openharmony/kernel_linux_common_modules
1
0
Fork 0
mirror of https://github.com/openharmony/kernel_linux_common_modules.git synced 2026-08-27 01:31:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

安全特性适配linux内核6.6

Browse Source 
Signed-off-by: cbl <caobaolong5@huawei.com>
This commit is contained in:
cbl
2024-08-29 17:03:20 +08:00
parent c3adf85085
commit ec6c1bf379
4 changed files with 24 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
container_escape_detection/core/ced_detection.c
+11 -2
View File
@@ -9,6 +9,7 @@
#include "objsec.h"
#include "ced_detection.h"
#include "ced_detection_points.h"
#include <linux/version.h>
enum ced_event_type {
EVENT_OK,
@@ -40,13 +41,21 @@ static int ced_avc_has_perm(u16 tclass, u32 requested)
struct av_decision avd;
int rc;
#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0))
if (!selinux_initialized(&selinux_state))
return 1;
#else
if (!selinux_initialized())
return 1;
#endif
u32 sid = current_sid();
#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0))
rc = avc_has_perm_noaudit(&selinux_state, sid, sid, tclass, requested,
AVC_STRICT, &avd);
#else
rc = avc_has_perm_noaudit(sid, sid, tclass, requested,
AVC_STRICT, &avd);
#endif
return rc;
}
container_escape_detection/include/ced_detection_points.h
+1 -1
View File
@@ -29,7 +29,7 @@ static inline void cred_info_record(struct cred_info *info, const struct cred *c
info->egid = cred->egid.val;
info->fsuid = cred->fsuid.val;
memcpy(&info->cap_effective.cap[0], &cred->cap_effective.cap[0], sizeof(info->cap_effective.cap));
memcpy(&info->cap_effective, &cred->cap_effective, sizeof(kernel_cap_t));
}
struct ns_info {
memory_security/src/hideaddr.c
+6
View File
@@ -17,6 +17,7 @@
#include "avc.h"
#include "objsec.h"
#include "hideaddr.h"
#include <linux/version.h>
static bool is_anon_exec(struct vm_area_struct *vma)
{
@@ -44,8 +45,13 @@ static int hideaddr_avc_has_perm(u16 tclass, u32 requested, struct seq_file *m)
u32 secid;
security_cred_getsecid(task->cred, &secid);
#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0))
return avc_has_perm_noaudit(&selinux_state, secid, secid, tclass, requested,
AVC_STRICT, &avd);
#else
return avc_has_perm_noaudit(secid, secid, tclass, requested,
AVC_STRICT, &avd);
#endif
}
static void hideaddr_header_prefix(unsigned long *start, unsigned long *end,
memory_security/src/jit_memory.c
+6
View File
@@ -11,6 +11,7 @@
#include "jit_space_list.h"
#include "avc.h"
#include "objsec.h"
#include <linux/version.h>
DEFINE_SPINLOCK(list_lock);
@@ -25,8 +26,13 @@ static bool jit_avc_has_perm(u16 tclass, u32 requested, struct task_struct *task
u32 secid;
security_cred_getsecid(task->cred, &secid);
#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0))
return (avc_has_perm_noaudit(&selinux_state, secid, secid, tclass, requested,
AVC_STRICT, &avd) == 0);
#else
return (avc_has_perm_noaudit(secid, secid, tclass, requested,
AVC_STRICT, &avd) == 0);
#endif
}
void find_jit_memory(struct task_struct *task, unsigned long start, unsigned long size, int *err)