linux/security/selinux/include
Eric Paris ed03218951 security: Protection for exploiting null dereference using mmap
Add a new security check on mmap operations to see if the user is attempting
to mmap to low area of the address space.  The amount of space protected is
indicated by the new proc tunable /proc/sys/vm/mmap_min_addr and defaults to
0, preserving existing behavior.

This patch uses a new SELinux security class "memprotect."  Policy already
contains a number of allow rules like a_t self:process * (unconfined_t being
one of them) which mean that putting this check in the process class (its
best current fit) would make it useless as all user processes, which we also
want to protect against, would be allowed. By taking the memprotect name of
the new class it will also make it possible for us to move some of the other
memory protect permissions out of 'process' and into the new class next time
we bump the policy version number (which I also think is a good future idea)

Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
2007-07-11 22:52:29 -04:00
..
av_inherit.h [SELinux]: Add support for DCCP 2006-12-02 21:22:24 -08:00
av_perm_to_string.h security: Protection for exploiting null dereference using mmap 2007-07-11 22:52:29 -04:00
av_permissions.h security: Protection for exploiting null dereference using mmap 2007-07-11 22:52:29 -04:00
avc.h SELinux: allow preemption between transition permission checks 2007-07-11 22:52:25 -04:00
avc_ss.h SELinux: export object class and permission definitions 2006-11-28 12:04:36 -05:00
class_to_string.h security: Protection for exploiting null dereference using mmap 2007-07-11 22:52:29 -04:00
common_perm_to_string.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
conditional.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
flask.h security: Protection for exploiting null dereference using mmap 2007-07-11 22:52:29 -04:00
initial_sid_to_string.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
netif.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
netlabel.h SELinux: rename selinux_netlabel.h to netlabel.h 2007-04-26 01:35:50 -04:00
objsec.h NetLabel: SELinux cleanups 2006-12-02 21:24:13 -08:00
security.h selinux: add selinuxfs structure for object class discovery 2007-07-11 22:52:20 -04:00
xfrm.h [SELINUX]: Fix 2.6.20-rc6 build when no xfrm 2007-01-26 19:03:48 -08:00