-
Notifications
You must be signed in to change notification settings - Fork 16
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
56b5e9f
commit 0a89e1f
Showing
3 changed files
with
156 additions
and
407 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,7 +1,7 @@ | ||
From 8d210c9529a46d6cd07027286714805b7c7e0c30 Mon Sep 17 00:00:00 2001 | ||
From 31d126e465d38a247ff9aef5851c93cee2753a77 Mon Sep 17 00:00:00 2001 | ||
From: "Jan Alexander Steffens (heftig)" <[email protected]> | ||
Date: Mon, 16 Sep 2019 04:53:20 +0200 | ||
Subject: [PATCH 1/3] ZEN: Add sysctl and CONFIG to disallow unprivileged | ||
Subject: [PATCH] ZEN: Add sysctl and CONFIG to disallow unprivileged | ||
CLONE_NEWUSER | ||
|
||
Our default behavior continues to match the vanilla kernel. | ||
|
@@ -14,7 +14,7 @@ Our default behavior continues to match the vanilla kernel. | |
5 files changed, 53 insertions(+) | ||
|
||
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h | ||
index 45f09bec02c4..87b20e2ee274 100644 | ||
index 45f09bec02c485..87b20e2ee27445 100644 | ||
--- a/include/linux/user_namespace.h | ||
+++ b/include/linux/user_namespace.h | ||
@@ -148,6 +148,8 @@ static inline void set_userns_rlimit_max(struct user_namespace *ns, | ||
|
@@ -36,10 +36,10 @@ index 45f09bec02c4..87b20e2ee274 100644 | |
{ | ||
return &init_user_ns; | ||
diff --git a/init/Kconfig b/init/Kconfig | ||
index 32c24950c4ce..f17ef1360063 100644 | ||
index 0c214af99085da..d9ae969eae321c 100644 | ||
--- a/init/Kconfig | ||
+++ b/init/Kconfig | ||
@@ -1225,6 +1225,22 @@ config USER_NS | ||
@@ -1251,6 +1251,22 @@ config USER_NS | ||
|
||
If unsure, say N. | ||
|
||
|
@@ -63,12 +63,12 @@ index 32c24950c4ce..f17ef1360063 100644 | |
bool "PID Namespaces" | ||
default y | ||
diff --git a/kernel/fork.c b/kernel/fork.c | ||
index 8103ffd217e9..f405763e06ae 100644 | ||
index 844dfdc8c639c3..31d41db3f84d74 100644 | ||
--- a/kernel/fork.c | ||
+++ b/kernel/fork.c | ||
@@ -100,6 +100,10 @@ | ||
#include <linux/user_events.h> | ||
#include <linux/iommu.h> | ||
@@ -98,6 +98,10 @@ | ||
#include <linux/io_uring.h> | ||
#include <linux/bpf.h> | ||
|
||
+#ifdef CONFIG_USER_NS | ||
+#include <linux/user_namespace.h> | ||
|
@@ -77,7 +77,7 @@ index 8103ffd217e9..f405763e06ae 100644 | |
#include <asm/pgalloc.h> | ||
#include <linux/uaccess.h> | ||
#include <asm/mmu_context.h> | ||
@@ -2267,6 +2271,10 @@ __latent_entropy struct task_struct *copy_process( | ||
@@ -2011,6 +2015,10 @@ static __latent_entropy struct task_struct *copy_process( | ||
if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS)) | ||
return ERR_PTR(-EINVAL); | ||
|
||
|
@@ -88,7 +88,7 @@ index 8103ffd217e9..f405763e06ae 100644 | |
/* | ||
* Thread groups must share signals as well, and detached threads | ||
* can only be started up within the thread group. | ||
@@ -3420,6 +3428,12 @@ int ksys_unshare(unsigned long unshare_flags) | ||
@@ -3171,6 +3179,12 @@ int ksys_unshare(unsigned long unshare_flags) | ||
if (unshare_flags & CLONE_NEWNS) | ||
unshare_flags |= CLONE_FS; | ||
|
||
|
@@ -102,10 +102,10 @@ index 8103ffd217e9..f405763e06ae 100644 | |
if (err) | ||
goto bad_unshare_out; | ||
diff --git a/kernel/sysctl.c b/kernel/sysctl.c | ||
index bfe53e835524..c64fa2b70a78 100644 | ||
index c6d9dec11b749d..9a4514ad481b21 100644 | ||
--- a/kernel/sysctl.c | ||
+++ b/kernel/sysctl.c | ||
@@ -80,6 +80,9 @@ | ||
@@ -81,6 +81,9 @@ | ||
#ifdef CONFIG_RT_MUTEXES | ||
#include <linux/rtmutex.h> | ||
#endif | ||
|
@@ -115,7 +115,7 @@ index bfe53e835524..c64fa2b70a78 100644 | |
|
||
/* shared constants to be used in various sysctls */ | ||
const int sysctl_vals[] = { 0, 1, 2, 3, 4, 100, 200, 1000, 3000, INT_MAX, 65535, -1 }; | ||
@@ -1623,6 +1626,15 @@ static struct ctl_table kern_table[] = { | ||
@@ -1659,6 +1662,15 @@ static struct ctl_table kern_table[] = { | ||
.mode = 0644, | ||
.proc_handler = proc_dointvec, | ||
}, | ||
|
@@ -132,7 +132,7 @@ index bfe53e835524..c64fa2b70a78 100644 | |
{ | ||
.procname = "tainted", | ||
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c | ||
index 1d8e47bed3f1..fec01d016a35 100644 | ||
index 54211dbd516c57..16ca0c1516298d 100644 | ||
--- a/kernel/user_namespace.c | ||
+++ b/kernel/user_namespace.c | ||
@@ -22,6 +22,13 @@ | ||
|
@@ -149,6 +149,3 @@ index 1d8e47bed3f1..fec01d016a35 100644 | |
static struct kmem_cache *user_ns_cachep __read_mostly; | ||
static DEFINE_MUTEX(userns_state_mutex); | ||
|
||
-- | ||
2.41.0 | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,8 +1,8 @@ | ||
# Maintainer: Jan Alexander Steffens (heftig) <[email protected]> | ||
# Maintainer: Joaquín I. Aramendía (samsagax) <[email protected]> | ||
|
||
pkgbase=linux-chimeraos | ||
pkgver=6.4.11.chos1 | ||
pkgbase=linux-lts-chimeraos | ||
pkgver=6.1.46.chos1 | ||
pkgrel=1 | ||
pkgdesc='Linux ChimeraOS' | ||
_srctag=${pkgver%.*} | ||
|
@@ -32,44 +32,6 @@ _srcname=chimeraos-linux | |
source=( | ||
"https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-$_srctag.tar.xz" | ||
config # the main kernel config file | ||
|
||
# Arch Linux patches | ||
0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch | ||
0002-drivers-firmware-skip-simpledrm-if-nvidia-drm.modese.patch | ||
|
||
# ChimeraOS specific patches | ||
# Some patches from TKG Team | ||
0001-mm-Support-soft-dirty-flag-reset-for-VA-range.patch | ||
|
||
# Fixes and additions | ||
0001-drm-panel-orientation-quirks-Add-quirk-for-AYA-NEO-2.patch | ||
0002-drm-panel-orientation-quirks-Add-quirk-for-AYA-NEO-F.patch | ||
0003-drm-panel-orientation-quirks-Add-quirk-for-AYA-NEO-G.patch | ||
0003-asus-ally-asus-hid-6.3-v2.patch | ||
0001-hwmon-oxp-sensors-staged-changes-for-v6.5.patch | ||
|
||
# Asus Ally bluetooth patch | ||
0004-asus-ally-bluetooth.patch | ||
|
||
# Aya Neo patches | ||
0001-ayaneo-geek-headset-fix.patch | ||
0002-ayaneo-2-headphone-fix.patch | ||
|
||
#HDR patches | ||
#0001-HDR.patch | ||
|
||
# Fixup sleep cs35l41 | ||
0001-ALSA-cs35l41-Use-mbox-command-to-enable-speaker-outp.patch | ||
0002-ALSA-cs35l41-Poll-for-Power-Up-Down-rather-than-wait.patch | ||
0003-ALSA-hda-cs35l41-Check-mailbox-status-of-pause-comma.patch | ||
0004-ALSA-hda-cs35l41-Ensure-we-correctly-re-sync-regmap-.patch | ||
0005-ALSA-hda-cs35l41-Ensure-we-pass-up-any-errors-during.patch | ||
0006-ALSA-hda-cs35l41-Move-Play-and-Pause-into-separate-f.patch | ||
0007-ALSA-hda-hda_component-Add-pre-and-post-playback-hoo.patch | ||
0008-ALSA-hda-cs35l41-Use-pre-and-post-playback-hooks.patch | ||
0009-ALSA-hda-cs35l41-Rework-System-Suspend-to-ensure-cor.patch | ||
0010-ALSA-hda-cs35l41-Add-device_link-between-HDA-and-cs3.patch | ||
0011-ALSA-hda-cs35l41-Ensure-amp-is-only-unmuted-during-p.patch | ||
) | ||
|
||
validpgpkeys=( | ||
|
@@ -301,3 +263,5 @@ for _p in "${pkgname[@]}"; do | |
done | ||
|
||
# vim:set ts=8 sts=2 sw=2 et: | ||
b2sums=('07a069c04919899ce2b0859d0a528ee13b154ec8c9e868a2a0e64f6bdcc0ce30ea4fd002f1b58e62eebfaf8216e528e26b79c7a99c67f208e4d36eca590836bf' | ||
'0e371dbca78583225badcdd6112c3f9af6fe39f1a94aaa79853f5bbbae3cfd3657ee555f49fd9292a0e9a7ef3e5d8dd8062430ce32ba0a82a516bbac5c0c41aa') |
Oops, something went wrong.