Messages in this thread Patch in this message | | | Date | Thu, 28 Jun 2007 11:41:38 -0400 (EDT) | From | James Morris <> | Subject | [PATCH 2/2] security: move mmap_min_addr sysctl to /proc/sys/vm |
| |
Move mmap_min_addr sysctl to /proc/sys/vm, as suggested by Andrew Morton.
Signed-off-by: James Morris <jmorris@namei.org> --- Documentation/sysctl/kernel.txt | 14 -------------- Documentation/sysctl/vm.txt | 15 +++++++++++++++ kernel/sysctl.c | 20 ++++++++++---------- 3 files changed, 25 insertions(+), 24 deletions(-)
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt index 1a9dc8a..111fd28 100644 --- a/Documentation/sysctl/kernel.txt +++ b/Documentation/sysctl/kernel.txt @@ -29,7 +29,6 @@ show up in /proc/sys/kernel: - java-interpreter [ binfmt_java, obsolete ] - kstack_depth_to_print [ X86 only ] - l2cr [ PPC only ] -- mmap_min_addr - modprobe ==> Documentation/kmod.txt - msgmax - msgmnb @@ -179,19 +178,6 @@ kernel stack. ============================================================== -mmap_min_addr - -This file indicates the amount of address space which a user process will be -restricted from mmaping. Since kernel null dereference bugs could -accidentally operate based on the information in the first couple of pages of -memory userspace processes should not be allowed to write to them. By default -this value is set to 0 and no protections will be enforced by the security -module. Setting this value to something like 64k will allow the vast majority -of applications to work correctly and provide defense in depth against future -potential kernel bugs. - -============================================================== - osrelease, ostype & version: # cat osrelease diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt index 1d19256..8cfca17 100644 --- a/Documentation/sysctl/vm.txt +++ b/Documentation/sysctl/vm.txt @@ -31,6 +31,7 @@ Currently, these files are in /proc/sys/vm: - min_unmapped_ratio - min_slab_ratio - panic_on_oom +- mmap_min_address ============================================================== @@ -216,3 +217,17 @@ above-mentioned. The default value is 0. 1 and 2 are for failover of clustering. Please select either according to your policy of failover. + +============================================================== + +mmap_min_addr + +This file indicates the amount of address space which a user process will +be restricted from mmaping. Since kernel null dereference bugs could +accidentally operate based on the information in the first couple of pages +of memory userspace processes should not be allowed to write to them. By +default this value is set to 0 and no protections will be enforced by the +security module. Setting this value to something like 64k will allow the +vast majority of applications to work correctly and provide defense in depth +against future potential kernel bugs. + diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 8f9a737..44f0a50 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -615,16 +615,6 @@ static ctl_table kern_table[] = { .proc_handler = &proc_dointvec, }, #endif -#ifdef CONFIG_SECURITY - { - .ctl_name = CTL_UNNUMBERED, - .procname = "mmap_min_addr", - .data = &mmap_min_addr, - .maxlen = sizeof(unsigned long), - .mode = 0644, - .proc_handler = &proc_doulongvec_minmax, - }, -#endif { .ctl_name = 0 } }; @@ -878,6 +868,16 @@ static ctl_table vm_table[] = { .strategy = &sysctl_jiffies, }, #endif +#ifdef CONFIG_SECURITY + { + .ctl_name = CTL_UNNUMBERED, + .procname = "mmap_min_addr", + .data = &mmap_min_addr, + .maxlen = sizeof(unsigned long), + .mode = 0644, + .proc_handler = &proc_doulongvec_minmax, + }, +#endif #if defined(CONFIG_X86_32) || \ (defined(CONFIG_SUPERH) && defined(CONFIG_VSYSCALL)) { -- 1.5.0.6 - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |