the-tree/security/min_addr.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 #include <linux/init.h>
0003 #include <linux/mm.h>
0004 #include <linux/security.h>
0005 #include <linux/sysctl.h>
0006
0007 /* amount of vm to protect from userspace access by both DAC and the LSM*/
0008 unsigned long mmap_min_addr;
0009 /* amount of vm to protect from userspace using CAP_SYS_RAWIO (DAC) */
0010 unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
0011 /* amount of vm to protect from userspace using the LSM = CONFIG_LSM_MMAP_MIN_ADDR */
0012
0013 /*
0014  * Update mmap_min_addr = max(dac_mmap_min_addr, CONFIG_LSM_MMAP_MIN_ADDR)
0015  */
0016 static void update_mmap_min_addr(void)
0017 {
0018 #ifdef CONFIG_LSM_MMAP_MIN_ADDR
0019     if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
0020         mmap_min_addr = dac_mmap_min_addr;
0021     else
0022         mmap_min_addr = CONFIG_LSM_MMAP_MIN_ADDR;
0023 #else
0024     mmap_min_addr = dac_mmap_min_addr;
0025 #endif
0026 }
0027
0028 /*
0029  * sysctl handler which just sets dac_mmap_min_addr = the new value and then
0030  * calls update_mmap_min_addr() so non MAP_FIXED hints get rounded properly
0031  */
0032 int mmap_min_addr_handler(struct ctl_table *table, int write,
0033               void *buffer, size_t *lenp, loff_t *ppos)
0034 {
0035     int ret;
0036
0037     if (write && !capable(CAP_SYS_RAWIO))
0038         return -EPERM;
0039
0040     ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
0041
0042     update_mmap_min_addr();
0043
0044     return ret;
0045 }
0046
0047 static int __init init_mmap_min_addr(void)
0048 {
0049     update_mmap_min_addr();
0050
0051     return 0;
0052 }
0053 pure_initcall(init_mmap_min_addr);