Messages in this thread | | | Date | Wed, 6 Apr 2016 15:40:14 -0700 | Subject | Re: [PATCH] Honor mmap_min_addr with the actual minimum | From | Kees Cook <> |
| |
On Wed, Apr 6, 2016 at 12:07 PM, Hector Marco-Gisbert <hecmargi@upv.es> wrote: > The minimum address that a process is allowed to mmap when LSM is > enabled is 0x10000 (65536). This value is tunable and exported via > /proc/sys/vm/mmap_min_addr but it is not honored with the actual > minimum value.
I think this is working as intended already, based on the commit log for 788084aba2ab7348257597496befcbccabdc98a3
See cap_mmap_addr (which uses dac_mmap_min_addr) vs SELinux's hook (which uses CONFIG_LSM_MMAP_MIN_ADDR), and everything else (that uses mmap_min_addr).
Without CONFIG_LSM_MMAP_MIN_ADDR, dac_mmap_min_addr always == mmap_min_addr.
With CONFIG_LSM_MMAP_MIN_ADDR, dac_mmap_min_addr can be less than mmap_min_addr, but mmap_min_addr will always be at least CONFIG_LSM_MMAP_MIN_ADDR.
Eric may be able to shed more light on this...
-Kees
> > It can be easily checked in a system typing: > > $ cat /proc/sys/vm/mmap_min_addr > 4096 # <= Incorrect, it should be 65536 > > $ echo 1024 > /proc/sys/vm/mmap_min_addr > $ cat /proc/sys/vm/mmap_min_addr > 1024 # <= Incorrect, it should be 65536 > > After applying the patch: > > $ cat /proc/sys/vm/mmap_min_addr > 65536 # <= It is correct > > $ echo 1024 > /proc/sys/vm/mmap_min_addr > $ cat /proc/sys/vm/mmap_min_addr > 65536 # <= It is correct > > > > Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es> > Acked-by: Ismael Ripoll Ripoll <iripoll@upv.es> > --- > security/min_addr.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/security/min_addr.c b/security/min_addr.c > index f728728..96d1811 100644 > --- a/security/min_addr.c > +++ b/security/min_addr.c > @@ -15,10 +15,12 @@ unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR; > static void update_mmap_min_addr(void) > { > #ifdef CONFIG_LSM_MMAP_MIN_ADDR > - if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR) > + if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR) { > mmap_min_addr = dac_mmap_min_addr; > - else > + } else { > mmap_min_addr = CONFIG_LSM_MMAP_MIN_ADDR; > + dac_mmap_min_addr = CONFIG_LSM_MMAP_MIN_ADDR; > + } > #else > mmap_min_addr = dac_mmap_min_addr; > #endif > -- > 1.9.1 >
-- Kees Cook Chrome OS & Brillo Security
| |