| commit | e6a7b37d4c8e16dd92b2fa340a6798cb4dbe80ad | [log] [tgz] |
|---|---|---|
| author | Stephen Smalley <sds@tycho.nsa.gov> | Mon Dec 09 13:24:25 2013 -0500 |
| committer | Nick Kralevich <nnk@google.com> | Mon Dec 09 13:19:49 2013 -0800 |
| tree | 2393deba0dd263bb3b99f843a62f5ceaf556e5a0 | |
| parent | 95e0842e341352af16bed4055ccf67878c322985 [diff] |
Restrict mapping low memory. Label /proc/sys/vm/mmap_min_addr with proc_security to prevent writing it by any domain other than init. Also remove memprotect mmap_zero permission from unconfineddomain so that it cannot pass the SELinux check over mapping low memory. Change-Id: Idc189feeb325a4aea26c93396fd0fa7225e79586 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>