aboutsummaryrefslogtreecommitdiffstats
path: root/mm
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2009-06-11 13:01:41 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2009-06-11 13:01:41 -0400
commit3296ca27f50ecbd71db1d808c7a72d311027f919 (patch)
tree833eaa58b2013bda86d4bd95faf6efad7a2d5ca4 /mm
parente893123c7378192c094747dadec326b7c000c190 (diff)
parent73fbad283cfbbcf02939bdbda31fc4a30e729cca (diff)
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: (44 commits) nommu: Provide mmap_min_addr definition. TOMOYO: Add description of lists and structures. TOMOYO: Remove unused field. integrity: ima audit dentry_open failure TOMOYO: Remove unused parameter. security: use mmap_min_addr indepedently of security models TOMOYO: Simplify policy reader. TOMOYO: Remove redundant markers. SELinux: define audit permissions for audit tree netlink messages TOMOYO: Remove unused mutex. tomoyo: avoid get+put of task_struct smack: Remove redundant initialization. integrity: nfsd imbalance bug fix rootplug: Remove redundant initialization. smack: do not beyond ARRAY_SIZE of data integrity: move ima_counts_get integrity: path_check update IMA: Add __init notation to ima functions IMA: Minimal IMA policy and boot param for TCB IMA policy selinux: remove obsolete read buffer limit from sel_read_bool ...
Diffstat (limited to 'mm')
-rw-r--r--mm/Kconfig19
-rw-r--r--mm/mmap.c3
-rw-r--r--mm/nommu.c3
-rw-r--r--mm/shmem.c2
4 files changed, 26 insertions, 1 deletions
diff --git a/mm/Kconfig b/mm/Kconfig
index c2b57d81e153..71830ba7b986 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -226,6 +226,25 @@ config HAVE_MLOCKED_PAGE_BIT
226config MMU_NOTIFIER 226config MMU_NOTIFIER
227 bool 227 bool
228 228
229config DEFAULT_MMAP_MIN_ADDR
230 int "Low address space to protect from user allocation"
231 default 4096
232 help
233 This is the portion of low virtual memory which should be protected
234 from userspace allocation. Keeping a user from writing to low pages
235 can help reduce the impact of kernel NULL pointer bugs.
236
237 For most ia64, ppc64 and x86 users with lots of address space
238 a value of 65536 is reasonable and should cause no problems.
239 On arm and other archs it should not be higher than 32768.
240 Programs which use vm86 functionality would either need additional
241 permissions from either the LSM or the capabilities module or have
242 this protection disabled.
243
244 This value can be changed after boot using the
245 /proc/sys/vm/mmap_min_addr tunable.
246
247
229config NOMMU_INITIAL_TRIM_EXCESS 248config NOMMU_INITIAL_TRIM_EXCESS
230 int "Turn on mmap() excess space trimming before booting" 249 int "Turn on mmap() excess space trimming before booting"
231 depends on !MMU 250 depends on !MMU
diff --git a/mm/mmap.c b/mm/mmap.c
index 6b7b1a95944b..2b43fa1aa3c8 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -87,6 +87,9 @@ int sysctl_overcommit_ratio = 50; /* default is 50% */
87int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT; 87int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
88struct percpu_counter vm_committed_as; 88struct percpu_counter vm_committed_as;
89 89
90/* amount of vm to protect from userspace access */
91unsigned long mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
92
90/* 93/*
91 * Check that a process has enough memory to allocate a new virtual 94 * Check that a process has enough memory to allocate a new virtual
92 * mapping. 0 means there is enough memory for the allocation to 95 * mapping. 0 means there is enough memory for the allocation to
diff --git a/mm/nommu.c b/mm/nommu.c
index b571ef707428..2fd2ad5da98e 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -69,6 +69,9 @@ int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
69int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS; 69int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
70int heap_stack_gap = 0; 70int heap_stack_gap = 0;
71 71
72/* amount of vm to protect from userspace access */
73unsigned long mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
74
72atomic_long_t mmap_pages_allocated; 75atomic_long_t mmap_pages_allocated;
73 76
74EXPORT_SYMBOL(mem_map); 77EXPORT_SYMBOL(mem_map);
diff --git a/mm/shmem.c b/mm/shmem.c
index b25f95ce3db7..0132fbd45a23 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2659,6 +2659,7 @@ struct file *shmem_file_setup(char *name, loff_t size, unsigned long flags)
2659 if (error) 2659 if (error)
2660 goto close_file; 2660 goto close_file;
2661#endif 2661#endif
2662 ima_counts_get(file);
2662 return file; 2663 return file;
2663 2664
2664close_file: 2665close_file:
@@ -2684,7 +2685,6 @@ int shmem_zero_setup(struct vm_area_struct *vma)
2684 if (IS_ERR(file)) 2685 if (IS_ERR(file))
2685 return PTR_ERR(file); 2686 return PTR_ERR(file);
2686 2687
2687 ima_shm_check(file);
2688 if (vma->vm_file) 2688 if (vma->vm_file)
2689 fput(vma->vm_file); 2689 fput(vma->vm_file);
2690 vma->vm_file = file; 2690 vma->vm_file = file;