diff -Nrup linux-2.4.24-grsec-1.9.13/grsecurity/Config.in linux-2.4.24-grsec-1.9.13-solar/grsecurity/Config.in --- linux-2.4.24-grsec-1.9.13/grsecurity/Config.in 2004-01-11 21:58:14.000000000 -0500 +++ linux-2.4.24-grsec-1.9.13-solar/grsecurity/Config.in 2004-01-11 21:40:48.000000000 -0500 @@ -1,3 +1,4 @@ +define_bool CONFIG_GRKERNSEC_AUDIT_TEXTREL y define_bool CONFIG_CRYPTO y define_bool CONFIG_CRYPTO_SHA256 y choice 'Security level' \ @@ -319,6 +320,7 @@ bool 'IPC logging' CONFIG_GRKERNSEC_AUDI bool 'Signal logging' CONFIG_GRKERNSEC_SIGNAL bool 'Fork failure logging' CONFIG_GRKERNSEC_FORKFAIL bool 'Time change logging' CONFIG_GRKERNSEC_TIME +bool 'ELF text relocations logging' CONFIG_GRKERNSEC_AUDIT_TEXTREL endmenu mainmenu_option next_comment comment 'Executable Protections' diff -Nrup linux-2.4.24-grsec-1.9.13/grsecurity/Makefile linux-2.4.24-grsec-1.9.13-solar/grsecurity/Makefile --- linux-2.4.24-grsec-1.9.13/grsecurity/Makefile 2004-01-11 21:58:14.000000000 -0500 +++ linux-2.4.24-grsec-1.9.13-solar/grsecurity/Makefile 2004-01-11 21:26:25.000000000 -0500 @@ -20,4 +20,6 @@ else obj-y += grsec_disabled.o endif +obj-y += grsec_textrel.o + include $(TOPDIR)/Rules.make diff -Nrup linux-2.4.24-grsec-1.9.13/grsecurity/grsec_init.c linux-2.4.24-grsec-1.9.13-solar/grsecurity/grsec_init.c --- linux-2.4.24-grsec-1.9.13/grsecurity/grsec_init.c 2004-01-11 21:58:14.000000000 -0500 +++ linux-2.4.24-grsec-1.9.13-solar/grsecurity/grsec_init.c 2004-01-11 21:01:22.000000000 -0500 @@ -5,6 +5,7 @@ #include #include +int grsec_enable_audit_textrel; int grsec_enable_link; int grsec_enable_dmesg; int grsec_enable_fifo; @@ -85,6 +86,9 @@ grsecurity_init(void) #ifndef CONFIG_GRKERNSEC_SYSCTL grsec_lock = 1; +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL + grsec_enable_audit_textrel = 1; +#endif #ifdef CONFIG_GRKERNSEC_AUDIT_GROUP grsec_enable_group = 1; grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID; diff -Nrup linux-2.4.24-grsec-1.9.13/grsecurity/grsec_textrel.c linux-2.4.24-grsec-1.9.13-solar/grsecurity/grsec_textrel.c --- linux-2.4.24-grsec-1.9.13/grsecurity/grsec_textrel.c 1969-12-31 19:00:00.000000000 -0500 +++ linux-2.4.24-grsec-1.9.13-solar/grsecurity/grsec_textrel.c 2004-01-11 21:36:59.000000000 -0500 @@ -0,0 +1,17 @@ +#include +#include +#include +#include +#include + +void +gr_log_textrel(struct vm_area_struct * vma) +{ +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL + if (grsec_enable_audit_textrel) + security_audit(GR_TEXTREL_AUDIT_MSG, + vma->vm_start, vma->vm_pgoff, + DEFAULTSECARGS); +#endif + return; +} diff -Nrup linux-2.4.24-grsec-1.9.13/include/linux/grmsg.h linux-2.4.24-grsec-1.9.13-solar/include/linux/grmsg.h --- linux-2.4.24-grsec-1.9.13/include/linux/grmsg.h 2004-01-11 21:58:14.000000000 -0500 +++ linux-2.4.24-grsec-1.9.13-solar/include/linux/grmsg.h 2004-01-11 21:52:48.000000000 -0500 @@ -97,3 +97,4 @@ #define GR_SHM_AUDIT_MSG "shared memory of size %d created by " DEFAULTSECMSG #define GR_SHMR_AUDIT_MSG "shared memory of uid:%d euid:%d removed by " DEFAULTSECMSG #define GR_RESOURCE_MSG "attempted resource overstep by requesting %lu for %.16s against limit %lu by " DEFAULTSECMSG +#define GR_TEXTREL_AUDIT_MSG "textrel VMA:0x%08lx 0x%08lx in " DEFAULTSECMSG diff -Nrup linux-2.4.24-grsec-1.9.13/include/linux/grsecurity.h linux-2.4.24-grsec-1.9.13-solar/include/linux/grsecurity.h --- linux-2.4.24-grsec-1.9.13/include/linux/grsecurity.h 2004-01-11 21:58:14.000000000 -0500 +++ linux-2.4.24-grsec-1.9.13-solar/include/linux/grsecurity.h 2004-01-11 21:01:22.000000000 -0500 @@ -164,6 +164,7 @@ extern int grsec_enable_randid; extern int grsec_enable_randisn; extern int grsec_enable_randsrc; extern int grsec_enable_randrpc; +extern int grsec_enable_audit_textrel; #endif #endif diff -Nrup linux-2.4.24-grsec-1.9.13/kernel/sysctl.c linux-2.4.24-grsec-1.9.13-solar/kernel/sysctl.c --- linux-2.4.24-grsec-1.9.13/kernel/sysctl.c 2004-01-11 21:58:14.000000000 -0500 +++ linux-2.4.24-grsec-1.9.13-solar/kernel/sysctl.c 2004-01-11 21:01:22.000000000 -0500 @@ -293,7 +293,7 @@ static ctl_table kern_table[] = { }; #ifdef CONFIG_GRKERNSEC -enum {GS_ACL=1, GS_LINK, GS_FIFO, GS_EXECVE, GS_EXECLOG, GS_SIGNAL, +enum {GS_ACL=1, GS_TEXTREL, GS_LINK, GS_FIFO, GS_EXECVE, GS_EXECLOG, GS_SIGNAL, GS_FORKFAIL, GS_TIME, GS_CHROOT_SHMAT, GS_CHROOT_UNIX, GS_CHROOT_MNT, GS_CHROOT_FCHDIR, GS_CHROOT_DBL, GS_CHROOT_PVT, GS_CHROOT_CD, GS_CHROOT_CM, GS_CHROOT_MK, GS_CHROOT_NI, GS_CHROOT_EXECLOG, GS_CHROOT_CAPS, @@ -307,6 +307,10 @@ GS_FINDTASK, GS_LOCK}; static ctl_table grsecurity_table[] = { {GS_ACL,"acl", NULL, sizeof(int), 0600, NULL, &gr_proc_handler}, #ifdef CONFIG_GRKERNSEC_SYSCTL +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL + {GS_TEXTREL, "audit_textrel", &grsec_enable_audit_textrel, sizeof (int), + 0600, NULL, &proc_dointvec}, +#endif #ifdef CONFIG_GRKERNSEC_LINK {GS_LINK, "linking_restrictions", &grsec_enable_link, sizeof (int), 0600, NULL, &proc_dointvec}, diff -Nrup linux-2.4.24-grsec-1.9.13/mm/mprotect.c linux-2.4.24-grsec-1.9.13-solar/mm/mprotect.c --- linux-2.4.24-grsec-1.9.13/mm/mprotect.c 2004-01-11 21:58:14.000000000 -0500 +++ linux-2.4.24-grsec-1.9.13-solar/mm/mprotect.c 2004-01-11 21:28:59.000000000 -0500 @@ -366,6 +366,7 @@ static inline void pax_handle_maywrite(s return; if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) { vma->vm_flags |= VM_MAYWRITE | VM_MAYNOTWRITE; + gr_log_textrel(vma); return; } i++;