Commit 6e141546 authored by David Howells's avatar David Howells Committed by James Morris
Browse files

NOMMU: Optimise away the {dac_,}mmap_min_addr tests 



In NOMMU mode clamp dac_mmap_min_addr to zero to cause the tests on it to be
skipped by the compiler.  We do this as the minimum mmap address doesn't make
any sense in NOMMU mode.

mmap_min_addr and round_hint_to_min() can be discarded entirely in NOMMU mode.

Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Acked-by: default avatarEric Paris <eparis@redhat.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent dd880fbe

include/linux/security.h

+7 −0
Original line number Diff line number Diff line
@@ -95,8 +95,13 @@ struct seq_file; 
extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);

extern int cap_netlink_recv(struct sk_buff *skb, int cap);



#ifdef CONFIG_MMU

extern unsigned long mmap_min_addr;

extern unsigned long dac_mmap_min_addr;

#else

#define dac_mmap_min_addr	0UL

#endif



/*

 * Values used in the task_security_ops calls

 */
@@ -121,6 +126,7 @@ struct request_sock; 
#define LSM_UNSAFE_PTRACE	2

#define LSM_UNSAFE_PTRACE_CAP	4



#ifdef CONFIG_MMU

/*

 * If a hint addr is less than mmap_min_addr change hint to be as

 * low as possible but still greater than mmap_min_addr
@@ -135,6 +141,7 @@ static inline unsigned long round_hint_to_min(unsigned long hint) 
}

extern int mmap_min_addr_handler(struct ctl_table *table, int write,

				 void __user *buffer, size_t *lenp, loff_t *ppos);

#endif



#ifdef CONFIG_SECURITY

kernel/sysctl.c

+2 −0
Original line number Diff line number Diff line
@@ -1214,6 +1214,7 @@ static struct ctl_table vm_table[] = { 
		.proc_handler	= proc_dointvec_jiffies,

	},

#endif

#ifdef CONFIG_MMU

	{

		.procname	= "mmap_min_addr",

		.data		= &dac_mmap_min_addr,
@@ -1221,6 +1222,7 @@ static struct ctl_table vm_table[] = { 
		.mode		= 0644,

		.proc_handler	= mmap_min_addr_handler,

	},

#endif

#ifdef CONFIG_NUMA

	{

		.procname	= "numa_zonelist_order",

mm/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -221,6 +221,7 @@ config KSM 


config DEFAULT_MMAP_MIN_ADDR

        int "Low address space to protect from user allocation"

	depends on MMU

        default 4096

        help

	  This is the portion of low virtual memory which should be protected

security/Makefile

+2 −1
Original line number Diff line number Diff line
@@ -8,7 +8,8 @@ subdir-$(CONFIG_SECURITY_SMACK) += smack 
subdir-$(CONFIG_SECURITY_TOMOYO)        += tomoyo



# always enable default capabilities

obj-y		+= commoncap.o min_addr.o

obj-y					+= commoncap.o

obj-$(CONFIG_MMU)			+= min_addr.o



# Object file lists

obj-$(CONFIG_SECURITY)			+= security.o capability.o

CRA Git | Maintained and supported by SUSTech CRA and CCSE