tree 2393deba0dd263bb3b99f843a62f5ceaf556e5a0
parent 95e0842e341352af16bed4055ccf67878c322985
author Stephen Smalley <sds@tycho.nsa.gov> 1386613465 -0500
committer Nick Kralevich <nnk@google.com> 1386623989 -0800

Restrict mapping low memory.

Label /proc/sys/vm/mmap_min_addr with proc_security to prevent
writing it by any domain other than init.  Also remove memprotect
mmap_zero permission from unconfineddomain so that it cannot pass
the SELinux check over mapping low memory.

Change-Id: Idc189feeb325a4aea26c93396fd0fa7225e79586
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>