From 0e1a6ef2dea88101b056b6d9984f3325c5efced3 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Sun, 8 Nov 2009 09:37:00 -0800 Subject: [PATCH] sysctl: require CAP_SYS_RAWIO to set mmap_min_addr Currently the mmap_min_addr value can only be bypassed during mmap when the task has CAP_SYS_RAWIO. However, the mmap_min_addr sysctl value itself can be adjusted to 0 if euid == 0, allowing a bypass without CAP_SYS_RAWIO. This patch adds a check for the capability before allowing mmap_min_addr to be changed. Signed-off-by: Kees Cook Acked-by: Serge Hallyn Signed-off-by: James Morris --- security/min_addr.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/security/min_addr.c b/security/min_addr.c index c844eed7915..fc43c9d3708 100644 --- a/security/min_addr.c +++ b/security/min_addr.c @@ -33,6 +33,9 @@ int mmap_min_addr_handler(struct ctl_table *table, int write, { int ret; + if (!capable(CAP_SYS_RAWIO)) + return -EPERM; + ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos); update_mmap_min_addr();