diff options
| author |   Anthony G. Basile <blueness@gentoo.org> | 2017-04-01 19:40:12 -0400 |
|---|---|---|
| committer | Anthony G. Basile <blueness@gentoo.org> | 2017-04-01 19:40:12 -0400 |
| commit | b897bcf385333e0aaa97084370db28c16dc589f4 (patch) | |
| tree | 603a21bf6485d0ebd9d7216bf3e921f9c1f3a363 /4.9.20/4426_default_XATTR_PAX_FLAGS.patch | |
| parent | grsecurity-3.1-4.9.18-201703261106 (diff) | |
| download | hardened-patchset-b897bcf385333e0aaa97084370db28c16dc589f4.tar.gz hardened-patchset-b897bcf385333e0aaa97084370db28c16dc589f4.tar.bz2 hardened-patchset-b897bcf385333e0aaa97084370db28c16dc589f4.zip | |
grsecurity-3.1-4.9.20-20170331082320170331
Diffstat (limited to '4.9.20/4426_default_XATTR_PAX_FLAGS.patch')
| -rw-r--r-- | 4.9.20/4426_default_XATTR_PAX_FLAGS.patch | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/4.9.20/4426_default_XATTR_PAX_FLAGS.patch b/4.9.20/4426_default_XATTR_PAX_FLAGS.patch new file mode 100644 index 0000000..f7e97b5 --- /dev/null +++ b/4.9.20/4426_default_XATTR_PAX_FLAGS.patch @@ -0,0 +1,36 @@ +diff -Naur linux-4.8.15-hardened-r1.orig/security/Kconfig linux-4.8.15-hardened-r1/security/Kconfig +--- linux-4.8.15-hardened-r1.orig/security/Kconfig 2017-01-01 12:10:19.638828792 -0500 ++++ linux-4.8.15-hardened-r1/security/Kconfig 2017-01-01 12:14:05.434836657 -0500 +@@ -293,7 +293,7 @@ + + config PAX_PT_PAX_FLAGS + bool 'Use ELF program header marking' +- default y if GRKERNSEC_CONFIG_AUTO ++ default n + help + Enabling this option will allow you to control PaX features on + a per executable basis via the 'paxctl' utility available at +@@ -312,9 +312,12 @@ + If you enable none of the marking options then all applications + will run with PaX enabled on them by default. + ++ Note for Gentoo: PT_PAX_FLAGS has been deprecated in Gentoo. Enable ++ this only for legacy systems. ++ + config PAX_XATTR_PAX_FLAGS + bool 'Use filesystem extended attributes marking' +- default y if GRKERNSEC_CONFIG_AUTO ++ default y + select CIFS_XATTR if CIFS + select EXT2_FS_XATTR if EXT2_FS + select EXT3_FS_XATTR if EXT3_FS +@@ -343,6 +346,9 @@ + If you enable none of the marking options then all applications + will run with PaX enabled on them by default. + ++ Note for Gentoo: XATTR_PAX_FLAGS is now the default in Gentoo. Do ++ not disable this unless you know what you're doing. ++ + choice + prompt 'MAC system integration' + default PAX_HAVE_ACL_FLAGS |