)]}'
{
  "commit": "fcaaade1db63bb2d6f7611d7824eb50d2f07a546",
  "tree": "9091dbdd0c9bd1e3af9ece6f5cce5c0d6c258253",
  "parents": [
    "cb84aa9b42b506299e5aea1ba4da26c03ab12877"
  ],
  "author": {
    "name": "Stephen Smalley",
    "email": "sds@tycho.nsa.gov",
    "time": "Wed Apr 28 15:57:57 2010 -0400"
  },
  "committer": {
    "name": "James Morris",
    "email": "jmorris@namei.org",
    "time": "Thu Apr 29 08:58:45 2010 +1000"
  },
  "message": "selinux: generalize disabling of execmem for plt-in-heap archs\n\nOn Tue, 2010-04-27 at 11:47 -0700, David Miller wrote:\n\u003e From: \"Tom \\\"spot\\\" Callaway\" \u003ctcallawa@redhat.com\u003e\n\u003e Date: Tue, 27 Apr 2010 14:20:21 -0400\n\u003e\n\u003e \u003e [root@apollo ~]$ cat /proc/2174/maps\n\u003e \u003e 00010000-00014000 r-xp 00000000 fd:00 15466577\n\u003e \u003e  /sbin/mingetty\n\u003e \u003e 00022000-00024000 rwxp 00002000 fd:00 15466577\n\u003e \u003e  /sbin/mingetty\n\u003e \u003e 00024000-00046000 rwxp 00000000 00:00 0\n\u003e \u003e  [heap]\n\u003e\n\u003e SELINUX probably barfs on the executable heap, the PLT is in the HEAP\n\u003e just like powerpc32 and that\u0027s why VM_DATA_DEFAULT_FLAGS has to set\n\u003e both executable and writable.\n\u003e\n\u003e You also can\u0027t remove the CONFIG_PPC32 ifdefs in selinux, since\n\u003e because of the VM_DATA_DEFAULT_FLAGS setting used still in that arch,\n\u003e the heap will always have executable permission, just like sparc does.\n\u003e You have to support those binaries forever, whether you like it or not.\n\u003e\n\u003e Let\u0027s just replace the CONFIG_PPC32 ifdef in SELINUX with CONFIG_PPC32\n\u003e || CONFIG_SPARC as in Tom\u0027s original patch and let\u0027s be done with\n\u003e this.\n\u003e\n\u003e In fact I would go through all the arch/ header files and check the\n\u003e VM_DATA_DEFAULT_FLAGS settings and add the necessary new ifdefs to the\n\u003e SELINUX code so that other platforms don\u0027t have the pain of having to\n\u003e go through this process too.\n\nTo avoid maintaining per-arch ifdefs, it seems that we could just\ndirectly use (VM_DATA_DEFAULT_FLAGS \u0026 VM_EXEC) as the basis for deciding\nwhether to enable or disable these checks.   VM_DATA_DEFAULT_FLAGS isn\u0027t\nconstant on some architectures but instead depends on\ncurrent-\u003epersonality, but we want this applied uniformly.  So we\u0027ll just\nuse the initial task state to determine whether or not to enable these\nchecks.\n\nSigned-off-by:  Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nAcked-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ebee467e2913ce4ee8dcc155ff876050d1aa5ee5",
      "old_mode": 33188,
      "old_path": "security/selinux/hooks.c",
      "new_id": "a03fd74602b457cdfa18498251ad992695ac14e4",
      "new_mode": 33188,
      "new_path": "security/selinux/hooks.c"
    }
  ]
}