picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
Systemd/src/shared
History
Zbigniew Jędrzejewski-Szmek b835eeb4ec
shared/seccomp: disallow pkey_mprotect the same as mprotect for W^X mappings (#7295) 
MemoryDenyWriteExecution policy could be be bypassed by using pkey_mprotect
instead of mprotect to create an executable writable mapping.

The impact is mitigated by the fact that the man page says "Note that this
feature is fully available on x86-64, and partially on x86", so hopefully
people do not rely on it as a sole security measure.

Found by Karin Hossen and Thomas Imbert from Sogeti ESEC R&D.

https://bugs.launchpad.net/bugs/1725348
2017-11-12 17:28:48 +01:00
..
linux build-sys: add new kernel bpf.h drop-in 2017-09-22 15:24:54 +02:00
linux-3.13 Avoid strict DM interface version dependencies (#5519) 2017-03-02 19:11:37 +01:00
acl-util.c acl-util: fix memleak 2016-11-03 22:07:49 +00:00
acl-util.h build-sys: use #if Y instead of #ifdef Y everywhere 2017-10-04 12:09:29 +02:00
acpi-fpdt.c shared/acpi-fpdt: use ENODATA for missing data and skip test 2016-03-04 21:45:45 -05:00
acpi-fpdt.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
apparmor-util.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
apparmor-util.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
ask-password-api.c tree-wide: use IN_SET macro (#6977) 2017-10-04 16:01:32 +02:00
ask-password-api.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
base-filesystem.c Merge pull request #5420 from OpenDZ/tixxdz/namespace-fixes-v2 2017-05-09 20:42:32 +02:00
base-filesystem.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
boot-timestamps.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
boot-timestamps.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
bus-unit-util.c core: allow to specify errno number in SystemCallErrorNumber= 2017-11-11 21:54:24 +09:00
bus-unit-util.h bus-util: unify loop around bus_append_unit_property_assignment() 2016-08-18 22:23:31 +02:00
bus-util.c build-sys: use #if Y instead of #ifdef Y everywhere 2017-10-04 12:09:29 +02:00
bus-util.h tree-wide: make bus_map_all_properties return a proper sd_bus_error 2017-02-09 16:13:07 +01:00
cgroup-show.c bus: include sd-{bus,messages}.h the same as other systemd headers 2017-04-21 12:05:55 -04:00
cgroup-show.h bus: include sd-{bus,messages}.h the same as other systemd headers 2017-04-21 12:05:55 -04:00
clean-ipc.c dynamic-user: don't use a UID that currently owns IPC objects (#6962) 2017-10-04 21:40:01 +02:00
clean-ipc.h dynamic-user: don't use a UID that currently owns IPC objects (#6962) 2017-10-04 21:40:01 +02:00
condition.c condition: detect TOMOYO MAC (#7249) 2017-11-07 19:12:36 +03:00
condition.h core: add ConditionUser and ConditionGroup 2017-05-26 09:42:44 -04:00
conf-parser.c conf-parse: remove 4K line length limit 2017-09-23 11:08:57 +02:00
conf-parser.h config parser: Introduce config_parse_ip_port 2017-04-29 22:33:50 +05:30
dev-setup.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dev-setup.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dissect-image.c Merge pull request #7089 from oniko/luks2-support 2017-11-10 16:16:36 +01:00
dissect-image.h core,nspawn,dissect: make nspawn's .roothash file search reusable 2017-02-07 12:21:28 +01:00
dns-domain.c Merge pull request #6974 from keszybz/clean-up-defines 2017-10-04 19:25:30 +02:00
dns-domain.h build-sys: use #if Y instead of #ifdef Y everywhere 2017-10-04 12:09:29 +02:00
dropin.c exec-util,conf-files: skip non-executable files in execute_directories() 2017-09-13 11:42:31 +02:00
dropin.h core: drop code that is now unused 2017-02-07 21:31:59 -05:00
efivars.c build-sys: use #if Y instead of #ifdef Y everywhere 2017-10-04 12:09:29 +02:00
efivars.h build-sys: use #if Y instead of #ifdef Y everywhere 2017-10-04 12:09:29 +02:00
fdset.c tree-wide: replace all readdir cycles with FOREACH_DIRENT{,_ALL} (#4853) 2016-12-09 10:04:30 +01:00
fdset.h build-sys: move fdset.[ch] src/basic → src/shared (#3580) 2016-06-23 05:10:53 +03:00
firewall-util.c tree-wide: use IN_SET macro (#6977) 2017-10-04 16:01:32 +02:00
firewall-util.h build-sys: use #if Y instead of #ifdef Y everywhere 2017-10-04 12:09:29 +02:00
fstab-util.c fstab-util: introduce fstab_has_fstype() helper 2017-06-27 10:04:46 +02:00
fstab-util.h fstab-util: introduce fstab_has_fstype() helper 2017-06-27 10:04:46 +02:00
gcrypt-util.c build-sys: use #if Y instead of #ifdef Y everywhere 2017-10-04 12:09:29 +02:00
gcrypt-util.h build-sys: use #if Y instead of #ifdef Y everywhere 2017-10-04 12:09:29 +02:00
generator.c generator: when we insert a '\n', actually place a proper newline, too 2017-10-05 13:06:44 +02:00
generator.h cryptsetup-generator: add a helper utility to create symlinks 2017-07-10 00:16:36 -04:00
gpt.h dissect: don't honour NOAUTO flags when looking for ESP (#5224) 2017-02-07 22:10:48 -05:00
ima-util.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
ima-util.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
import-util.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
import-util.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
initreq.h
install-printf.c shared/install-printf: fix memleak 2017-01-15 13:42:53 -05:00
install-printf.h tree-wide: place #pragma once at the same place everywhere 2016-02-20 22:42:29 +01:00
install.c systemctl: fix memory leak (#7289) 2017-11-10 10:32:25 +01:00
install.h install: move and rename to lowercase two functions 2017-09-21 18:36:45 +02:00
journal-util.c build-sys: use #if Y instead of #ifdef Y everywhere 2017-10-04 12:09:29 +02:00
journal-util.h journalctl: move access_check() to shared/ 2017-02-28 21:37:35 -05:00
libshared.sym shared: Add a linker script so that all functions are tagget @SD_SHARED instead of @Base (#6669) 2017-08-28 18:49:03 +02:00
logs-show.c journalctl: add --output-fields= (#7181) 2017-10-27 12:10:47 +09:00
logs-show.h journalctl: add --output-fields= (#7181) 2017-10-27 12:10:47 +09:00
loop-util.c dissect: add small "systemd-dissect" tool as wrapper around dissect-image.c 2016-12-07 18:38:41 +01:00
loop-util.h dissect: add small "systemd-dissect" tool as wrapper around dissect-image.c 2016-12-07 18:38:41 +01:00
machine-image.c machine-image: handle nicely if the user asks us to remove a symlinked image 2017-10-26 17:54:56 +02:00
machine-image.h machine-image: add partial discovery of block devices as images 2017-10-26 17:54:56 +02:00
machine-pool.c tree-wide: stop using canonicalize_file_name(), use chase_symlinks() instead 2016-12-01 00:25:51 +01:00
machine-pool.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
meson.build condition: detect TOMOYO MAC (#7249) 2017-11-07 19:12:36 +03:00
nsflags.c Merge pull request #4538 from fbuihuu/confirm-spawn-fixes 2016-11-18 11:08:06 +01:00
nsflags.h core: add new RestrictNamespaces= unit file setting 2016-11-04 07:40:13 -06:00
output-mode.c Add short-iso-precise for journalctl output (#5884) 2017-05-07 20:23:49 -04:00
output-mode.h Add short-iso-precise for journalctl output (#5884) 2017-05-07 20:23:49 -04:00
pager.c pager: cache not only number of columns but also of lines before we open pager 2017-11-10 21:10:17 +01:00
pager.h tree-wide: merge pager_open_if_enabled() to the pager_open() 2016-02-26 01:13:23 +06:00
path-lookup.c Remove a bunch of unused variables 2017-11-01 23:06:44 +01:00
path-lookup.h install: consider globally enabled units as "enabled" for the user 2017-09-22 18:40:26 +02:00
ptyfwd.c tree-wide: use IN_SET where possible 2017-10-02 13:09:54 +02:00
ptyfwd.h run: exit early in --pty if service failed 2017-02-03 11:51:57 +01:00
resolve-util.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
resolve-util.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
seccomp-util.c shared/seccomp: disallow pkey_mprotect the same as mprotect for W^X mappings (#7295) 2017-11-12 17:28:48 +01:00
seccomp-util.h core: add support to specify errno in SystemCallFilter= 2017-11-11 21:54:12 +09:00
sleep-config.c tree-wide: fix wrong indent (#5757) 2017-04-19 08:48:29 +02:00
sleep-config.h tree-wide: place #pragma once at the same place everywhere 2016-02-20 22:42:29 +01:00
spawn-ask-password-agent.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
spawn-ask-password-agent.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
spawn-polkit-agent.c build-sys: use #if Y instead of #ifdef Y everywhere 2017-10-04 12:09:29 +02:00
spawn-polkit-agent.h treewide: unify identical definitions of polkit_agent_open_if_enabled() (#7187) 2017-10-30 09:57:53 +01:00
specifier.c shared: end string with % if one was found at the end of a expandible string (#6828) 2017-09-14 19:51:19 +02:00
specifier.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
switch-root.c shared: rework switch_root() code 2016-12-21 19:09:29 +01:00
switch-root.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
sysctl-util.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
sysctl-util.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-tables.h test-tables: ellide boring parts of sparse mappings 2016-01-29 12:13:08 -05:00
tests.c test: drop TEST_DATA_DIR, fold into get_testdata_dir() 2017-02-16 21:45:57 +01:00
tests.h test: drop TEST_DATA_DIR, fold into get_testdata_dir() 2017-02-16 21:45:57 +01:00
tomoyo-util.c condition: detect TOMOYO MAC (#7249) 2017-11-07 19:12:36 +03:00
tomoyo-util.h condition: detect TOMOYO MAC (#7249) 2017-11-07 19:12:36 +03:00
udev-util.c Rip out setting of the log level from udev_new and put it in a new function 2017-05-07 22:49:12 -04:00
udev-util.h Rip out setting of the log level from udev_new and put it in a new function 2017-05-07 22:49:12 -04:00
uid-range.c tree-wide: make ++/-- usage consistent WRT spacing 2016-02-22 20:32:04 -08:00
uid-range.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
utmp-wtmp.c tree-wide: use IN_SET where possible 2017-10-02 13:09:54 +02:00
utmp-wtmp.h build-sys: s/HAVE_UTMP/ENABLE_UTMP/ 2017-10-04 12:09:50 +02:00
vlan-util.c network: bridge vlan without PVID (#5899) 2017-05-29 17:20:01 +02:00
vlan-util.h network: bridge vlan without PVID (#5899) 2017-05-29 17:20:01 +02:00
volatile-util.c fstab-generator: add support for volatile boots 2016-12-21 19:09:29 +01:00
volatile-util.h fstab-generator: add support for volatile boots 2016-12-21 19:09:29 +01:00
watchdog.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
watchdog.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00