From 66611f2298539fa28a3667c02ca4013602634d3d Mon Sep 17 00:00:00 2001 From: Adam Jackson Date: Fri, 15 Feb 2008 13:49:12 -0500 Subject: Trivial SELinux awareness. Enable with --enable-selinux. Avoids AVC warnings when allocating executable memory by first checking if the current process has permission to do so. --- src/mesa/main/execmem.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/mesa/main/execmem.c b/src/mesa/main/execmem.c index 40f66d7da2..b40a2de8fa 100644 --- a/src/mesa/main/execmem.c +++ b/src/mesa/main/execmem.c @@ -47,6 +47,10 @@ #include #include "mm.h" +#ifdef MESA_SELINUX +#include +#endif + #define EXEC_HEAP_SIZE (10*1024*1024) _glthread_DECLARE_STATIC_MUTEX(exec_mutex); @@ -55,9 +59,17 @@ static struct mem_block *exec_heap = NULL; static unsigned char *exec_mem = NULL; -static void +static int init_heap(void) { +#ifdef MESA_SELINUX + if (is_selinux_enabled()) { + if (!security_get_boolean_active("allow_execmem") || + !security_get_boolean_pending("allow_execmem")) + return 0; + } +#endif + if (!exec_heap) exec_heap = mmInit( 0, EXEC_HEAP_SIZE ); @@ -65,6 +77,8 @@ init_heap(void) exec_mem = (unsigned char *) mmap(0, EXEC_HEAP_SIZE, PROT_EXEC | PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + + return (exec_mem != NULL); } @@ -76,7 +90,8 @@ _mesa_exec_malloc(GLuint size) _glthread_LOCK_MUTEX(exec_mutex); - init_heap(); + if (!init_heap()) + goto bail; if (exec_heap) { size = (size + 31) & ~31; @@ -87,7 +102,8 @@ _mesa_exec_malloc(GLuint size) addr = exec_mem + block->ofs; else _mesa_printf("_mesa_exec_malloc failed\n"); - + +bail: _glthread_UNLOCK_MUTEX(exec_mutex); return addr; -- cgit v1.2.3