summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch57
-rw-r--r--PKGBUILD9
-rw-r--r--config.x86_644
3 files changed, 66 insertions, 4 deletions
diff --git a/0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch b/0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch
new file mode 100644
index 0000000..dfa89cc
--- /dev/null
+++ b/0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch
@@ -0,0 +1,57 @@
+From b30ec6648774140adcbfc9b0e813ecfd0785f79d Mon Sep 17 00:00:00 2001
+From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
+Date: Thu, 7 Dec 2017 13:50:48 +0100
+Subject: [PATCH 2/3] ZEN: Add CONFIG for unprivileged_userns_clone
+
+This way our default behavior continues to match the vanilla kernel.
+---
+ init/Kconfig | 16 ++++++++++++++++
+ kernel/user_namespace.c | 4 ++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 4592bf7997c0..f3df02990aff 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1004,6 +1004,22 @@ config USER_NS
+
+ If unsure, say N.
+
++config USER_NS_UNPRIVILEGED
++ bool "Allow unprivileged users to create namespaces"
++ default y
++ depends on USER_NS
++ help
++ When disabled, unprivileged users will not be able to create
++ new namespaces. Allowing users to create their own namespaces
++ has been part of several recent local privilege escalation
++ exploits, so if you need user namespaces but are
++ paranoid^Wsecurity-conscious you want to disable this.
++
++ This setting can be overridden at runtime via the
++ kernel.unprivileged_userns_clone sysctl.
++
++ If unsure, say Y.
++
+ config PID_NS
+ bool "PID Namespaces"
+ default y
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index 6b9dbc257e34..107b17f0d528 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -27,7 +27,11 @@
+ #include <linux/sort.h>
+
+ /* sysctl */
++#ifdef CONFIG_USER_NS_UNPRIVILEGED
++int unprivileged_userns_clone = 1;
++#else
+ int unprivileged_userns_clone;
++#endif
+
+ static struct kmem_cache *user_ns_cachep __read_mostly;
+ static DEFINE_MUTEX(userns_state_mutex);
+--
+2.22.0
+
diff --git a/PKGBUILD b/PKGBUILD
index e594a71..027d7ab 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -18,7 +18,7 @@
pkgbase=linux-ck
_majver=5.1
-_minver=9
+_minver=10
if [ "$_minver" == "0" ]; then
pkgver=${_majver}
else
@@ -39,6 +39,7 @@ options=('!strip')
source=(
https://www.kernel.org/pub/linux/kernel/v5.x/linux-$pkgver.tar.{xz,sign}
0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
+ 0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch
ck_remove-excess-extraversion.patch
http://ck.kolivas.org/patches/5.0/${_majver}/${_majver}-ck${_ckpatchversion}/${_ckpatch}.xz
graysky_bdver2-hotfix.patch
@@ -50,16 +51,17 @@ source=(
90-linux.hook # pacman hook for initramfs regeneration
linux.preset # standard config files for mkinitcpio ramdisk
)
-sha256sums=('58c9eca99c3dd2fff5b559302996c985c3f3f2aad0b99b2172a61c4df7122a79'
+sha256sums=('39063041532579cb7e9fab5837313a8e6639c1c583cd39c72b313b3abfa9fbcf'
'SKIP'
'91fafa76bf9cb32159ac7f22191b3589278b91e65bc4505cf2fc6013b8037bf3'
+ '63e4378e69e2f23ed87af32a4951477a6d82d4ac0de2295db46502c8120da9d9'
'a2db6672b2d35f3006c7151e8fa90f5187dcdac9fcc46e88e78d45c7d8226d1f'
'f8d18a34f6b17ec8e5f2a7354383ca627e0fd00b5578c1ee7d9808a34f33c724'
'229e063a578db0a278108f37b24da20c2a2a18d825e98a67e426cb0f4b492e4a'
'226e30068ea0fecdb22f337391385701996bfbdba37cdcf0f1dbf55f1080542d'
'e7ebf050c22bcec0028c0b3c79fd6d3913b0370ecc6a23dfe78ce475630cf503'
'0f81d6e4158b7beeb0eb514f1b9401f7e23699cb0f7b0d513e25dae1815daaeb'
- '2d647fab9f5355e1c55c9fc280812314917298cf59881fb6e80a51e7e39dd0c2'
+ 'e7facc4e05b3e5c0bbd5671c398835338368d30481b8c3c8b19559efccba01c9'
'ae2e95db94ef7176207c690224169594d49445e04249d2499e9d2fbc117a0b21'
'75f99f5239e03238f88d1a834c50043ec32b1dc568f2cc291b07d04718483919'
'ad6344badc91ad0630caacde83f7f9b97276f80d26a20619a87952be65492c65')
@@ -82,6 +84,7 @@ prepare() {
# Hotfixes
msg2 "Applying hotfixes"
patch -p1 -i ../0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
+ patch -p1 -i ../0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch
# ck hotfixes
diff --git a/config.x86_64 b/config.x86_64
index 35aab7e..f1c099e 100644
--- a/config.x86_64
+++ b/config.x86_64
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.1.8 Kernel Configuration
+# Linux/x86 5.1.9 Kernel Configuration
#
#
@@ -163,6 +163,7 @@ CONFIG_NAMESPACES=y
CONFIG_UTS_NS=y
CONFIG_IPC_NS=y
CONFIG_USER_NS=y
+CONFIG_USER_NS_UNPRIVILEGED=y
CONFIG_PID_NS=y
CONFIG_NET_NS=y
CONFIG_CHECKPOINT_RESTORE=y
@@ -6060,6 +6061,7 @@ CONFIG_CHASH=m
# CONFIG_CHASH_STATS is not set
# CONFIG_CHASH_SELFTEST is not set
CONFIG_DRM_NOUVEAU=m
+CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT=y
CONFIG_NOUVEAU_DEBUG=5
CONFIG_NOUVEAU_DEBUG_DEFAULT=3
# CONFIG_NOUVEAU_DEBUG_MMU is not set