sunfish-admin/AXP-Resurection
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
0681842adc154bf4cbe1c2a34811bfd4aeccbfb6
AXP-Resurection/vendor/sunfish-a16/patches/009-kernel-hardening/ports/ro-0007-0034-sysctl-read-only.patch
T
sunfish-adminandCursor 3f941e8451 009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons. 
Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-09 17:31:01 +02:00

425 lines
16 KiB
Diff
Raw Blame History

From: Daniel Micay <danielmicay@gmail.com>
Subject: [PATCH] make sysctl constants read-only
Port of AXP/Graphene ro/4.14/0007.patch and ro/4.14/0034.patch.
Declarations still match; hunk context does not, and this tree has no
net/decnet/sysctl_net_decnet.c. Same __read_only (__ro_after_init)
annotations AXP applies, on the files that exist here.
Signed-off-by: Daniel Micay <danielmicay@gmail.com>
---
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -53,7 +53,7 @@
/*
* Minimum pipe size, as required by POSIX
*/
-unsigned int pipe_min_size = PAGE_SIZE;
+unsigned int pipe_min_size __read_only = PAGE_SIZE;
/* Maximum allocatable pages per user. Hard limit is unset by default, soft
* matches default values.
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -121,48 +121,48 @@
/* Constants used for minimum and maximum */
#ifdef CONFIG_LOCKUP_DETECTOR
-static int sixty = 60;
+static int sixty __read_only = 60;
#endif
-static int __maybe_unused neg_one = -1;
-static int __maybe_unused neg_three = -3;
+static int __maybe_unused neg_one __read_only = -1;
+static int __maybe_unused neg_three __read_only = -3;
-static int zero;
-static int __maybe_unused one = 1;
-static int __maybe_unused two = 2;
-static int __maybe_unused three = 3;
-static int __maybe_unused four = 4;
+static int zero __read_only;
+static int __maybe_unused one __read_only = 1;
+static int __maybe_unused two __read_only = 2;
+static int __maybe_unused three __read_only = 3;
+static int __maybe_unused four __read_only = 4;
static int int_max = INT_MAX;
-static unsigned long zero_ul;
-static unsigned long one_ul = 1;
-static unsigned long long_max = LONG_MAX;
-static int one_hundred = 100;
-static int one_thousand = 1000;
+static unsigned long zero_ul __read_only;
+static unsigned long one_ul __read_only = 1;
+static unsigned long long_max __read_only = LONG_MAX;
+static int one_hundred __read_only = 100;
+static int one_thousand __read_only = 1000;
#ifdef CONFIG_SCHED_WALT
-static int two_million = 2000000;
+static int two_million __read_only = 2000000;
#endif
#ifdef CONFIG_PRINTK
-static int ten_thousand = 10000;
+static int ten_thousand __read_only = 10000;
#endif
#ifdef CONFIG_PERF_EVENTS
-static int six_hundred_forty_kb = 640 * 1024;
+static int six_hundred_forty_kb __read_only = 640 * 1024;
#endif
static int __maybe_unused two_hundred_million __read_only = 200000000;
static int two_hundred_fifty_five __read_only = 255;
/* this is needed for the proc_doulongvec_minmax of vm_dirty_bytes */
-static unsigned long dirty_bytes_min = 2 * PAGE_SIZE;
+static unsigned long dirty_bytes_min __read_only = 2 * PAGE_SIZE;
/* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
-static int maxolduid = 65535;
-static int minolduid;
+static int maxolduid __read_only = 65535;
+static int minolduid __read_only;
-static int ngroups_max = NGROUPS_MAX;
+static int ngroups_max __read_only = NGROUPS_MAX;
static const int cap_last_cap = CAP_LAST_CAP;
/*this is needed for proc_doulongvec_minmax of sysctl_hung_task_timeout_secs */
#ifdef CONFIG_DETECT_HUNG_TASK
-static unsigned long hung_task_timeout_max = (LONG_MAX/HZ);
+static unsigned long hung_task_timeout_max __read_only = (LONG_MAX/HZ);
#endif
#ifdef CONFIG_INOTIFY_USER
@@ -332,19 +332,19 @@
};
#ifdef CONFIG_SCHED_DEBUG
-static int min_sched_granularity_ns = 100000; /* 100 usecs */
-static int max_sched_granularity_ns = NSEC_PER_SEC; /* 1 second */
-static int min_wakeup_granularity_ns; /* 0 usecs */
-static int max_wakeup_granularity_ns = NSEC_PER_SEC; /* 1 second */
+static int min_sched_granularity_ns __read_only = 100000; /* 100 usecs */
+static int max_sched_granularity_ns __read_only = NSEC_PER_SEC; /* 1 second */
+static int min_wakeup_granularity_ns __read_only; /* 0 usecs */
+static int max_wakeup_granularity_ns __read_only = NSEC_PER_SEC; /* 1 second */
#ifdef CONFIG_SMP
-static int min_sched_tunable_scaling = SCHED_TUNABLESCALING_NONE;
-static int max_sched_tunable_scaling = SCHED_TUNABLESCALING_END-1;
+static int min_sched_tunable_scaling __read_only = SCHED_TUNABLESCALING_NONE;
+static int max_sched_tunable_scaling __read_only = SCHED_TUNABLESCALING_END-1;
#endif /* CONFIG_SMP */
#endif /* CONFIG_SCHED_DEBUG */
#ifdef CONFIG_COMPACTION
-static int min_extfrag_threshold;
-static int max_extfrag_threshold = 1000;
+static int min_extfrag_threshold __read_only;
+static int max_extfrag_threshold __read_only = 1000;
#endif
#ifdef CONFIG_BPF_SYSCALL
--- a/ipc/mq_sysctl.c
+++ b/ipc/mq_sysctl.c
@@ -47,11 +47,11 @@
#define proc_mq_dointvec_minmax NULL
#endif
-static int msg_max_limit_min = MIN_MSGMAX;
-static int msg_max_limit_max = HARD_MSGMAX;
+static int msg_max_limit_min __read_only = MIN_MSGMAX;
+static int msg_max_limit_max __read_only = HARD_MSGMAX;
-static int msg_maxsize_limit_min = MIN_MSGSIZEMAX;
-static int msg_maxsize_limit_max = HARD_MSGSIZEMAX;
+static int msg_maxsize_limit_min __read_only = MIN_MSGSIZEMAX;
+static int msg_maxsize_limit_max __read_only = HARD_MSGSIZEMAX;
static struct ctl_table mq_sysctls[] = {
{
--- a/lib/test_sysctl.c
+++ b/lib/test_sysctl.c
@@ -36,8 +36,8 @@
#include <linux/delay.h>
#include <linux/vmalloc.h>
-static int i_zero;
-static int i_one_hundred = 100;
+static int i_zero __read_only;
+static int i_one_hundred __read_only = 100;
struct test_sysctl_data {
int int_0001;
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -12,21 +12,21 @@
#include <linux/spinlock.h>
#include <net/ax25.h>
-static int min_ipdefmode[1], max_ipdefmode[] = {1};
-static int min_axdefmode[1], max_axdefmode[] = {1};
-static int min_backoff[1], max_backoff[] = {2};
-static int min_conmode[1], max_conmode[] = {2};
-static int min_window[] = {1}, max_window[] = {7};
-static int min_ewindow[] = {1}, max_ewindow[] = {63};
-static int min_t1[] = {1}, max_t1[] = {30000};
-static int min_t2[] = {1}, max_t2[] = {20000};
-static int min_t3[1], max_t3[] = {3600000};
-static int min_idle[1], max_idle[] = {65535000};
-static int min_n2[] = {1}, max_n2[] = {31};
-static int min_paclen[] = {1}, max_paclen[] = {512};
-static int min_proto[1], max_proto[] = { AX25_PROTO_MAX };
+static int min_ipdefmode[1], max_ipdefmode[] __read_only = {1};
+static int min_axdefmode[1], max_axdefmode[] __read_only = {1};
+static int min_backoff[1], max_backoff[] __read_only = {2};
+static int min_conmode[1], max_conmode[] __read_only = {2};
+static int min_window[] __read_only = {1}, max_window[] __read_only = {7};
+static int min_ewindow[] __read_only = {1}, max_ewindow[] __read_only = {63};
+static int min_t1[] __read_only = {1}, max_t1[] __read_only = {30000};
+static int min_t2[] __read_only = {1}, max_t2[] __read_only = {20000};
+static int min_t3[1], max_t3[] __read_only = {3600000};
+static int min_idle[1], max_idle[] __read_only = {65535000};
+static int min_n2[] __read_only = {1}, max_n2[] __read_only = {31};
+static int min_paclen[] __read_only = {1}, max_paclen[] __read_only = {512};
+static int min_proto[1], max_proto[] __read_only = { AX25_PROTO_MAX };
#ifdef CONFIG_AX25_DAMA_SLAVE
-static int min_ds_timeout[1], max_ds_timeout[] = {65535000};
+static int min_ds_timeout[1], max_ds_timeout[] __read_only = {65535000};
#endif
static const struct ctl_table ax25_param_table[] = {
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -23,14 +23,14 @@
#include <net/busy_poll.h>
#include <net/pkt_sched.h>
-static int zero = 0;
-static int one = 1;
-static int two __maybe_unused = 2;
-static int min_sndbuf = SOCK_MIN_SNDBUF;
-static int min_rcvbuf = SOCK_MIN_RCVBUF;
-static int max_skb_frags = MAX_SKB_FRAGS;
-static long long_one __maybe_unused = 1;
-static long long_max __maybe_unused = LONG_MAX;
+static int zero __read_only = 0;
+static int one __read_only = 1;
+static int two __maybe_unused __read_only = 2;
+static int min_sndbuf __read_only = SOCK_MIN_SNDBUF;
+static int min_rcvbuf __read_only = SOCK_MIN_RCVBUF;
+static int max_skb_frags __read_only = MAX_SKB_FRAGS;
+static long long_one __maybe_unused __read_only = 1;
+static long long_max __maybe_unused __read_only = LONG_MAX;
static int net_msg_warn; /* Unused, but still a sysctl */
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -28,33 +28,33 @@
#include <net/protocol.h>
#include <net/netevent.h>
-static int zero;
-static int one = 1;
-static int three = 3;
-static int four = 4;
-static int hundred = 100;
-static int thousand = 1000;
-static int gso_max_segs = GSO_MAX_SEGS;
-static int tcp_retr1_max = 255;
-static int ip_local_port_range_min[] = { 1, 1 };
-static int ip_local_port_range_max[] = { 65535, 65535 };
-static int tcp_adv_win_scale_min = -31;
-static int tcp_adv_win_scale_max = 31;
-static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS;
-static int tcp_min_snd_mss_max = 65535;
+static int zero __read_only;
+static int one __read_only = 1;
+static int three __read_only = 3;
+static int four __read_only = 4;
+static int hundred __read_only = 100;
+static int thousand __read_only = 1000;
+static int gso_max_segs __read_only = GSO_MAX_SEGS;
+static int tcp_retr1_max __read_only = 255;
+static int ip_local_port_range_min[] __read_only = { 1, 1 };
+static int ip_local_port_range_max[] __read_only = { 65535, 65535 };
+static int tcp_adv_win_scale_min __read_only = -31;
+static int tcp_adv_win_scale_max __read_only = 31;
+static int tcp_min_snd_mss_min __read_only = TCP_MIN_SND_MSS;
+static int tcp_min_snd_mss_max __read_only = 65535;
static int ip_privileged_port_min;
-static int ip_privileged_port_max = 65535;
-static int ip_ttl_min = 1;
-static int ip_ttl_max = 255;
-static int tcp_syn_retries_min = 1;
-static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
-static int ip_ping_group_range_min[] = { 0, 0 };
-static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
-static int one_day_secs = 24 * 3600;
-static int tcp_delack_seg_min = TCP_DELACK_MIN;
-static int tcp_delack_seg_max = 60;
+static int ip_privileged_port_max __read_only = 65535;
+static int ip_ttl_min __read_only = 1;
+static int ip_ttl_max __read_only = 255;
+static int tcp_syn_retries_min __read_only = 1;
+static int tcp_syn_retries_max __read_only = MAX_TCP_SYNCNT;
+static int ip_ping_group_range_min[] __read_only = { 0, 0 };
+static int ip_ping_group_range_max[] __read_only = { GID_T_MAX, GID_T_MAX };
+static int one_day_secs __read_only = 24 * 3600;
+static int tcp_delack_seg_min __read_only = TCP_DELACK_MIN;
+static int tcp_delack_seg_max __read_only = 60;
static int tcp_use_userconfig_min;
-static int tcp_use_userconfig_max = 1;
+static int tcp_use_userconfig_max __read_only = 1;
/* obsolete */
static int sysctl_tcp_low_latency __read_mostly;
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -22,9 +22,9 @@
#endif
static int zero;
-static int one = 1;
-static int auto_flowlabels_min;
-static int auto_flowlabels_max = IP6_AUTO_FLOW_LABEL_MAX;
+static int one __read_only = 1;
+static int auto_flowlabels_min __read_only;
+static int auto_flowlabels_max __read_only = IP6_AUTO_FLOW_LABEL_MAX;
static int proc_rt6_multipath_hash_policy(struct ctl_table *table, int write,
void *buffer, size_t *lenp, loff_t *ppos)
--- a/net/netrom/sysctl_net_netrom.c
+++ b/net/netrom/sysctl_net_netrom.c
@@ -15,22 +15,22 @@
/*
* Values taken from NET/ROM documentation.
*/
-static int min_quality[] = {0}, max_quality[] = {255};
-static int min_obs[] = {0}, max_obs[] = {255};
-static int min_ttl[] = {0}, max_ttl[] = {255};
-static int min_t1[] = {5 * HZ};
-static int max_t1[] = {600 * HZ};
-static int min_n2[] = {2}, max_n2[] = {127};
-static int min_t2[] = {1 * HZ};
-static int max_t2[] = {60 * HZ};
-static int min_t4[] = {1 * HZ};
-static int max_t4[] = {1000 * HZ};
-static int min_window[] = {1}, max_window[] = {127};
-static int min_idle[] = {0 * HZ};
-static int max_idle[] = {65535 * HZ};
-static int min_route[] = {0}, max_route[] = {1};
-static int min_fails[] = {1}, max_fails[] = {10};
-static int min_reset[] = {0}, max_reset[] = {1};
+static int min_quality[] __read_only = {0}, max_quality[] __read_only = {255};
+static int min_obs[] __read_only = {0}, max_obs[] __read_only = {255};
+static int min_ttl[] __read_only = {0}, max_ttl[] __read_only = {255};
+static int min_t1[] __read_only = {5 * HZ};
+static int max_t1[] __read_only = {600 * HZ};
+static int min_n2[] __read_only = {2}, max_n2[] __read_only = {127};
+static int min_t2[] __read_only = {1 * HZ};
+static int max_t2[] __read_only = {60 * HZ};
+static int min_t4[] __read_only = {1 * HZ};
+static int max_t4[] __read_only = {1000 * HZ};
+static int min_window[] __read_only = {1}, max_window[] __read_only = {127};
+static int min_idle[] __read_only = {0 * HZ};
+static int max_idle[] __read_only = {65535 * HZ};
+static int min_route[] __read_only = {0}, max_route[] __read_only = {1};
+static int min_fails[] __read_only = {1}, max_fails[] __read_only = {10};
+static int min_reset[] __read_only = {0}, max_reset[] __read_only = {1};
static struct ctl_table_header *nr_table_header;
--- a/net/phonet/sysctl.c
+++ b/net/phonet/sysctl.c
@@ -35,8 +35,8 @@
#define DYNAMIC_PORT_MAX 0x7f
static DEFINE_SEQLOCK(local_port_range_lock);
-static int local_port_range_min[2] = {0, 0};
-static int local_port_range_max[2] = {1023, 1023};
+static int local_port_range_min[2] __read_only = {0, 0};
+static int local_port_range_max[2] __read_only = {1023, 1023};
static int local_port_range[2] = {DYNAMIC_PORT_MIN, DYNAMIC_PORT_MAX};
static struct ctl_table_header *phonet_table_hrd;
--- a/net/rose/sysctl_net_rose.c
+++ b/net/rose/sysctl_net_rose.c
@@ -12,15 +12,15 @@
#include <net/ax25.h>
#include <net/rose.h>
-static int min_timer[] = {1 * HZ};
-static int max_timer[] = {300 * HZ};
-static int min_idle[] = {0 * HZ};
-static int max_idle[] = {65535 * HZ};
-static int min_route[1], max_route[] = {1};
-static int min_ftimer[] = {60 * HZ};
-static int max_ftimer[] = {600 * HZ};
-static int min_maxvcs[] = {1}, max_maxvcs[] = {254};
-static int min_window[] = {1}, max_window[] = {7};
+static int min_timer[] __read_only = {1 * HZ};
+static int max_timer[] __read_only = {300 * HZ};
+static int min_idle[] __read_only = {0 * HZ};
+static int max_idle[] __read_only = {65535 * HZ};
+static int min_route[1], max_route[] __read_only = {1};
+static int min_ftimer[] __read_only = {60 * HZ};
+static int max_ftimer[] __read_only = {600 * HZ};
+static int min_maxvcs[] __read_only = {1}, max_maxvcs[] = {254};
+static int min_window[] __read_only = {1}, max_window[] = {7};
static struct ctl_table_header *rose_table_header;
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -40,21 +40,21 @@
#include <net/sctp/sctp.h>
#include <linux/sysctl.h>
-static int zero = 0;
-static int one = 1;
-static int timer_max = 86400000; /* ms in one day */
-static int int_max = INT_MAX;
-static int sack_timer_min = 1;
-static int sack_timer_max = 500;
-static int addr_scope_max = SCTP_SCOPE_POLICY_MAX;
-static int rwnd_scale_max = 16;
-static int rto_alpha_min = 0;
-static int rto_beta_min = 0;
-static int rto_alpha_max = 1000;
-static int rto_beta_max = 1000;
+static int zero __read_only = 0;
+static int one __read_only = 1;
+static int timer_max __read_only = 86400000; /* ms in one day */
+static int int_max __read_only = INT_MAX;
+static int sack_timer_min __read_only = 1;
+static int sack_timer_max __read_only = 500;
+static int addr_scope_max __read_only = SCTP_SCOPE_POLICY_MAX;
+static int rwnd_scale_max __read_only = 16;
+static int rto_alpha_min __read_only = 0;
+static int rto_beta_min __read_only = 0;
+static int rto_alpha_max __read_only = 1000;
+static int rto_beta_max __read_only = 1000;
-static unsigned long max_autoclose_min = 0;
-static unsigned long max_autoclose_max =
+static unsigned long max_autoclose_min __read_only = 0;
+static unsigned long max_autoclose_max __read_only =
(MAX_SCHEDULE_TIMEOUT / HZ > UINT_MAX)
? UINT_MAX : MAX_SCHEDULE_TIMEOUT / HZ;
--- a/net/x25/sysctl_net_x25.c
+++ b/net/x25/sysctl_net_x25.c
@@ -13,8 +13,8 @@
#include <linux/init.h>
#include <net/x25.h>
-static int min_timer[] = { 1 * HZ };
-static int max_timer[] = { 300 * HZ };
+static int min_timer[] __read_only = { 1 * HZ };
+static int max_timer[] __read_only = { 300 * HZ };
static struct ctl_table_header *x25_table_header;
Reference in new issue View Git Blame Copy Permalink