forked from mirrors/nixpkgs
grsecurity: Fix grsec-path.patch to apply with newest patches
This commit is contained in:
parent
7f39579931
commit
e76c059b23
|
@ -1,15 +1,17 @@
|
|||
diff --git a/kernel/kmod.c b/kernel/kmod.c
|
||||
index 3227c2c..f32c944 100644
|
||||
index 67f7981..03f127d 100644
|
||||
--- a/kernel/kmod.c
|
||||
+++ b/kernel/kmod.c
|
||||
@@ -246,8 +246,8 @@ static int ____call_usermodehelper(void *data)
|
||||
@@ -246,9 +246,9 @@ static int ____call_usermodehelper(void *data)
|
||||
out the path to be used prior to this point and are now operating
|
||||
on that copy
|
||||
*/
|
||||
- if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
|
||||
- strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7)) || strstr(sub_info->path, "..")) {
|
||||
- strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
|
||||
- strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
|
||||
+ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) &&
|
||||
+ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || strstr(sub_info->path, "..")) {
|
||||
+ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) ||
|
||||
+ strstr(sub_info->path, "..")) {
|
||||
printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
|
||||
retval = -EPERM;
|
||||
goto fail;
|
||||
|
|
Loading…
Reference in a new issue