| 1 | // SPDX-License-Identifier: GPL-2.0 |
|---|---|
| 2 | #include <linux/init.h> |
| 3 | #include <linux/mm.h> |
| 4 | #include <linux/security.h> |
| 5 | #include <linux/sysctl.h> |
| 6 | |
| 7 | /* amount of vm to protect from userspace access by both DAC and the LSM*/ |
| 8 | unsigned long mmap_min_addr; |
| 9 | /* amount of vm to protect from userspace using CAP_SYS_RAWIO (DAC) */ |
| 10 | unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR; |
| 11 | /* amount of vm to protect from userspace using the LSM = CONFIG_LSM_MMAP_MIN_ADDR */ |
| 12 | |
| 13 | /* |
| 14 | * Update mmap_min_addr = max(dac_mmap_min_addr, CONFIG_LSM_MMAP_MIN_ADDR) |
| 15 | */ |
| 16 | static void update_mmap_min_addr(void) |
| 17 | { |
| 18 | #ifdef CONFIG_LSM_MMAP_MIN_ADDR |
| 19 | if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR) |
| 20 | mmap_min_addr = dac_mmap_min_addr; |
| 21 | else |
| 22 | mmap_min_addr = CONFIG_LSM_MMAP_MIN_ADDR; |
| 23 | #else |
| 24 | mmap_min_addr = dac_mmap_min_addr; |
| 25 | #endif |
| 26 | } |
| 27 | |
| 28 | /* |
| 29 | * sysctl handler which just sets dac_mmap_min_addr = the new value and then |
| 30 | * calls update_mmap_min_addr() so non MAP_FIXED hints get rounded properly |
| 31 | */ |
| 32 | int mmap_min_addr_handler(struct ctl_table *table, int write, |
| 33 | void *buffer, size_t *lenp, loff_t *ppos) |
| 34 | { |
| 35 | int ret; |
| 36 | |
| 37 | if (write && !capable(CAP_SYS_RAWIO)) |
| 38 | return -EPERM; |
| 39 | |
| 40 | ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos); |
| 41 | |
| 42 | update_mmap_min_addr(); |
| 43 | |
| 44 | return ret; |
| 45 | } |
| 46 | |
| 47 | static int __init init_mmap_min_addr(void) |
| 48 | { |
| 49 | update_mmap_min_addr(); |
| 50 | |
| 51 | return 0; |
| 52 | } |
| 53 | pure_initcall(init_mmap_min_addr); |
| 54 |