIGN(start);
+ 	end = PAGE_ALIGN(end);
+-	if (end <= start)
+-		return;
+-	do_brk(start, end - start);
++	if (end > start) {
++		unsigned long addr = do_brk(start, end - start);
++		if (BAD_ADDR(addr))
++			return addr;
++	}
++	return 0;
+ }
+ 
+ /*
+@@ -423,7 +428,11 @@
+ beyond_if:
+ 	set_binfmt(&aout_format);
+ 
+-	set_brk(current->mm->start_brk, current->mm->brk);
++	retval = set_brk(current->mm->start_brk, current->mm->brk);
++	if (retval < 0) {
++		send_sig(SIGKILL, current, 0);
++		return retval;
++	}
+ 
+ 	retval = setup_arg_pages(bprm); 
+ 	if (retval < 0) { 
+--- linux-2.4.28/fs/exec.c	2004-11-28 16:37:25.000000000 -0500
++++ linux-2.4.28-hardened/fs/exec.c	2004-11-28 17:15:50.298381624 -0500
+@@ -388,6 +388,7 @@
+ 
+ 	down_write(&current->mm->mmap_sem);
+ 	{
++		struct vm_area_struct *vma;
+ 		mpnt->vm_mm = current->mm;
+ 		mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p;
+ 		mpnt->vm_end = STACK_TOP;
+@@ -404,6 +405,12 @@
+ 		mpnt->vm_pgoff = 0;
+ 		mpnt->vm_file = NULL;
+ 		mpnt->vm_private_data = (void *) 0;
++		vma = find_vma(current->mm, mpnt->vm_start);
++		if (vma) {
++			up_write(&current->mm->mmap_sem);
++			kmem_cache_free(vm_area_cachep, mpnt);
++			return -ENOMEM;
++		}
+ 		insert_vm_struct(current->mm, mpnt);
+ 		current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
+ 
diff --git a/sys-kernel/hardened-sources/files/2.4.28-selinux-cmdline-race.patch b/sys-kernel/hardened-sources/files/2.4.28-selinux-cmdline-race.patch
new file mode 100644
index 000000000000..f4a759f56ff1
--- /dev/null
+++ b/sys-kernel/hardened-sources/files/2.4.28-selinux-cmdline-race.patch
@@ -0,0 +1,11 @@
+--- linux-2.4.28/fs/proc/base.c	2004-11-28 16:37:21.000000000 -0500
++++ linux-2.4.28-hardened/fs/proc/base.c	2004-11-28 17:10:36.593072080 -0500
+@@ -192,7 +192,7 @@
+ 	if (mm)
+ 		atomic_inc(&mm->mm_users);
+ 	task_unlock(task);
+-	if (mm) {
++	if (mm && mm->arg_end) {
+ 		int len = mm->arg_end - mm->arg_start;
+ 		if (len > PAGE_SIZE)
+ 			len = PAGE_SIZE;
diff --git a/sys-kernel/hardened-sources/files/digest-hardened-sources-2.4.28 b/sys-kernel/hardened-sources/files/digest-hardened-sources-2.4.28
index 9691eab1f6f1..ca564687aeb3 100644
--- a/sys-kernel/hardened-sources/files/digest-hardened-sources-2.4.28
+++ b/sys-kernel/hardened-sources/files/digest-hardened-sources-2.4.28
@@ -1,2 +1,2 @@
 MD5 ac7735000d185bc7778c08288760a8a3 linux-2.4.28.tar.bz2 31064046
-MD5 0685f747c491abe1b9eec1a1355ea0b4 hardened-patches-2.4-28.0.tar.bz2 527898
+MD5 89087134d26519e7137d7ab621addb3f hardened-patches-2.4-28.1.tar.bz2 528257
diff --git a/sys-kernel/hardened-sources/hardened-sources-2.4.28.ebuild b/sys-kernel/hardened-sources/hardened-sources-2.4.28.ebuild
index deab86105f1b..3044cc4818b0 100644
--- a/sys-kernel/hardened-sources/hardened-sources-2.4.28.ebuild
+++ b/sys-kernel/hardened-sources/hardened-sources-2.4.28.ebuild
@@ -1,30 +1,36 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-sources/hardened-sources-2.4.28.ebuild,v 1.3 2004/11/28 18:14:57 solar Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-sources/hardened-sources-2.4.28.ebuild,v 1.4 2004/11/29 02:45:14 solar Exp $
 
 IUSE="selinux"
 ETYPE="sources"
 inherit kernel-2
 detect_version
 
-HGPV=28.0
+HGPV=28.1
 HGPV_SRC="mirror://gentoo/hardened-patches-${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}/hardened-patches-${KV_MAJOR}.${KV_MINOR}-${HGPV}.tar.bz2"
 
 UNIPATCH_STRICTORDER="yes"
 
+UNIPATCH_LIST=" ${DISTDIR}/hardened-patches-${KV_MAJOR}.${KV_MINOR}-${HGPV}.tar.bz2 \
+				${DISTDIR}/${PN}-grsec-${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-CAN-2004-0814.patch.gz \
+				${DISTDIR}/${PN}-selinux-${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-CAN-2004-0814.patch.gz \
+				${FILESDIR}/${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-grsec-cmdline-race.patch \
+				${FILESDIR}/${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-selinux-cmdline-race.patch \
+				${FILESDIR}/${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-grsec-binfmt_a.out.patch \
+				${FILESDIR}/${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-selinux-binfmt_a.out.patch"
+
+UNIPATCH_DOCS="${WORKDIR}/patches/hardened-patches-${KV_MAJOR}.${KV_MINOR}-${HGPV}/0000_README"
+
 # According to the patchset numbering scheme, 31xx patches are grsec related
 # while 32xx are SELinux related.
 
 if use selinux; then
-	UNIPATCH_EXCLUDE="31"
+	UNIPATCH_LIST="${UNIPATCH_LIST} 31 ${PN}-grsec ${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-grsec"
 else
-	UNIPATCH_EXCLUDE="32"
+	UNIPATCH_LIST="${UNIPATCH_LIST} 32 ${PN}-selinux ${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-selinux"
 fi
 
-UNIPATCH_LIST=" ${DISTDIR}/hardened-patches-${KV_MAJOR}.${KV_MINOR}-${HGPV}.tar.bz2"
-
-UNIPATCH_DOCS="${WORKDIR}/patches/hardened-patches-${KV_MAJOR}.${KV_MINOR}-${HGPV}/0000_README"
-
 DESCRIPTION="Hardened sources for the ${KV_MAJOR}.${KV_MINOR} kernel tree"
 
 SRC_URI="${KERNEL_URI} ${HGPV_SRC}"