Grsec/PaX: 2.2.2-2.6.32.46-201109240842 + 2.2.2-3.0.4-20110924084220110924

5 files changed, 43 insertions, 24 deletions

diff --git a/3.0.4/0000_README b/3.0.4/0000_README
index a44f871..6cdadcb 100644
--- a/3.0.4/0000_README
+++ b/3.0.4/0000_README
@@ -3,7 +3,7 @@ README
 
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.2.2-3.0.4-201109190917.patch
+Patch:	4420_grsecurity-2.2.2-3.0.4-201109240842.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.0.4/4420_grsecurity-2.2.2-3.0.4-201109190917.patch b/3.0.4/4420_grsecurity-2.2.2-3.0.4-201109240842.patch
index ec88fda..5e86d2b 100644
--- a/3.0.4/4420_grsecurity-2.2.2-3.0.4-201109190917.patch
+++ b/3.0.4/4420_grsecurity-2.2.2-3.0.4-201109240842.patch
@@ -50694,8 +50694,8 @@ diff -urNp linux-3.0.4/grsecurity/grsec_chroot.c linux-3.0.4/grsecurity/grsec_ch
 +}
 diff -urNp linux-3.0.4/grsecurity/grsec_disabled.c linux-3.0.4/grsecurity/grsec_disabled.c
 --- linux-3.0.4/grsecurity/grsec_disabled.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-3.0.4/grsecurity/grsec_disabled.c	2011-08-23 21:48:14.000000000 -0400
-@@ -0,0 +1,447 @@
++++ linux-3.0.4/grsecurity/grsec_disabled.c	2011-09-24 08:13:01.000000000 -0400
+@@ -0,0 +1,433 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
 +#include <linux/sched.h>
@@ -50863,18 +50863,6 @@ diff -urNp linux-3.0.4/grsecurity/grsec_disabled.c linux-3.0.4/grsecurity/grsec_
 +	return 0;
 +}
 +
-+int
-+gr_is_capable(const int cap)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_is_capable_nolog(const int cap)
-+{
-+	return 1;
-+}
-+
 +void
 +gr_handle_alertkill(struct task_struct *task)
 +{
@@ -51135,8 +51123,6 @@ diff -urNp linux-3.0.4/grsecurity/grsec_disabled.c linux-3.0.4/grsecurity/grsec_
 +	return dentry->d_inode->i_sb->s_dev;
 +}
 +
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
 +EXPORT_SYMBOL(gr_learn_resource);
 +EXPORT_SYMBOL(gr_set_kernel_label);
 +#ifdef CONFIG_SECURITY
@@ -55798,7 +55784,7 @@ diff -urNp linux-3.0.4/include/linux/grdefs.h linux-3.0.4/include/linux/grdefs.h
 +#endif
 diff -urNp linux-3.0.4/include/linux/grinternal.h linux-3.0.4/include/linux/grinternal.h
 --- linux-3.0.4/include/linux/grinternal.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-3.0.4/include/linux/grinternal.h	2011-08-23 21:48:14.000000000 -0400
++++ linux-3.0.4/include/linux/grinternal.h	2011-09-24 08:43:45.000000000 -0400
 @@ -0,0 +1,219 @@
 +#ifndef __GRINTERNAL_H
 +#define __GRINTERNAL_H
@@ -55924,7 +55910,7 @@ diff -urNp linux-3.0.4/include/linux/grinternal.h linux-3.0.4/include/linux/grin
 +	CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
 +	CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
 +	CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
-+	CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
++	CAP_TO_MASK(CAP_IPC_OWNER) , CAP_TO_MASK(CAP_SYSLOG) }}
 +
 +#define security_learn(normal_msg,args...) \
 +({ \
@@ -67520,7 +67506,16 @@ diff -urNp linux-3.0.4/mm/slob.c linux-3.0.4/mm/slob.c
  
 diff -urNp linux-3.0.4/mm/slub.c linux-3.0.4/mm/slub.c
 --- linux-3.0.4/mm/slub.c	2011-07-21 22:17:23.000000000 -0400
-+++ linux-3.0.4/mm/slub.c	2011-08-23 21:48:14.000000000 -0400
++++ linux-3.0.4/mm/slub.c	2011-09-24 08:37:26.000000000 -0400
+@@ -200,7 +200,7 @@ struct track {
+ 
+ enum track_item { TRACK_ALLOC, TRACK_FREE };
+ 
+-#ifdef CONFIG_SYSFS
++#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
+ static int sysfs_slab_add(struct kmem_cache *);
+ static int sysfs_slab_alias(struct kmem_cache *, const char *);
+ static void sysfs_slab_remove(struct kmem_cache *);
 @@ -442,7 +442,7 @@ static void print_track(const char *s, s
  	if (!t->addr)
  		return;
@@ -67671,6 +67666,30 @@ diff -urNp linux-3.0.4/mm/slub.c linux-3.0.4/mm/slub.c
  			goto err;
  		}
  		up_write(&slub_lock);
+@@ -3545,7 +3586,7 @@ void *__kmalloc_node_track_caller(size_t
+ }
+ #endif
+ 
+-#ifdef CONFIG_SYSFS
++#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
+ static int count_inuse(struct page *page)
+ {
+ 	return page->inuse;
+@@ -3935,12 +3976,12 @@ static void resiliency_test(void)
+ 	validate_slab_cache(kmalloc_caches[9]);
+ }
+ #else
+-#ifdef CONFIG_SYSFS
++#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
+ static void resiliency_test(void) {};
+ #endif
+ #endif
+ 
+-#ifdef CONFIG_SYSFS
++#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
+ enum slab_stat_type {
+ 	SL_ALL,			/* All slabs */
+ 	SL_PARTIAL,		/* Only partially allocated slabs */
 @@ -4150,7 +4191,7 @@ SLAB_ATTR_RO(ctor);
  
  static ssize_t aliases_show(struct kmem_cache *s, char *buf)
diff --git a/3.0.4/4425_grsec-pax-without-grsec.patch b/3.0.4/4425_grsec-pax-without-grsec.patch
index cdc33f2..41be0d0 100644
--- a/3.0.4/4425_grsec-pax-without-grsec.patch
+++ b/3.0.4/4425_grsec-pax-without-grsec.patch
@@ -77,7 +77,7 @@ diff -Naur a/fs/exec.c b/fs/exec.c
 diff -Naur a/security/Kconfig b/security/Kconfig
 --- a/security/Kconfig	2011-04-17 19:05:03.000000000 -0400
 +++ b/security/Kconfig	2011-04-17 19:20:30.000000000 -0400
-@@ -26,7 +26,7 @@
+@@ -29,7 +29,7 @@
  	
  config PAX
  	bool "Enable various PaX features"
diff --git a/3.0.4/4437-grsec-kconfig-proc-user.patch b/3.0.4/4437-grsec-kconfig-proc-user.patch
index 4e5acda..c588683 100644
--- a/3.0.4/4437-grsec-kconfig-proc-user.patch
+++ b/3.0.4/4437-grsec-kconfig-proc-user.patch
@@ -6,7 +6,7 @@ in a different way to avoid bug #366019.  This patch should eventually go upstre
 diff -Naur linux-2.6.39-hardened-r4.orig//grsecurity/Kconfig linux-2.6.39-hardened-r4/grsecurity/Kconfig
 --- a/grsecurity/Kconfig	2011-06-29 10:02:56.000000000 -0400
 +++ b/grsecurity/Kconfig	2011-06-29 10:08:07.000000000 -0400
-@@ -669,7 +669,7 @@
+@@ -666,7 +666,7 @@
  
  config GRKERNSEC_PROC_USER
  	bool "Restrict /proc to user only"
@@ -15,7 +15,7 @@ diff -Naur linux-2.6.39-hardened-r4.orig//grsecurity/Kconfig linux-2.6.39-harden
  	help
  	  If you say Y here, non-root users will only be able to view their own
  	  processes, and restricts them from viewing network-related information,
-@@ -677,7 +677,7 @@
+@@ -674,7 +674,7 @@
  
  config GRKERNSEC_PROC_USERGROUP
  	bool "Allow special group"
diff --git a/3.0.4/4440_selinux-avc_audit-log-curr_ip.patch b/3.0.4/4440_selinux-avc_audit-log-curr_ip.patch
index 3a991fb..0fd5d2d 100644
--- a/3.0.4/4440_selinux-avc_audit-log-curr_ip.patch
+++ b/3.0.4/4440_selinux-avc_audit-log-curr_ip.patch
@@ -28,7 +28,7 @@ Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
 diff -Naur linux-2.6.38-hardened-r1.orig/grsecurity/Kconfig linux-2.6.38-hardened-r1/grsecurity/Kconfig
 --- linux-2.6.38-hardened-r1.orig/grsecurity/Kconfig	2011-04-17 19:25:54.000000000 -0400
 +++ linux-2.6.38-hardened-r1/grsecurity/Kconfig	2011-04-17 19:32:53.000000000 -0400
-@@ -1268,6 +1268,27 @@
+@@ -1265,6 +1265,27 @@
  menu "Logging Options"
  depends on GRKERNSEC