diff options
| author | William A. Kennington III <william@wkennington.com> | 2015-04-15 16:21:02 -0700 |
|---|---|---|
| committer | William A. Kennington III <william@wkennington.com> | 2015-04-15 16:22:42 -0700 |
| commit | b46dae268a6ab0a0a2dc8d2c80265d1eeec67bf4 (patch) | |
| tree | d8cc3c0dcbc94193b09f34d92ee6452ea302408c | |
| parent | 0fd47747811c1d31e2369d5b216bdf8ef0c468e2 (diff) | |
| download | nixpkgs-b46dae268a6ab0a0a2dc8d2c80265d1eeec67bf4.tar nixpkgs-b46dae268a6ab0a0a2dc8d2c80265d1eeec67bf4.tar.gz nixpkgs-b46dae268a6ab0a0a2dc8d2c80265d1eeec67bf4.tar.bz2 nixpkgs-b46dae268a6ab0a0a2dc8d2c80265d1eeec67bf4.tar.lz nixpkgs-b46dae268a6ab0a0a2dc8d2c80265d1eeec67bf4.tar.xz nixpkgs-b46dae268a6ab0a0a2dc8d2c80265d1eeec67bf4.tar.zst nixpkgs-b46dae268a6ab0a0a2dc8d2c80265d1eeec67bf4.zip | |
grsec_path: Update patch
| -rw-r--r-- | pkgs/os-specific/linux/kernel/grsec-path.patch | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/pkgs/os-specific/linux/kernel/grsec-path.patch b/pkgs/os-specific/linux/kernel/grsec-path.patch index aaf7d80dc91..6f477c22b5e 100644 --- a/pkgs/os-specific/linux/kernel/grsec-path.patch +++ b/pkgs/os-specific/linux/kernel/grsec-path.patch @@ -1,18 +1,17 @@ diff --git a/kernel/kmod.c b/kernel/kmod.c -index a26e825..29baec1 100644 +index a689506..30747b4 100644 --- a/kernel/kmod.c +++ b/kernel/kmod.c -@@ -294,10 +294,9 @@ static int ____call_usermodehelper(void *data) +@@ -294,10 +294,8 @@ static int ____call_usermodehelper(void *data) out the path to be used prior to this point and are now operating on that copy */ - if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) && - strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) && -- strncmp(sub_info->path, "/usr/libexec/", 13) && +- strncmp(sub_info->path, "/usr/libexec/", 13) && strncmp(sub_info->path, "/usr/bin/", 9) && - strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) { -+ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) && -+ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || -+ strstr(sub_info->path, "..")) { - printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path); ++ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) && ++ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || strstr(sub_info->path, "..")) { + printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of permitted system paths\n", sub_info->path); retval = -EPERM; goto out; |