From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753024AbcDFTIs (ORCPT ); Wed, 6 Apr 2016 15:08:48 -0400 Received: from smtpsalv.cc.upv.es ([158.42.249.11]:54931 "EHLO smtpsalv.upv.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751304AbcDFTIr (ORCPT ); Wed, 6 Apr 2016 15:08:47 -0400 From: Hector Marco-Gisbert To: linux-kernel@vger.kernel.org Cc: James Morris , "Serge E. Hallyn" , linux-security-module@vger.kernel.org, kees Cook , Ismael Ripoll , Hector Marco-Gisbert Subject: [PATCH] Honor mmap_min_addr with the actual minimum Date: Wed, 6 Apr 2016 21:07:28 +0200 Message-Id: <1459969648-4386-1-git-send-email-hecmargi@upv.es> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The minimum address that a process is allowed to mmap when LSM is enabled is 0x10000 (65536). This value is tunable and exported via /proc/sys/vm/mmap_min_addr but it is not honored with the actual minimum value. It can be easily checked in a system typing: $ cat /proc/sys/vm/mmap_min_addr 4096 # <= Incorrect, it should be 65536 $ echo 1024 > /proc/sys/vm/mmap_min_addr $ cat /proc/sys/vm/mmap_min_addr 1024 # <= Incorrect, it should be 65536 After applying the patch: $ cat /proc/sys/vm/mmap_min_addr 65536 # <= It is correct $ echo 1024 > /proc/sys/vm/mmap_min_addr $ cat /proc/sys/vm/mmap_min_addr 65536 # <= It is correct Signed-off-by: Hector Marco-Gisbert Acked-by: Ismael Ripoll Ripoll --- security/min_addr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/security/min_addr.c b/security/min_addr.c index f728728..96d1811 100644 --- a/security/min_addr.c +++ b/security/min_addr.c @@ -15,10 +15,12 @@ unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR; static void update_mmap_min_addr(void) { #ifdef CONFIG_LSM_MMAP_MIN_ADDR - if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR) + if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR) { mmap_min_addr = dac_mmap_min_addr; - else + } else { mmap_min_addr = CONFIG_LSM_MMAP_MIN_ADDR; + dac_mmap_min_addr = CONFIG_LSM_MMAP_MIN_ADDR; + } #else mmap_min_addr = dac_mmap_min_addr; #endif -- 1.9.1