Eric Paris ed03218951 security: Protection for exploiting null dereference using mmap ... Add a new security check on mmap operations to see if the user is attempting to mmap to low area of the address space. The amount of space protected is indicated by the new proc tunable /proc/sys/vm/mmap_min_addr and defaults to 0, preserving existing behavior. This patch uses a new SELinux security class "memprotect." Policy already contains a number of allow rules like a_t self:process * (unconfined_t being one of them) which mean that putting this check in the process class (its best current fit) would make it useless as all user processes, which we also want to protect against, would be allowed. By taking the memprotect name of the new class it will also make it possible for us to move some of the other memory protect permissions out of 'process' and into the new class next time we bump the policy version number (which I also think is a good future idea) Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>		2007-07-11 22:52:29 -04:00
..
allocpercpu.c	[PATCH] Allow NULL pointers in percpu_free	2006-12-07 08:39:22 -08:00
backing-dev.c	[PATCH] nfs: fix congestion control	2007-03-16 19:25:05 -07:00
bootmem.c	[PATCH] remove EXPORT_UNUSED_SYMBOL'ed symbols	2006-12-07 08:39:44 -08:00
bounce.c	block: blk_max_pfn is somtimes wrong	2007-03-27 08:52:47 +02:00
fadvise.c	[PATCH] mm: change uses of f_{dentry,vfsmnt} to use f_path	2006-12-08 08:28:43 -08:00
filemap_xip.c	xip sendfile removal	2007-07-10 08:04:15 +02:00
filemap.c	sendfile: kill generic_file_sendfile()	2007-07-10 08:04:14 +02:00
filemap.h	Remove all inclusions of <linux/config.h>	2006-10-04 03:38:54 -04:00
fremap.c	[PATCH] mm: more rmap debugging	2006-12-22 08:55:49 -08:00
highmem.c	[PATCH] i386: PARAVIRT: add kmap_atomic_pte for mapping highpte pages	2007-05-02 19:27:15 +02:00
hugetlb.c	Rework ptep_set_access_flags and fix sun4c	2007-06-16 13:16:16 -07:00
internal.h	Make page->private usable in compound pages	2007-05-07 12:12:53 -07:00
Kconfig	sh64: generic quicklist support.	2007-05-14 09:55:35 +09:00
madvise.c	Detach sched.h from mm.h	2007-05-21 09:18:19 -07:00
Makefile	Quicklists for page table pages	2007-05-07 12:12:54 -07:00
memory_hotplug.c	memory hotplug: fix unnecessary calling of init_currenty_empty_zone()	2007-06-01 08:18:29 -07:00
memory.c	Rework ptep_set_access_flags and fix sun4c	2007-06-16 13:16:16 -07:00
mempolicy.c	[PATCH] Page migration: Fix vma flag checking	2007-03-05 07:57:51 -08:00
mempool.c	[PATCH] Numerous fixes to kernel-doc info in source files.	2007-02-11 10:51:32 -08:00
migrate.c	page migration: fix NR_FILE_PAGES accounting	2007-04-24 08:23:08 -07:00
mincore.c	[PATCH] mincore: vma crossing fix	2007-02-15 09:57:03 -08:00
mlock.c	Detach sched.h from mm.h	2007-05-21 09:18:19 -07:00
mmap.c	security: Protection for exploiting null dereference using mmap	2007-07-11 22:52:29 -04:00
mmzone.c	[PATCH] remove EXPORT_UNUSED_SYMBOL'ed symbols	2006-12-07 08:39:44 -08:00
mprotect.c	[PATCH] paravirt: lazy mmu mode hooks.patch	2006-10-01 00:39:33 -07:00
mremap.c	security: Protection for exploiting null dereference using mmap	2007-07-11 22:52:29 -04:00
msync.c	Detach sched.h from mm.h	2007-05-21 09:18:19 -07:00
nommu.c	security: Protection for exploiting null dereference using mmap	2007-07-11 22:52:29 -04:00
oom_kill.c	oom: fix constraint deadlock	2007-05-07 12:12:55 -07:00
page_alloc.c	mm: Fix memory/cpu hotplug section mismatch and oops.	2007-06-15 16:18:08 -07:00
page_io.c	[PATCH] swsusp: use block device offsets to identify swap locations	2006-12-07 08:39:27 -08:00
page-writeback.c	consolidate generic_writepages and mpage_writepages	2007-05-11 08:29:35 -07:00
pdflush.c	[PATCH] Add include/linux/freezer.h and move definitions from sched.h	2006-12-07 08:39:27 -08:00
prio_tree.c	Linux-2.6.12-rc2	2005-04-16 15:20:36 -07:00
quicklist.c	Quicklists for page table pages	2007-05-07 12:12:54 -07:00
readahead.c	readahead: code cleanup	2007-05-07 12:12:52 -07:00
rmap.c	mm: kill validate_anon_vma to avoid mapcount BUG	2007-06-28 11:34:53 -07:00
shmem_acl.c	[PATCH] Fix typos in mm/shmem_acl.c	2006-10-11 11:14:23 -07:00
shmem.c	shmem: convert to using splice instead of sendfile()	2007-07-10 08:04:15 +02:00
slab.c	Fix slab redzone alignment	2007-07-05 15:54:13 -07:00
slob.c	Remove SLAB_CTOR_CONSTRUCTOR	2007-05-17 05:23:04 -07:00
slub.c	slub: remove useless EXPORT_SYMBOL	2007-07-06 11:45:11 -07:00
sparse.c	Move three functions that are only needed for CONFIG_MEMORY_HOTPLUG	2007-06-08 17:23:33 -07:00
swap_state.c	[PATCH] lockdep: locking init debugging improvement	2006-07-03 15:27:02 -07:00
swap.c	Add suspend-related notifications for CPU hotplug	2007-05-09 12:30:56 -07:00
swapfile.c	mm: make read_cache_page synchronous	2007-05-07 12:12:51 -07:00
thrash.c	Bug in mm/thrash.c function grab_swap_token()	2007-05-11 08:29:32 -07:00
tiny-shmem.c	[PATCH] mm/{,tiny-}shmem.c cleanups	2007-03-01 14:53:35 -08:00
truncate.c	fs: convert core functions to zero_user_page	2007-05-09 12:30:55 -07:00
util.c	[PATCH] slab: clean up leak tracking ifdefs a little bit	2006-10-04 07:55:13 -07:00
vmalloc.c	Make __vunmap static	2007-05-17 05:23:04 -07:00
vmscan.c	Add suspend-related notifications for CPU hotplug	2007-05-09 12:30:56 -07:00
vmstat.c	mm: fixup /proc/vmstat output	2007-07-06 10:26:50 -07:00