Updating liguros repov21.1.3

120 files changed, 8748 insertions, 0 deletions

diff --git a/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/0000_README b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/0000_README
new file mode 100644
index 000000000000..e4c8baca988b
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/0000_README
@@ -0,0 +1,112 @@
+README
+--------------------------------------------------------------------------
+This patchset is to be the series of patches for gentoo-sources.
+It is designed for cross-compatibility, fixes and stability, with performance
+and additional features/driver support being a second.
+
+Unless otherwise stated and marked as such, this kernel should be suitable for
+all environments.
+
+
+Patchset Numbering Scheme
+--------------------------------------------------------------------------
+
+FIXES
+1000-1400	linux-stable
+1400-1500	linux-stable queue
+1500-1700	security
+1700-1800	architecture-related
+1800-1900	mm/scheduling/misc
+1900-2000	filesystems
+2000-2100	networking core
+2100-2200	storage core
+2200-2300	power management (ACPI, APM)
+2300-2400	bus (USB, IEEE1394, PCI, PCMCIA, ...)
+2400-2500	network drivers
+2500-2600	storage drivers
+2600-2700	input
+2700-2900	media (graphics, sound, tv)
+2900-3000	other
+3000-4000	reserved
+
+FEATURES
+4000-4100	network
+4100-4200	storage
+4200-4300	graphics
+4300-4400	filesystem
+4400-4500   security enhancement
+4500-4600   other
+
+EXPERIMENTAL
+5000-5100   experimental patches (BFQ, ...)
+
+Individual Patch Descriptions:
+--------------------------------------------------------------------------
+
+Patch:  1000_linux-5.10.1.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.1
+
+Patch:  1001_linux-5.10.2.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.2
+
+Patch:  1002_linux-5.10.3.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.3
+
+Patch:  1003_linux-5.10.4.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.4
+
+Patch:  1004_linux-5.10.5.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.5
+
+Patch:  1005_linux-5.10.6.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.6
+
+Patch:  1006_linux-5.10.7.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.7
+
+Patch:  1007_linux-5.10.8.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.8
+
+Patch:  1008_linux-5.10.9.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.9
+
+Patch:  1500_XATTR_USER_PREFIX.patch
+From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
+Desc:   Support for namespace user.pax.* on tmpfs.
+
+Patch:  1510_fs-enable-link-security-restrictions-by-default.patch
+From:   http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
+Desc:   Enable link security restrictions by default.
+
+Patch:  2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
+From:   https://lore.kernel.org/linux-bluetooth/20190522070540.48895-1-marcel@holtmann.org/raw
+Desc:   Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758
+
+Patch:  2900_tmp513-Fix-build-issue-by-selecting-CONFIG_REG.patch
+From:   https://bugs.gentoo.org/710790
+Desc:   tmp513 requies REGMAP_I2C to build.  Select it by default in Kconfig. See bug #710790. Thanks to Phil Stracchino
+
+Patch:  2920_sign-file-patch-for-libressl.patch
+From:   https://bugs.gentoo.org/717166
+Desc:   sign-file: full functionality with modern LibreSSL
+
+Patch:  4567_distro-Gentoo-Kconfig.patch
+From:   Tom Wijsman <TomWij@gentoo.org>
+Desc:   Add Gentoo Linux support config settings and defaults.
+
+Patch:  5000_shifts-ubuntu-20.04.patch
+From:   https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal
+Desc:   UID/GID shifting overlay filesystem for containers 
+
+Patch:  5013_enable-cpu-optimizations-for-gcc10.patch
+From:   https://github.com/graysky2/kernel_gcc_patch/
+Desc:   Kernel patch enables gcc = v10.1+ optimizations for additional CPUs.
diff --git a/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/1500_XATTR_USER_PREFIX.patch b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/1500_XATTR_USER_PREFIX.patch
new file mode 100644
index 000000000000..245dcc29fa56
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/1500_XATTR_USER_PREFIX.patch
@@ -0,0 +1,67 @@
+From: Anthony G. Basile <blueness@gentoo.org>
+
+This patch adds support for a restricted user-controlled namespace on
+tmpfs filesystem used to house PaX flags.  The namespace must be of the
+form user.pax.* and its value cannot exceed a size of 8 bytes.
+
+This is needed even on all Gentoo systems so that XATTR_PAX flags
+are preserved for users who might build packages using portage on
+a tmpfs system with a non-hardened kernel and then switch to a
+hardened kernel with XATTR_PAX enabled.
+
+The namespace is added to any user with Extended Attribute support
+enabled for tmpfs.  Users who do not enable xattrs will not have
+the XATTR_PAX flags preserved.
+
+diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
+index 1590c49..5eab462 100644
+--- a/include/uapi/linux/xattr.h
++++ b/include/uapi/linux/xattr.h
+@@ -73,5 +73,9 @@
+ #define XATTR_POSIX_ACL_DEFAULT  "posix_acl_default"
+ #define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT
+ 
++/* User namespace */
++#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax."
++#define XATTR_PAX_FLAGS_SUFFIX "flags"
++#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
+ 
+ #endif /* _UAPI_LINUX_XATTR_H */
+--- a/mm/shmem.c	2020-05-04 15:30:27.042035334 -0400
++++ b/mm/shmem.c	2020-05-04 15:34:57.013881725 -0400
+@@ -3238,6 +3238,14 @@ static int shmem_xattr_handler_set(const
+ 	struct shmem_inode_info *info = SHMEM_I(inode);
+ 
+ 	name = xattr_full_name(handler, name);
++
++	if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
++		if (strcmp(name, XATTR_NAME_PAX_FLAGS))
++			return -EOPNOTSUPP;
++		if (size > 8)
++			return -EINVAL;
++	}
++
+ 	return simple_xattr_set(&info->xattrs, name, value, size, flags, NULL);
+ }
+ 
+@@ -3253,6 +3261,12 @@ static const struct xattr_handler shmem_
+ 	.set = shmem_xattr_handler_set,
+ };
+ 
++static const struct xattr_handler shmem_user_xattr_handler = {
++	.prefix = XATTR_USER_PREFIX,
++	.get = shmem_xattr_handler_get,
++	.set = shmem_xattr_handler_set,
++};
++
+ static const struct xattr_handler *shmem_xattr_handlers[] = {
+ #ifdef CONFIG_TMPFS_POSIX_ACL
+ 	&posix_acl_access_xattr_handler,
+@@ -3260,6 +3274,7 @@ static const struct xattr_handler *shmem
+ #endif
+ 	&shmem_security_xattr_handler,
+ 	&shmem_trusted_xattr_handler,
++	&shmem_user_xattr_handler,
+ 	NULL
+ };
+ 
diff --git a/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/1510_fs-enable-link-security-restrictions-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/1510_fs-enable-link-security-restrictions-by-default.patch
new file mode 100644
index 000000000000..f0ed144fb17a
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/1510_fs-enable-link-security-restrictions-by-default.patch
@@ -0,0 +1,20 @@
+From: Ben Hutchings <ben@decadent.org.uk>
+Subject: fs: Enable link security restrictions by default
+Date: Fri, 02 Nov 2012 05:32:06 +0000
+Bug-Debian: https://bugs.debian.org/609455
+Forwarded: not-needed
+This reverts commit 561ec64ae67ef25cac8d72bb9c4bfc955edfd415
+('VFS: don't do protected {sym,hard}links by default').
+--- a/fs/namei.c	2018-09-28 07:56:07.770005006 -0400
++++ b/fs/namei.c	2018-09-28 07:56:43.370349204 -0400
+@@ -885,8 +885,8 @@ static inline void put_link(struct namei
+ 		path_put(&last->link);
+ }
+ 
+-int sysctl_protected_symlinks __read_mostly = 0;
+-int sysctl_protected_hardlinks __read_mostly = 0;
++int sysctl_protected_symlinks __read_mostly = 1;
++int sysctl_protected_hardlinks __read_mostly = 1;
+ int sysctl_protected_fifos __read_mostly;
+ int sysctl_protected_regular __read_mostly;
+ 
diff --git a/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
new file mode 100644
index 000000000000..394ad48fc20c
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
@@ -0,0 +1,37 @@
+The encryption is only mandatory to be enforced when both sides are using
+Secure Simple Pairing and this means the key size check makes only sense
+in that case.
+
+On legacy Bluetooth 2.0 and earlier devices like mice the encryption was
+optional and thus causing an issue if the key size check is not bound to
+using Secure Simple Pairing.
+
+Fixes: d5bb334a8e17 ("Bluetooth: Align minimum encryption key size for LE and BR/EDR connections")
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Cc: stable@vger.kernel.org
+---
+ net/bluetooth/hci_conn.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 3cf0764d5793..7516cdde3373 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1272,8 +1272,13 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
+ 			return 0;
+ 	}
+ 
+-	if (hci_conn_ssp_enabled(conn) &&
+-	    !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
++	/* If Secure Simple Pairing is not enabled, then legacy connection
++	 * setup is used and no encryption or key sizes can be enforced.
++	 */
++	if (!hci_conn_ssp_enabled(conn))
++		return 1;
++
++	if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+ 		return 0;
+ 
+ 	/* The minimum encryption key size needs to be enforced by the
+-- 
+2.20.1
diff --git a/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/2900_tmp513-Fix-build-issue-by-selecting-CONFIG_REG.patch b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/2900_tmp513-Fix-build-issue-by-selecting-CONFIG_REG.patch
new file mode 100644
index 000000000000..433568579cab
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/2900_tmp513-Fix-build-issue-by-selecting-CONFIG_REG.patch
@@ -0,0 +1,30 @@
+From dc328d75a6f37f4ff11a81ae16b1ec88c3197640 Mon Sep 17 00:00:00 2001
+From: Mike Pagano <mpagano@gentoo.org>
+Date: Mon, 23 Mar 2020 08:20:06 -0400
+Subject: [PATCH 1/1] This driver requires REGMAP_I2C to build.  Select it by
+ default in Kconfig. Reported at gentoo bugzilla:
+ https://bugs.gentoo.org/710790
+Cc: mpagano@gentoo.org
+
+Reported-by: Phil Stracchino <phils@caerllewys.net>
+
+Signed-off-by: Mike Pagano <mpagano@gentoo.org>
+---
+ drivers/hwmon/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index 47ac20aee06f..530b4f29ba85 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -1769,6 +1769,7 @@ config SENSORS_TMP421
+ config SENSORS_TMP513
+ 	tristate "Texas Instruments TMP513 and compatibles"
+ 	depends on I2C
++	select REGMAP_I2C
+ 	help
+ 	  If you say yes here you get support for Texas Instruments TMP512,
+ 	  and TMP513 temperature and power supply sensor chips.
+-- 
+2.24.1
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/2920_sign-file-patch-for-libressl.patch b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/2920_sign-file-patch-for-libressl.patch
new file mode 100644
index 000000000000..e6ec017d46c8
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/2920_sign-file-patch-for-libressl.patch
@@ -0,0 +1,16 @@
+--- a/scripts/sign-file.c	2020-05-20 18:47:21.282820662 -0400
++++ b/scripts/sign-file.c	2020-05-20 18:48:37.991081899 -0400
+@@ -41,9 +41,10 @@
+  * signing with anything other than SHA1 - so we're stuck with that if such is
+  * the case.
+  */
+-#if defined(LIBRESSL_VERSION_NUMBER) || \
+-	OPENSSL_VERSION_NUMBER < 0x10000000L || \
+-	defined(OPENSSL_NO_CMS)
++#if defined(OPENSSL_NO_CMS) || \
++	( defined(LIBRESSL_VERSION_NUMBER) \
++	&& (LIBRESSL_VERSION_NUMBER < 0x3010000fL) ) || \
++	OPENSSL_VERSION_NUMBER < 0x10000000L
+ #define USE_PKCS7
+ #endif
+ #ifndef USE_PKCS7
diff --git a/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/4567_distro-Gentoo-Kconfig.patch b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/4567_distro-Gentoo-Kconfig.patch
new file mode 100644
index 000000000000..e754a3e6e459
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/4567_distro-Gentoo-Kconfig.patch
@@ -0,0 +1,169 @@
+--- a/Kconfig	2020-04-15 11:05:30.202413863 -0400
++++ b/Kconfig	2020-04-15 10:37:45.683952949 -0400
+@@ -32,3 +32,5 @@ source "lib/Kconfig"
+ source "lib/Kconfig.debug"
+ 
+ source "Documentation/Kconfig"
++
++source "distro/Kconfig"
+--- /dev/null	2020-09-24 03:06:47.590000000 -0400
++++ b/distro/Kconfig	2020-09-24 11:31:29.403150624 -0400
+@@ -0,0 +1,158 @@
++menu "Gentoo Linux"
++
++config GENTOO_LINUX
++	bool "Gentoo Linux support"
++
++	default y
++
++	help
++		In order to boot Gentoo Linux a minimal set of config settings needs to
++		be enabled in the kernel; to avoid the users from having to enable them
++		manually as part of a Gentoo Linux installation or a new clean config,
++		we enable these config settings by default for convenience.
++
++		See the settings that become available for more details and fine-tuning.
++
++config GENTOO_LINUX_UDEV
++	bool "Linux dynamic and persistent device naming (userspace devfs) support"
++
++	depends on GENTOO_LINUX
++	default y if GENTOO_LINUX
++
++	select DEVTMPFS
++	select TMPFS
++	select UNIX
++
++	select MMU
++	select SHMEM
++
++	help
++		In order to boot Gentoo Linux a minimal set of config settings needs to
++		be enabled in the kernel; to avoid the users from having to enable them
++		manually as part of a Gentoo Linux installation or a new clean config,
++		we enable these config settings by default for convenience.
++
++		Currently this only selects TMPFS, DEVTMPFS and their dependencies.
++		TMPFS is enabled to maintain a tmpfs file system at /dev/shm, /run and
++		/sys/fs/cgroup; DEVTMPFS to maintain a devtmpfs file system at /dev.
++
++		Some of these are critical files that need to be available early in the
++		boot process; if not available, it causes sysfs and udev to malfunction.
++
++		To ensure Gentoo Linux boots, it is best to leave this setting enabled;
++		if you run a custom setup, you could consider whether to disable this.
++
++config GENTOO_LINUX_PORTAGE
++	bool "Select options required by Portage features"
++
++	depends on GENTOO_LINUX
++	default y if GENTOO_LINUX
++
++	select CGROUPS
++	select NAMESPACES
++	select IPC_NS
++	select NET_NS
++	select PID_NS
++	select SYSVIPC
++	select UTS_NS
++
++	help
++		This enables options required by various Portage FEATURES.
++		Currently this selects:
++
++		CGROUPS     (required for FEATURES=cgroup)
++		IPC_NS      (required for FEATURES=ipc-sandbox)
++		NET_NS      (required for FEATURES=network-sandbox)
++		PID_NS		(required for FEATURES=pid-sandbox)
++		SYSVIPC     (required by IPC_NS)
++   
++
++		It is highly recommended that you leave this enabled as these FEATURES
++		are, or will soon be, enabled by default.
++
++menu "Support for init systems, system and service managers"
++	visible if GENTOO_LINUX
++
++config GENTOO_LINUX_INIT_SCRIPT
++	bool "OpenRC, runit and other script based systems and managers"
++
++	default y if GENTOO_LINUX
++
++	depends on GENTOO_LINUX
++
++	select BINFMT_SCRIPT
++	select CGROUPS
++	select EPOLL
++	select FILE_LOCKING
++	select INOTIFY_USER
++	select SIGNALFD
++	select TIMERFD
++
++	help
++		The init system is the first thing that loads after the kernel booted.
++
++		These config settings allow you to select which init systems to support;
++		instead of having to select all the individual settings all over the
++		place, these settings allows you to select all the settings at once.
++
++		This particular setting enables all the known requirements for OpenRC,
++		runit and similar script based systems and managers.
++
++		If you are unsure about this, it is best to leave this setting enabled.
++
++config GENTOO_LINUX_INIT_SYSTEMD
++	bool "systemd"
++
++	default n
++
++	depends on GENTOO_LINUX && GENTOO_LINUX_UDEV
++
++	select AUTOFS4_FS
++	select BLK_DEV_BSG
++	select BPF_SYSCALL
++	select CGROUP_BPF
++	select CGROUPS
++	select CHECKPOINT_RESTORE
++	select CRYPTO_HMAC 
++	select CRYPTO_SHA256
++	select CRYPTO_USER_API_HASH
++	select DEVPTS_MULTIPLE_INSTANCES
++	select DMIID if X86_32 || X86_64 || X86
++	select EPOLL
++	select FANOTIFY
++	select FHANDLE
++	select FILE_LOCKING
++	select INOTIFY_USER
++	select IPV6
++	select NET
++	select NET_NS
++	select PROC_FS
++	select SECCOMP
++	select SECCOMP_FILTER
++	select SIGNALFD
++	select SYSFS
++	select TIMERFD
++	select TMPFS_POSIX_ACL
++	select TMPFS_XATTR
++	select USER_NS
++
++	select ANON_INODES
++	select BLOCK
++	select EVENTFD
++	select FSNOTIFY
++	select INET
++	select NLATTR
++
++	help
++		The init system is the first thing that loads after the kernel booted.
++
++		These config settings allow you to select which init systems to support;
++		instead of having to select all the individual settings all over the
++		place, these settings allows you to select all the settings at once.
++
++		This particular setting enables all the known requirements for systemd;
++		it also enables suggested optional settings, as the package suggests to.
++
++endmenu
++
++endmenu
diff --git a/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/5000_shiftfs-ubuntu-20.04.patch b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/5000_shiftfs-ubuntu-20.04.patch
new file mode 100644
index 000000000000..665fc660b0de
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/gentoo-patches/5000_shiftfs-ubuntu-20.04.patch
@@ -0,0 +1,2203 @@
+--- /dev/null	2021-01-08 13:33:13.190303432 -0500
++++ b/fs/shiftfs.c	2021-01-08 19:02:40.000000000 -0500
+@@ -0,0 +1,2157 @@
++#include <linux/btrfs.h>
++#include <linux/capability.h>
++#include <linux/cred.h>
++#include <linux/mount.h>
++#include <linux/fdtable.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/namei.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/magic.h>
++#include <linux/parser.h>
++#include <linux/security.h>
++#include <linux/seq_file.h>
++#include <linux/statfs.h>
++#include <linux/slab.h>
++#include <linux/user_namespace.h>
++#include <linux/uidgid.h>
++#include <linux/xattr.h>
++#include <linux/posix_acl.h>
++#include <linux/posix_acl_xattr.h>
++#include <linux/uio.h>
++#include <linux/fiemap.h>
++
++struct shiftfs_super_info {
++	struct vfsmount *mnt;
++	struct user_namespace *userns;
++	/* creds of process who created the super block */
++	const struct cred *creator_cred;
++	bool mark;
++	unsigned int passthrough;
++	unsigned int passthrough_mark;
++};
++
++static void shiftfs_fill_inode(struct inode *inode, unsigned long ino,
++			       umode_t mode, dev_t dev, struct dentry *dentry);
++
++#define SHIFTFS_PASSTHROUGH_NONE 0
++#define SHIFTFS_PASSTHROUGH_STAT 1
++#define SHIFTFS_PASSTHROUGH_IOCTL 2
++#define SHIFTFS_PASSTHROUGH_ALL                                                \
++	(SHIFTFS_PASSTHROUGH_STAT | SHIFTFS_PASSTHROUGH_IOCTL)
++
++static inline bool shiftfs_passthrough_ioctls(struct shiftfs_super_info *info)
++{
++	if (!(info->passthrough & SHIFTFS_PASSTHROUGH_IOCTL))
++		return false;
++
++	return true;
++}
++
++static inline bool shiftfs_passthrough_statfs(struct shiftfs_super_info *info)
++{
++	if (!(info->passthrough & SHIFTFS_PASSTHROUGH_STAT))
++		return false;
++
++	return true;
++}
++
++enum {
++	OPT_MARK,
++	OPT_PASSTHROUGH,
++	OPT_LAST,
++};
++
++/* global filesystem options */
++static const match_table_t tokens = {
++	{ OPT_MARK, "mark" },
++	{ OPT_PASSTHROUGH, "passthrough=%u" },
++	{ OPT_LAST, NULL }
++};
++
++static const struct cred *shiftfs_override_creds(const struct super_block *sb)
++{
++	struct shiftfs_super_info *sbinfo = sb->s_fs_info;
++
++	return override_creds(sbinfo->creator_cred);
++}
++
++static inline void shiftfs_revert_object_creds(const struct cred *oldcred,
++					       struct cred *newcred)
++{
++	revert_creds(oldcred);
++	put_cred(newcred);
++}
++
++static kuid_t shift_kuid(struct user_namespace *from, struct user_namespace *to,
++			 kuid_t kuid)
++{
++	uid_t uid = from_kuid(from, kuid);
++	return make_kuid(to, uid);
++}
++
++static kgid_t shift_kgid(struct user_namespace *from, struct user_namespace *to,
++			 kgid_t kgid)
++{
++	gid_t gid = from_kgid(from, kgid);
++	return make_kgid(to, gid);
++}
++
++static int shiftfs_override_object_creds(const struct super_block *sb,
++					 const struct cred **oldcred,
++					 struct cred **newcred,
++					 struct dentry *dentry, umode_t mode,
++					 bool hardlink)
++{
++	struct shiftfs_super_info *sbinfo = sb->s_fs_info;
++	kuid_t fsuid = current_fsuid();
++	kgid_t fsgid = current_fsgid();
++
++	*oldcred = shiftfs_override_creds(sb);
++
++	*newcred = prepare_creds();
++	if (!*newcred) {
++		revert_creds(*oldcred);
++		return -ENOMEM;
++	}
++
++	(*newcred)->fsuid = shift_kuid(sb->s_user_ns, sbinfo->userns, fsuid);
++	(*newcred)->fsgid = shift_kgid(sb->s_user_ns, sbinfo->userns, fsgid);
++
++	if (!hardlink) {
++		int err = security_dentry_create_files_as(dentry, mode,
++							  &dentry->d_name,
++							  *oldcred, *newcred);
++		if (err) {
++			shiftfs_revert_object_creds(*oldcred, *newcred);
++			return err;
++		}
++	}
++
++	put_cred(override_creds(*newcred));
++	return 0;
++}
++
++static void shiftfs_copyattr(struct inode *from, struct inode *to)
++{
++	struct user_namespace *from_ns = from->i_sb->s_user_ns;
++	struct user_namespace *to_ns = to->i_sb->s_user_ns;
++
++	to->i_uid = shift_kuid(from_ns, to_ns, from->i_uid);
++	to->i_gid = shift_kgid(from_ns, to_ns, from->i_gid);
++	to->i_mode = from->i_mode;
++	to->i_atime = from->i_atime;
++	to->i_mtime = from->i_mtime;
++	to->i_ctime = from->i_ctime;
++	i_size_write(to, i_size_read(from));
++}
++
++static void shiftfs_copyflags(struct inode *from, struct inode *to)
++{
++	unsigned int mask = S_SYNC | S_IMMUTABLE | S_APPEND | S_NOATIME;
++
++	inode_set_flags(to, from->i_flags & mask, mask);
++}
++
++static void shiftfs_file_accessed(struct file *file)
++{
++	struct inode *upperi, *loweri;
++
++	if (file->f_flags & O_NOATIME)
++		return;
++
++	upperi = file_inode(file);
++	loweri = upperi->i_private;
++
++	if (!loweri)
++		return;
++
++	upperi->i_mtime = loweri->i_mtime;
++	upperi->i_ctime = loweri->i_ctime;
++
++	touch_atime(&file->f_path);
++}
++
++static int shiftfs_parse_mount_options(struct shiftfs_super_info *sbinfo,
++				       char *options)
++{
++	char *p;
++	substring_t args[MAX_OPT_ARGS];
++
++	sbinfo->mark = false;
++	sbinfo->passthrough = 0;
++
++	while ((p = strsep(&options, ",")) != NULL) {
++		int err, intarg, token;
++
++		if (!*p)
++			continue;
++
++		token = match_token(p, tokens, args);
++		switch (token) {
++		case OPT_MARK:
++			sbinfo->mark = true;
++			break;
++		case OPT_PASSTHROUGH:
++			err = match_int(&args[0], &intarg);
++			if (err)
++				return err;
++
++			if (intarg & ~SHIFTFS_PASSTHROUGH_ALL)
++				return -EINVAL;
++
++			sbinfo->passthrough = intarg;
++			break;
++		default:
++			return -EINVAL;
++		}
++	}
++
++	return 0;
++}
++
++static void shiftfs_d_release(struct dentry *dentry)
++{
++	struct dentry *lowerd = dentry->d_fsdata;
++
++	if (lowerd)
++		dput(lowerd);
++}
++
++static struct dentry *shiftfs_d_real(struct dentry *dentry,
++				     const struct inode *inode)
++{
++	struct dentry *lowerd = dentry->d_fsdata;
++
++	if (inode && d_inode(dentry) == inode)
++		return dentry;
++
++	lowerd = d_real(lowerd, inode);
++	if (lowerd && (!inode || inode == d_inode(lowerd)))
++		return lowerd;
++
++	WARN(1, "shiftfs_d_real(%pd4, %s:%lu): real dentry not found\n", dentry,
++	     inode ? inode->i_sb->s_id : "NULL", inode ? inode->i_ino : 0);
++	return dentry;
++}
++
++static int shiftfs_d_weak_revalidate(struct dentry *dentry, unsigned int flags)
++{
++	int err = 1;
++	struct dentry *lowerd = dentry->d_fsdata;
++
++	if (d_is_negative(lowerd) != d_is_negative(dentry))
++		return 0;
++
++	if ((lowerd->d_flags & DCACHE_OP_WEAK_REVALIDATE))
++		err = lowerd->d_op->d_weak_revalidate(lowerd, flags);
++
++	if (d_really_is_positive(dentry)) {
++		struct inode *inode = d_inode(dentry);
++		struct inode *loweri = d_inode(lowerd);
++
++		shiftfs_copyattr(loweri, inode);
++	}
++
++	return err;
++}
++
++static int shiftfs_d_revalidate(struct dentry *dentry, unsigned int flags)
++{
++	int err = 1;
++	struct dentry *lowerd = dentry->d_fsdata;
++
++	if (d_unhashed(lowerd) ||
++	    ((d_is_negative(lowerd) != d_is_negative(dentry))))
++		return 0;
++
++	if (flags & LOOKUP_RCU)
++		return -ECHILD;
++
++	if ((lowerd->d_flags & DCACHE_OP_REVALIDATE))
++		err = lowerd->d_op->d_revalidate(lowerd, flags);
++
++	if (d_really_is_positive(dentry)) {
++		struct inode *inode = d_inode(dentry);
++		struct inode *loweri = d_inode(lowerd);
++
++		shiftfs_copyattr(loweri, inode);
++	}
++
++	return err;
++}
++
++static const struct dentry_operations shiftfs_dentry_ops = {
++	.d_release	   = shiftfs_d_release,
++	.d_real		   = shiftfs_d_real,
++	.d_revalidate	   = shiftfs_d_revalidate,
++	.d_weak_revalidate = shiftfs_d_weak_revalidate,
++};
++
++static const char *shiftfs_get_link(struct dentry *dentry, struct inode *inode,
++				    struct delayed_call *done)
++{
++	const char *p;
++	const struct cred *oldcred;
++	struct dentry *lowerd;
++
++	/* RCU lookup not supported */
++	if (!dentry)
++		return ERR_PTR(-ECHILD);
++
++	lowerd = dentry->d_fsdata;
++	oldcred = shiftfs_override_creds(dentry->d_sb);
++	p = vfs_get_link(lowerd, done);
++	revert_creds(oldcred);
++
++	return p;
++}
++
++static int shiftfs_setxattr(struct dentry *dentry, struct inode *inode,
++			    const char *name, const void *value,
++			    size_t size, int flags)
++{
++	struct dentry *lowerd = dentry->d_fsdata;
++	int err;
++	const struct cred *oldcred;
++
++	oldcred = shiftfs_override_creds(dentry->d_sb);
++	err = vfs_setxattr(lowerd, name, value, size, flags);
++	revert_creds(oldcred);
++
++	shiftfs_copyattr(lowerd->d_inode, inode);
++
++	return err;
++}
++
++static int shiftfs_xattr_get(const struct xattr_handler *handler,
++			     struct dentry *dentry, struct inode *inode,
++			     const char *name, void *value, size_t size)
++{
++	struct dentry *lowerd = dentry->d_fsdata;
++	int err;
++	const struct cred *oldcred;
++
++	oldcred = shiftfs_override_creds(dentry->d_sb);
++	err = vfs_getxattr(lowerd, name, value, size);
++	revert_creds(oldcred);
++
++	return err;
++}
++
++static ssize_t shiftfs_listxattr(struct dentry *dentry, char *list,
++				 size_t size)
++{
++	struct dentry *lowerd = dentry->d_fsdata;
++	int err;
++	const struct cred *oldcred;
++
++	oldcred = shiftfs_override_creds(dentry->d_sb);
++	err = vfs_listxattr(lowerd, list, size);
++	revert_creds(oldcred);
++
++	return err;
++}
++
++static int shiftfs_removexattr(struct dentry *dentry, const char *name)
++{
++	struct dentry *lowerd = dentry->d_fsdata;
++	int err;
++	const struct cred *oldcred;
++
++	oldcred = shiftfs_override_creds(dentry->d_sb);
++	err = vfs_removexattr(lowerd, name);
++	revert_creds(oldcred);
++
++	/* update c/mtime */
++	shiftfs_copyattr(lowerd->d_inode, d_inode(dentry));
++
++	return err;
++}
++
++static int shiftfs_xattr_set(const struct xattr_handler *handler,
++			     struct dentry *dentry, struct inode *inode,
++			     const char *name, const void *value, size_t size,
++			     int flags)
++{
++	if (!value)
++		return shiftfs_removexattr(dentry, name);
++	return shiftfs_setxattr(dentry, inode, name, value, size, flags);
++}
++
++static int shiftfs_inode_test(struct inode *inode, void *data)
++{
++	return inode->i_private == data;
++}
++
++static int shiftfs_inode_set(struct inode *inode, void *data)
++{
++	inode->i_private = data;
++	return 0;
++}
++
++static int shiftfs_create_object(struct inode *diri, struct dentry *dentry,
++				 umode_t mode, const char *symlink,
++				 struct dentry *hardlink, bool excl)
++{
++	int err;
++	const struct cred *oldcred;
++	struct cred *newcred;
++	void *loweri_iop_ptr = NULL;
++	umode_t modei = mode;
++	struct super_block *dir_sb = diri->i_sb;
++	struct dentry *lowerd_new = dentry->d_fsdata;
++	struct inode *inode = NULL, *loweri_dir = diri->i_private;
++	const struct inode_operations *loweri_dir_iop = loweri_dir->i_op;
++	struct dentry *lowerd_link = NULL;
++
++	if (hardlink) {
++		loweri_iop_ptr = loweri_dir_iop->link;
++	} else {
++		switch (mode & S_IFMT) {
++		case S_IFDIR:
++			loweri_iop_ptr = loweri_dir_iop->mkdir;
++			break;
++		case S_IFREG:
++			loweri_iop_ptr = loweri_dir_iop->create;
++			break;
++		case S_IFLNK:
++			loweri_iop_ptr = loweri_dir_iop->symlink;
++			break;
++		case S_IFSOCK:
++			/* fall through */
++		case S_IFIFO:
++			loweri_iop_ptr = loweri_dir_iop->mknod;
++			break;
++		}
++	}
++	if (!loweri_iop_ptr) {
++		err = -EINVAL;
++		goto out_iput;
++	}
++
++	inode_lock_nested(loweri_dir, I_MUTEX_PARENT);
++
++	if (!hardlink) {
++		inode = new_inode(dir_sb);
++		if (!inode) {
++			err = -ENOMEM;
++			goto out_iput;
++		}
++
++		/*
++		 * new_inode() will have added the new inode to the super
++		 * block's list of inodes. Further below we will call
++		 * inode_insert5() Which would perform the same operation again
++		 * thereby corrupting the list. To avoid this raise I_CREATING
++		 * in i_state which will cause inode_insert5() to skip this
++		 * step. I_CREATING will be cleared by d_instantiate_new()
++		 * below.
++		 */
++		spin_lock(&inode->i_lock);
++		inode->i_state |= I_CREATING;
++		spin_unlock(&inode->i_lock);
++
++		inode_init_owner(inode, diri, mode);
++		modei = inode->i_mode;
++	}
++
++	err = shiftfs_override_object_creds(dentry->d_sb, &oldcred, &newcred,
++					    dentry, modei, hardlink != NULL);
++	if (err)
++		goto out_iput;
++
++	if (hardlink) {
++		lowerd_link = hardlink->d_fsdata;
++		err = vfs_link(lowerd_link, loweri_dir, lowerd_new, NULL);
++	} else {
++		switch (modei & S_IFMT) {
++		case S_IFDIR:
++			err = vfs_mkdir(loweri_dir, lowerd_new, modei);
++			break;
++		case S_IFREG:
++			err = vfs_create(loweri_dir, lowerd_new, modei, excl);
++			break;
++		case S_IFLNK:
++			err = vfs_symlink(loweri_dir, lowerd_new, symlink);
++			break;
++		case S_IFSOCK:
++			/* fall through */
++		case S_IFIFO:
++			err = vfs_mknod(loweri_dir, lowerd_new, modei, 0);
++			break;
++		default:
++			err = -EINVAL;
++			break;
++		}
++	}
++
++	shiftfs_revert_object_creds(oldcred, newcred);
++
++	if (!err && WARN_ON(!lowerd_new->d_inode))
++		err = -EIO;
++	if (err)
++		goto out_iput;
++
++	if (hardlink) {
++		inode = d_inode(hardlink);
++		ihold(inode);
++
++		/* copy up times from lower inode */
++		shiftfs_copyattr(d_inode(lowerd_link), inode);
++		set_nlink(d_inode(hardlink), d_inode(lowerd_link)->i_nlink);
++		d_instantiate(dentry, inode);
++	} else {
++		struct inode *inode_tmp;
++		struct inode *loweri_new = d_inode(lowerd_new);
++
++		inode_tmp = inode_insert5(inode, (unsigned long)loweri_new,
++					  shiftfs_inode_test, shiftfs_inode_set,
++					  loweri_new);
++		if (unlikely(inode_tmp != inode)) {
++			pr_err_ratelimited("shiftfs: newly created inode found in cache\n");
++			iput(inode_tmp);
++			err = -EINVAL;
++			goto out_iput;
++		}
++
++		ihold(loweri_new);
++		shiftfs_fill_inode(inode, loweri_new->i_ino, loweri_new->i_mode,
++				   0, lowerd_new);
++		d_instantiate_new(dentry, inode);
++	}
++
++	shiftfs_copyattr(loweri_dir, diri);
++	if (loweri_iop_ptr == loweri_dir_iop->mkdir)
++		set_nlink(diri, loweri_dir->i_nlink);
++
++	inode = NULL;
++
++out_iput:
++	iput(inode);
++	inode_unlock(loweri_dir);
++
++	return err;
++}
++
++static int shiftfs_create(struct inode *dir, struct dentry *dentry,
++			  umode_t mode,  bool excl)
++{
++	mode |= S_IFREG;
++
++	return shiftfs_create_object(dir, dentry, mode, NULL, NULL, excl);
++}
++
++static int shiftfs_mkdir(struct inode *dir, struct dentry *dentry,
++			 umode_t mode)
++{
++	mode |= S_IFDIR;
++
++	return shiftfs_create_object(dir, dentry, mode, NULL, NULL, false);
++}
++
++static int shiftfs_link(struct dentry *hardlink, struct inode *dir,
++			struct dentry *dentry)
++{
++	return shiftfs_create_object(dir, dentry, 0, NULL, hardlink, false);
++}
++
++static int shiftfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode,
++			 dev_t rdev)
++{
++	if (!S_ISFIFO(mode) && !S_ISSOCK(mode))
++		return -EPERM;
++
++	return shiftfs_create_object(dir, dentry, mode, NULL, NULL, false);
++}
++
++static int shiftfs_symlink(struct inode *dir, struct dentry *dentry,
++			   const char *symlink)
++{
++	return shiftfs_create_object(dir, dentry, S_IFLNK, symlink, NULL, false);
++}
++
++static int shiftfs_rm(struct inode *dir, struct dentry *dentry, bool rmdir)
++{
++	struct dentry *lowerd = dentry->d_fsdata;
++	struct inode *loweri = dir->i_private;
++	struct inode *inode = d_inode(dentry);
++	int err;
++	const struct cred *oldcred;
++
++	dget(lowerd);
++	oldcred = shiftfs_override_creds(dentry->d_sb);
++	inode_lock_nested(loweri, I_MUTEX_PARENT);
++	if (rmdir)
++		err = vfs_rmdir(loweri, lowerd);
++	else
++		err = vfs_unlink(loweri, lowerd, NULL);
++	revert_creds(oldcred);
++
++	if (!err) {
++		d_drop(dentry);
++
++		if (rmdir)
++			clear_nlink(inode);
++		else
++			drop_nlink(inode);
++	}
++	inode_unlock(loweri);
++
++	shiftfs_copyattr(loweri, dir);
++	dput(lowerd);
++
++	return err;
++}
++
++static int shiftfs_unlink(struct inode *dir, struct dentry *dentry)
++{
++	return shiftfs_rm(dir, dentry, false);
++}
++
++static int shiftfs_rmdir(struct inode *dir, struct dentry *dentry)
++{
++	return shiftfs_rm(dir, dentry, true);
++}
++
++static int shiftfs_rename(struct inode *olddir, struct dentry *old,
++			  struct inode *newdir, struct dentry *new,
++			  unsigned int flags)
++{
++	struct dentry *lowerd_dir_old = old->d_parent->d_fsdata,
++		      *lowerd_dir_new = new->d_parent->d_fsdata,
++		      *lowerd_old = old->d_fsdata, *lowerd_new = new->d_fsdata,
++		      *trapd;
++	struct inode *loweri_dir_old = lowerd_dir_old->d_inode,
++		     *loweri_dir_new = lowerd_dir_new->d_inode;
++	int err = -EINVAL;
++	const struct cred *oldcred;
++
++	trapd = lock_rename(lowerd_dir_new, lowerd_dir_old);
++
++	if (trapd == lowerd_old || trapd == lowerd_new)
++		goto out_unlock;
++
++	oldcred = shiftfs_override_creds(old->d_sb);
++	err = vfs_rename(loweri_dir_old, lowerd_old, loweri_dir_new, lowerd_new,
++			 NULL, flags);
++	revert_creds(oldcred);
++
++	shiftfs_copyattr(loweri_dir_old, olddir);
++	shiftfs_copyattr(loweri_dir_new, newdir);
++
++out_unlock:
++	unlock_rename(lowerd_dir_new, lowerd_dir_old);
++
++	return err;
++}
++
++static struct dentry *shiftfs_lookup(struct inode *dir, struct dentry *dentry,
++				     unsigned int flags)
++{
++	struct dentry *new;
++	struct inode *newi;
++	const struct cred *oldcred;
++	struct dentry *lowerd = dentry->d_parent->d_fsdata;
++	struct inode *inode = NULL, *loweri = lowerd->d_inode;
++
++	inode_lock(loweri);
++	oldcred = shiftfs_override_creds(dentry->d_sb);
++	new = lookup_one_len(dentry->d_name.name, lowerd, dentry->d_name.len);
++	revert_creds(oldcred);
++	inode_unlock(loweri);
++
++	if (IS_ERR(new))
++		return new;
++
++	dentry->d_fsdata = new;
++
++	newi = new->d_inode;
++	if (!newi)
++		goto out;
++
++	inode = iget5_locked(dentry->d_sb, (unsigned long)newi,
++			     shiftfs_inode_test, shiftfs_inode_set, newi);
++	if (!inode) {
++		dput(new);
++		return ERR_PTR(-ENOMEM);
++	}
++	if (inode->i_state & I_NEW) {
++		/*
++		 * inode->i_private set by shiftfs_inode_set(), but we still
++		 * need to take a reference
++		*/
++		ihold(newi);
++		shiftfs_fill_inode(inode, newi->i_ino, newi->i_mode, 0, new);
++		unlock_new_inode(inode);
++	}
++
++out:
++	return d_splice_alias(inode, dentry);
++}
++
++static int shiftfs_permission(struct inode *inode, int mask)
++{
++	int err;
++	const struct cred *oldcred;
++	struct inode *loweri = inode->i_private;
++
++	if (!loweri) {
++		WARN_ON(!(mask & MAY_NOT_BLOCK));
++		return -ECHILD;
++	}
++
++	err = generic_permission(inode, mask);
++	if (err)
++		return err;
++
++	oldcred = shiftfs_override_creds(inode->i_sb);
++	err = inode_permission(loweri, mask);
++	revert_creds(oldcred);
++
++	return err;
++}
++
++static int shiftfs_fiemap(struct inode *inode,
++			  struct fiemap_extent_info *fieinfo, u64 start,
++			  u64 len)
++{
++	int err;
++	const struct cred *oldcred;
++	struct inode *loweri = inode->i_private;
++
++	if (!loweri->i_op->fiemap)
++		return -EOPNOTSUPP;
++
++	oldcred = shiftfs_override_creds(inode->i_sb);
++	if (fieinfo->fi_flags & FIEMAP_FLAG_SYNC)
++		filemap_write_and_wait(loweri->i_mapping);
++	err = loweri->i_op->fiemap(loweri, fieinfo, start, len);
++	revert_creds(oldcred);
++
++	return err;
++}
++
++static int shiftfs_tmpfile(struct inode *dir, struct dentry *dentry,
++			   umode_t mode)
++{
++	int err;
++	const struct cred *oldcred;
++	struct dentry *lowerd = dentry->d_fsdata;
++	struct inode *loweri = dir->i_private;
++
++	if (!loweri->i_op->tmpfile)
++		return -EOPNOTSUPP;
++
++	oldcred = shiftfs_override_creds(dir->i_sb);
++	err = loweri->i_op->tmpfile(loweri, lowerd, mode);
++	revert_creds(oldcred);
++
++	return err;
++}
++
++static int shiftfs_setattr(struct dentry *dentry, struct iattr *attr)
++{
++	struct dentry *lowerd = dentry->d_fsdata;
++	struct inode *loweri = lowerd->d_inode;
++	struct iattr newattr;
++	const struct cred *oldcred;
++	struct super_block *sb = dentry->d_sb;
++	struct shiftfs_super_info *sbinfo = sb->s_fs_info;
++	int err;
++
++	err = setattr_prepare(dentry, attr);
++	if (err)
++		return err;
++
++	newattr = *attr;
++	newattr.ia_uid = shift_kuid(sb->s_user_ns, sbinfo->userns, attr->ia_uid);
++	newattr.ia_gid = shift_kgid(sb->s_user_ns, sbinfo->userns, attr->ia_gid);
++
++	/*
++	 * mode change is for clearing setuid/setgid bits. Allow lower fs
++	 * to interpret this in its own way.
++	 */
++	if (newattr.ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
++		newattr.ia_valid &= ~ATTR_MODE;
++
++	inode_lock(loweri);
++	oldcred = shiftfs_override_creds(dentry->d_sb);
++	err = notify_change(lowerd, &newattr, NULL);
++	revert_creds(oldcred);
++	inode_unlock(loweri);
++
++	shiftfs_copyattr(loweri, d_inode(dentry));
++
++	return err;
++}
++
++static int shiftfs_getattr(const struct path *path, struct kstat *stat,
++			   u32 request_mask, unsigned int query_flags)
++{
++	struct inode *inode = path->dentry->d_inode;
++	struct dentry *lowerd = path->dentry->d_fsdata;
++	struct inode *loweri = lowerd->d_inode;
++	struct shiftfs_super_info *info = path->dentry->d_sb->s_fs_info;
++	struct path newpath = { .mnt = info->mnt, .dentry = lowerd };
++	struct user_namespace *from_ns = loweri->i_sb->s_user_ns;
++	struct user_namespace *to_ns = inode->i_sb->s_user_ns;
++	const struct cred *oldcred;
++	int err;
++
++	oldcred = shiftfs_override_creds(inode->i_sb);
++	err = vfs_getattr(&newpath, stat, request_mask, query_flags);
++	revert_creds(oldcred);
++
++	if (err)
++		return err;
++
++	/* transform the underlying id */
++	stat->uid = shift_kuid(from_ns, to_ns, stat->uid);
++	stat->gid = shift_kgid(from_ns, to_ns, stat->gid);
++	return 0;
++}
++
++#ifdef CONFIG_SHIFT_FS_POSIX_ACL
++
++static int
++shift_acl_ids(struct user_namespace *from, struct user_namespace *to,
++	      struct posix_acl *acl)
++{
++	int i;
++
++	for (i = 0; i < acl->a_count; i++) {
++		struct posix_acl_entry *e = &acl->a_entries[i];
++		switch(e->e_tag) {
++		case ACL_USER:
++			e->e_uid = shift_kuid(from, to, e->e_uid);
++			if (!uid_valid(e->e_uid))
++				return -EOVERFLOW;
++			break;
++		case ACL_GROUP:
++			e->e_gid = shift_kgid(from, to, e->e_gid);
++			if (!gid_valid(e->e_gid))
++				return -EOVERFLOW;
++			break;
++		}
++	}
++	return 0;
++}
++
++static void
++shift_acl_xattr_ids(struct user_namespace *from, struct user_namespace *to,
++		    void *value, size_t size)
++{
++	struct posix_acl_xattr_header *header = value;
++	struct posix_acl_xattr_entry *entry = (void *)(header + 1), *end;
++	int count;
++	kuid_t kuid;
++	kgid_t kgid;
++
++	if (!value)
++		return;
++	if (size < sizeof(struct posix_acl_xattr_header))
++		return;
++	if (header->a_version != cpu_to_le32(POSIX_ACL_XATTR_VERSION))
++		return;
++
++	count = posix_acl_xattr_count(size);
++	if (count < 0)
++		return;
++	if (count == 0)
++		return;
++
++	for (end = entry + count; entry != end; entry++) {
++		switch(le16_to_cpu(entry->e_tag)) {
++		case ACL_USER:
++			kuid = make_kuid(&init_user_ns, le32_to_cpu(entry->e_id));
++			kuid = shift_kuid(from, to, kuid);
++			entry->e_id = cpu_to_le32(from_kuid(&init_user_ns, kuid));
++			break;
++		case ACL_GROUP:
++			kgid = make_kgid(&init_user_ns, le32_to_cpu(entry->e_id));
++			kgid = shift_kgid(from, to, kgid);
++			entry->e_id = cpu_to_le32(from_kgid(&init_user_ns, kgid));
++			break;
++		default:
++			break;
++		}
++	}
++}
++
++static struct posix_acl *shiftfs_get_acl(struct inode *inode, int type)
++{
++	struct inode *loweri = inode->i_private;
++	const struct cred *oldcred;
++	struct posix_acl *lower_acl, *acl = NULL;
++	struct user_namespace *from_ns = loweri->i_sb->s_user_ns;
++	struct user_namespace *to_ns = inode->i_sb->s_user_ns;
++	int size;
++	int err;
++
++	if (!IS_POSIXACL(loweri))
++		return NULL;
++
++	oldcred = shiftfs_override_creds(inode->i_sb);
++	lower_acl = get_acl(loweri, type);
++	revert_creds(oldcred);
++
++	if (lower_acl && !IS_ERR(lower_acl)) {
++		/* XXX: export posix_acl_clone? */
++		size = sizeof(struct posix_acl) +
++		       lower_acl->a_count * sizeof(struct posix_acl_entry);
++		acl = kmemdup(lower_acl, size, GFP_KERNEL);
++		posix_acl_release(lower_acl);
++
++		if (!acl)
++			return ERR_PTR(-ENOMEM);
++
++		refcount_set(&acl->a_refcount, 1);
++
++		err = shift_acl_ids(from_ns, to_ns, acl);
++		if (err) {
++			kfree(acl);
++			return ERR_PTR(err);
++		}
++	}
++
++	return acl;
++}
++
++static int
++shiftfs_posix_acl_xattr_get(const struct xattr_handler *handler,
++			   struct dentry *dentry, struct inode *inode,
++			   const char *name, void *buffer, size_t size)
++{
++	struct inode *loweri = inode->i_private;
++	int ret;
++
++	ret = shiftfs_xattr_get(NULL, dentry, inode, handler->name,
++				buffer, size);
++	if (ret < 0)
++		return ret;
++
++	inode_lock(loweri);
++	shift_acl_xattr_ids(loweri->i_sb->s_user_ns, inode->i_sb->s_user_ns,
++			    buffer, size);
++	inode_unlock(loweri);
++	return ret;
++}
++
++static int
++shiftfs_posix_acl_xattr_set(const struct xattr_handler *handler,
++			    struct dentry *dentry, struct inode *inode,
++			    const char *name, const void *value,
++			    size_t size, int flags)
++{
++	struct inode *loweri = inode->i_private;
++	int err;
++
++	if (!IS_POSIXACL(loweri) || !loweri->i_op->set_acl)
++		return -EOPNOTSUPP;
++	if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
++		return value ? -EACCES : 0;
++	if (!inode_owner_or_capable(inode))
++		return -EPERM;
++
++	if (value) {
++		shift_acl_xattr_ids(inode->i_sb->s_user_ns,
++				    loweri->i_sb->s_user_ns,
++				    (void *)value, size);
++		err = shiftfs_setxattr(dentry, inode, handler->name, value,
++				       size, flags);
++	} else {
++		err = shiftfs_removexattr(dentry, handler->name);
++	}
++
++	if (!err)
++		shiftfs_copyattr(loweri, inode);
++
++	return err;
++}
++
++static const struct xattr_handler
++shiftfs_posix_acl_access_xattr_handler = {
++	.name = XATTR_NAME_POSIX_ACL_ACCESS,
++	.flags = ACL_TYPE_ACCESS,
++	.get = shiftfs_posix_acl_xattr_get,
++	.set = shiftfs_posix_acl_xattr_set,
++};
++
++static const struct xattr_handler
++shiftfs_posix_acl_default_xattr_handler = {
++	.name = XATTR_NAME_POSIX_ACL_DEFAULT,
++	.flags = ACL_TYPE_DEFAULT,
++	.get = shiftfs_posix_acl_xattr_get,
++	.set = shiftfs_posix_acl_xattr_set,
++};
++
++#else /* !CONFIG_SHIFT_FS_POSIX_ACL */
++
++#define shiftfs_get_acl NULL
++
++#endif /* CONFIG_SHIFT_FS_POSIX_ACL */
++
++static const struct inode_operations shiftfs_dir_inode_operations = {
++	.lookup		= shiftfs_lookup,
++	.mkdir		= shiftfs_mkdir,
++	.symlink	= shiftfs_symlink,
++	.unlink		= shiftfs_unlink,
++	.rmdir		= shiftfs_rmdir,
++	.rename		= shiftfs_rename,
++	.link		= shiftfs_link,
++	.setattr	= shiftfs_setattr,
++	.create		= shiftfs_create,
++	.mknod		= shiftfs_mknod,
++	.permission	= shiftfs_permission,
++	.getattr	= shiftfs_getattr,
++	.listxattr	= shiftfs_listxattr,
++	.get_acl	= shiftfs_get_acl,
++};
++
++static const struct inode_operations shiftfs_file_inode_operations = {
++	.fiemap		= shiftfs_fiemap,
++	.getattr	= shiftfs_getattr,
++	.get_acl	= shiftfs_get_acl,
++	.listxattr	= shiftfs_listxattr,
++	.permission	= shiftfs_permission,
++	.setattr	= shiftfs_setattr,
++	.tmpfile	= shiftfs_tmpfile,
++};
++
++static const struct inode_operations shiftfs_special_inode_operations = {
++	.getattr	= shiftfs_getattr,
++	.get_acl	= shiftfs_get_acl,
++	.listxattr	= shiftfs_listxattr,
++	.permission	= shiftfs_permission,
++	.setattr	= shiftfs_setattr,
++};
++
++static const struct inode_operations shiftfs_symlink_inode_operations = {
++	.getattr	= shiftfs_getattr,
++	.get_link	= shiftfs_get_link,
++	.listxattr	= shiftfs_listxattr,
++	.setattr	= shiftfs_setattr,
++};
++
++static struct file *shiftfs_open_realfile(const struct file *file,
++					  struct inode *realinode)
++{
++	struct file *realfile;
++	const struct cred *old_cred;
++	struct inode *inode = file_inode(file);
++	struct dentry *lowerd = file->f_path.dentry->d_fsdata;
++	struct shiftfs_super_info *info = inode->i_sb->s_fs_info;
++	struct path realpath = { .mnt = info->mnt, .dentry = lowerd };
++
++	old_cred = shiftfs_override_creds(inode->i_sb);
++	realfile = open_with_fake_path(&realpath, file->f_flags, realinode,
++				       info->creator_cred);
++	revert_creds(old_cred);
++
++	return realfile;
++}
++
++#define SHIFTFS_SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT)
++
++static int shiftfs_change_flags(struct file *file, unsigned int flags)
++{
++	struct inode *inode = file_inode(file);
++	int err;
++
++	/* if some flag changed that cannot be changed then something's amiss */
++	if (WARN_ON((file->f_flags ^ flags) & ~SHIFTFS_SETFL_MASK))
++		return -EIO;
++
++	flags &= SHIFTFS_SETFL_MASK;
++
++	if (((flags ^ file->f_flags) & O_APPEND) && IS_APPEND(inode))
++		return -EPERM;
++
++	if (flags & O_DIRECT) {
++		if (!file->f_mapping->a_ops ||
++		    !file->f_mapping->a_ops->direct_IO)
++			return -EINVAL;
++	}
++
++	if (file->f_op->check_flags) {
++		err = file->f_op->check_flags(flags);
++		if (err)
++			return err;
++	}
++
++	spin_lock(&file->f_lock);
++	file->f_flags = (file->f_flags & ~SHIFTFS_SETFL_MASK) | flags;
++	spin_unlock(&file->f_lock);
++
++	return 0;
++}
++
++static int shiftfs_open(struct inode *inode, struct file *file)
++{
++	struct file *realfile;
++
++	realfile = shiftfs_open_realfile(file, inode->i_private);
++	if (IS_ERR(realfile))
++		return PTR_ERR(realfile);
++
++	file->private_data = realfile;
++	/* For O_DIRECT dentry_open() checks f_mapping->a_ops->direct_IO. */
++	file->f_mapping = realfile->f_mapping;
++
++	return 0;
++}
++
++static int shiftfs_dir_open(struct inode *inode, struct file *file)
++{
++	struct file *realfile;
++	const struct cred *oldcred;
++	struct dentry *lowerd = file->f_path.dentry->d_fsdata;
++	struct shiftfs_super_info *info = inode->i_sb->s_fs_info;
++	struct path realpath = { .mnt = info->mnt, .dentry = lowerd };
++
++	oldcred = shiftfs_override_creds(file->f_path.dentry->d_sb);
++	realfile = dentry_open(&realpath, file->f_flags | O_NOATIME,
++			       info->creator_cred);
++	revert_creds(oldcred);
++	if (IS_ERR(realfile))
++		return PTR_ERR(realfile);
++
++	file->private_data = realfile;
++
++	return 0;
++}
++
++static int shiftfs_release(struct inode *inode, struct file *file)
++{
++	struct file *realfile = file->private_data;
++
++	if (realfile)
++		fput(realfile);
++
++	return 0;
++}
++
++static int shiftfs_dir_release(struct inode *inode, struct file *file)
++{
++	return shiftfs_release(inode, file);
++}
++
++static loff_t shiftfs_dir_llseek(struct file *file, loff_t offset, int whence)
++{
++	struct file *realfile = file->private_data;
++
++	return vfs_llseek(realfile, offset, whence);
++}
++
++static loff_t shiftfs_file_llseek(struct file *file, loff_t offset, int whence)
++{
++	struct inode *realinode = file_inode(file)->i_private;
++
++	return generic_file_llseek_size(file, offset, whence,
++					realinode->i_sb->s_maxbytes,
++					i_size_read(realinode));
++}
++
++/* XXX: Need to figure out what to to about atime updates, maybe other
++ * timestamps too ... ref. ovl_file_accessed() */
++
++static rwf_t shiftfs_iocb_to_rwf(struct kiocb *iocb)
++{
++	int ifl = iocb->ki_flags;
++	rwf_t flags = 0;
++
++	if (ifl & IOCB_NOWAIT)
++		flags |= RWF_NOWAIT;
++	if (ifl & IOCB_HIPRI)
++		flags |= RWF_HIPRI;
++	if (ifl & IOCB_DSYNC)
++		flags |= RWF_DSYNC;
++	if (ifl & IOCB_SYNC)
++		flags |= RWF_SYNC;
++
++	return flags;
++}
++
++static int shiftfs_real_fdget(const struct file *file, struct fd *lowerfd)
++{
++	struct file *realfile;
++
++	if (file->f_op->open != shiftfs_open &&
++	    file->f_op->open != shiftfs_dir_open)
++		return -EINVAL;
++
++	realfile = file->private_data;
++	lowerfd->flags = 0;
++	lowerfd->file = realfile;
++
++	/* Did the flags change since open? */
++	if (unlikely(file->f_flags & ~lowerfd->file->f_flags))
++		return shiftfs_change_flags(lowerfd->file, file->f_flags);
++
++	return 0;
++}
++
++static ssize_t shiftfs_read_iter(struct kiocb *iocb, struct iov_iter *iter)
++{
++	struct file *file = iocb->ki_filp;
++	struct fd lowerfd;
++	const struct cred *oldcred;
++	ssize_t ret;
++
++	if (!iov_iter_count(iter))
++		return 0;
++
++	ret = shiftfs_real_fdget(file, &lowerfd);
++	if (ret)
++		return ret;
++
++	oldcred = shiftfs_override_creds(file->f_path.dentry->d_sb);
++	ret = vfs_iter_read(lowerfd.file, iter, &iocb->ki_pos,
++			    shiftfs_iocb_to_rwf(iocb));
++	revert_creds(oldcred);
++
++	shiftfs_file_accessed(file);
++
++	fdput(lowerfd);
++	return ret;
++}
++
++static ssize_t shiftfs_write_iter(struct kiocb *iocb, struct iov_iter *iter)
++{
++	struct file *file = iocb->ki_filp;
++	struct inode *inode = file_inode(file);
++	struct fd lowerfd;
++	const struct cred *oldcred;
++	ssize_t ret;
++
++	if (!iov_iter_count(iter))
++		return 0;
++
++	inode_lock(inode);
++	/* Update mode */
++	shiftfs_copyattr(inode->i_private, inode);
++	ret = file_remove_privs(file);
++	if (ret)
++		goto out_unlock;
++
++	ret = shiftfs_real_fdget(file, &lowerfd);
++	if (ret)
++		goto out_unlock;
++
++	oldcred = shiftfs_override_creds(file->f_path.dentry->d_sb);
++	file_start_write(lowerfd.file);
++	ret = vfs_iter_write(lowerfd.file, iter, &iocb->ki_pos,
++			     shiftfs_iocb_to_rwf(iocb));
++	file_end_write(lowerfd.file);
++	revert_creds(oldcred);
++
++	/* Update size */
++	shiftfs_copyattr(inode->i_private, inode);
++
++	fdput(lowerfd);
++
++out_unlock:
++	inode_unlock(inode);
++	return ret;
++}
++
++static int shiftfs_fsync(struct file *file, loff_t start, loff_t end,
++			 int datasync)
++{
++	struct fd lowerfd;
++	const struct cred *oldcred;
++	int ret;
++
++	ret = shiftfs_real_fdget(file, &lowerfd);
++	if (ret)
++		return ret;
++
++	oldcred = shiftfs_override_creds(file->f_path.dentry->d_sb);
++	ret = vfs_fsync_range(lowerfd.file, start, end, datasync);
++	revert_creds(oldcred);
++
++	fdput(lowerfd);
++	return ret;
++}
++
++static int shiftfs_mmap(struct file *file, struct vm_area_struct *vma)
++{
++	struct file *realfile = file->private_data;
++	const struct cred *oldcred;
++	int ret;
++
++	if (!realfile->f_op->mmap)
++		return -ENODEV;
++
++	if (WARN_ON(file != vma->vm_file))
++		return -EIO;
++
++	oldcred = shiftfs_override_creds(file->f_path.dentry->d_sb);
++	vma->vm_file = get_file(realfile);
++	ret = call_mmap(vma->vm_file, vma);
++	revert_creds(oldcred);
++
++	shiftfs_file_accessed(file);
++
++	if (ret) {
++		/*
++		 * Drop refcount from new vm_file value and restore original
++		 * vm_file value
++		 */
++		vma->vm_file = file;
++		fput(realfile);
++	} else {
++		/* Drop refcount from previous vm_file value */
++		fput(file);
++	}
++
++	return ret;
++}
++
++static long shiftfs_fallocate(struct file *file, int mode, loff_t offset,
++			      loff_t len)
++{
++	struct inode *inode = file_inode(file);
++	struct inode *loweri = inode->i_private;
++	struct fd lowerfd;
++	const struct cred *oldcred;
++	int ret;
++
++	ret = shiftfs_real_fdget(file, &lowerfd);
++	if (ret)
++		return ret;
++
++	oldcred = shiftfs_override_creds(file->f_path.dentry->d_sb);
++	ret = vfs_fallocate(lowerfd.file, mode, offset, len);
++	revert_creds(oldcred);
++
++	/* Update size */
++	shiftfs_copyattr(loweri, inode);
++
++	fdput(lowerfd);
++	return ret;
++}
++
++static int shiftfs_fadvise(struct file *file, loff_t offset, loff_t len,
++			   int advice)
++{
++	struct fd lowerfd;
++	const struct cred *oldcred;
++	int ret;
++
++	ret = shiftfs_real_fdget(file, &lowerfd);
++	if (ret)
++		return ret;
++
++	oldcred = shiftfs_override_creds(file->f_path.dentry->d_sb);
++	ret = vfs_fadvise(lowerfd.file, offset, len, advice);
++	revert_creds(oldcred);
++
++	fdput(lowerfd);
++	return ret;
++}
++
++static int shiftfs_override_ioctl_creds(int cmd, const struct super_block *sb,
++					const struct cred **oldcred,
++					struct cred **newcred)
++{
++	struct shiftfs_super_info *sbinfo = sb->s_fs_info;
++	kuid_t fsuid = current_fsuid();
++	kgid_t fsgid = current_fsgid();
++
++	*oldcred = shiftfs_override_creds(sb);
++
++	*newcred = prepare_creds();
++	if (!*newcred) {
++		revert_creds(*oldcred);
++		return -ENOMEM;
++	}
++
++	(*newcred)->fsuid = shift_kuid(sb->s_user_ns, sbinfo->userns, fsuid);
++	(*newcred)->fsgid = shift_kgid(sb->s_user_ns, sbinfo->userns, fsgid);
++
++	/* clear all caps to prevent bypassing capable() checks */
++	cap_clear((*newcred)->cap_bset);
++	cap_clear((*newcred)->cap_effective);
++	cap_clear((*newcred)->cap_inheritable);
++	cap_clear((*newcred)->cap_permitted);
++
++	if (cmd == BTRFS_IOC_SNAP_DESTROY) {
++		kuid_t kuid_root = make_kuid(sb->s_user_ns, 0);
++		/*
++		 * Allow the root user in the container to remove subvolumes
++		 * from other users.
++		 */
++		if (uid_valid(kuid_root) && uid_eq(fsuid, kuid_root))
++			cap_raise((*newcred)->cap_effective, CAP_DAC_OVERRIDE);
++	}
++
++	put_cred(override_creds(*newcred));
++	return 0;
++}
++
++static inline void shiftfs_revert_ioctl_creds(const struct cred *oldcred,
++					      struct cred *newcred)
++{
++	return shiftfs_revert_object_creds(oldcred, newcred);
++}
++
++static inline bool is_btrfs_snap_ioctl(int cmd)
++{
++	if ((cmd == BTRFS_IOC_SNAP_CREATE) || (cmd == BTRFS_IOC_SNAP_CREATE_V2))
++		return true;
++
++	return false;
++}
++
++static int shiftfs_btrfs_ioctl_fd_restore(int cmd, int fd, void __user *arg,
++					  struct btrfs_ioctl_vol_args *v1,
++					  struct btrfs_ioctl_vol_args_v2 *v2)
++{
++	int ret;
++
++	if (!is_btrfs_snap_ioctl(cmd))
++		return 0;
++
++	if (cmd == BTRFS_IOC_SNAP_CREATE)
++		ret = copy_to_user(arg, v1, sizeof(*v1));
++	else
++		ret = copy_to_user(arg, v2, sizeof(*v2));
++
++	__close_fd(current->files, fd);
++	kfree(v1);
++	kfree(v2);
++
++	return ret;
++}
++
++static int shiftfs_btrfs_ioctl_fd_replace(int cmd, void __user *arg,
++					  struct btrfs_ioctl_vol_args **b1,
++					  struct btrfs_ioctl_vol_args_v2 **b2,
++					  int *newfd)
++{
++	int oldfd, ret;
++	struct fd src;
++	struct fd lfd = {};
++	struct btrfs_ioctl_vol_args *v1 = NULL;
++	struct btrfs_ioctl_vol_args_v2 *v2 = NULL;
++
++	if (!is_btrfs_snap_ioctl(cmd))
++		return 0;
++
++	if (cmd == BTRFS_IOC_SNAP_CREATE) {
++		v1 = memdup_user(arg, sizeof(*v1));
++		if (IS_ERR(v1))
++			return PTR_ERR(v1);
++		oldfd = v1->fd;
++		*b1 = v1;
++	} else {
++		v2 = memdup_user(arg, sizeof(*v2));
++		if (IS_ERR(v2))
++			return PTR_ERR(v2);
++		oldfd = v2->fd;
++		*b2 = v2;
++	}
++
++	src = fdget(oldfd);
++	if (!src.file)
++		return -EINVAL;
++
++	ret = shiftfs_real_fdget(src.file, &lfd);
++	if (ret) {
++		fdput(src);
++		return ret;
++	}
++
++	/*
++	 * shiftfs_real_fdget() does not take a reference to lfd.file, so
++	 * take a reference here to offset the one which will be put by
++	 * __close_fd(), and make sure that reference is put on fdput(lfd).
++	 */
++	get_file(lfd.file);
++	lfd.flags |= FDPUT_FPUT;
++	fdput(src);
++
++	*newfd = get_unused_fd_flags(lfd.file->f_flags);
++	if (*newfd < 0) {
++		fdput(lfd);
++		return *newfd;
++	}
++
++	fd_install(*newfd, lfd.file);
++
++	if (cmd == BTRFS_IOC_SNAP_CREATE) {
++		v1->fd = *newfd;
++		ret = copy_to_user(arg, v1, sizeof(*v1));
++		v1->fd = oldfd;
++	} else {
++		v2->fd = *newfd;
++		ret = copy_to_user(arg, v2, sizeof(*v2));
++		v2->fd = oldfd;
++	}
++
++	if (ret)
++		shiftfs_btrfs_ioctl_fd_restore(cmd, *newfd, arg, v1, v2);
++
++	return ret;
++}
++
++static long shiftfs_real_ioctl(struct file *file, unsigned int cmd,
++			       unsigned long arg)
++{
++	struct fd lowerfd;
++	struct cred *newcred;
++	const struct cred *oldcred;
++	int newfd = -EBADF;
++	long err = 0, ret = 0;
++	void __user *argp = (void __user *)arg;
++	struct super_block *sb = file->f_path.dentry->d_sb;
++	struct btrfs_ioctl_vol_args *btrfs_v1 = NULL;
++	struct btrfs_ioctl_vol_args_v2 *btrfs_v2 = NULL;
++
++	ret = shiftfs_btrfs_ioctl_fd_replace(cmd, argp, &btrfs_v1, &btrfs_v2,
++					     &newfd);
++	if (ret < 0)
++		return ret;
++
++	ret = shiftfs_real_fdget(file, &lowerfd);
++	if (ret)
++		goto out_restore;
++
++	ret = shiftfs_override_ioctl_creds(cmd, sb, &oldcred, &newcred);
++	if (ret)
++		goto out_fdput;
++
++	ret = vfs_ioctl(lowerfd.file, cmd, arg);
++
++	shiftfs_revert_ioctl_creds(oldcred, newcred);
++
++	shiftfs_copyattr(file_inode(lowerfd.file), file_inode(file));
++	shiftfs_copyflags(file_inode(lowerfd.file), file_inode(file));
++
++out_fdput:
++	fdput(lowerfd);
++
++out_restore:
++	err = shiftfs_btrfs_ioctl_fd_restore(cmd, newfd, argp,
++					     btrfs_v1, btrfs_v2);
++	if (!ret)
++		ret = err;
++
++	return ret;
++}
++
++static bool in_ioctl_whitelist(int flag, unsigned long arg)
++{
++	void __user *argp = (void __user *)arg;
++	u64 flags = 0;
++
++	switch (flag) {
++	case BTRFS_IOC_FS_INFO:
++		return true;
++	case BTRFS_IOC_SNAP_CREATE:
++		return true;
++	case BTRFS_IOC_SNAP_CREATE_V2:
++		return true;
++	case BTRFS_IOC_SUBVOL_CREATE:
++		return true;
++	case BTRFS_IOC_SUBVOL_CREATE_V2:
++		return true;
++	case BTRFS_IOC_SUBVOL_GETFLAGS:
++		return true;
++	case BTRFS_IOC_SUBVOL_SETFLAGS:
++		if (copy_from_user(&flags, argp, sizeof(flags)))
++			return false;
++
++		if (flags & ~BTRFS_SUBVOL_RDONLY)
++			return false;
++
++		return true;
++	case BTRFS_IOC_SNAP_DESTROY:
++		return true;
++	}
++
++	return false;
++}
++
++static long shiftfs_ioctl(struct file *file, unsigned int cmd,
++			  unsigned long arg)
++{
++	switch (cmd) {
++	case FS_IOC_GETVERSION:
++		/* fall through */
++	case FS_IOC_GETFLAGS:
++		/* fall through */
++	case FS_IOC_SETFLAGS:
++		break;
++	default:
++		if (!in_ioctl_whitelist(cmd, arg) ||
++		    !shiftfs_passthrough_ioctls(file->f_path.dentry->d_sb->s_fs_info))
++			return -ENOTTY;
++	}
++
++	return shiftfs_real_ioctl(file, cmd, arg);
++}
++
++static long shiftfs_compat_ioctl(struct file *file, unsigned int cmd,
++				 unsigned long arg)
++{
++	switch (cmd) {
++	case FS_IOC32_GETVERSION:
++		/* fall through */
++	case FS_IOC32_GETFLAGS:
++		/* fall through */
++	case FS_IOC32_SETFLAGS:
++		break;
++	default:
++		if (!in_ioctl_whitelist(cmd, arg) ||
++		    !shiftfs_passthrough_ioctls(file->f_path.dentry->d_sb->s_fs_info))
++			return -ENOIOCTLCMD;
++	}
++
++	return shiftfs_real_ioctl(file, cmd, arg);
++}
++
++enum shiftfs_copyop {
++	SHIFTFS_COPY,
++	SHIFTFS_CLONE,
++	SHIFTFS_DEDUPE,
++};
++
++static ssize_t shiftfs_copyfile(struct file *file_in, loff_t pos_in,
++				struct file *file_out, loff_t pos_out, u64 len,
++				unsigned int flags, enum shiftfs_copyop op)
++{
++	ssize_t ret;
++	struct fd real_in, real_out;
++	const struct cred *oldcred;
++	struct inode *inode_out = file_inode(file_out);
++	struct inode *loweri = inode_out->i_private;
++
++	ret = shiftfs_real_fdget(file_out, &real_out);
++	if (ret)
++		return ret;
++
++	ret = shiftfs_real_fdget(file_in, &real_in);
++	if (ret) {
++		fdput(real_out);
++		return ret;
++	}
++
++	oldcred = shiftfs_override_creds(inode_out->i_sb);
++	switch (op) {
++	case SHIFTFS_COPY:
++		ret = vfs_copy_file_range(real_in.file, pos_in, real_out.file,
++					  pos_out, len, flags);
++		break;
++
++	case SHIFTFS_CLONE:
++		ret = vfs_clone_file_range(real_in.file, pos_in, real_out.file,
++					   pos_out, len, flags);
++		break;
++
++	case SHIFTFS_DEDUPE:
++		ret = vfs_dedupe_file_range_one(real_in.file, pos_in,
++						real_out.file, pos_out, len,
++						flags);
++		break;
++	}
++	revert_creds(oldcred);
++
++	/* Update size */
++	shiftfs_copyattr(loweri, inode_out);
++
++	fdput(real_in);
++	fdput(real_out);
++
++	return ret;
++}
++
++static ssize_t shiftfs_copy_file_range(struct file *file_in, loff_t pos_in,
++				       struct file *file_out, loff_t pos_out,
++				       size_t len, unsigned int flags)
++{
++	return shiftfs_copyfile(file_in, pos_in, file_out, pos_out, len, flags,
++				SHIFTFS_COPY);
++}
++
++static loff_t shiftfs_remap_file_range(struct file *file_in, loff_t pos_in,
++				       struct file *file_out, loff_t pos_out,
++				       loff_t len, unsigned int remap_flags)
++{
++	enum shiftfs_copyop op;
++
++	if (remap_flags & ~(REMAP_FILE_DEDUP | REMAP_FILE_ADVISORY))
++		return -EINVAL;
++
++	if (remap_flags & REMAP_FILE_DEDUP)
++		op = SHIFTFS_DEDUPE;
++	else
++		op = SHIFTFS_CLONE;
++
++	return shiftfs_copyfile(file_in, pos_in, file_out, pos_out, len,
++				remap_flags, op);
++}
++
++static int shiftfs_iterate_shared(struct file *file, struct dir_context *ctx)
++{
++	const struct cred *oldcred;
++	int err = -ENOTDIR;
++	struct file *realfile = file->private_data;
++
++	oldcred = shiftfs_override_creds(file->f_path.dentry->d_sb);
++	err = iterate_dir(realfile, ctx);
++	revert_creds(oldcred);
++
++	return err;
++}
++
++const struct file_operations shiftfs_file_operations = {
++	.open			= shiftfs_open,
++	.release		= shiftfs_release,
++	.llseek			= shiftfs_file_llseek,
++	.read_iter		= shiftfs_read_iter,
++	.write_iter		= shiftfs_write_iter,
++	.fsync			= shiftfs_fsync,
++	.mmap			= shiftfs_mmap,
++	.fallocate		= shiftfs_fallocate,
++	.fadvise		= shiftfs_fadvise,
++	.unlocked_ioctl		= shiftfs_ioctl,
++	.compat_ioctl		= shiftfs_compat_ioctl,
++	.copy_file_range	= shiftfs_copy_file_range,
++	.remap_file_range	= shiftfs_remap_file_range,
++};
++
++const struct file_operations shiftfs_dir_operations = {
++	.open			= shiftfs_dir_open,
++	.release		= shiftfs_dir_release,
++	.compat_ioctl		= shiftfs_compat_ioctl,
++	.fsync			= shiftfs_fsync,
++	.iterate_shared		= shiftfs_iterate_shared,
++	.llseek			= shiftfs_dir_llseek,
++	.read			= generic_read_dir,
++	.unlocked_ioctl		= shiftfs_ioctl,
++};
++
++static const struct address_space_operations shiftfs_aops = {
++	/* For O_DIRECT dentry_open() checks f_mapping->a_ops->direct_IO */
++	.direct_IO	= noop_direct_IO,
++};
++
++static void shiftfs_fill_inode(struct inode *inode, unsigned long ino,
++			       umode_t mode, dev_t dev, struct dentry *dentry)
++{
++	struct inode *loweri;
++
++	inode->i_ino = ino;
++	inode->i_flags |= S_NOCMTIME;
++
++	mode &= S_IFMT;
++	inode->i_mode = mode;
++	switch (mode & S_IFMT) {
++	case S_IFDIR:
++		inode->i_op = &shiftfs_dir_inode_operations;
++		inode->i_fop = &shiftfs_dir_operations;
++		break;
++	case S_IFLNK:
++		inode->i_op = &shiftfs_symlink_inode_operations;
++		break;
++	case S_IFREG:
++		inode->i_op = &shiftfs_file_inode_operations;
++		inode->i_fop = &shiftfs_file_operations;
++		inode->i_mapping->a_ops = &shiftfs_aops;
++		break;
++	default:
++		inode->i_op = &shiftfs_special_inode_operations;
++		init_special_inode(inode, mode, dev);
++		break;
++	}
++
++	if (!dentry)
++		return;
++
++	loweri = dentry->d_inode;
++	if (!loweri->i_op->get_link)
++		inode->i_opflags |= IOP_NOFOLLOW;
++
++	shiftfs_copyattr(loweri, inode);
++	shiftfs_copyflags(loweri, inode);
++	set_nlink(inode, loweri->i_nlink);
++}
++
++static int shiftfs_show_options(struct seq_file *m, struct dentry *dentry)
++{
++	struct super_block *sb = dentry->d_sb;
++	struct shiftfs_super_info *sbinfo = sb->s_fs_info;
++
++	if (sbinfo->mark)
++		seq_show_option(m, "mark", NULL);
++
++	if (sbinfo->passthrough)
++		seq_printf(m, ",passthrough=%u", sbinfo->passthrough);
++
++	return 0;
++}
++
++static int shiftfs_statfs(struct dentry *dentry, struct kstatfs *buf)
++{
++	struct super_block *sb = dentry->d_sb;
++	struct shiftfs_super_info *sbinfo = sb->s_fs_info;
++	struct dentry *root = sb->s_root;
++	struct dentry *realroot = root->d_fsdata;
++	struct path realpath = { .mnt = sbinfo->mnt, .dentry = realroot };
++	int err;
++
++	err = vfs_statfs(&realpath, buf);
++	if (err)
++		return err;
++
++	if (!shiftfs_passthrough_statfs(sbinfo))
++		buf->f_type = sb->s_magic;
++
++	return 0;
++}
++
++static void shiftfs_evict_inode(struct inode *inode)
++{
++	struct inode *loweri = inode->i_private;
++
++	clear_inode(inode);
++
++	if (loweri)
++		iput(loweri);
++}
++
++static void shiftfs_put_super(struct super_block *sb)
++{
++	struct shiftfs_super_info *sbinfo = sb->s_fs_info;
++
++	if (sbinfo) {
++		mntput(sbinfo->mnt);
++		put_cred(sbinfo->creator_cred);
++		kfree(sbinfo);
++	}
++}
++
++static const struct xattr_handler shiftfs_xattr_handler = {
++	.prefix = "",
++	.get    = shiftfs_xattr_get,
++	.set    = shiftfs_xattr_set,
++};
++
++const struct xattr_handler *shiftfs_xattr_handlers[] = {
++#ifdef CONFIG_SHIFT_FS_POSIX_ACL
++	&shiftfs_posix_acl_access_xattr_handler,
++	&shiftfs_posix_acl_default_xattr_handler,
++#endif
++	&shiftfs_xattr_handler,
++	NULL
++};
++
++static inline bool passthrough_is_subset(int old_flags, int new_flags)
++{
++	if ((new_flags & old_flags) != new_flags)
++		return false;
++
++	return true;
++}
++
++static int shiftfs_super_check_flags(unsigned long old_flags,
++				     unsigned long new_flags)
++{
++	if ((old_flags & SB_RDONLY) && !(new_flags & SB_RDONLY))
++		return -EPERM;
++
++	if ((old_flags & SB_NOSUID) && !(new_flags & SB_NOSUID))
++		return -EPERM;
++
++	if ((old_flags & SB_NODEV) && !(new_flags & SB_NODEV))
++		return -EPERM;
++
++	if ((old_flags & SB_NOEXEC) && !(new_flags & SB_NOEXEC))
++		return -EPERM;
++
++	if ((old_flags & SB_NOATIME) && !(new_flags & SB_NOATIME))
++		return -EPERM;
++
++	if ((old_flags & SB_NODIRATIME) && !(new_flags & SB_NODIRATIME))
++		return -EPERM;
++
++	if (!(old_flags & SB_POSIXACL) && (new_flags & SB_POSIXACL))
++		return -EPERM;
++
++	return 0;
++}
++
++static int shiftfs_remount(struct super_block *sb, int *flags, char *data)
++{
++	int err;
++	struct shiftfs_super_info new = {};
++	struct shiftfs_super_info *info = sb->s_fs_info;
++
++	err = shiftfs_parse_mount_options(&new, data);
++	if (err)
++		return err;
++
++	err = shiftfs_super_check_flags(sb->s_flags, *flags);
++	if (err)
++		return err;
++
++	/* Mark mount option cannot be changed. */
++	if (info->mark || (info->mark != new.mark))
++		return -EPERM;
++
++	if (info->passthrough != new.passthrough) {
++		/* Don't allow exceeding passthrough options of mark mount. */
++		if (!passthrough_is_subset(info->passthrough_mark,
++					   info->passthrough))
++			return -EPERM;
++
++		info->passthrough = new.passthrough;
++	}
++
++	return 0;
++}
++
++static const struct super_operations shiftfs_super_ops = {
++	.put_super	= shiftfs_put_super,
++	.show_options	= shiftfs_show_options,
++	.statfs		= shiftfs_statfs,
++	.remount_fs	= shiftfs_remount,
++	.evict_inode	= shiftfs_evict_inode,
++};
++
++struct shiftfs_data {
++	void *data;
++	const char *path;
++};
++
++static void shiftfs_super_force_flags(struct super_block *sb,
++				      unsigned long lower_flags)
++{
++	sb->s_flags |= lower_flags & (SB_RDONLY | SB_NOSUID | SB_NODEV |
++				      SB_NOEXEC | SB_NOATIME | SB_NODIRATIME);
++
++	if (!(lower_flags & SB_POSIXACL))
++		sb->s_flags &= ~SB_POSIXACL;
++}
++
++static int shiftfs_fill_super(struct super_block *sb, void *raw_data,
++			      int silent)
++{
++	int err;
++	struct path path = {};
++	struct shiftfs_super_info *sbinfo_mp;
++	char *name = NULL;
++	struct inode *inode = NULL;
++	struct dentry *dentry = NULL;
++	struct shiftfs_data *data = raw_data;
++	struct shiftfs_super_info *sbinfo = NULL;
++
++	if (!data->path)
++		return -EINVAL;
++
++	sb->s_fs_info = kzalloc(sizeof(*sbinfo), GFP_KERNEL);
++	if (!sb->s_fs_info)
++		return -ENOMEM;
++	sbinfo = sb->s_fs_info;
++
++	err = shiftfs_parse_mount_options(sbinfo, data->data);
++	if (err)
++		return err;
++
++	/* to mount a mark, must be userns admin */
++	if (!sbinfo->mark && !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
++		return -EPERM;
++
++	name = kstrdup(data->path, GFP_KERNEL);
++	if (!name)
++		return -ENOMEM;
++
++	err = kern_path(name, LOOKUP_FOLLOW, &path);
++	if (err)
++		goto out_free_name;
++
++	if (!S_ISDIR(path.dentry->d_inode->i_mode)) {
++		err = -ENOTDIR;
++		goto out_put_path;
++	}
++
++	sb->s_flags |= SB_POSIXACL;
++
++	if (sbinfo->mark) {
++		struct cred *cred_tmp;
++		struct super_block *lower_sb = path.mnt->mnt_sb;
++
++		/* to mark a mount point, must root wrt lower s_user_ns */
++		if (!ns_capable(lower_sb->s_user_ns, CAP_SYS_ADMIN)) {
++			err = -EPERM;
++			goto out_put_path;
++		}
++
++		/*
++		 * this part is visible unshifted, so make sure no
++		 * executables that could be used to give suid
++		 * privileges
++		 */
++		sb->s_iflags = SB_I_NOEXEC;
++
++		shiftfs_super_force_flags(sb, lower_sb->s_flags);
++
++		/*
++		 * Handle nesting of shiftfs mounts by referring this mark
++		 * mount back to the original mark mount. This is more
++		 * efficient and alleviates concerns about stack depth.
++		 */
++		if (lower_sb->s_magic == SHIFTFS_MAGIC) {
++			sbinfo_mp = lower_sb->s_fs_info;
++
++			/* Doesn't make sense to mark a mark mount */
++			if (sbinfo_mp->mark) {
++				err = -EINVAL;
++				goto out_put_path;
++			}
++
++			if (!passthrough_is_subset(sbinfo_mp->passthrough,
++						   sbinfo->passthrough)) {
++				err = -EPERM;
++				goto out_put_path;
++			}
++
++			sbinfo->mnt = mntget(sbinfo_mp->mnt);
++			dentry = dget(path.dentry->d_fsdata);
++			/*
++			 * Copy up the passthrough mount options from the
++			 * parent mark mountpoint.
++			 */
++			sbinfo->passthrough_mark = sbinfo_mp->passthrough_mark;
++			sbinfo->creator_cred = get_cred(sbinfo_mp->creator_cred);
++		} else {
++			sbinfo->mnt = mntget(path.mnt);
++			dentry = dget(path.dentry);
++			/*
++			 * For a new mark passthrough_mark and passthrough
++			 * are identical.
++			 */
++			sbinfo->passthrough_mark = sbinfo->passthrough;
++
++			cred_tmp = prepare_creds();
++			if (!cred_tmp) {
++				err = -ENOMEM;
++				goto out_put_path;
++			}
++			/* Don't override disk quota limits or use reserved space. */
++			cap_lower(cred_tmp->cap_effective, CAP_SYS_RESOURCE);
++			sbinfo->creator_cred = cred_tmp;
++		}
++	} else {
++		/*
++		 * This leg executes if we're admin capable in the namespace,
++		 * so be very careful.
++		 */
++		err = -EPERM;
++		if (path.dentry->d_sb->s_magic != SHIFTFS_MAGIC)
++			goto out_put_path;
++
++		sbinfo_mp = path.dentry->d_sb->s_fs_info;
++		if (!sbinfo_mp->mark)
++			goto out_put_path;
++
++		if (!passthrough_is_subset(sbinfo_mp->passthrough,
++					   sbinfo->passthrough))
++			goto out_put_path;
++
++		sbinfo->mnt = mntget(sbinfo_mp->mnt);
++		sbinfo->creator_cred = get_cred(sbinfo_mp->creator_cred);
++		dentry = dget(path.dentry->d_fsdata);
++		/*
++		 * Copy up passthrough settings from mark mountpoint so we can
++		 * verify when the overlay wants to remount with different
++		 * passthrough settings.
++		 */
++		sbinfo->passthrough_mark = sbinfo_mp->passthrough;
++		shiftfs_super_force_flags(sb, path.mnt->mnt_sb->s_flags);
++	}
++
++	sb->s_stack_depth = dentry->d_sb->s_stack_depth + 1;
++	if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
++		printk(KERN_ERR "shiftfs: maximum stacking depth exceeded\n");
++		err = -EINVAL;
++		goto out_put_path;
++	}
++
++	inode = new_inode(sb);
++	if (!inode) {
++		err = -ENOMEM;
++		goto out_put_path;
++	}
++	shiftfs_fill_inode(inode, dentry->d_inode->i_ino, S_IFDIR, 0, dentry);
++
++	ihold(dentry->d_inode);
++	inode->i_private = dentry->d_inode;
++
++	sb->s_magic = SHIFTFS_MAGIC;
++	sb->s_maxbytes = MAX_LFS_FILESIZE;
++	sb->s_op = &shiftfs_super_ops;
++	sb->s_xattr = shiftfs_xattr_handlers;
++	sb->s_d_op = &shiftfs_dentry_ops;
++	sb->s_root = d_make_root(inode);
++	if (!sb->s_root) {
++		err = -ENOMEM;
++		goto out_put_path;
++	}
++
++	sb->s_root->d_fsdata = dentry;
++	sbinfo->userns = get_user_ns(dentry->d_sb->s_user_ns);
++	shiftfs_copyattr(dentry->d_inode, sb->s_root->d_inode);
++
++	dentry = NULL;
++	err = 0;
++
++out_put_path:
++	path_put(&path);
++
++out_free_name:
++	kfree(name);
++
++	dput(dentry);
++
++	return err;
++}
++
++static struct dentry *shiftfs_mount(struct file_system_type *fs_type,
++				    int flags, const char *dev_name, void *data)
++{
++	struct shiftfs_data d = { data, dev_name };
++
++	return mount_nodev(fs_type, flags, &d, shiftfs_fill_super);
++}
++
++static struct file_system_type shiftfs_type = {
++	.owner		= THIS_MODULE,
++	.name		= "shiftfs",
++	.mount		= shiftfs_mount,
++	.kill_sb	= kill_anon_super,
++	.fs_flags	= FS_USERNS_MOUNT,
++};
++
++static int __init shiftfs_init(void)
++{
++	return register_filesystem(&shiftfs_type);
++}
++
++static void __exit shiftfs_exit(void)
++{
++	unregister_filesystem(&shiftfs_type);
++}
++
++MODULE_ALIAS_FS("shiftfs");
++MODULE_AUTHOR("James Bottomley");
++MODULE_AUTHOR("Seth Forshee <seth.forshee@canonical.com>");
++MODULE_AUTHOR("Christian Brauner <christian.brauner@ubuntu.com>");
++MODULE_DESCRIPTION("id shifting filesystem");
++MODULE_LICENSE("GPL v2");
++module_init(shiftfs_init)
++module_exit(shiftfs_exit)
+--- a/include/uapi/linux/magic.h	2021-01-06 19:08:45.234777659 -0500
++++ b/include/uapi/linux/magic.h	2021-01-06 19:09:53.900375394 -0500
+@@ -96,4 +96,6 @@
+ #define DEVMEM_MAGIC		0x454d444d	/* "DMEM" */
+ #define Z3FOLD_MAGIC		0x33
+ 
++#define SHIFTFS_MAGIC         0x6a656a62
++
+ #endif /* __LINUX_MAGIC_H__ */
+--- a/fs/Makefile	2021-01-08 18:08:28.187064015 -0500
++++ b/fs/Makefile	2021-01-08 18:09:00.788217579 -0500
+@@ -136,3 +136,4 @@ obj-$(CONFIG_EFIVAR_FS)		+= efivarfs/
+ obj-$(CONFIG_EROFS_FS)		+= erofs/
+ obj-$(CONFIG_VBOXSF_FS)		+= vboxsf/
+ obj-$(CONFIG_ZONEFS_FS)		+= zonefs/
++obj-$(CONFIG_SHIFT_FS)    += shiftfs.o
+--- a/fs/Kconfig	2021-01-06 19:14:17.709697891 -0500
++++ b/fs/Kconfig	2021-01-06 19:15:23.413281282 -0500
+@@ -122,6 +122,24 @@ source "fs/autofs/Kconfig"
+ source "fs/fuse/Kconfig"
+ source "fs/overlayfs/Kconfig"
+ 
++config SHIFT_FS
++  tristate "UID/GID shifting overlay filesystem for containers"
++  help
++    This filesystem can overlay any mounted filesystem and shift
++    the uid/gid the files appear at.  The idea is that
++    unprivileged containers can use this to mount root volumes
++    using this technique.
++
++config SHIFT_FS_POSIX_ACL
++  bool "shiftfs POSIX Access Control Lists"
++  depends on SHIFT_FS
++  select FS_POSIX_ACL
++  help
++    POSIX Access Control Lists (ACLs) support permissions for users and
++    groups beyond the owner/group/world scheme.
++
++    If you don't know what Access Control Lists are, say N.
++
+ menu "Caches"
+ 
+ source "fs/fscache/Kconfig"
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0001-make-DEFAULT_MMAP_MIN_ADDR-match-LSM_MMAP_MIN_ADDR.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0001-make-DEFAULT_MMAP_MIN_ADDR-match-LSM_MMAP_MIN_ADDR.patch
new file mode 100644
index 000000000000..6d51081a6c82
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0001-make-DEFAULT_MMAP_MIN_ADDR-match-LSM_MMAP_MIN_ADDR.patch
@@ -0,0 +1,27 @@
+From c08148e63cf99a834bdcc61af247e6b6ad40951b Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sat, 27 May 2017 07:22:12 -0400
+Subject: [PATCH 001/113] make DEFAULT_MMAP_MIN_ADDR match LSM_MMAP_MIN_ADDR
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ mm/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/mm/Kconfig b/mm/Kconfig
+index 390165ffbb0f..3b24c9e3535e 100644
+--- a/mm/Kconfig
++++ b/mm/Kconfig
+@@ -321,7 +321,8 @@ config KSM
+ config DEFAULT_MMAP_MIN_ADDR
+ 	int "Low address space to protect from user allocation"
+ 	depends on MMU
+-	default 4096
++	default 32768 if ARM || (ARM64 && COMPAT)
++	default 65536
+ 	help
+ 	  This is the portion of low virtual memory which should be protected
+ 	  from userspace allocation.  Keeping a user from writing to low pages
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0002-enable-HARDENED_USERCOPY-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0002-enable-HARDENED_USERCOPY-by-default.patch
new file mode 100644
index 000000000000..5e7e86682928
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0002-enable-HARDENED_USERCOPY-by-default.patch
@@ -0,0 +1,25 @@
+From b895b1b6a104ad8f4c2c05d8c85040b4b787732a Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 29 May 2017 06:17:41 -0400
+Subject: [PATCH 002/113] enable HARDENED_USERCOPY by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ security/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/Kconfig b/security/Kconfig
+index 7561f6f99f1d..9446ddf40974 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -154,6 +154,7 @@ config HARDENED_USERCOPY
+ 	bool "Harden memory copies between kernel and userspace"
+ 	depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
+ 	imply STRICT_DEVMEM
++	default y
+ 	help
+ 	  This option checks for obviously wrong memory regions when
+ 	  copying memory to/from the kernel (via copy_to_user() and
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0003-disable-HARDENED_USERCOPY_FALLBACK-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0003-disable-HARDENED_USERCOPY_FALLBACK-by-default.patch
new file mode 100644
index 000000000000..5ea45ca688fa
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0003-disable-HARDENED_USERCOPY_FALLBACK-by-default.patch
@@ -0,0 +1,24 @@
+From 467fa2ec364a40ccb9a7618fa211104bc79c3a7b Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 26 Apr 2018 02:01:26 -0400
+Subject: [PATCH 003/113] disable HARDENED_USERCOPY_FALLBACK by default
+
+---
+ security/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/security/Kconfig b/security/Kconfig
+index 9446ddf40974..5c388f7fe09d 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -167,7 +167,6 @@ config HARDENED_USERCOPY
+ config HARDENED_USERCOPY_FALLBACK
+ 	bool "Allow usercopy whitelist violations to fallback to object size"
+ 	depends on HARDENED_USERCOPY
+-	default y
+ 	help
+ 	  This is a temporary option that allows missing usercopy whitelists
+ 	  to be discovered via a WARN() to the kernel log, instead of
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0004-enable-SECURITY_DMESG_RESTRICT-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0004-enable-SECURITY_DMESG_RESTRICT-by-default.patch
new file mode 100644
index 000000000000..402c5a6cd5b0
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0004-enable-SECURITY_DMESG_RESTRICT-by-default.patch
@@ -0,0 +1,26 @@
+From 593daac6352ec4fceff83c152ba3632ea64d85a8 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 12:05:15 -0400
+Subject: [PATCH 004/113] enable SECURITY_DMESG_RESTRICT by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ security/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/Kconfig b/security/Kconfig
+index 5c388f7fe09d..428ad7622370 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -9,7 +9,7 @@ source "security/keys/Kconfig"
+ 
+ config SECURITY_DMESG_RESTRICT
+ 	bool "Restrict unprivileged access to the kernel syslog"
+-	default n
++	default y
+ 	help
+ 	  This enforces restrictions on unprivileged users reading the kernel
+ 	  syslog via dmesg(8).
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0005-set-kptr_restrict-2-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0005-set-kptr_restrict-2-by-default.patch
new file mode 100644
index 000000000000..c64e04c8bb19
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0005-set-kptr_restrict-2-by-default.patch
@@ -0,0 +1,26 @@
+From 967e396861b82f8d0daff25b5a9b2bb008076aec Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 12:06:14 -0400
+Subject: [PATCH 005/113] set kptr_restrict=2 by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ lib/vsprintf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/vsprintf.c b/lib/vsprintf.c
+index 14c9a6af1b23..2501f75bd74d 100644
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -821,7 +821,7 @@ static char *ptr_to_id(char *buf, char *end, const void *ptr,
+ 	return pointer_string(buf, end, (const void *)hashval, spec);
+ }
+ 
+-int kptr_restrict __read_mostly;
++int kptr_restrict __read_mostly = 2;
+ 
+ static noinline_for_stack
+ char *restricted_pointer(char *buf, char *end, const void *ptr,
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0006-enable-DEBUG_LIST-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0006-enable-DEBUG_LIST-by-default.patch
new file mode 100644
index 000000000000..208bb4f287c7
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0006-enable-DEBUG_LIST-by-default.patch
@@ -0,0 +1,25 @@
+From 0febc4111e3e908623ab2489e5cba9446e9213e9 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 12:10:57 -0400
+Subject: [PATCH 006/113] enable DEBUG_LIST by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ lib/Kconfig.debug | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index c789b39ed527..89c9d6aebf77 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -1471,6 +1471,7 @@ menu "Debug kernel data structures"
+ config DEBUG_LIST
+ 	bool "Debug linked list manipulation"
+ 	depends on DEBUG_KERNEL || BUG_ON_DATA_CORRUPTION
++	default y
+ 	help
+ 	  Enable this to turn on extended checks in the linked-list
+ 	  walking routines.
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0007-enable-BUG_ON_DATA_CORRUPTION-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0007-enable-BUG_ON_DATA_CORRUPTION-by-default.patch
new file mode 100644
index 000000000000..df35827929f9
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0007-enable-BUG_ON_DATA_CORRUPTION-by-default.patch
@@ -0,0 +1,25 @@
+From f5fa582231e90e6bb094e05a8604cc10bb0a793e Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 29 May 2017 12:21:21 -0400
+Subject: [PATCH 007/113] enable BUG_ON_DATA_CORRUPTION by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ lib/Kconfig.debug | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 89c9d6aebf77..11068e77d146 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -1511,6 +1511,7 @@ config DEBUG_NOTIFIERS
+ config BUG_ON_DATA_CORRUPTION
+ 	bool "Trigger a BUG when data corruption is detected"
+ 	select DEBUG_LIST
++	default y
+ 	help
+ 	  Select this option if the kernel should BUG when it encounters
+ 	  data corruption in kernel memory structures when they get checked
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0008-enable-ARM64_SW_TTBR0_PAN-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0008-enable-ARM64_SW_TTBR0_PAN-by-default.patch
new file mode 100644
index 000000000000..cd7aef62607d
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0008-enable-ARM64_SW_TTBR0_PAN-by-default.patch
@@ -0,0 +1,24 @@
+From 935268b79a412174ac7343954e2adfc10902459e Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 25 Feb 2018 01:39:32 -0500
+Subject: [PATCH 008/113] enable ARM64_SW_TTBR0_PAN by default
+
+---
+ arch/arm64/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index a6b5b7ef40ae..a145245ec5e7 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1199,6 +1199,7 @@ config RODATA_FULL_DEFAULT_ENABLED
+ 
+ config ARM64_SW_TTBR0_PAN
+ 	bool "Emulate Privileged Access Never using TTBR0_EL1 switching"
++	default y
+ 	help
+ 	  Enabling this option prevents the kernel from accessing
+ 	  user-space memory directly by pointing TTBR0_EL1 to a reserved
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0009-arm64-enable-RANDOMIZE_BASE-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0009-arm64-enable-RANDOMIZE_BASE-by-default.patch
new file mode 100644
index 000000000000..b547e6ec6e22
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0009-arm64-enable-RANDOMIZE_BASE-by-default.patch
@@ -0,0 +1,24 @@
+From f99493c13116246e9ba06383824cce6e856d4e5d Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 25 Feb 2018 01:33:48 -0500
+Subject: [PATCH 009/113] arm64: enable RANDOMIZE_BASE by default
+
+---
+ arch/arm64/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index a145245ec5e7..21088a6532d8 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1790,6 +1790,7 @@ config RANDOMIZE_BASE
+ 	bool "Randomize the address of the kernel image"
+ 	select ARM64_MODULE_PLTS if MODULES
+ 	select RELOCATABLE
++	default y
+ 	help
+ 	  Randomizes the virtual address at which the kernel image is
+ 	  loaded, as a security feature that deters exploit attempts
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0010-enable-SLAB_FREELIST_RANDOM-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0010-enable-SLAB_FREELIST_RANDOM-by-default.patch
new file mode 100644
index 000000000000..da841868f26d
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0010-enable-SLAB_FREELIST_RANDOM-by-default.patch
@@ -0,0 +1,25 @@
+From ff368e2ff05808d37dec571568c0f50287e4d77c Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 19:43:38 -0400
+Subject: [PATCH 010/113] enable SLAB_FREELIST_RANDOM by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ init/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 0872a5a2e759..dcbcb4243316 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1929,6 +1929,7 @@ config SLAB_MERGE_DEFAULT
+ config SLAB_FREELIST_RANDOM
+ 	bool "Randomize slab freelist"
+ 	depends on SLAB || SLUB
++	default y
+ 	help
+ 	  Randomizes the freelist order used on creating new pages. This
+ 	  security feature reduces the predictability of the kernel slab
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0011-enable-SLAB_FREELIST_HARDENED-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0011-enable-SLAB_FREELIST_HARDENED-by-default.patch
new file mode 100644
index 000000000000..7d55ca97f37e
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0011-enable-SLAB_FREELIST_HARDENED-by-default.patch
@@ -0,0 +1,24 @@
+From b59aebba3ceef4122584686d3a2f82b7e7e34176 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 20 Aug 2017 15:39:25 -0400
+Subject: [PATCH 011/113] enable SLAB_FREELIST_HARDENED by default
+
+---
+ init/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index dcbcb4243316..667d1c6c021b 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1938,6 +1938,7 @@ config SLAB_FREELIST_RANDOM
+ config SLAB_FREELIST_HARDENED
+ 	bool "Harden slab freelist metadata"
+ 	depends on SLAB || SLUB
++	default y
+ 	help
+ 	  Many kernel heap attacks try to target slab cache metadata and
+ 	  other infrastructure. This options makes minor performance
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0012-disable-SLAB_MERGE_DEFAULT-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0012-disable-SLAB_MERGE_DEFAULT-by-default.patch
new file mode 100644
index 000000000000..b42f315b54de
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0012-disable-SLAB_MERGE_DEFAULT-by-default.patch
@@ -0,0 +1,24 @@
+From 97af255a10ce384d48a18cdb397bedf852dbe749 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sat, 8 Jul 2017 02:38:54 -0400
+Subject: [PATCH 012/113] disable SLAB_MERGE_DEFAULT by default
+
+---
+ init/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 667d1c6c021b..859ab5ae66ff 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1914,7 +1914,6 @@ endchoice
+ 
+ config SLAB_MERGE_DEFAULT
+ 	bool "Allow slab caches to be merged"
+-	default y
+ 	help
+ 	  For reduced kernel memory fragmentation, slab caches can be
+ 	  merged when they share the same size and other characteristics.
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0013-enable-FORTIFY_SOURCE-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0013-enable-FORTIFY_SOURCE-by-default.patch
new file mode 100644
index 000000000000..d50416cabd0e
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0013-enable-FORTIFY_SOURCE-by-default.patch
@@ -0,0 +1,25 @@
+From 90dc8c5eb2ff066f12771c539f71c2b9cf87b273 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 8 May 2017 12:51:54 -0400
+Subject: [PATCH 013/113] enable FORTIFY_SOURCE by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ security/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/Kconfig b/security/Kconfig
+index 428ad7622370..3a2c68c7b50f 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -191,6 +191,7 @@ config HARDENED_USERCOPY_PAGESPAN
+ config FORTIFY_SOURCE
+ 	bool "Harden common str/mem functions against buffer overflows"
+ 	depends on ARCH_HAS_FORTIFY_SOURCE
++	default y
+ 	help
+ 	  Detect overflows of buffers in common string and memory functions
+ 	  where the compiler can determine and validate the buffer sizes.
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0014-enable-PANIC_ON_OOPS-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0014-enable-PANIC_ON_OOPS-by-default.patch
new file mode 100644
index 000000000000..7a26f3e4bcaf
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0014-enable-PANIC_ON_OOPS-by-default.patch
@@ -0,0 +1,34 @@
+From 9e0cedb9a03ca4f234554676ae91a47dc2148e09 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 12:09:17 -0400
+Subject: [PATCH 014/113] enable PANIC_ON_OOPS by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ lib/Kconfig.debug | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 11068e77d146..45b169177fb9 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -894,6 +894,7 @@ menu "Debug Oops, Lockups and Hangs"
+ 
+ config PANIC_ON_OOPS
+ 	bool "Panic on Oops"
++	default y
+ 	help
+ 	  Say Y here to enable the kernel to panic when it oopses. This
+ 	  has the same effect as setting oops=panic on the kernel command
+@@ -903,7 +904,7 @@ config PANIC_ON_OOPS
+ 	  anything erroneous after an oops which could result in data
+ 	  corruption or other issues.
+ 
+-	  Say N if unsure.
++	  Say Y if unsure.
+ 
+ config PANIC_ON_OOPS_VALUE
+ 	int
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0015-stop-hiding-SLUB_DEBUG-behind-EXPERT.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0015-stop-hiding-SLUB_DEBUG-behind-EXPERT.patch
new file mode 100644
index 000000000000..841b15deb76f
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0015-stop-hiding-SLUB_DEBUG-behind-EXPERT.patch
@@ -0,0 +1,26 @@
+From e355335e289287e665b996c16df84c007636df2e Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 14 May 2017 22:39:34 -0400
+Subject: [PATCH 015/113] stop hiding SLUB_DEBUG behind EXPERT
+
+It can make sense to disable this to reduce attack surface / complexity.
+---
+ init/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 859ab5ae66ff..74680a15ceb4 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1843,7 +1843,7 @@ config VM_EVENT_COUNTERS
+ 
+ config SLUB_DEBUG
+ 	default y
+-	bool "Enable SLUB debugging support" if EXPERT
++	bool "Enable SLUB debugging support"
+ 	depends on SLUB && SYSFS
+ 	help
+ 	  SLUB has extensive debug support features. Disabling these can
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0016-stop-hiding-X86_16BIT-behind-EXPERT.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0016-stop-hiding-X86_16BIT-behind-EXPERT.patch
new file mode 100644
index 000000000000..ab3cc0ae988d
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0016-stop-hiding-X86_16BIT-behind-EXPERT.patch
@@ -0,0 +1,25 @@
+From da8913e5cd8444478e81fc0199eea97667bd2070 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 4 May 2017 18:11:31 -0400
+Subject: [PATCH 016/113] stop hiding X86_16BIT behind EXPERT
+
+---
+ arch/x86/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 3a5ecb1039bf..d2d5e0cbf85c 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -1194,7 +1194,7 @@ config VM86
+ 	default X86_LEGACY_VM86
+ 
+ config X86_16BIT
+-	bool "Enable support for 16-bit segments" if EXPERT
++	bool "Enable support for 16-bit segments"
+ 	default y
+ 	depends on MODIFY_LDT_SYSCALL
+ 	help
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0017-disable-X86_16BIT-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0017-disable-X86_16BIT-by-default.patch
new file mode 100644
index 000000000000..d1ff728f0d80
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0017-disable-X86_16BIT-by-default.patch
@@ -0,0 +1,25 @@
+From 04b55cd1dcace045623c8a6f9b8895c88ef84fc9 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 4 May 2017 18:11:52 -0400
+Subject: [PATCH 017/113] disable X86_16BIT by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ arch/x86/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index d2d5e0cbf85c..ab6e7e2d3cf0 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -1195,7 +1195,6 @@ config VM86
+ 
+ config X86_16BIT
+ 	bool "Enable support for 16-bit segments"
+-	default y
+ 	depends on MODIFY_LDT_SYSCALL
+ 	help
+ 	  This option is required by programs like Wine to run 16-bit
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0018-stop-hiding-MODIFY_LDT_SYSCALL-behind-EXPERT.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0018-stop-hiding-MODIFY_LDT_SYSCALL-behind-EXPERT.patch
new file mode 100644
index 000000000000..1922a8338bf4
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0018-stop-hiding-MODIFY_LDT_SYSCALL-behind-EXPERT.patch
@@ -0,0 +1,25 @@
+From 9aad5f717e78e14e27f51daef922f86bb8ff3008 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 4 May 2017 18:15:52 -0400
+Subject: [PATCH 018/113] stop hiding MODIFY_LDT_SYSCALL behind EXPERT
+
+---
+ arch/x86/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index ab6e7e2d3cf0..7b9df510469b 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -2392,7 +2392,7 @@ config CMDLINE_OVERRIDE
+ 	  be set to 'N' under normal conditions.
+ 
+ config MODIFY_LDT_SYSCALL
+-	bool "Enable the LDT (local descriptor table)" if EXPERT
++	bool "Enable the LDT (local descriptor table)"
+ 	default y
+ 	help
+ 	  Linux can allow user programs to install a per-process x86
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0019-disable-MODIFY_LDT_SYSCALL-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0019-disable-MODIFY_LDT_SYSCALL-by-default.patch
new file mode 100644
index 000000000000..7f1d4061b693
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0019-disable-MODIFY_LDT_SYSCALL-by-default.patch
@@ -0,0 +1,26 @@
+From 62ab31d8233198ce7f059ef4aa7ad33b36b0bbe7 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 4 May 2017 18:16:16 -0400
+Subject: [PATCH 019/113] disable MODIFY_LDT_SYSCALL by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ arch/x86/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 7b9df510469b..63e1e9fc18dd 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -2393,7 +2393,6 @@ config CMDLINE_OVERRIDE
+ 
+ config MODIFY_LDT_SYSCALL
+ 	bool "Enable the LDT (local descriptor table)"
+-	default y
+ 	help
+ 	  Linux can allow user programs to install a per-process x86
+ 	  Local Descriptor Table (LDT) using the modify_ldt(2) system
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0020-set-LEGACY_VSYSCALL_NONE-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0020-set-LEGACY_VSYSCALL_NONE-by-default.patch
new file mode 100644
index 000000000000..b36fe7105d80
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0020-set-LEGACY_VSYSCALL_NONE-by-default.patch
@@ -0,0 +1,25 @@
+From ac50dc84da87a3894df39d03be2747b57c749fad Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 29 May 2017 07:08:42 -0400
+Subject: [PATCH 020/113] set LEGACY_VSYSCALL_NONE by default
+
+---
+ arch/x86/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 63e1e9fc18dd..4fd082de7420 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -2296,7 +2296,7 @@ config COMPAT_VDSO
+ choice
+ 	prompt "vsyscall table for legacy applications"
+ 	depends on X86_64
+-	default LEGACY_VSYSCALL_XONLY
++	default LEGACY_VSYSCALL_NONE
+ 	help
+ 	  Legacy user code that does not know how to find the vDSO expects
+ 	  to be able to issue three syscalls by calling fixed addresses in
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0021-stop-hiding-AIO-behind-EXPERT.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0021-stop-hiding-AIO-behind-EXPERT.patch
new file mode 100644
index 000000000000..fbfc43d136ba
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0021-stop-hiding-AIO-behind-EXPERT.patch
@@ -0,0 +1,25 @@
+From c918ded1d65dce93c974c5b06a96664a9f88221e Mon Sep 17 00:00:00 2001
+From: Bernhard40 <32568352+Bernhard40@users.noreply.github.com>
+Date: Fri, 6 Oct 2017 10:21:50 +0000
+Subject: [PATCH 021/113] stop hiding AIO behind EXPERT
+
+---
+ init/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 74680a15ceb4..8605f3e78e47 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1591,7 +1591,7 @@ config SHMEM
+ 	  which may be appropriate on small systems without swap.
+ 
+ config AIO
+-	bool "Enable AIO support" if EXPERT
++	bool "Enable AIO support"
+ 	default y
+ 	help
+ 	  This option enables POSIX asynchronous I/O which may by used
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0022-disable-AIO-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0022-disable-AIO-by-default.patch
new file mode 100644
index 000000000000..05c3bee7b5ba
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0022-disable-AIO-by-default.patch
@@ -0,0 +1,24 @@
+From 756ecd7b6e3c0fb46d8bf89a2013327b27da668d Mon Sep 17 00:00:00 2001
+From: Bernhard40 <32568352+Bernhard40@users.noreply.github.com>
+Date: Fri, 6 Oct 2017 10:24:10 +0000
+Subject: [PATCH 022/113] disable AIO by default
+
+---
+ init/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 8605f3e78e47..21f0b6926cf3 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1592,7 +1592,6 @@ config SHMEM
+ 
+ config AIO
+ 	bool "Enable AIO support"
+-	default y
+ 	help
+ 	  This option enables POSIX asynchronous I/O which may by used
+ 	  by some high performance threaded applications. Disabling
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0023-remove-SYSVIPC-from-arm64-x86_64-defconfigs.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0023-remove-SYSVIPC-from-arm64-x86_64-defconfigs.patch
new file mode 100644
index 000000000000..fe358e24e5bb
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0023-remove-SYSVIPC-from-arm64-x86_64-defconfigs.patch
@@ -0,0 +1,32 @@
+From 97969c017205cbf4060c1786c521724a833f95f2 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 25 Feb 2018 02:08:49 -0500
+Subject: [PATCH 023/113] remove SYSVIPC from arm64/x86_64 defconfigs
+
+---
+ arch/arm64/configs/defconfig      | 1 -
+ arch/x86/configs/x86_64_defconfig | 1 -
+ 2 files changed, 2 deletions(-)
+
+diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
+index 5cfe3cf6f2ac..f25871361bdc 100644
+--- a/arch/arm64/configs/defconfig
++++ b/arch/arm64/configs/defconfig
+@@ -1,4 +1,3 @@
+-CONFIG_SYSVIPC=y
+ CONFIG_POSIX_MQUEUE=y
+ CONFIG_AUDIT=y
+ CONFIG_NO_HZ_IDLE=y
+diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
+index 9936528e1939..981ee8c0e330 100644
+--- a/arch/x86/configs/x86_64_defconfig
++++ b/arch/x86/configs/x86_64_defconfig
+@@ -1,5 +1,4 @@
+ # CONFIG_LOCALVERSION_AUTO is not set
+-CONFIG_SYSVIPC=y
+ CONFIG_POSIX_MQUEUE=y
+ CONFIG_AUDIT=y
+ CONFIG_NO_HZ=y
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0024-disable-DEVPORT-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0024-disable-DEVPORT-by-default.patch
new file mode 100644
index 000000000000..892cc5d4a63f
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0024-disable-DEVPORT-by-default.patch
@@ -0,0 +1,24 @@
+From 0b9b844d33431c8cc5ee572342fa783a144e2f9f Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sat, 27 May 2017 07:28:10 -0400
+Subject: [PATCH 024/113] disable DEVPORT by default
+
+---
+ drivers/char/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
+index d229a2d0c017..68178c3a25de 100644
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -391,7 +391,6 @@ config MAX_RAW_DEVS
+ config DEVPORT
+ 	bool "/dev/port character device"
+ 	depends on ISA || PCI
+-	default y
+ 	help
+ 	  Say Y here if you want to support the /dev/port device. The /dev/port
+ 	  device is similar to /dev/mem, but for I/O ports.
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0025-disable-PROC_VMCORE-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0025-disable-PROC_VMCORE-by-default.patch
new file mode 100644
index 000000000000..79c6cb420f0f
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0025-disable-PROC_VMCORE-by-default.patch
@@ -0,0 +1,24 @@
+From 333c60e37e16b27149c5af06b91eddba8eae3e40 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sat, 27 May 2017 07:29:45 -0400
+Subject: [PATCH 025/113] disable PROC_VMCORE by default
+
+---
+ fs/proc/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
+index c930001056f9..6a0a51b3f593 100644
+--- a/fs/proc/Kconfig
++++ b/fs/proc/Kconfig
+@@ -41,7 +41,6 @@ config PROC_KCORE
+ config PROC_VMCORE
+ 	bool "/proc/vmcore support"
+ 	depends on PROC_FS && CRASH_DUMP
+-	default y
+ 	help
+ 	  Exports the dump image of crashed kernel in ELF format.
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0026-disable-NFS_DEBUG-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0026-disable-NFS_DEBUG-by-default.patch
new file mode 100644
index 000000000000..dbf48be81e75
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0026-disable-NFS_DEBUG-by-default.patch
@@ -0,0 +1,24 @@
+From 957e4171bbb0432c97b10872c51e84fa121997ce Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 28 May 2017 03:03:46 -0400
+Subject: [PATCH 026/113] disable NFS_DEBUG by default
+
+---
+ fs/nfs/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
+index e2a488d403a6..ce54c1c693a8 100644
+--- a/fs/nfs/Kconfig
++++ b/fs/nfs/Kconfig
+@@ -195,7 +195,6 @@ config NFS_DEBUG
+ 	bool
+ 	depends on NFS_FS && SUNRPC_DEBUG
+ 	select CRC32
+-	default y
+ 
+ config NFS_DISABLE_UDP_SUPPORT
+        bool "NFS: Disable NFS UDP protocol support"
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0027-enable-DEBUG_WX-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0027-enable-DEBUG_WX-by-default.patch
new file mode 100644
index 000000000000..bc4c4099f7dd
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0027-enable-DEBUG_WX-by-default.patch
@@ -0,0 +1,25 @@
+From caea72027aca57069470dc5218ace236188b8f0b Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 29 May 2017 12:11:11 -0400
+Subject: [PATCH 027/113] enable DEBUG_WX by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ mm/Kconfig.debug | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mm/Kconfig.debug b/mm/Kconfig.debug
+index 864f129f1937..929d585bd267 100644
+--- a/mm/Kconfig.debug
++++ b/mm/Kconfig.debug
+@@ -126,6 +126,7 @@ config DEBUG_WX
+ 	depends on ARCH_HAS_DEBUG_WX
+ 	depends on MMU
+ 	select PTDUMP_CORE
++	default y
+ 	help
+ 	  Generate a warning if any W+X mappings are found at boot.
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0028-disable-LEGACY_PTYS-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0028-disable-LEGACY_PTYS-by-default.patch
new file mode 100644
index 000000000000..38e02cb2f77e
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0028-disable-LEGACY_PTYS-by-default.patch
@@ -0,0 +1,24 @@
+From c7a6d86985eda3812758d07f7c2ffc54b076478f Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Fri, 5 Jan 2018 13:21:16 -0500
+Subject: [PATCH 028/113] disable LEGACY_PTYS by default
+
+---
+ drivers/tty/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig
+index 93fd984eb2f5..d9086484d2de 100644
+--- a/drivers/tty/Kconfig
++++ b/drivers/tty/Kconfig
+@@ -122,7 +122,6 @@ config UNIX98_PTYS
+ 
+ config LEGACY_PTYS
+ 	bool "Legacy (BSD) PTY support"
+-	default y
+ 	help
+ 	  A pseudo terminal (PTY) is a software device consisting of two
+ 	  halves: a master and a slave. The slave device behaves identical to
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0029-disable-DEVMEM-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0029-disable-DEVMEM-by-default.patch
new file mode 100644
index 000000000000..29e9479fc76b
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0029-disable-DEVMEM-by-default.patch
@@ -0,0 +1,24 @@
+From bffed3709c1980aab2e55b2d8397e948b4a29762 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Fri, 5 Jan 2018 12:41:42 -0500
+Subject: [PATCH 029/113] disable DEVMEM by default
+
+---
+ drivers/char/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
+index 68178c3a25de..2fd45f01e7a2 100644
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -327,7 +327,6 @@ config NSC_GPIO
+ 
+ config DEVMEM
+ 	bool "/dev/mem virtual device support"
+-	default y
+ 	help
+ 	  Say Y here if you want to support the /dev/mem device.
+ 	  The /dev/mem device is used to access areas of physical
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0030-enable-IO_STRICT_DEVMEM-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0030-enable-IO_STRICT_DEVMEM-by-default.patch
new file mode 100644
index 000000000000..476697f069c6
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0030-enable-IO_STRICT_DEVMEM-by-default.patch
@@ -0,0 +1,24 @@
+From 8b568dd1513a5b69cd9d378868291c358c4a0b71 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Fri, 5 Jan 2018 12:43:49 -0500
+Subject: [PATCH 030/113] enable IO_STRICT_DEVMEM by default
+
+---
+ lib/Kconfig.debug | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 45b169177fb9..a46f21a56125 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -1668,6 +1668,7 @@ config STRICT_DEVMEM
+ config IO_STRICT_DEVMEM
+ 	bool "Filter I/O access to /dev/mem"
+ 	depends on STRICT_DEVMEM
++	default y
+ 	help
+ 	  If this option is disabled, you allow userspace (root) access to all
+ 	  io-memory regardless of whether a driver is actively using that
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0031-disable-COMPAT_BRK-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0031-disable-COMPAT_BRK-by-default.patch
new file mode 100644
index 000000000000..52e28d4db2b7
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0031-disable-COMPAT_BRK-by-default.patch
@@ -0,0 +1,24 @@
+From 48c45c757acdd747ab5b1c47100b0476b9b9869e Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 7 May 2017 18:28:33 -0400
+Subject: [PATCH 031/113] disable COMPAT_BRK by default
+
+---
+ init/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 21f0b6926cf3..4f5827e10be3 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1866,7 +1866,6 @@ config SLUB_MEMCG_SYSFS_ON
+ 
+ config COMPAT_BRK
+ 	bool "Disable heap randomization"
+-	default y
+ 	help
+ 	  Randomizing heap placement makes heap exploits harder, but it
+ 	  also breaks ancient binaries (including anything libc5 based).
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0032-use-maximum-supported-mmap-rnd-entropy-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0032-use-maximum-supported-mmap-rnd-entropy-by-default.patch
new file mode 100644
index 000000000000..f931f28343e3
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0032-use-maximum-supported-mmap-rnd-entropy-by-default.patch
@@ -0,0 +1,35 @@
+From ff5211c87bb6c691cedcec47acbca66339d8e113 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 7 May 2017 16:16:39 -0400
+Subject: [PATCH 032/113] use maximum supported mmap rnd entropy by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ arch/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/Kconfig b/arch/Kconfig
+index 69fe7133c765..8b5c346d5dd8 100644
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -752,7 +752,7 @@ config ARCH_MMAP_RND_BITS
+ 	int "Number of bits to use for ASLR of mmap base address" if EXPERT
+ 	range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX
+ 	default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT
+-	default ARCH_MMAP_RND_BITS_MIN
++	default ARCH_MMAP_RND_BITS_MAX
+ 	depends on HAVE_ARCH_MMAP_RND_BITS
+ 	help
+ 	  This value can be used to select the number of bits to use to
+@@ -786,7 +786,7 @@ config ARCH_MMAP_RND_COMPAT_BITS
+ 	int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT
+ 	range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX
+ 	default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT
+-	default ARCH_MMAP_RND_COMPAT_BITS_MIN
++	default ARCH_MMAP_RND_COMPAT_BITS_MAX
+ 	depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS
+ 	help
+ 	  This value can be used to select the number of bits to use to
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0033-enable-protected_-symlinks-hardlinks-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0033-enable-protected_-symlinks-hardlinks-by-default.patch
new file mode 100644
index 000000000000..cdd2322e5d6a
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0033-enable-protected_-symlinks-hardlinks-by-default.patch
@@ -0,0 +1,27 @@
+From 81e0ac7582c94a0a3e95ca71dae0a3a832b54aa1 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 30 May 2017 10:47:23 -0400
+Subject: [PATCH 033/113] enable protected_{symlinks,hardlinks} by default
+
+---
+ fs/namei.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/namei.c b/fs/namei.c
+index d4a6dd772303..59ff3ce21026 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -932,8 +932,8 @@ static inline void put_link(struct nameidata *nd)
+ 		path_put(&last->link);
+ }
+ 
+-int sysctl_protected_symlinks __read_mostly = 0;
+-int sysctl_protected_hardlinks __read_mostly = 0;
++int sysctl_protected_symlinks __read_mostly = 1;
++int sysctl_protected_hardlinks __read_mostly = 1;
+ int sysctl_protected_fifos __read_mostly;
+ int sysctl_protected_regular __read_mostly;
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0034-enable-SECURITY-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0034-enable-SECURITY-by-default.patch
new file mode 100644
index 000000000000..9198fcc8b9d0
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0034-enable-SECURITY-by-default.patch
@@ -0,0 +1,24 @@
+From 4fee8ec7986f701856c13fc257b6a73ecf1adc1b Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 25 Feb 2018 02:13:48 -0500
+Subject: [PATCH 034/113] enable SECURITY by default
+
+---
+ security/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/Kconfig b/security/Kconfig
+index 3a2c68c7b50f..fa037a250821 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -23,6 +23,7 @@ config SECURITY
+ 	bool "Enable different security models"
+ 	depends on SYSFS
+ 	depends on MULTIUSER
++	default y
+ 	help
+ 	  This allows you to choose different security modules to be
+ 	  configured into your kernel.
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0035-enable-SECURITY_YAMA-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0035-enable-SECURITY_YAMA-by-default.patch
new file mode 100644
index 000000000000..dfe54cd72d5a
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0035-enable-SECURITY_YAMA-by-default.patch
@@ -0,0 +1,25 @@
+From c9064201bf14d83ccbd5e6fb674b106dc45117c7 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 29 May 2017 06:17:59 -0400
+Subject: [PATCH 035/113] enable SECURITY_YAMA by default
+
+---
+ security/yama/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/yama/Kconfig b/security/yama/Kconfig
+index a810304123ca..b809050b25d2 100644
+--- a/security/yama/Kconfig
++++ b/security/yama/Kconfig
+@@ -2,7 +2,7 @@
+ config SECURITY_YAMA
+ 	bool "Yama support"
+ 	depends on SECURITY
+-	default n
++	default y
+ 	help
+ 	  This selects Yama, which extends DAC support with additional
+ 	  system-wide security settings beyond regular Linux discretionary
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0036-enable-SECURITY_NETWORK-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0036-enable-SECURITY_NETWORK-by-default.patch
new file mode 100644
index 000000000000..20cb373b0412
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0036-enable-SECURITY_NETWORK-by-default.patch
@@ -0,0 +1,24 @@
+From c1bffc520a3493d1457463be0be28fca3c9d995b Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 25 Feb 2018 02:14:02 -0500
+Subject: [PATCH 036/113] enable SECURITY_NETWORK by default
+
+---
+ security/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/Kconfig b/security/Kconfig
+index fa037a250821..81d0a08736aa 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -49,6 +49,7 @@ config SECURITYFS
+ config SECURITY_NETWORK
+ 	bool "Socket and Networking Security Hooks"
+ 	depends on SECURITY
++	default y
+ 	help
+ 	  This enables the socket and networking security hooks.
+ 	  If enabled, a security module can use these hooks to
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0037-enable-AUDIT-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0037-enable-AUDIT-by-default.patch
new file mode 100644
index 000000000000..fb630a62b55d
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0037-enable-AUDIT-by-default.patch
@@ -0,0 +1,24 @@
+From 50995ff90f3b4c0646cf088cfa5bc32b7bea7554 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 25 Feb 2018 02:15:24 -0500
+Subject: [PATCH 037/113] enable AUDIT by default
+
+---
+ init/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 4f5827e10be3..9b75a4921575 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -419,6 +419,7 @@ config USELIB
+ config AUDIT
+ 	bool "Auditing support"
+ 	depends on NET
++	default y
+ 	help
+ 	  Enable auditing infrastructure that can be used with another
+ 	  kernel subsystem, such as SELinux (which requires this for
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0038-enable-SECURITY_SELINUX-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0038-enable-SECURITY_SELINUX-by-default.patch
new file mode 100644
index 000000000000..c45be54530b6
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0038-enable-SECURITY_SELINUX-by-default.patch
@@ -0,0 +1,25 @@
+From 3ba7070144172d142f4126950485ca597c6939a3 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 25 Feb 2018 02:16:49 -0500
+Subject: [PATCH 038/113] enable SECURITY_SELINUX by default
+
+---
+ security/selinux/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig
+index 9e921fc72538..76d7ed11513c 100644
+--- a/security/selinux/Kconfig
++++ b/security/selinux/Kconfig
+@@ -3,7 +3,7 @@ config SECURITY_SELINUX
+ 	bool "NSA SELinux Support"
+ 	depends on SECURITY_NETWORK && AUDIT && NET && INET
+ 	select NETWORK_SECMARK
+-	default n
++	default y
+ 	help
+ 	  This selects NSA Security-Enhanced Linux (SELinux).
+ 	  You will also need a policy configuration and a labeled filesystem.
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0039-enable-SYN_COOKIES-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0039-enable-SYN_COOKIES-by-default.patch
new file mode 100644
index 000000000000..672a1ec5a491
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0039-enable-SYN_COOKIES-by-default.patch
@@ -0,0 +1,24 @@
+From 0a5d70a559e9754652239f57ca2aadb5b6585bfe Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sat, 6 Jan 2018 13:41:11 -0500
+Subject: [PATCH 039/113] enable SYN_COOKIES by default
+
+---
+ net/ipv4/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
+index 87983e70f03f..989e005bf698 100644
+--- a/net/ipv4/Kconfig
++++ b/net/ipv4/Kconfig
+@@ -267,6 +267,7 @@ config IP_PIMSM_V2
+ 
+ config SYN_COOKIES
+ 	bool "IP: TCP syncookie support"
++	default y
+ 	help
+ 	  Normal TCP/IP networking is open to an attack known as "SYN
+ 	  flooding". This denial-of-service attack prevents legitimate remote
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0040-enable-INIT_ON_ALLOC_DEFAULT_ON-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0040-enable-INIT_ON_ALLOC_DEFAULT_ON-by-default.patch
new file mode 100644
index 000000000000..df9832e31583
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0040-enable-INIT_ON_ALLOC_DEFAULT_ON-by-default.patch
@@ -0,0 +1,24 @@
+From 18f719b5161dddc75f318861005ff1e4a4ef2db7 Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Thu, 19 Sep 2019 19:02:23 +0200
+Subject: [PATCH 040/113] enable INIT_ON_ALLOC_DEFAULT_ON by default
+
+---
+ security/Kconfig.hardening | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
+index 269967c4fc1b..1e279f6d7633 100644
+--- a/security/Kconfig.hardening
++++ b/security/Kconfig.hardening
+@@ -190,6 +190,7 @@ config STACKLEAK_RUNTIME_DISABLE
+ 
+ config INIT_ON_ALLOC_DEFAULT_ON
+ 	bool "Enable heap memory zeroing on allocation by default"
++	default yes
+ 	help
+ 	  This has the effect of setting "init_on_alloc=1" on the kernel
+ 	  command line. This can be disabled with "init_on_alloc=0".
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0041-enable-INIT_ON_FREE_DEFAULT_ON-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0041-enable-INIT_ON_FREE_DEFAULT_ON-by-default.patch
new file mode 100644
index 000000000000..4e982d9b4435
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0041-enable-INIT_ON_FREE_DEFAULT_ON-by-default.patch
@@ -0,0 +1,24 @@
+From 4f0609d264254471d8f2e8127d8b78bdca19624b Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Thu, 19 Sep 2019 19:03:01 +0200
+Subject: [PATCH 041/113] enable INIT_ON_FREE_DEFAULT_ON by default
+
+---
+ security/Kconfig.hardening | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
+index 1e279f6d7633..2fa447823405 100644
+--- a/security/Kconfig.hardening
++++ b/security/Kconfig.hardening
+@@ -203,6 +203,7 @@ config INIT_ON_ALLOC_DEFAULT_ON
+ 
+ config INIT_ON_FREE_DEFAULT_ON
+ 	bool "Enable heap memory zeroing on free by default"
++	default yes
+ 	help
+ 	  This has the effect of setting "init_on_free=1" on the kernel
+ 	  command line. This can be disabled with "init_on_free=0".
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0042-kconfig-select-DEBUG_FS_ALLOW_NONE-by-default-if-DEB.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0042-kconfig-select-DEBUG_FS_ALLOW_NONE-by-default-if-DEB.patch
new file mode 100644
index 000000000000..5417d9c2c1ec
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0042-kconfig-select-DEBUG_FS_ALLOW_NONE-by-default-if-DEB.patch
@@ -0,0 +1,27 @@
+From b700b765dd26ebe26b35b301399942a244a921d3 Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Sun, 27 Sep 2020 00:43:48 +0200
+Subject: [PATCH 042/113] kconfig: select DEBUG_FS_ALLOW_NONE by default if
+ DEBUG_FS is enabled
+
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ lib/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index a46f21a56125..4a1a32a059f4 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -488,7 +488,7 @@ config DEBUG_FS
+ choice
+ 	prompt "Debugfs default access"
+ 	depends on DEBUG_FS
+-	default DEBUG_FS_ALLOW_ALL
++	default DEBUG_FS_ALLOW_NONE
+ 	help
+ 	  This selects the default access restrictions for debugfs.
+ 	  It can be overridden with kernel command line option
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0043-stop-hiding-SYSFS_SYSCALL-behind-EXPERT.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0043-stop-hiding-SYSFS_SYSCALL-behind-EXPERT.patch
new file mode 100644
index 000000000000..0516071630e9
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0043-stop-hiding-SYSFS_SYSCALL-behind-EXPERT.patch
@@ -0,0 +1,25 @@
+From 6a7dfafae70e0305fc3d75f579386934276df8c8 Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Tue, 22 Dec 2020 23:35:53 +0100
+Subject: [PATCH 043/113] stop hiding SYSFS_SYSCALL behind EXPERT
+
+---
+ init/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 9b75a4921575..006d4d41e3af 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1434,7 +1434,7 @@ config SGETMASK_SYSCALL
+ 	  If unsure, leave the default option here.
+ 
+ config SYSFS_SYSCALL
+-	bool "Sysfs syscall support" if EXPERT
++	bool "Sysfs syscall support"
+ 	default y
+ 	help
+ 	  sys_sysfs is an obsolete system call no longer supported in libc.
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0044-disable-SYSFS_SYSCALL-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0044-disable-SYSFS_SYSCALL-by-default.patch
new file mode 100644
index 000000000000..fc26dc353954
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0044-disable-SYSFS_SYSCALL-by-default.patch
@@ -0,0 +1,31 @@
+From 96339bb02ae66fd7ed944364d2d2d60937fdc16a Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Tue, 22 Dec 2020 23:36:54 +0100
+Subject: [PATCH 044/113] disable SYSFS_SYSCALL by default
+
+---
+ init/Kconfig | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 006d4d41e3af..3d6b1b23e2db 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1435,13 +1435,12 @@ config SGETMASK_SYSCALL
+ 
+ config SYSFS_SYSCALL
+ 	bool "Sysfs syscall support"
+-	default y
+ 	help
+ 	  sys_sysfs is an obsolete system call no longer supported in libc.
+ 	  Note that disabling this option is more secure but might break
+ 	  compatibility with some systems.
+ 
+-	  If unsure say Y here.
++	  If unsure say N here.
+ 
+ config FHANDLE
+ 	bool "open by fhandle syscalls" if EXPERT
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0045-stop-hiding-UID16-behind-EXPERT.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0045-stop-hiding-UID16-behind-EXPERT.patch
new file mode 100644
index 000000000000..72da549d2c6e
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0045-stop-hiding-UID16-behind-EXPERT.patch
@@ -0,0 +1,25 @@
+From 784df6727e4ffa2e0eac2fa16cb35564abe3ffec Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Tue, 22 Dec 2020 23:40:09 +0100
+Subject: [PATCH 045/113] stop hiding UID16 behind EXPERT
+
+---
+ init/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 3d6b1b23e2db..2b6d0492def5 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1403,7 +1403,7 @@ menuconfig EXPERT
+ 	  Only use this if you really know what you are doing.
+ 
+ config UID16
+-	bool "Enable 16-bit UID system calls" if EXPERT
++	bool "Enable 16-bit UID system calls"
+ 	depends on HAVE_UID16 && MULTIUSER
+ 	default y
+ 	help
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0046-disable-UID16-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0046-disable-UID16-by-default.patch
new file mode 100644
index 000000000000..aac19b55adb0
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0046-disable-UID16-by-default.patch
@@ -0,0 +1,24 @@
+From 9a68e972e38347a1927e8fbb22611c222a4cbb75 Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Tue, 22 Dec 2020 23:41:32 +0100
+Subject: [PATCH 046/113] disable UID16 by default
+
+---
+ init/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 2b6d0492def5..58df4930995f 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1405,7 +1405,6 @@ menuconfig EXPERT
+ config UID16
+ 	bool "Enable 16-bit UID system calls"
+ 	depends on HAVE_UID16 && MULTIUSER
+-	default y
+ 	help
+ 	  This enables the legacy 16-bit UID syscall wrappers.
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0047-add-__read_only-for-non-init-related-usage.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0047-add-__read_only-for-non-init-related-usage.patch
new file mode 100644
index 000000000000..4a9800a8e873
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0047-add-__read_only-for-non-init-related-usage.patch
@@ -0,0 +1,25 @@
+From c5c4ff5a56e02bd16c034d568f9c60b876822ae4 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 7 May 2017 00:28:23 -0400
+Subject: [PATCH 047/113] add __read_only for non-init related usage
+
+---
+ include/linux/cache.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/linux/cache.h b/include/linux/cache.h
+index d742c57eaee5..f0222c070458 100644
+--- a/include/linux/cache.h
++++ b/include/linux/cache.h
+@@ -37,6 +37,8 @@
+ #define __ro_after_init __section(".data..ro_after_init")
+ #endif
+ 
++#define __read_only __ro_after_init
++
+ #ifndef ____cacheline_aligned
+ #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
+ #endif
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0048-make-sysctl-constants-read-only.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0048-make-sysctl-constants-read-only.patch
new file mode 100644
index 000000000000..b02bff45353b
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0048-make-sysctl-constants-read-only.patch
@@ -0,0 +1,108 @@
+From 2a61c23a99cf6547dab8335378dadfe41e7418cb Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 7 May 2017 00:43:03 -0400
+Subject: [PATCH 048/113] make sysctl constants read-only
+
+Most of this is extracted from the last publicly available version of
+the PaX patches where it's part of KERNEXEC as __read_only. It has been
+extended to a few more of these constants.
+---
+ kernel/sysctl.c | 54 ++++++++++++++++++++++++-------------------------
+ 1 file changed, 27 insertions(+), 27 deletions(-)
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index afad085960b8..b2cd3dbbb17a 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -108,33 +108,33 @@
+ 
+ /* Constants used for minimum and  maximum */
+ #ifdef CONFIG_LOCKUP_DETECTOR
+-static int sixty = 60;
+-#endif
+-
+-static int __maybe_unused neg_one = -1;
+-static int __maybe_unused two = 2;
+-static int __maybe_unused four = 4;
+-static unsigned long zero_ul;
+-static unsigned long one_ul = 1;
+-static unsigned long long_max = LONG_MAX;
+-static int one_hundred = 100;
+-static int two_hundred = 200;
+-static int one_thousand = 1000;
++static int sixty __read_only = 60;
++#endif
++
++static int __maybe_unused neg_one __read_only = -1;
++static int __maybe_unused two __read_only = 2;
++static int __maybe_unused four __read_only = 4;
++static unsigned long zero_ul __read_only;
++static unsigned long one_ul __read_only = 1;
++static unsigned long long_max __read_only = LONG_MAX;
++static int one_hundred __read_only = 100;
++static int two_hundred __read_only = 200;
++static int one_thousand __read_only = 1000;
+ #ifdef CONFIG_PRINTK
+-static int ten_thousand = 10000;
++static int ten_thousand __read_only = 10000;
+ #endif
+ #ifdef CONFIG_PERF_EVENTS
+-static int six_hundred_forty_kb = 640 * 1024;
++static int six_hundred_forty_kb __read_only = 640 * 1024;
+ #endif
+ 
+ /* this is needed for the proc_doulongvec_minmax of vm_dirty_bytes */
+-static unsigned long dirty_bytes_min = 2 * PAGE_SIZE;
++static unsigned long dirty_bytes_min __read_only = 2 * PAGE_SIZE;
+ 
+ /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
+-static int maxolduid = 65535;
+-static int minolduid;
++static int maxolduid __read_only = 65535;
++static int minolduid __read_only;
+ 
+-static int ngroups_max = NGROUPS_MAX;
++static int ngroups_max __read_only = NGROUPS_MAX;
+ static const int cap_last_cap = CAP_LAST_CAP;
+ 
+ /*
+@@ -142,7 +142,7 @@ static const int cap_last_cap = CAP_LAST_CAP;
+  * and hung_task_check_interval_secs
+  */
+ #ifdef CONFIG_DETECT_HUNG_TASK
+-static unsigned long hung_task_timeout_max = (LONG_MAX/HZ);
++static unsigned long hung_task_timeout_max __read_only = (LONG_MAX/HZ);
+ #endif
+ 
+ #ifdef CONFIG_INOTIFY_USER
+@@ -185,19 +185,19 @@ int sysctl_legacy_va_layout;
+ #endif
+ 
+ #ifdef CONFIG_SCHED_DEBUG
+-static int min_sched_granularity_ns = 100000;		/* 100 usecs */
+-static int max_sched_granularity_ns = NSEC_PER_SEC;	/* 1 second */
+-static int min_wakeup_granularity_ns;			/* 0 usecs */
+-static int max_wakeup_granularity_ns = NSEC_PER_SEC;	/* 1 second */
++static int min_sched_granularity_ns __read_only = 100000;		/* 100 usecs */
++static int max_sched_granularity_ns __read_only = NSEC_PER_SEC;	/* 1 second */
++static int min_wakeup_granularity_ns __read_only;			/* 0 usecs */
++static int max_wakeup_granularity_ns __read_only = NSEC_PER_SEC;	/* 1 second */
+ #ifdef CONFIG_SMP
+-static int min_sched_tunable_scaling = SCHED_TUNABLESCALING_NONE;
+-static int max_sched_tunable_scaling = SCHED_TUNABLESCALING_END-1;
++static int min_sched_tunable_scaling __read_only = SCHED_TUNABLESCALING_NONE;
++static int max_sched_tunable_scaling __read_only = SCHED_TUNABLESCALING_END-1;
+ #endif /* CONFIG_SMP */
+ #endif /* CONFIG_SCHED_DEBUG */
+ 
+ #ifdef CONFIG_COMPACTION
+-static int min_extfrag_threshold;
+-static int max_extfrag_threshold = 1000;
++static int min_extfrag_threshold __read_only;
++static int max_extfrag_threshold __read_only = 1000;
+ #endif
+ 
+ #endif /* CONFIG_SYSCTL */
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0049-mark-kernel_set_to_readonly-as-__ro_after_init.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0049-mark-kernel_set_to_readonly-as-__ro_after_init.patch
new file mode 100644
index 000000000000..0254ae87e99c
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0049-mark-kernel_set_to_readonly-as-__ro_after_init.patch
@@ -0,0 +1,67 @@
+From 754920c103a3ab1c579a3241f16f0e74221cd94f Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Fri, 12 May 2017 03:22:00 -0400
+Subject: [PATCH 049/113] mark kernel_set_to_readonly as __ro_after_init
+
+This change was extracted from PaX where it's part of KERNEXEC.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ arch/x86/mm/init_32.c | 5 ++---
+ arch/x86/mm/init_64.c | 5 ++---
+ 2 files changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
+index 7c055259de3a..77192cbc1dd7 100644
+--- a/arch/x86/mm/init_32.c
++++ b/arch/x86/mm/init_32.c
+@@ -828,7 +828,7 @@ void arch_remove_memory(int nid, u64 start, u64 size,
+ }
+ #endif
+ 
+-int kernel_set_to_readonly __read_mostly;
++int kernel_set_to_readonly __ro_after_init;
+ 
+ static void mark_nxdata_nx(void)
+ {
+@@ -852,12 +852,11 @@ void mark_rodata_ro(void)
+ 	unsigned long start = PFN_ALIGN(_text);
+ 	unsigned long size = (unsigned long)__end_rodata - start;
+ 
++	kernel_set_to_readonly = 1;
+ 	set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
+ 	pr_info("Write protecting kernel text and read-only data: %luk\n",
+ 		size >> 10);
+ 
+-	kernel_set_to_readonly = 1;
+-
+ #ifdef CONFIG_CPA_DEBUG
+ 	pr_info("Testing CPA: Reverting %lx-%lx\n", start, start + size);
+ 	set_pages_rw(virt_to_page(start), size >> PAGE_SHIFT);
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index b5a3fa4033d3..63a0f8097d0a 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -1322,7 +1322,7 @@ int __init deferred_page_init_max_threads(const struct cpumask *node_cpumask)
+ }
+ #endif
+ 
+-int kernel_set_to_readonly;
++int kernel_set_to_readonly __ro_after_init;
+ 
+ void mark_rodata_ro(void)
+ {
+@@ -1335,9 +1335,8 @@ void mark_rodata_ro(void)
+ 
+ 	printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n",
+ 	       (end - start) >> 10);
+-	set_memory_ro(start, (end - start) >> PAGE_SHIFT);
+-
+ 	kernel_set_to_readonly = 1;
++	set_memory_ro(start, (end - start) >> PAGE_SHIFT);
+ 
+ 	/*
+ 	 * The rodata/data/bss/brk section (but not the kernel text!)
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0050-Revert-mark-kernel_set_to_readonly-as-__ro_after_ini.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0050-Revert-mark-kernel_set_to_readonly-as-__ro_after_ini.patch
new file mode 100644
index 000000000000..ab744a1e00d8
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0050-Revert-mark-kernel_set_to_readonly-as-__ro_after_ini.patch
@@ -0,0 +1,70 @@
+From 2405e1d6c15fc42cea726aad766b543ea50e6241 Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Sun, 13 Jan 2019 21:42:45 +0100
+Subject: [PATCH 050/113] Revert "mark kernel_set_to_readonly as
+ __ro_after_init"
+
+    This commit causes CPA conflicts, cf.
+    https://github.com/anthraxx/linux-hardened/issues/4.
+
+    Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+---
+ arch/x86/mm/init_32.c | 5 +++--
+ arch/x86/mm/init_64.c | 5 +++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
+index 77192cbc1dd7..7c055259de3a 100644
+--- a/arch/x86/mm/init_32.c
++++ b/arch/x86/mm/init_32.c
+@@ -828,7 +828,7 @@ void arch_remove_memory(int nid, u64 start, u64 size,
+ }
+ #endif
+ 
+-int kernel_set_to_readonly __ro_after_init;
++int kernel_set_to_readonly __read_mostly;
+ 
+ static void mark_nxdata_nx(void)
+ {
+@@ -852,11 +852,12 @@ void mark_rodata_ro(void)
+ 	unsigned long start = PFN_ALIGN(_text);
+ 	unsigned long size = (unsigned long)__end_rodata - start;
+ 
+-	kernel_set_to_readonly = 1;
+ 	set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
+ 	pr_info("Write protecting kernel text and read-only data: %luk\n",
+ 		size >> 10);
+ 
++	kernel_set_to_readonly = 1;
++
+ #ifdef CONFIG_CPA_DEBUG
+ 	pr_info("Testing CPA: Reverting %lx-%lx\n", start, start + size);
+ 	set_pages_rw(virt_to_page(start), size >> PAGE_SHIFT);
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index 63a0f8097d0a..b5a3fa4033d3 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -1322,7 +1322,7 @@ int __init deferred_page_init_max_threads(const struct cpumask *node_cpumask)
+ }
+ #endif
+ 
+-int kernel_set_to_readonly __ro_after_init;
++int kernel_set_to_readonly;
+ 
+ void mark_rodata_ro(void)
+ {
+@@ -1335,9 +1335,10 @@ void mark_rodata_ro(void)
+ 
+ 	printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n",
+ 	       (end - start) >> 10);
+-	kernel_set_to_readonly = 1;
+ 	set_memory_ro(start, (end - start) >> PAGE_SHIFT);
+ 
++	kernel_set_to_readonly = 1;
++
+ 	/*
+ 	 * The rodata/data/bss/brk section (but not the kernel text!)
+ 	 * should also be not-executable.
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0051-mark-slub-runtime-configuration-as-__ro_after_init.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0051-mark-slub-runtime-configuration-as-__ro_after_init.patch
new file mode 100644
index 000000000000..8714f3f736ed
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0051-mark-slub-runtime-configuration-as-__ro_after_init.patch
@@ -0,0 +1,57 @@
+From 959e911bb724b2b0fae06af0f70d87562347ac6e Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 14 May 2017 19:01:58 -0400
+Subject: [PATCH 051/113] mark slub runtime configuration as __ro_after_init
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ mm/slub.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 3f4303f4b657..7a8d4d37cffb 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -486,13 +486,13 @@ static inline void *restore_red_left(struct kmem_cache *s, void *p)
+  * Debug settings:
+  */
+ #if defined(CONFIG_SLUB_DEBUG_ON)
+-static slab_flags_t slub_debug = DEBUG_DEFAULT_FLAGS;
++static slab_flags_t slub_debug __ro_after_init = DEBUG_DEFAULT_FLAGS;
+ #else
+-static slab_flags_t slub_debug;
++static slab_flags_t slub_debug __ro_after_init;
+ #endif
+ 
+-static char *slub_debug_string;
+-static int disable_higher_order_debug;
++static char *slub_debug_string __ro_after_init;
++static int disable_higher_order_debug __ro_after_init;
+ 
+ /*
+  * slub is about to manipulate internal object metadata.  This memory lies
+@@ -3363,9 +3363,9 @@ EXPORT_SYMBOL(kmem_cache_alloc_bulk);
+  * and increases the number of allocations possible without having to
+  * take the list_lock.
+  */
+-static unsigned int slub_min_order;
+-static unsigned int slub_max_order = PAGE_ALLOC_COSTLY_ORDER;
+-static unsigned int slub_min_objects;
++static unsigned int slub_min_order __ro_after_init;
++static unsigned int slub_max_order __ro_after_init = PAGE_ALLOC_COSTLY_ORDER;
++static unsigned int slub_min_objects __ro_after_init;
+ 
+ /*
+  * Calculate the order of allocation given an slab object size.
+@@ -4883,7 +4883,7 @@ enum slab_stat_type {
+ #define SO_TOTAL	(1 << SL_TOTAL)
+ 
+ #ifdef CONFIG_MEMCG
+-static bool memcg_sysfs_enabled = IS_ENABLED(CONFIG_SLUB_MEMCG_SYSFS_ON);
++static bool memcg_sysfs_enabled __ro_after_init = IS_ENABLED(CONFIG_SLUB_MEMCG_SYSFS_ON);
+ 
+ static int __init setup_slub_memcg_sysfs(char *str)
+ {
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0052-add-__ro_after_init-to-slab_nomerge-and-slab_state.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0052-add-__ro_after_init-to-slab_nomerge-and-slab_state.patch
new file mode 100644
index 000000000000..e511665a8393
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0052-add-__ro_after_init-to-slab_nomerge-and-slab_state.patch
@@ -0,0 +1,38 @@
+From 2ce9b3abeee44fe91a0d1a4b437d6b82b3ec5807 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 11:35:35 -0400
+Subject: [PATCH 052/113] add __ro_after_init to slab_nomerge and slab_state
+
+This was extracted from the PaX patch where it's part of the KERNEXEC
+feature as __read_only.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ mm/slab_common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index f9ccd5dc13f3..bff04048559f 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -30,7 +30,7 @@
+ 
+ #include "slab.h"
+ 
+-enum slab_state slab_state;
++enum slab_state slab_state __ro_after_init;
+ LIST_HEAD(slab_caches);
+ DEFINE_MUTEX(slab_mutex);
+ struct kmem_cache *kmem_cache;
+@@ -61,7 +61,7 @@ static DECLARE_WORK(slab_caches_to_rcu_destroy_work,
+ /*
+  * Merge control. If this is set then no merging of slab caches will occur.
+  */
+-static bool slab_nomerge = !IS_ENABLED(CONFIG_SLAB_MERGE_DEFAULT);
++static bool slab_nomerge __ro_after_init = !IS_ENABLED(CONFIG_SLAB_MERGE_DEFAULT);
+ 
+ static int __init setup_slab_nomerge(char *str)
+ {
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0053-mark-kmem_cache-as-__ro_after_init.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0053-mark-kmem_cache-as-__ro_after_init.patch
new file mode 100644
index 000000000000..e68384a3eded
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0053-mark-kmem_cache-as-__ro_after_init.patch
@@ -0,0 +1,25 @@
+From f2da4d4a6b9a51404dbdedc96a31afc679aa4c76 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 28 May 2017 18:51:30 -0400
+Subject: [PATCH 053/113] mark kmem_cache as __ro_after_init
+
+---
+ mm/slab_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index bff04048559f..2b73c12d8fce 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -33,7 +33,7 @@
+ enum slab_state slab_state __ro_after_init;
+ LIST_HEAD(slab_caches);
+ DEFINE_MUTEX(slab_mutex);
+-struct kmem_cache *kmem_cache;
++struct kmem_cache *kmem_cache __ro_after_init;
+ 
+ #ifdef CONFIG_HARDENED_USERCOPY
+ bool usercopy_fallback __ro_after_init =
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0054-mark-__supported_pte_mask-as-__ro_after_init.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0054-mark-__supported_pte_mask-as-__ro_after_init.patch
new file mode 100644
index 000000000000..7c638945b1e7
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0054-mark-__supported_pte_mask-as-__ro_after_init.patch
@@ -0,0 +1,49 @@
+From 2ac41cc0030d5f7d390784265ae75f373d2f2b7b Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Fri, 12 May 2017 00:06:16 -0400
+Subject: [PATCH 054/113] mark __supported_pte_mask as __ro_after_init
+
+These changes were extracted from PaX where it was part of KERNEXEC as
+__read_only.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ arch/x86/mm/init_32.c | 4 ++--
+ arch/x86/mm/init_64.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
+index 7c055259de3a..291b7b4476a9 100644
+--- a/arch/x86/mm/init_32.c
++++ b/arch/x86/mm/init_32.c
+@@ -546,9 +546,9 @@ static void __init pagetable_init(void)
+ 
+ #define DEFAULT_PTE_MASK ~(_PAGE_NX | _PAGE_GLOBAL)
+ /* Bits supported by the hardware: */
+-pteval_t __supported_pte_mask __read_mostly = DEFAULT_PTE_MASK;
++pteval_t __supported_pte_mask __ro_after_init = DEFAULT_PTE_MASK;
+ /* Bits allowed in normal kernel mappings: */
+-pteval_t __default_kernel_pte_mask __read_mostly = DEFAULT_PTE_MASK;
++pteval_t __default_kernel_pte_mask __ro_after_init = DEFAULT_PTE_MASK;
+ EXPORT_SYMBOL_GPL(__supported_pte_mask);
+ /* Used in PAGE_KERNEL_* macros which are reasonably used out-of-tree: */
+ EXPORT_SYMBOL(__default_kernel_pte_mask);
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index b5a3fa4033d3..c3d771ffc178 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -97,9 +97,9 @@ DEFINE_ENTRY(pte, pte, init)
+  */
+ 
+ /* Bits supported by the hardware: */
+-pteval_t __supported_pte_mask __read_mostly = ~0;
++pteval_t __supported_pte_mask __ro_after_init = ~0;
+ /* Bits allowed in normal kernel mappings: */
+-pteval_t __default_kernel_pte_mask __read_mostly = ~0;
++pteval_t __default_kernel_pte_mask __ro_after_init = ~0;
+ EXPORT_SYMBOL_GPL(__supported_pte_mask);
+ /* Used in PAGE_KERNEL_* macros which are reasonably used out-of-tree: */
+ EXPORT_SYMBOL(__default_kernel_pte_mask);
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0055-mark-kobj_ns_type_register-as-only-used-for-init.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0055-mark-kobj_ns_type_register-as-only-used-for-init.patch
new file mode 100644
index 000000000000..330bc26f13fa
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0055-mark-kobj_ns_type_register-as-only-used-for-init.patch
@@ -0,0 +1,45 @@
+From d53e0cfc0aefc1a7d0897c5724c61437b8ab01f6 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 4 Jul 2017 01:24:28 -0400
+Subject: [PATCH 055/113] mark kobj_ns_type_register as only used for init
+
+This allows kobj_ns_ops_tbl to be __ro_after_init.
+
+Extracted from PaX.
+---
+ include/linux/kobject_ns.h | 2 +-
+ lib/kobject.c              | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/kobject_ns.h b/include/linux/kobject_ns.h
+index 2b5b64256cf4..8cdce21dce0f 100644
+--- a/include/linux/kobject_ns.h
++++ b/include/linux/kobject_ns.h
+@@ -45,7 +45,7 @@ struct kobj_ns_type_operations {
+ 	void (*drop_ns)(void *);
+ };
+ 
+-int kobj_ns_type_register(const struct kobj_ns_type_operations *ops);
++int __init kobj_ns_type_register(const struct kobj_ns_type_operations *ops);
+ int kobj_ns_type_registered(enum kobj_ns_type type);
+ const struct kobj_ns_type_operations *kobj_child_ns_ops(struct kobject *parent);
+ const struct kobj_ns_type_operations *kobj_ns_ops(struct kobject *kobj);
+diff --git a/lib/kobject.c b/lib/kobject.c
+index ea53b30cf483..5343bbeea5f8 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -1023,9 +1023,9 @@ EXPORT_SYMBOL_GPL(kset_create_and_add);
+ 
+ 
+ static DEFINE_SPINLOCK(kobj_ns_type_lock);
+-static const struct kobj_ns_type_operations *kobj_ns_ops_tbl[KOBJ_NS_TYPES];
++static const struct kobj_ns_type_operations *kobj_ns_ops_tbl[KOBJ_NS_TYPES] __ro_after_init;
+ 
+-int kobj_ns_type_register(const struct kobj_ns_type_operations *ops)
++int __init kobj_ns_type_register(const struct kobj_ns_type_operations *ops)
+ {
+ 	enum kobj_ns_type type = ops->type;
+ 	int error;
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0056-mark-open_softirq-as-only-used-for-init.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0056-mark-open_softirq-as-only-used-for-init.patch
new file mode 100644
index 000000000000..ed508d5f5d73
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0056-mark-open_softirq-as-only-used-for-init.patch
@@ -0,0 +1,39 @@
+From ff1b1e591088960b026c1dbba863260fd1bf5bcc Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 4 Jul 2017 01:32:30 -0400
+Subject: [PATCH 056/113] mark open_softirq as only used for init
+
+---
+ include/linux/interrupt.h | 2 +-
+ kernel/softirq.c          | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
+index ee8299eb1f52..f03b78ae5f0a 100644
+--- a/include/linux/interrupt.h
++++ b/include/linux/interrupt.h
+@@ -569,7 +569,7 @@ static inline void do_softirq_own_stack(void)
+ }
+ #endif
+ 
+-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
++extern void __init open_softirq(int nr, void (*action)(struct softirq_action *));
+ extern void softirq_init(void);
+ extern void __raise_softirq_irqoff(unsigned int nr);
+ 
+diff --git a/kernel/softirq.c b/kernel/softirq.c
+index 09229ad82209..0595a8248c4a 100644
+--- a/kernel/softirq.c
++++ b/kernel/softirq.c
+@@ -486,7 +486,7 @@ void __raise_softirq_irqoff(unsigned int nr)
+ 	or_softirq_pending(1UL << nr);
+ }
+ 
+-void open_softirq(int nr, void (*action)(struct softirq_action *))
++void __init open_softirq(int nr, void (*action)(struct softirq_action *))
+ {
+ 	softirq_vec[nr].action = action;
+ }
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0057-remove-unused-softirq_action-callback-parameter.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0057-remove-unused-softirq_action-callback-parameter.patch
new file mode 100644
index 000000000000..ca059d7d7591
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0057-remove-unused-softirq_action-callback-parameter.patch
@@ -0,0 +1,208 @@
+From 02a23dd9c7a518ccee1067f4fd7be7246075ddf3 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 4 Jul 2017 01:41:11 -0400
+Subject: [PATCH 057/113] remove unused softirq_action callback parameter
+
+Extracted from PaX.
+---
+ block/blk-mq.c            |  2 +-
+ include/linux/interrupt.h |  4 ++--
+ kernel/rcu/tiny.c         |  2 +-
+ kernel/rcu/tree.c         |  2 +-
+ kernel/sched/fair.c       |  2 +-
+ kernel/softirq.c          | 15 +++++++--------
+ kernel/time/hrtimer.c     |  2 +-
+ kernel/time/timer.c       |  2 +-
+ lib/irq_poll.c            |  2 +-
+ net/core/dev.c            |  4 ++--
+ 10 files changed, 18 insertions(+), 19 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 2a1eff60c797..75a0077ea1a9 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -569,7 +569,7 @@ EXPORT_SYMBOL(blk_mq_end_request);
+  * Softirq action handler - move entries to local list and loop over them
+  * while passing them to the queue registered handler.
+  */
+-static __latent_entropy void blk_done_softirq(struct softirq_action *h)
++static __latent_entropy void blk_done_softirq(void)
+ {
+ 	struct list_head *cpu_list, local_list;
+ 
+diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
+index f03b78ae5f0a..4381b79f76cf 100644
+--- a/include/linux/interrupt.h
++++ b/include/linux/interrupt.h
+@@ -554,7 +554,7 @@ extern const char * const softirq_to_name[NR_SOFTIRQS];
+ 
+ struct softirq_action
+ {
+-	void	(*action)(struct softirq_action *);
++	void	(*action)(void);
+ };
+ 
+ asmlinkage void do_softirq(void);
+@@ -569,7 +569,7 @@ static inline void do_softirq_own_stack(void)
+ }
+ #endif
+ 
+-extern void __init open_softirq(int nr, void (*action)(struct softirq_action *));
++extern void __init open_softirq(int nr, void (*action)(void));
+ extern void softirq_init(void);
+ extern void __raise_softirq_irqoff(unsigned int nr);
+ 
+diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
+index aa897c3f2e92..d8976886fd68 100644
+--- a/kernel/rcu/tiny.c
++++ b/kernel/rcu/tiny.c
+@@ -101,7 +101,7 @@ static inline bool rcu_reclaim_tiny(struct rcu_head *head)
+ }
+ 
+ /* Invoke the RCU callbacks whose grace period has elapsed.  */
+-static __latent_entropy void rcu_process_callbacks(struct softirq_action *unused)
++static __latent_entropy void rcu_process_callbacks(void)
+ {
+ 	struct rcu_head *next, *list;
+ 	unsigned long flags;
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 593df7edfe97..3285d81d8a26 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -2722,7 +2722,7 @@ static __latent_entropy void rcu_core(void)
+ 		queue_work_on(rdp->cpu, rcu_gp_wq, &rdp->strict_work);
+ }
+ 
+-static void rcu_core_si(struct softirq_action *h)
++static void rcu_core_si(void)
+ {
+ 	rcu_core();
+ }
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index ae7ceba8fd4f..d118be5f18b8 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -10628,7 +10628,7 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf)
+  * run_rebalance_domains is triggered when needed from the scheduler tick.
+  * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
+  */
+-static __latent_entropy void run_rebalance_domains(struct softirq_action *h)
++static __latent_entropy void run_rebalance_domains(void)
+ {
+ 	struct rq *this_rq = this_rq();
+ 	enum cpu_idle_type idle = this_rq->idle_balance ?
+diff --git a/kernel/softirq.c b/kernel/softirq.c
+index 0595a8248c4a..3a21b22227c1 100644
+--- a/kernel/softirq.c
++++ b/kernel/softirq.c
+@@ -295,7 +295,7 @@ asmlinkage __visible void __softirq_entry __do_softirq(void)
+ 		kstat_incr_softirqs_this_cpu(vec_nr);
+ 
+ 		trace_softirq_entry(vec_nr);
+-		h->action(h);
++		h->action();
+ 		trace_softirq_exit(vec_nr);
+ 		if (unlikely(prev_count != preempt_count())) {
+ 			pr_err("huh, entered softirq %u %s %p with preempt_count %08x, exited with %08x?\n",
+@@ -486,7 +486,7 @@ void __raise_softirq_irqoff(unsigned int nr)
+ 	or_softirq_pending(1UL << nr);
+ }
+ 
+-void __init open_softirq(int nr, void (*action)(struct softirq_action *))
++void __init open_softirq(int nr, void (*action)(void))
+ {
+ 	softirq_vec[nr].action = action;
+ }
+@@ -532,8 +532,7 @@ void __tasklet_hi_schedule(struct tasklet_struct *t)
+ }
+ EXPORT_SYMBOL(__tasklet_hi_schedule);
+ 
+-static void tasklet_action_common(struct softirq_action *a,
+-				  struct tasklet_head *tl_head,
++static void tasklet_action_common(struct tasklet_head *tl_head,
+ 				  unsigned int softirq_nr)
+ {
+ 	struct tasklet_struct *list;
+@@ -573,14 +572,14 @@ static void tasklet_action_common(struct softirq_action *a,
+ 	}
+ }
+ 
+-static __latent_entropy void tasklet_action(struct softirq_action *a)
++static __latent_entropy void tasklet_action(void)
+ {
+-	tasklet_action_common(a, this_cpu_ptr(&tasklet_vec), TASKLET_SOFTIRQ);
++	tasklet_action_common(this_cpu_ptr(&tasklet_vec), TASKLET_SOFTIRQ);
+ }
+ 
+-static __latent_entropy void tasklet_hi_action(struct softirq_action *a)
++static __latent_entropy void tasklet_hi_action(void)
+ {
+-	tasklet_action_common(a, this_cpu_ptr(&tasklet_hi_vec), HI_SOFTIRQ);
++	tasklet_action_common(this_cpu_ptr(&tasklet_hi_vec), HI_SOFTIRQ);
+ }
+ 
+ void tasklet_setup(struct tasklet_struct *t,
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index 387b4bef7dd1..8fe28c28a906 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -1587,7 +1587,7 @@ static void __hrtimer_run_queues(struct hrtimer_cpu_base *cpu_base, ktime_t now,
+ 	}
+ }
+ 
+-static __latent_entropy void hrtimer_run_softirq(struct softirq_action *h)
++static __latent_entropy void hrtimer_run_softirq(void)
+ {
+ 	struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases);
+ 	unsigned long flags;
+diff --git a/kernel/time/timer.c b/kernel/time/timer.c
+index c3ad64fb9d8b..217bc49a3856 100644
+--- a/kernel/time/timer.c
++++ b/kernel/time/timer.c
+@@ -1753,7 +1753,7 @@ static inline void __run_timers(struct timer_base *base)
+ /*
+  * This function runs timers and the timer-tq in bottom half context.
+  */
+-static __latent_entropy void run_timer_softirq(struct softirq_action *h)
++static __latent_entropy void run_timer_softirq(void)
+ {
+ 	struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]);
+ 
+diff --git a/lib/irq_poll.c b/lib/irq_poll.c
+index 2f17b488d58e..b6e7996a0058 100644
+--- a/lib/irq_poll.c
++++ b/lib/irq_poll.c
+@@ -75,7 +75,7 @@ void irq_poll_complete(struct irq_poll *iop)
+ }
+ EXPORT_SYMBOL(irq_poll_complete);
+ 
+-static void __latent_entropy irq_poll_softirq(struct softirq_action *h)
++static void __latent_entropy irq_poll_softirq(void)
+ {
+ 	struct list_head *list = this_cpu_ptr(&blk_cpu_iopoll);
+ 	int rearm = 0, budget = irq_poll_budget;
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 38412e70f761..c3cd49e04b7b 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4856,7 +4856,7 @@ int netif_rx_any_context(struct sk_buff *skb)
+ }
+ EXPORT_SYMBOL(netif_rx_any_context);
+ 
+-static __latent_entropy void net_tx_action(struct softirq_action *h)
++static __latent_entropy void net_tx_action(void)
+ {
+ 	struct softnet_data *sd = this_cpu_ptr(&softnet_data);
+ 
+@@ -6803,7 +6803,7 @@ static int napi_poll(struct napi_struct *n, struct list_head *repoll)
+ 	return work;
+ }
+ 
+-static __latent_entropy void net_rx_action(struct softirq_action *h)
++static __latent_entropy void net_rx_action(void)
+ {
+ 	struct softnet_data *sd = this_cpu_ptr(&softnet_data);
+ 	unsigned long time_limit = jiffies +
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0058-mark-softirq_vec-as-__ro_after_init.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0058-mark-softirq_vec-as-__ro_after_init.patch
new file mode 100644
index 000000000000..d7521ab21f83
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0058-mark-softirq_vec-as-__ro_after_init.patch
@@ -0,0 +1,28 @@
+From 5897eb27d1526693a60422b1fc35f227bab3f6de Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 4 Jul 2017 01:42:33 -0400
+Subject: [PATCH 058/113] mark softirq_vec as __ro_after_init
+
+Note: __cacheline_aligned_in_smp conflicts with __ro_after_init on x86.
+
+Extracted from PaX.
+---
+ kernel/softirq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/softirq.c b/kernel/softirq.c
+index 3a21b22227c1..6a02d63b135a 100644
+--- a/kernel/softirq.c
++++ b/kernel/softirq.c
+@@ -52,7 +52,7 @@ DEFINE_PER_CPU_ALIGNED(irq_cpustat_t, irq_stat);
+ EXPORT_PER_CPU_SYMBOL(irq_stat);
+ #endif
+ 
+-static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp;
++static struct softirq_action softirq_vec[NR_SOFTIRQS] __ro_after_init __aligned(PAGE_SIZE);
+ 
+ DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0059-mm-slab-trigger-BUG-if-requested-object-is-not-a-sla.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0059-mm-slab-trigger-BUG-if-requested-object-is-not-a-sla.patch
new file mode 100644
index 000000000000..a8566bf164b1
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0059-mm-slab-trigger-BUG-if-requested-object-is-not-a-sla.patch
@@ -0,0 +1,34 @@
+From 28200a5f9b0475dff1ae77082b8c93a0d54dd8b0 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 17 Sep 2019 18:00:54 +0200
+Subject: [PATCH 059/113] mm: slab: trigger BUG if requested object is not a
+ slab page
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+---
+ mm/slab.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/mm/slab.h b/mm/slab.h
+index f9977d6613d6..5adb48bb2e68 100644
+--- a/mm/slab.h
++++ b/mm/slab.h
+@@ -435,9 +435,13 @@ static inline struct kmem_cache *virt_to_cache(const void *obj)
+ 	struct page *page;
+ 
+ 	page = virt_to_head_page(obj);
++#ifdef CONFIG_BUG_ON_DATA_CORRUPTION
++	BUG_ON(!PageSlab(page));
++#else
+ 	if (WARN_ONCE(!PageSlab(page), "%s: Object is not a Slab page!\n",
+ 					__func__))
+ 		return NULL;
++#endif
+ 	return page->slab_cache;
+ }
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0060-bug-on-kmem_cache_free-with-the-wrong-cache.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0060-bug-on-kmem_cache_free-with-the-wrong-cache.patch
new file mode 100644
index 000000000000..620f5cad9ede
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0060-bug-on-kmem_cache_free-with-the-wrong-cache.patch
@@ -0,0 +1,40 @@
+From c2b5b02ca3a38a17b536a74e4b1530fbdd669164 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 11:50:53 -0400
+Subject: [PATCH 060/113] bug on kmem_cache_free with the wrong cache
+
+At least when CONFIG_BUG_ON_DATA_CORRUPTION is enabled.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ mm/slab.h | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/mm/slab.h b/mm/slab.h
+index 5adb48bb2e68..9fef4285514a 100644
+--- a/mm/slab.h
++++ b/mm/slab.h
+@@ -471,10 +471,15 @@ static inline struct kmem_cache *cache_from_obj(struct kmem_cache *s, void *x)
+ 		return s;
+ 
+ 	cachep = virt_to_cache(x);
+-	if (WARN(cachep && cachep != s,
+-		  "%s: Wrong slab cache. %s but object is from %s\n",
+-		  __func__, s->name, cachep->name))
++	if (cachep && cachep != s) {
++#ifdef CONFIG_BUG_ON_DATA_CORRUPTION
++		BUG();
++#else
++		WARN(1, "%s: Wrong slab cache. %s but object is from %s\n",
++			__func__, s->name, cachep->name);
++#endif
+ 		print_tracking(cachep, x);
++	}
+ 	return cachep;
+ }
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0061-bug-on-PageSlab-PageCompound-in-ksize.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0061-bug-on-PageSlab-PageCompound-in-ksize.patch
new file mode 100644
index 000000000000..0a3cc38b1c4c
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0061-bug-on-PageSlab-PageCompound-in-ksize.patch
@@ -0,0 +1,31 @@
+From 4088d6038cb1378f391dd956e2e5431c95334781 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 11:57:35 -0400
+Subject: [PATCH 061/113] bug on !PageSlab && !PageCompound in ksize
+
+At least when CONFIG_BUG_ON_DATA_CORRUPTION is enabled.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ mm/slub.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 7a8d4d37cffb..391880ea7445 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -4092,7 +4092,11 @@ size_t __ksize(const void *object)
+ 	page = virt_to_head_page(object);
+ 
+ 	if (unlikely(!PageSlab(page))) {
++#ifdef CONFIG_BUG_ON_DATA_CORRUPTION
++		BUG_ON(!PageCompound(page));
++#else
+ 		WARN_ON(!PageCompound(page));
++#endif
+ 		return page_size(page);
+ 	}
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0062-mm-add-support-for-verifying-page-sanitization.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0062-mm-add-support-for-verifying-page-sanitization.patch
new file mode 100644
index 000000000000..807950b20955
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0062-mm-add-support-for-verifying-page-sanitization.patch
@@ -0,0 +1,70 @@
+From 1e25cf9c966b3d9ad2045d8b24fff3626c4466c8 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 21:54:56 -0400
+Subject: [PATCH 062/113] mm: add support for verifying page sanitization
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ include/linux/highmem.h    | 7 +++++++
+ mm/page_alloc.c            | 6 ++++++
+ security/Kconfig.hardening | 7 +++++++
+ 3 files changed, 20 insertions(+)
+
+diff --git a/include/linux/highmem.h b/include/linux/highmem.h
+index 14e6202ce47f..4348ad7f5c50 100644
+--- a/include/linux/highmem.h
++++ b/include/linux/highmem.h
+@@ -284,6 +284,13 @@ static inline void clear_highpage(struct page *page)
+ 	kunmap_atomic(kaddr);
+ }
+ 
++static inline void verify_zero_highpage(struct page *page)
++{
++	void *kaddr = kmap_atomic(page);
++	BUG_ON(memchr_inv(kaddr, 0, PAGE_SIZE));
++	kunmap_atomic(kaddr);
++}
++
+ static inline void zero_user_segments(struct page *page,
+ 	unsigned start1, unsigned end1,
+ 	unsigned start2, unsigned end2)
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 14b9e83ff9da..84070ae3885e 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2284,6 +2284,12 @@ static void prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags
+ {
+ 	post_alloc_hook(page, order, gfp_flags);
+ 
++	if (IS_ENABLED(CONFIG_PAGE_SANITIZE_VERIFY) && want_init_on_free()) {
++		int i;
++		for (i = 0; i < (1 << order); i++)
++			verify_zero_highpage(page + i);
++	}
++
+ 	if (!free_pages_prezeroed() && want_init_on_alloc(gfp_flags))
+ 		kernel_init_free_pages(page, 1 << order);
+ 
+diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
+index 2fa447823405..83ad70ae6bc3 100644
+--- a/security/Kconfig.hardening
++++ b/security/Kconfig.hardening
+@@ -219,6 +219,13 @@ config INIT_ON_FREE_DEFAULT_ON
+ 	  touching "cold" memory areas. Most cases see 3-5% impact. Some
+ 	  synthetic workloads have measured as high as 8%.
+ 
++config PAGE_SANITIZE_VERIFY
++	bool "Verify sanitized pages"
++	default y
++	help
++	  When init_on_free is enabled, verify that newly allocated pages
++	  are zeroed to detect write-after-free bugs.
++
+ endmenu
+ 
+ endmenu
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0063-slub-Extend-init_on_free-to-slab-caches-with-constru.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0063-slub-Extend-init_on_free-to-slab-caches-with-constru.patch
new file mode 100644
index 000000000000..b8d33136a582
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0063-slub-Extend-init_on_free-to-slab-caches-with-constru.patch
@@ -0,0 +1,75 @@
+From 985d592a0130e9256059ffab878e5b4048b60e9a Mon Sep 17 00:00:00 2001
+From: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Date: Fri, 20 Sep 2019 14:02:42 +0200
+Subject: [PATCH 063/113] slub: Extend init_on_free to slab caches with
+ constructors
+
+This is the remaining non-upstream part of SLAB_SANITIZE, which was a
+partial port, from Daniel Micay, of the feature from PaX without the
+default fast mode based on passing SLAB_NO_SANITIZE in
+performance-critical cases that are not particularly security sensitive.
+
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+---
+ mm/slab.h | 12 +++++++++---
+ mm/slub.c | 14 +++++++++++++-
+ 2 files changed, 22 insertions(+), 4 deletions(-)
+
+diff --git a/mm/slab.h b/mm/slab.h
+index 9fef4285514a..0fcd97a4eb6f 100644
+--- a/mm/slab.h
++++ b/mm/slab.h
+@@ -641,9 +641,15 @@ static inline bool slab_want_init_on_alloc(gfp_t flags, struct kmem_cache *c)
+ 
+ static inline bool slab_want_init_on_free(struct kmem_cache *c)
+ {
+-	if (static_branch_unlikely(&init_on_free))
+-		return !(c->ctor ||
+-			 (c->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON)));
++	if (static_branch_unlikely(&init_on_free)) {
++#ifndef CONFIG_SLUB
++		if (c->ctor)
++			return false;
++#endif
++		if (c->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON))
++			return false;
++		return true;
++	}
+ 	return false;
+ }
+ 
+diff --git a/mm/slub.c b/mm/slub.c
+index 391880ea7445..3c2c22488439 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1571,7 +1571,8 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
+ 							   : 0;
+ 			memset((char *)object + s->inuse, 0,
+ 			       s->size - s->inuse - rsize);
+-
++			if (s->ctor)
++				s->ctor(object);
+ 		}
+ 		/* If object's reuse doesn't have to be delayed */
+ 		if (!slab_free_hook(s, object)) {
+@@ -1580,6 +1581,17 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
+ 			*head = object;
+ 			if (!*tail)
+ 				*tail = object;
++		} else if (slab_want_init_on_free(s) && s->ctor) {
++			/* Objects that are put into quarantine by KASAN will
++			 * still undergo free_consistency_checks() and thus
++			 * need to show a valid freepointer to check_object().
++			 *
++			 * Note that doing this for all caches (not just ctor
++			 * ones, which have s->offset != NULL)) causes a GPF,
++			 * due to KASAN poisoning and the way set_freepointer()
++			 * eventually dereferences the freepointer.
++			 */
++			set_freepointer(s, object, NULL);
+ 		}
+ 	} while (object != old_tail);
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0064-slub-Add-support-for-verifying-slab-sanitization.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0064-slub-Add-support-for-verifying-slab-sanitization.patch
new file mode 100644
index 000000000000..3cc95809cde1
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0064-slub-Add-support-for-verifying-slab-sanitization.patch
@@ -0,0 +1,116 @@
+From f362f6adb22cf03806adfd3994da8a21ddcbc597 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 4 May 2017 15:58:57 -0400
+Subject: [PATCH 064/113] slub: Add support for verifying slab sanitization
+
+This is an extension to the sanitization feature in PaX for when
+sacricifing more performance for security is acceptable.
+
+The initial version from Daniel Micay was relying on PAGE_SANITIZE. It
+now relies on upstream's init_on_free.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ mm/slub.c                  | 36 ++++++++++++++++++++++++++++++++----
+ security/Kconfig.hardening |  8 ++++++++
+ 2 files changed, 40 insertions(+), 4 deletions(-)
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 3c2c22488439..d5427ead7d74 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -127,6 +127,12 @@ static inline bool kmem_cache_debug(struct kmem_cache *s)
+ 	return kmem_cache_debug_flags(s, SLAB_DEBUG_FLAGS);
+ }
+ 
++static inline bool has_sanitize_verify(struct kmem_cache *s)
++{
++	return IS_ENABLED(CONFIG_SLAB_SANITIZE_VERIFY) &&
++	       slab_want_init_on_free(s);
++}
++
+ void *fixup_red_left(struct kmem_cache *s, void *p)
+ {
+ 	if (kmem_cache_debug_flags(s, SLAB_RED_ZONE))
+@@ -1571,7 +1577,7 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
+ 							   : 0;
+ 			memset((char *)object + s->inuse, 0,
+ 			       s->size - s->inuse - rsize);
+-			if (s->ctor)
++			if (!IS_ENABLED(CONFIG_SLAB_SANITIZE_VERIFY) && s->ctor)
+ 				s->ctor(object);
+ 		}
+ 		/* If object's reuse doesn't have to be delayed */
+@@ -1606,7 +1612,7 @@ static void *setup_object(struct kmem_cache *s, struct page *page,
+ {
+ 	setup_object_debug(s, page, object);
+ 	object = kasan_init_slab_obj(s, object);
+-	if (unlikely(s->ctor)) {
++	if (unlikely(s->ctor) && !has_sanitize_verify(s)) {
+ 		kasan_unpoison_object_data(s, object);
+ 		s->ctor(object);
+ 		kasan_poison_object_data(s, object);
+@@ -2897,7 +2903,16 @@ static __always_inline void *slab_alloc_node(struct kmem_cache *s,
+ 
+ 	maybe_wipe_obj_freeptr(s, object);
+ 
+-	if (unlikely(slab_want_init_on_alloc(gfpflags, s)) && object)
++	if (has_sanitize_verify(s) && object) {
++		/* KASAN hasn't unpoisoned the object yet (this is done in the
++		 * post-alloc hook), so let's do it temporarily.
++		 */
++		kasan_unpoison_object_data(s, object);
++		BUG_ON(memchr_inv(object, 0, s->object_size));
++		if (s->ctor)
++			s->ctor(object);
++		kasan_poison_object_data(s, object);
++	} else if (unlikely(slab_want_init_on_alloc(gfpflags, s)) && object)
+ 		memset(object, 0, s->object_size);
+ 
+ 	slab_post_alloc_hook(s, objcg, gfpflags, 1, &object);
+@@ -3337,7 +3352,20 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+ 	local_irq_enable();
+ 
+ 	/* Clear memory outside IRQ disabled fastpath loop */
+-	if (unlikely(slab_want_init_on_alloc(flags, s))) {
++	if (has_sanitize_verify(s)) {
++		int j;
++
++		for (j = 0; j < i; j++) {
++			/* KASAN hasn't unpoisoned the object yet (this is done
++			 * in the post-alloc hook), so let's do it temporarily.
++			 */
++			kasan_unpoison_object_data(s, p[j]);
++			BUG_ON(memchr_inv(p[j], 0, s->object_size));
++			if (s->ctor)
++				s->ctor(p[j]);
++			kasan_poison_object_data(s, p[j]);
++		}
++	} else if (unlikely(slab_want_init_on_alloc(flags, s))) {
+ 		int j;
+ 
+ 		for (j = 0; j < i; j++)
+diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
+index 83ad70ae6bc3..7dede18f1074 100644
+--- a/security/Kconfig.hardening
++++ b/security/Kconfig.hardening
+@@ -226,6 +226,14 @@ config PAGE_SANITIZE_VERIFY
+ 	  When init_on_free is enabled, verify that newly allocated pages
+ 	  are zeroed to detect write-after-free bugs.
+ 
++config SLAB_SANITIZE_VERIFY
++	bool "Verify sanitized SLAB allocations"
++	default y
++	depends on !KASAN
++	help
++	  When init_on_free is enabled, verify that newly allocated slab
++	  objects are zeroed to detect write-after-free bugs.
++
+ endmenu
+ 
+ endmenu
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0065-slub-add-multi-purpose-random-canaries.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0065-slub-add-multi-purpose-random-canaries.patch
new file mode 100644
index 000000000000..14a729677948
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0065-slub-add-multi-purpose-random-canaries.patch
@@ -0,0 +1,264 @@
+From e14734f36f6835f5371fab894bfb445056bfa670 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 16:16:58 -0400
+Subject: [PATCH 065/113] slub: add multi-purpose random canaries
+
+From the configuration option:
+
+	Place canaries at the end of kernel slab allocations, sacrificing
+	some performance and memory usage for security.
+
+	Canaries can detect some forms of heap corruption when allocations
+	are freed and as part of the HARDENED_USERCOPY feature. It provides
+	basic use-after-free detection for HARDENED_USERCOPY.
+
+	Canaries absorb small overflows (rendering them harmless), mitigate
+	non-NUL terminated C string overflows on 64-bit via a guaranteed zero
+	byte and provide basic double-free detection.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ include/linux/slub_def.h |  5 +++
+ init/Kconfig             | 17 ++++++++++
+ mm/slab.h                |  2 +-
+ mm/slub.c                | 69 ++++++++++++++++++++++++++++++++++++++--
+ 4 files changed, 89 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
+index 1be0ed5befa1..c71cf30b5987 100644
+--- a/include/linux/slub_def.h
++++ b/include/linux/slub_def.h
+@@ -113,6 +113,11 @@ struct kmem_cache {
+ 	unsigned long random;
+ #endif
+ 
++#ifdef CONFIG_SLAB_CANARY
++	unsigned long random_active;
++	unsigned long random_inactive;
++#endif
++
+ #ifdef CONFIG_NUMA
+ 	/*
+ 	 * Defragmentation by allocating from a remote node.
+diff --git a/init/Kconfig b/init/Kconfig
+index 58df4930995f..2af6689d9e71 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1943,6 +1943,23 @@ config SLAB_FREELIST_HARDENED
+ 	  sanity-checking than others. This option is most effective with
+ 	  CONFIG_SLUB.
+ 
++config SLAB_CANARY
++	depends on SLUB
++	depends on !SLAB_MERGE_DEFAULT
++	bool "SLAB canaries"
++	default y
++	help
++	  Place canaries at the end of kernel slab allocations, sacrificing
++	  some performance and memory usage for security.
++
++	  Canaries can detect some forms of heap corruption when allocations
++	  are freed and as part of the HARDENED_USERCOPY feature. It provides
++	  basic use-after-free detection for HARDENED_USERCOPY.
++
++	  Canaries absorb small overflows (rendering them harmless), mitigate
++	  non-NUL terminated C string overflows on 64-bit via a guaranteed zero
++	  byte and provide basic double-free detection.
++
+ config SHUFFLE_PAGE_ALLOCATOR
+ 	bool "Page allocator randomization"
+ 	default SLAB_FREELIST_RANDOM && ACPI_NUMA
+diff --git a/mm/slab.h b/mm/slab.h
+index 0fcd97a4eb6f..105dba485a7e 100644
+--- a/mm/slab.h
++++ b/mm/slab.h
+@@ -504,7 +504,7 @@ static inline size_t slab_ksize(const struct kmem_cache *s)
+ 	 * back there or track user information then we can
+ 	 * only use the space before that information.
+ 	 */
+-	if (s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_STORE_USER))
++	if ((s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_STORE_USER)) || IS_ENABLED(CONFIG_SLAB_CANARY))
+ 		return s->inuse;
+ 	/*
+ 	 * Else we can use all the padding etc for the allocation
+diff --git a/mm/slub.c b/mm/slub.c
+index d5427ead7d74..a06d34be763a 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -569,6 +569,33 @@ static inline unsigned int get_info_end(struct kmem_cache *s)
+ 		return s->inuse;
+ }
+ 
++#ifdef CONFIG_SLAB_CANARY
++static inline unsigned long *get_canary(struct kmem_cache *s, void *object)
++{
++	return object + get_info_end(s);
++}
++
++static inline unsigned long get_canary_value(const void *canary, unsigned long value)
++{
++	return (value ^ (unsigned long)canary) & CANARY_MASK;
++}
++
++static inline void set_canary(struct kmem_cache *s, void *object, unsigned long value)
++{
++	unsigned long *canary = get_canary(s, object);
++	*canary = get_canary_value(canary, value);
++}
++
++static inline void check_canary(struct kmem_cache *s, void *object, unsigned long value)
++{
++	unsigned long *canary = get_canary(s, object);
++	BUG_ON(*canary != get_canary_value(canary, value));
++}
++#else
++#define set_canary(s, object, value)
++#define check_canary(s, object, value)
++#endif
++
+ static struct track *get_track(struct kmem_cache *s, void *object,
+ 	enum track_item alloc)
+ {
+@@ -576,6 +603,9 @@ static struct track *get_track(struct kmem_cache *s, void *object,
+ 
+ 	p = object + get_info_end(s);
+ 
++	if (IS_ENABLED(CONFIG_SLAB_CANARY))
++		p = (void *)p + sizeof(void *);
++
+ 	return p + alloc;
+ }
+ 
+@@ -717,6 +747,9 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
+ 
+ 	off = get_info_end(s);
+ 
++	if (IS_ENABLED(CONFIG_SLAB_CANARY))
++		off += sizeof(void *);
++
+ 	if (s->flags & SLAB_STORE_USER)
+ 		off += 2 * sizeof(struct track);
+ 
+@@ -825,8 +858,9 @@ static int check_bytes_and_report(struct kmem_cache *s, struct page *page,
+  * 	Meta data starts here.
+  *
+  * 	A. Free pointer (if we cannot overwrite object on free)
+- * 	B. Tracking data for SLAB_STORE_USER
+- * 	C. Padding to reach required alignment boundary or at mininum
++ * 	B. Canary for SLAB_CANARY
++ * 	C. Tracking data for SLAB_STORE_USER
++ * 	D. Padding to reach required alignment boundary or at mininum
+  * 		one word if debugging is on to be able to detect writes
+  * 		before the word boundary.
+  *
+@@ -844,6 +878,9 @@ static int check_pad_bytes(struct kmem_cache *s, struct page *page, u8 *p)
+ {
+ 	unsigned long off = get_info_end(s);	/* The end of info */
+ 
++	if (IS_ENABLED(CONFIG_SLAB_CANARY))
++		off += sizeof(void *);
++
+ 	if (s->flags & SLAB_STORE_USER)
+ 		/* We also have user information there */
+ 		off += 2 * sizeof(struct track);
+@@ -1567,6 +1604,8 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
+ 		object = next;
+ 		next = get_freepointer(s, object);
+ 
++		check_canary(s, object, s->random_active);
++
+ 		if (slab_want_init_on_free(s)) {
+ 			/*
+ 			 * Clear the object and the metadata, but don't touch
+@@ -1580,6 +1619,9 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
+ 			if (!IS_ENABLED(CONFIG_SLAB_SANITIZE_VERIFY) && s->ctor)
+ 				s->ctor(object);
+ 		}
++
++		set_canary(s, object, s->random_inactive);
++
+ 		/* If object's reuse doesn't have to be delayed */
+ 		if (!slab_free_hook(s, object)) {
+ 			/* Move object to the new freelist */
+@@ -1611,6 +1653,7 @@ static void *setup_object(struct kmem_cache *s, struct page *page,
+ 				void *object)
+ {
+ 	setup_object_debug(s, page, object);
++	set_canary(s, object, s->random_inactive);
+ 	object = kasan_init_slab_obj(s, object);
+ 	if (unlikely(s->ctor) && !has_sanitize_verify(s)) {
+ 		kasan_unpoison_object_data(s, object);
+@@ -2915,6 +2958,11 @@ static __always_inline void *slab_alloc_node(struct kmem_cache *s,
+ 	} else if (unlikely(slab_want_init_on_alloc(gfpflags, s)) && object)
+ 		memset(object, 0, s->object_size);
+ 
++	if (object) {
++		check_canary(s, object, s->random_inactive);
++		set_canary(s, object, s->random_active);
++	}
++
+ 	slab_post_alloc_hook(s, objcg, gfpflags, 1, &object);
+ 
+ 	return object;
+@@ -3302,7 +3350,7 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+ 			  void **p)
+ {
+ 	struct kmem_cache_cpu *c;
+-	int i;
++	int i, k;
+ 	struct obj_cgroup *objcg = NULL;
+ 
+ 	/* memcg and kmem_cache debug support */
+@@ -3372,6 +3420,11 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+ 			memset(p[j], 0, s->object_size);
+ 	}
+ 
++	for (k = 0; k < i; k++) {
++		check_canary(s, p[k], s->random_inactive);
++		set_canary(s, p[k], s->random_active);
++	}
++
+ 	/* memcg and kmem_cache debug support */
+ 	slab_post_alloc_hook(s, objcg, flags, size, p);
+ 	return i;
+@@ -3573,6 +3626,7 @@ static void early_kmem_cache_node_alloc(int node)
+ 	init_object(kmem_cache_node, n, SLUB_RED_ACTIVE);
+ 	init_tracking(kmem_cache_node, n);
+ #endif
++	set_canary(kmem_cache_node, n, kmem_cache_node->random_active);
+ 	n = kasan_kmalloc(kmem_cache_node, n, sizeof(struct kmem_cache_node),
+ 		      GFP_KERNEL);
+ 	page->freelist = get_freepointer(kmem_cache_node, n);
+@@ -3753,6 +3807,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
+ 		s->offset = ALIGN(freepointer_area / 2, sizeof(void *));
+ 	}
+ 
++	if (IS_ENABLED(CONFIG_SLAB_CANARY))
++		size += sizeof(void *);
++
+ #ifdef CONFIG_SLUB_DEBUG
+ 	if (flags & SLAB_STORE_USER)
+ 		/*
+@@ -3826,6 +3883,10 @@ static int kmem_cache_open(struct kmem_cache *s, slab_flags_t flags)
+ #ifdef CONFIG_SLAB_FREELIST_HARDENED
+ 	s->random = get_random_long();
+ #endif
++#ifdef CONFIG_SLAB_CANARY
++	s->random_active = get_random_long();
++	s->random_inactive = get_random_long();
++#endif
+ 
+ 	if (!calculate_sizes(s, -1))
+ 		goto error;
+@@ -4099,6 +4160,8 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
+ 		offset -= s->red_left_pad;
+ 	}
+ 
++	check_canary(s, (void *)ptr - offset, s->random_active);
++
+ 	/* Allow address range falling entirely within usercopy region. */
+ 	if (offset >= s->useroffset &&
+ 	    offset - s->useroffset <= s->usersize &&
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0066-security-perf-Allow-further-restriction-of-perf_even.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0066-security-perf-Allow-further-restriction-of-perf_even.patch
new file mode 100644
index 000000000000..b21bf0ca48b9
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0066-security-perf-Allow-further-restriction-of-perf_even.patch
@@ -0,0 +1,122 @@
+From 4448c1ad8e8ba581e5cde9343479c9140c370f40 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Mon, 11 Jan 2016 15:23:55 +0000
+Subject: [PATCH 066/113] security,perf: Allow further restriction of
+ perf_event_open
+
+When kernel.perf_event_open is set to 3 (or greater), disallow all
+access to performance events by users without CAP_SYS_ADMIN.
+Add a Kconfig symbol CONFIG_SECURITY_PERF_EVENTS_RESTRICT that
+makes this value the default.
+
+This is based on a similar feature in grsecurity
+(CONFIG_GRKERNSEC_PERF_HARDEN).  This version doesn't include making
+the variable read-only.  It also allows enabling further restriction
+at run-time regardless of whether the default is changed.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+[thibaut.sautereau@ssi.gouv.fr: Adapt to work with the new CAP_PERFMON capability]
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+---
+ Documentation/admin-guide/sysctl/kernel.rst | 2 ++
+ include/linux/perf_event.h                  | 8 ++++++++
+ kernel/events/core.c                        | 7 ++++++-
+ security/Kconfig                            | 9 +++++++++
+ tools/perf/Documentation/security.txt       | 1 +
+ 5 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst
+index d4b32cc32bb7..4c20e6ded0af 100644
+--- a/Documentation/admin-guide/sysctl/kernel.rst
++++ b/Documentation/admin-guide/sysctl/kernel.rst
+@@ -860,6 +860,8 @@ with respect to CAP_PERFMON use cases.
+ >=1  Disallow CPU event access by users without ``CAP_PERFMON``.
+ 
+ >=2  Disallow kernel profiling by users without ``CAP_PERFMON``.
++
++>=3  Disallow use of any event by users without ``CAP_PERFMON``.
+ ===  ==================================================================
+ 
+ 
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index 96450f6fb1de..d020c26b612a 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -1312,6 +1312,14 @@ static inline int perf_is_paranoid(void)
+ 	return sysctl_perf_event_paranoid > -1;
+ }
+ 
++static inline int perf_allow_open(struct perf_event_attr *attr)
++{
++	if (sysctl_perf_event_paranoid > 2 && !perfmon_capable())
++		return -EACCES;
++
++	return security_perf_event_open(attr, PERF_SECURITY_OPEN);
++}
++
+ static inline int perf_allow_kernel(struct perf_event_attr *attr)
+ {
+ 	if (sysctl_perf_event_paranoid > 1 && !perfmon_capable())
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index c3ba29d058b7..6efbf92763b1 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -407,8 +407,13 @@ static cpumask_var_t perf_online_mask;
+  *   0 - disallow raw tracepoint access for unpriv
+  *   1 - disallow cpu events for unpriv
+  *   2 - disallow kernel profiling for unpriv
++ *   3 - disallow all unpriv perf event use
+  */
++#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT
++int sysctl_perf_event_paranoid __read_mostly = 3;
++#else
+ int sysctl_perf_event_paranoid __read_mostly = 2;
++#endif
+ 
+ /* Minimum for 512 kiB + 1 user control page */
+ int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
+@@ -11638,7 +11643,7 @@ SYSCALL_DEFINE5(perf_event_open,
+ 		return -EINVAL;
+ 
+ 	/* Do we allow access to perf_event_open(2) ? */
+-	err = security_perf_event_open(&attr, PERF_SECURITY_OPEN);
++	err = perf_allow_open(&attr);
+ 	if (err)
+ 		return err;
+ 
+diff --git a/security/Kconfig b/security/Kconfig
+index 81d0a08736aa..c797326308f1 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -19,6 +19,15 @@ config SECURITY_DMESG_RESTRICT
+ 
+ 	  If you are unsure how to answer this question, answer N.
+ 
++config SECURITY_PERF_EVENTS_RESTRICT
++	bool "Restrict unprivileged use of performance events"
++	depends on PERF_EVENTS
++	help
++	  If you say Y here, the kernel.perf_event_paranoid sysctl
++	  will be set to 3 by default, and no unprivileged use of the
++	  perf_event_open syscall will be permitted unless it is
++	  changed.
++
+ config SECURITY
+ 	bool "Enable different security models"
+ 	depends on SYSFS
+diff --git a/tools/perf/Documentation/security.txt b/tools/perf/Documentation/security.txt
+index 4fe3b8b1958f..a7d88cc23a70 100644
+--- a/tools/perf/Documentation/security.txt
++++ b/tools/perf/Documentation/security.txt
+@@ -148,6 +148,7 @@ Perf tool provides a message similar to the one below:
+    >= 0: Disallow raw and ftrace function tracepoint access
+    >= 1: Disallow CPU event access
+    >= 2: Disallow kernel profiling
++   >= 3: Disallow use of any event
+    To make the adjusted perf_event_paranoid setting permanent preserve it
+    in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0067-enable-SECURITY_PERF_EVENTS_RESTRICT-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0067-enable-SECURITY_PERF_EVENTS_RESTRICT-by-default.patch
new file mode 100644
index 000000000000..dd345e6b4081
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0067-enable-SECURITY_PERF_EVENTS_RESTRICT-by-default.patch
@@ -0,0 +1,25 @@
+From 7fe66b1e27064b49bcc1e4c0e96ab13698346f73 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 4 May 2017 14:45:59 -0400
+Subject: [PATCH 067/113] enable SECURITY_PERF_EVENTS_RESTRICT by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ security/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/Kconfig b/security/Kconfig
+index c797326308f1..2348ff7d4e1d 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -22,6 +22,7 @@ config SECURITY_DMESG_RESTRICT
+ config SECURITY_PERF_EVENTS_RESTRICT
+ 	bool "Restrict unprivileged use of performance events"
+ 	depends on PERF_EVENTS
++	default y
+ 	help
+ 	  If you say Y here, the kernel.perf_event_paranoid sysctl
+ 	  will be set to 3 by default, and no unprivileged use of the
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0068-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0068-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
new file mode 100644
index 000000000000..e7710605ba1a
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0068-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
@@ -0,0 +1,124 @@
+From bbe1a03db5c12911149ce15253f622196fc95612 Mon Sep 17 00:00:00 2001
+From: Serge Hallyn <serge.hallyn@canonical.com>
+Date: Fri, 31 May 2013 19:12:12 +0100
+Subject: [PATCH 068/113] add sysctl to disallow unprivileged CLONE_NEWUSER by
+ default
+
+Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
+[bwh: Remove unneeded binary sysctl bits]
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+[thibaut.sautereau@ssi.gouv.fr: Adapt to sysctl code refactoring]
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ include/linux/user_namespace.h |  4 ++++
+ kernel/fork.c                  | 11 +++++++++++
+ kernel/sysctl.c                | 12 ++++++++++++
+ kernel/user_namespace.c        |  3 +++
+ 4 files changed, 30 insertions(+)
+
+diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
+index 6ef1c7109fc4..2140091b0b8d 100644
+--- a/include/linux/user_namespace.h
++++ b/include/linux/user_namespace.h
+@@ -106,6 +106,8 @@ void dec_ucount(struct ucounts *ucounts, enum ucount_type type);
+ 
+ #ifdef CONFIG_USER_NS
+ 
++extern int unprivileged_userns_clone;
++
+ static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
+ {
+ 	if (ns)
+@@ -139,6 +141,8 @@ extern bool current_in_userns(const struct user_namespace *target_ns);
+ struct ns_common *ns_get_owner(struct ns_common *ns);
+ #else
+ 
++#define unprivileged_userns_clone 0
++
+ static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
+ {
+ 	return &init_user_ns;
+diff --git a/kernel/fork.c b/kernel/fork.c
+index c675fdbd3dce..cba344194fba 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -82,6 +82,7 @@
+ #include <linux/perf_event.h>
+ #include <linux/posix-timers.h>
+ #include <linux/user-return-notifier.h>
++#include <linux/user_namespace.h>
+ #include <linux/oom.h>
+ #include <linux/khugepaged.h>
+ #include <linux/signalfd.h>
+@@ -1863,6 +1864,10 @@ static __latent_entropy struct task_struct *copy_process(
+ 	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
+ 		return ERR_PTR(-EINVAL);
+ 
++	if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone)
++		if (!capable(CAP_SYS_ADMIN))
++			return ERR_PTR(-EPERM);
++
+ 	/*
+ 	 * Thread groups must share signals as well, and detached threads
+ 	 * can only be started up within the thread group.
+@@ -2928,6 +2933,12 @@ int ksys_unshare(unsigned long unshare_flags)
+ 	if (unshare_flags & CLONE_NEWNS)
+ 		unshare_flags |= CLONE_FS;
+ 
++	if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) {
++		err = -EPERM;
++		if (!capable(CAP_SYS_ADMIN))
++			goto bad_unshare_out;
++	}
++
+ 	err = check_unshare_flags(unshare_flags);
+ 	if (err)
+ 		goto bad_unshare_out;
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index b2cd3dbbb17a..fccf24a08c8a 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -103,6 +103,9 @@
+ #ifdef CONFIG_LOCKUP_DETECTOR
+ #include <linux/nmi.h>
+ #endif
++#ifdef CONFIG_USER_NS
++#include <linux/user_namespace.h>
++#endif
+ 
+ #if defined(CONFIG_SYSCTL)
+ 
+@@ -1902,6 +1905,15 @@ static struct ctl_table kern_table[] = {
+ 		.proc_handler	= proc_dointvec,
+ 	},
+ #endif
++#ifdef CONFIG_USER_NS
++	{
++		.procname	= "unprivileged_userns_clone",
++		.data		= &unprivileged_userns_clone,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec,
++	},
++#endif
+ #ifdef CONFIG_PROC_SYSCTL
+ 	{
+ 		.procname	= "tainted",
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index e703d5d9cbe8..29a30cff5e60 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -21,6 +21,9 @@
+ #include <linux/bsearch.h>
+ #include <linux/sort.h>
+ 
++/* sysctl */
++int unprivileged_userns_clone;
++
+ static struct kmem_cache *user_ns_cachep __read_mostly;
+ static DEFINE_MUTEX(userns_state_mutex);
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0069-add-CONFIG-for-unprivileged_userns_clone.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0069-add-CONFIG-for-unprivileged_userns_clone.patch
new file mode 100644
index 000000000000..bb7d710106cb
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0069-add-CONFIG-for-unprivileged_userns_clone.patch
@@ -0,0 +1,66 @@
+From e22af80c2327bdb0558e73c0e456904f2da1b95a Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Wed, 31 Jul 2019 20:50:48 +0100
+Subject: [PATCH 069/113] add CONFIG for unprivileged_userns_clone
+
+When disabled, unprivileged users will not be able to create
+new namespaces. Allowing users to create their own namespaces
+has been part of several recent local privilege escalation
+exploits, so if you need user namespaces but are
+paranoid^Wsecurity-conscious you want to disable this.
+
+By default unprivileged user namespaces are disabled.
+
+Authored-by: Jan Alexander Steffens (heftig) <jan.steffens@gmail.com>
+Edited-by: Levente Polyak (anthraxx) <levente@leventepolyak.net>
+---
+ init/Kconfig            | 16 ++++++++++++++++
+ kernel/user_namespace.c |  4 ++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 2af6689d9e71..a7b5a4cb7939 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1174,6 +1174,22 @@ config USER_NS
+ 
+ 	  If unsure, say N.
+ 
++config USER_NS_UNPRIVILEGED
++	bool "Allow unprivileged users to create namespaces"
++	depends on USER_NS
++	default n
++	help
++	  When disabled, unprivileged users will not be able to create
++	  new namespaces. Allowing users to create their own namespaces
++	  has been part of several recent local privilege escalation
++	  exploits, so if you need user namespaces but are
++	  paranoid^Wsecurity-conscious you want to disable this.
++
++	  This setting can be overridden at runtime via the
++	  kernel.unprivileged_userns_clone sysctl.
++
++	  If unsure, say N.
++
+ config PID_NS
+ 	bool "PID Namespaces"
+ 	default y
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index 29a30cff5e60..5758274feaee 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -22,7 +22,11 @@
+ #include <linux/sort.h>
+ 
+ /* sysctl */
++#ifdef CONFIG_USER_NS_UNPRIVILEGED
++int unprivileged_userns_clone = 1;
++#else
+ int unprivileged_userns_clone;
++#endif
+ 
+ static struct kmem_cache *user_ns_cachep __read_mostly;
+ static DEFINE_MUTEX(userns_state_mutex);
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0070-add-kmalloc-krealloc-alloc_size-attributes.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0070-add-kmalloc-krealloc-alloc_size-attributes.patch
new file mode 100644
index 000000000000..b2c09bb68f1c
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0070-add-kmalloc-krealloc-alloc_size-attributes.patch
@@ -0,0 +1,65 @@
+From 8e9daa30852f8a399d6a1c6de2d5bb6902a0b6f6 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 12:02:56 -0400
+Subject: [PATCH 070/113] add kmalloc/krealloc alloc_size attributes
+
+Note that this is overly strict when combined with ksize users accessing
+beyond the requested data size.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ include/linux/slab.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/slab.h b/include/linux/slab.h
+index dd6897f62010..78f99835b91b 100644
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -181,7 +181,7 @@ int kmem_cache_shrink(struct kmem_cache *);
+ /*
+  * Common kmalloc functions provided by all allocators
+  */
+-void * __must_check krealloc(const void *, size_t, gfp_t);
++void * __must_check krealloc(const void *, size_t, gfp_t) __attribute((alloc_size(2)));
+ void kfree(const void *);
+ void kfree_sensitive(const void *);
+ size_t __ksize(const void *);
+@@ -386,7 +386,7 @@ static __always_inline unsigned int kmalloc_index(size_t size)
+ }
+ #endif /* !CONFIG_SLOB */
+ 
+-void *__kmalloc(size_t size, gfp_t flags) __assume_kmalloc_alignment __malloc;
++void *__kmalloc(size_t size, gfp_t flags) __assume_kmalloc_alignment __malloc __attribute__((alloc_size(1)));
+ void *kmem_cache_alloc(struct kmem_cache *, gfp_t flags) __assume_slab_alignment __malloc;
+ void kmem_cache_free(struct kmem_cache *, void *);
+ 
+@@ -410,7 +410,7 @@ static __always_inline void kfree_bulk(size_t size, void **p)
+ }
+ 
+ #ifdef CONFIG_NUMA
+-void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment __malloc;
++void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment __malloc __attribute__((alloc_size(1)));
+ void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node) __assume_slab_alignment __malloc;
+ #else
+ static __always_inline void *__kmalloc_node(size_t size, gfp_t flags, int node)
+@@ -535,7 +535,7 @@ static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
+  *	Try really hard to succeed the allocation but fail
+  *	eventually.
+  */
+-static __always_inline void *kmalloc(size_t size, gfp_t flags)
++static __always_inline __attribute__((alloc_size(1))) void *kmalloc(size_t size, gfp_t flags)
+ {
+ 	if (__builtin_constant_p(size)) {
+ #ifndef CONFIG_SLOB
+@@ -557,7 +557,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
+ 	return __kmalloc(size, flags);
+ }
+ 
+-static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
++static __always_inline __attribute__((alloc_size(1))) void *kmalloc_node(size_t size, gfp_t flags, int node)
+ {
+ #ifndef CONFIG_SLOB
+ 	if (__builtin_constant_p(size) &&
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0071-add-vmalloc-alloc_size-attributes.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0071-add-vmalloc-alloc_size-attributes.patch
new file mode 100644
index 000000000000..4f0f9ed7d94d
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0071-add-vmalloc-alloc_size-attributes.patch
@@ -0,0 +1,47 @@
+From 95fa24be751c5fc7febc66ee3d36d67e5c0515db Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 12:04:03 -0400
+Subject: [PATCH 071/113] add vmalloc alloc_size attributes
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ include/linux/vmalloc.h | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
+index 938eaf9517e2..7c069063c20d 100644
+--- a/include/linux/vmalloc.h
++++ b/include/linux/vmalloc.h
+@@ -102,18 +102,18 @@ static inline void vmalloc_init(void)
+ static inline unsigned long vmalloc_nr_pages(void) { return 0; }
+ #endif
+ 
+-extern void *vmalloc(unsigned long size);
+-extern void *vzalloc(unsigned long size);
+-extern void *vmalloc_user(unsigned long size);
+-extern void *vmalloc_node(unsigned long size, int node);
+-extern void *vzalloc_node(unsigned long size, int node);
+-extern void *vmalloc_32(unsigned long size);
+-extern void *vmalloc_32_user(unsigned long size);
+-extern void *__vmalloc(unsigned long size, gfp_t gfp_mask);
++extern void *vmalloc(unsigned long size) __attribute__((alloc_size(1)));
++extern void *vzalloc(unsigned long size) __attribute__((alloc_size(1)));
++extern void *vmalloc_user(unsigned long size) __attribute__((alloc_size(1)));
++extern void *vmalloc_node(unsigned long size, int node) __attribute__((alloc_size(1)));
++extern void *vzalloc_node(unsigned long size, int node) __attribute__((alloc_size(1)));
++extern void *vmalloc_32(unsigned long size) __attribute__((alloc_size(1)));
++extern void *vmalloc_32_user(unsigned long size) __attribute__((alloc_size(1)));
++extern void *__vmalloc(unsigned long size, gfp_t gfp_mask) __attribute__((alloc_size(1)));
+ extern void *__vmalloc_node_range(unsigned long size, unsigned long align,
+ 			unsigned long start, unsigned long end, gfp_t gfp_mask,
+ 			pgprot_t prot, unsigned long vm_flags, int node,
+-			const void *caller);
++			const void *caller) __attribute__((alloc_size(1)));
+ void *__vmalloc_node(unsigned long size, unsigned long align, gfp_t gfp_mask,
+ 		int node, const void *caller);
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0072-add-kvmalloc-alloc_size-attribute.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0072-add-kvmalloc-alloc_size-attribute.patch
new file mode 100644
index 000000000000..d157ea4b3bc5
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0072-add-kvmalloc-alloc_size-attribute.patch
@@ -0,0 +1,26 @@
+From f550e63d8cc9eec15dca68c8499df45ebacf4bcb Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 4 Jul 2017 00:51:33 -0400
+Subject: [PATCH 072/113] add kvmalloc alloc_size attribute
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ include/linux/mm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index cd5c313729ea..746f6d05bd81 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -759,7 +759,7 @@ static inline int is_vmalloc_or_module_addr(const void *x)
+ }
+ #endif
+ 
+-extern void *kvmalloc_node(size_t size, gfp_t flags, int node);
++extern void *kvmalloc_node(size_t size, gfp_t flags, int node) __attribute__((alloc_size(1)));
+ static inline void *kvmalloc(size_t size, gfp_t flags)
+ {
+ 	return kvmalloc_node(size, flags, NUMA_NO_NODE);
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0073-add-percpu-alloc_size-attributes.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0073-add-percpu-alloc_size-attributes.patch
new file mode 100644
index 000000000000..6612f8f70a48
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0073-add-percpu-alloc_size-attributes.patch
@@ -0,0 +1,37 @@
+From 8dae82a90632982a88a5e745858f2e10a1862319 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 14 May 2017 16:39:36 -0400
+Subject: [PATCH 073/113] add percpu alloc_size attributes
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ include/linux/percpu.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/percpu.h b/include/linux/percpu.h
+index 5e76af742c80..9a6c682ec127 100644
+--- a/include/linux/percpu.h
++++ b/include/linux/percpu.h
+@@ -123,7 +123,7 @@ extern int __init pcpu_page_first_chunk(size_t reserved_size,
+ 				pcpu_fc_populate_pte_fn_t populate_pte_fn);
+ #endif
+ 
+-extern void __percpu *__alloc_reserved_percpu(size_t size, size_t align);
++extern void __percpu *__alloc_reserved_percpu(size_t size, size_t align) __attribute__((alloc_size(1)));
+ extern bool __is_kernel_percpu_address(unsigned long addr, unsigned long *can_addr);
+ extern bool is_kernel_percpu_address(unsigned long addr);
+ 
+@@ -131,8 +131,8 @@ extern bool is_kernel_percpu_address(unsigned long addr);
+ extern void __init setup_per_cpu_areas(void);
+ #endif
+ 
+-extern void __percpu *__alloc_percpu_gfp(size_t size, size_t align, gfp_t gfp);
+-extern void __percpu *__alloc_percpu(size_t size, size_t align);
++extern void __percpu *__alloc_percpu_gfp(size_t size, size_t align, gfp_t gfp) __attribute__((alloc_size(1)));
++extern void __percpu *__alloc_percpu(size_t size, size_t align) __attribute__((alloc_size(1)));
+ extern void free_percpu(void __percpu *__pdata);
+ extern phys_addr_t per_cpu_ptr_to_phys(void *addr);
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0074-add-alloc_pages_exact-alloc_size-attributes.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0074-add-alloc_pages_exact-alloc_size-attributes.patch
new file mode 100644
index 000000000000..10f484ee0ad4
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0074-add-alloc_pages_exact-alloc_size-attributes.patch
@@ -0,0 +1,30 @@
+From 2a79cb5f248d05bd79f440343a7b4e95c2a079b2 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 14 May 2017 16:53:59 -0400
+Subject: [PATCH 074/113] add alloc_pages_exact alloc_size attributes
+
+Edited-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ include/linux/gfp.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/gfp.h b/include/linux/gfp.h
+index c603237e006c..893378b0262e 100644
+--- a/include/linux/gfp.h
++++ b/include/linux/gfp.h
+@@ -568,9 +568,9 @@ static inline struct page *alloc_pages(gfp_t gfp_mask, unsigned int order)
+ extern unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order);
+ extern unsigned long get_zeroed_page(gfp_t gfp_mask);
+ 
+-void *alloc_pages_exact(size_t size, gfp_t gfp_mask);
++void *alloc_pages_exact(size_t size, gfp_t gfp_mask) __attribute__((alloc_size(1)));
+ void free_pages_exact(void *virt, size_t size);
+-void * __meminit alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask);
++void * __meminit alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask) __attribute__((alloc_size(2)));
+ 
+ #define __get_free_page(gfp_mask) \
+ 		__get_free_pages((gfp_mask), 0)
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0075-Add-the-extra_latent_entropy-kernel-parameter.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0075-Add-the-extra_latent_entropy-kernel-parameter.patch
new file mode 100644
index 000000000000..c8dc717493ed
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0075-Add-the-extra_latent_entropy-kernel-parameter.patch
@@ -0,0 +1,104 @@
+From c4f1400051880e1e85db4753894a5eaa37919a79 Mon Sep 17 00:00:00 2001
+From: Emese Revfy <re.emese@gmail.com>
+Date: Tue, 31 May 2016 01:34:02 +0200
+Subject: [PATCH 075/113] Add the extra_latent_entropy kernel parameter
+
+When extra_latent_entropy is passed on the kernel command line,
+entropy will be extracted from up to the first 4GB of RAM while the
+runtime memory allocator is being initialized.
+
+Based on work created by the PaX Team.
+
+Signed-off-by: Emese Revfy <re.emese@gmail.com>
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ .../admin-guide/kernel-parameters.txt         |  5 ++++
+ mm/page_alloc.c                               | 25 +++++++++++++++++++
+ scripts/gcc-plugins/Kconfig                   |  5 ++++
+ 3 files changed, 35 insertions(+)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index f6a1513dfb76..f399208c873a 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -3566,6 +3566,11 @@
+ 			the specified number of seconds.  This is to be used if
+ 			your oopses keep scrolling off the screen.
+ 
++	extra_latent_entropy
++			Enable a very simple form of latent entropy extraction
++			from the first 4GB of memory as the bootmem allocator
++			passes the memory pages to the buddy allocator.
++
+ 	pcbit=		[HW,ISDN]
+ 
+ 	pcd.		[PARIDE]
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 84070ae3885e..ded9e8536285 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -70,6 +70,7 @@
+ #include <linux/psi.h>
+ #include <linux/padata.h>
+ #include <linux/khugepaged.h>
++#include <linux/random.h>
+ 
+ #include <asm/sections.h>
+ #include <asm/tlbflush.h>
+@@ -136,6 +137,15 @@ struct pcpu_drain {
+ static DEFINE_MUTEX(pcpu_drain_mutex);
+ static DEFINE_PER_CPU(struct pcpu_drain, pcpu_drain);
+ 
++bool __meminitdata extra_latent_entropy;
++
++static int __init setup_extra_latent_entropy(char *str)
++{
++	extra_latent_entropy = true;
++	return 0;
++}
++early_param("extra_latent_entropy", setup_extra_latent_entropy);
++
+ #ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
+ volatile unsigned long latent_entropy __latent_entropy;
+ EXPORT_SYMBOL(latent_entropy);
+@@ -1549,6 +1559,21 @@ void __free_pages_core(struct page *page, unsigned int order)
+ 	__ClearPageReserved(p);
+ 	set_page_count(p, 0);
+ 
++	if (extra_latent_entropy && !PageHighMem(page) && page_to_pfn(page) < 0x100000) {
++		unsigned long hash = 0;
++		size_t index, end = PAGE_SIZE * nr_pages / sizeof hash;
++		const unsigned long *data = lowmem_page_address(page);
++
++		for (index = 0; index < end; index++)
++			hash ^= hash + data[index];
++#ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
++		latent_entropy ^= hash;
++		add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy));
++#else
++		add_device_randomness((const void *)&hash, sizeof(hash));
++#endif
++	}
++
+ 	atomic_long_add(nr_pages, &page_zone(page)->managed_pages);
+ 
+ 	/*
+diff --git a/scripts/gcc-plugins/Kconfig b/scripts/gcc-plugins/Kconfig
+index ae19fb0243b9..ad78375ece5e 100644
+--- a/scripts/gcc-plugins/Kconfig
++++ b/scripts/gcc-plugins/Kconfig
+@@ -53,6 +53,11 @@ config GCC_PLUGIN_LATENT_ENTROPY
+ 	  is some slowdown of the boot process (about 0.5%) and fork and
+ 	  irq processing.
+ 
++	  When extra_latent_entropy is passed on the kernel command line,
++	  entropy will be extracted from up to the first 4GB of RAM while the
++	  runtime memory allocator is being initialized.  This costs even more
++	  slowdown of the boot process.
++
+ 	  Note that entropy extracted this way is not cryptographically
+ 	  secure!
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0076-ata-avoid-null-pointer-dereference-on-bug.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0076-ata-avoid-null-pointer-dereference-on-bug.patch
new file mode 100644
index 000000000000..5d6d8b671d38
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0076-ata-avoid-null-pointer-dereference-on-bug.patch
@@ -0,0 +1,37 @@
+From 76d2e699fca89323e7f8318d3b84928c81e6ddd3 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 15 May 2017 23:45:34 -0400
+Subject: [PATCH 076/113] ata: avoid null pointer dereference on bug
+
+Extracted from PaX.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ drivers/ata/libata-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 61c762961ca8..02a83039c25b 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4540,7 +4540,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
+ 	struct ata_port *ap;
+ 	unsigned int tag;
+ 
+-	WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
++	BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
+ 	ap = qc->ap;
+ 
+ 	qc->flags = 0;
+@@ -4557,7 +4557,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
+ 	struct ata_port *ap;
+ 	struct ata_link *link;
+ 
+-	WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
++	BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
+ 	WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
+ 	ap = qc->ap;
+ 	link = qc->dev->link;
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0077-sanity-check-for-negative-length-in-nla_memcpy.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0077-sanity-check-for-negative-length-in-nla_memcpy.patch
new file mode 100644
index 000000000000..e0651a45c162
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0077-sanity-check-for-negative-length-in-nla_memcpy.patch
@@ -0,0 +1,28 @@
+From a1e40a045158cacd7edd2c5a1affbd5a32ee17ca Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 15 May 2017 23:51:12 -0400
+Subject: [PATCH 077/113] sanity check for negative length in nla_memcpy
+
+Extracted from PaX.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ lib/nlattr.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/nlattr.c b/lib/nlattr.c
+index 74019c8ebf6b..c480b4e7ffef 100644
+--- a/lib/nlattr.c
++++ b/lib/nlattr.c
+@@ -778,6 +778,8 @@ int nla_memcpy(void *dest, const struct nlattr *src, int count)
+ {
+ 	int minlen = min_t(int, count, nla_len(src));
+ 
++	BUG_ON(minlen < 0);
++
+ 	memcpy(dest, nla_data(src), minlen);
+ 	if (count > minlen)
+ 		memset(dest + minlen, 0, count - minlen);
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0078-add-page-destructor-sanity-check.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0078-add-page-destructor-sanity-check.patch
new file mode 100644
index 000000000000..585d2db063c2
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0078-add-page-destructor-sanity-check.patch
@@ -0,0 +1,71 @@
+From 58595d383421defffcae5c0c1b75bfa05555db44 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 15 May 2017 23:59:18 -0400
+Subject: [PATCH 078/113] add page destructor sanity check
+
+Taken from the public PaX patches.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+[thibaut.sautereau@ssi.gouv.fr: Restore get_compound_page_dtor()]
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Reviewd-by: Levente Polyak <levente@leventepolyak.net>
+---
+ include/linux/mm.h |  9 +++++++--
+ mm/swap.c          | 12 +++++++++++-
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 746f6d05bd81..a463ffe84eb4 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -894,10 +894,15 @@ static inline void set_compound_page_dtor(struct page *page,
+ 	page[1].compound_dtor = compound_dtor;
+ }
+ 
+-static inline void destroy_compound_page(struct page *page)
++static inline compound_page_dtor *get_compound_page_dtor(struct page *page)
+ {
+ 	VM_BUG_ON_PAGE(page[1].compound_dtor >= NR_COMPOUND_DTORS, page);
+-	compound_page_dtors[page[1].compound_dtor](page);
++	return compound_page_dtors[page[1].compound_dtor];
++}
++
++static inline void destroy_compound_page(struct page *page)
++{
++	(*get_compound_page_dtor(page))(page);
+ }
+ 
+ static inline unsigned int compound_order(struct page *page)
+diff --git a/mm/swap.c b/mm/swap.c
+index 47a47681c86b..762095d95092 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -102,6 +102,8 @@ static void __put_single_page(struct page *page)
+ 
+ static void __put_compound_page(struct page *page)
+ {
++	compound_page_dtor *dtor;
++
+ 	/*
+ 	 * __page_cache_release() is supposed to be called for thp, not for
+ 	 * hugetlb. This is because hugetlb page does never have PageLRU set
+@@ -110,7 +112,15 @@ static void __put_compound_page(struct page *page)
+ 	 */
+ 	if (!PageHuge(page))
+ 		__page_cache_release(page);
+-	destroy_compound_page(page);
++	dtor = get_compound_page_dtor(page);
++	if (!PageHuge(page))
++		BUG_ON(dtor != free_compound_page
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++			&& dtor != free_transhuge_page
++#endif
++		);
++
++	(*dtor)(page);
+ }
+ 
+ void __put_page(struct page *page)
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0079-PaX-shadow-cr4-sanity-check-essentially-a-revert.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0079-PaX-shadow-cr4-sanity-check-essentially-a-revert.patch
new file mode 100644
index 000000000000..1139bfcdee94
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0079-PaX-shadow-cr4-sanity-check-essentially-a-revert.patch
@@ -0,0 +1,52 @@
+From a1f711d5c9c22a3ecb704269ab0053fb87f20b6b Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 16 May 2017 00:59:48 -0400
+Subject: [PATCH 079/113] PaX shadow cr4 sanity check (essentially a revert)
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ arch/x86/kernel/cpu/common.c | 1 +
+ arch/x86/kernel/process.c    | 1 +
+ arch/x86/mm/tlb.c            | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 35ad8480c464..edaeeab9df4b 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -399,6 +399,7 @@ EXPORT_SYMBOL_GPL(native_write_cr4);
+ void cr4_update_irqsoff(unsigned long set, unsigned long clear)
+ {
+ 	unsigned long newval, cr4 = this_cpu_read(cpu_tlbstate.cr4);
++	BUG_ON(cr4 != __read_cr4());
+ 
+ 	lockdep_assert_irqs_disabled();
+ 
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 145a7ac0c19a..058941e9ae40 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -596,6 +596,7 @@ void speculation_ctrl_update_current(void)
+ static inline void cr4_toggle_bits_irqsoff(unsigned long mask)
+ {
+ 	unsigned long newval, cr4 = this_cpu_read(cpu_tlbstate.cr4);
++	BUG_ON(cr4 != __read_cr4());
+ 
+ 	newval = cr4 ^ mask;
+ 	if (newval != cr4) {
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index 569ac1d57f55..044d88da4aee 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -1066,6 +1066,7 @@ STATIC_NOPV void native_flush_tlb_global(void)
+ 	raw_local_irq_save(flags);
+ 
+ 	cr4 = this_cpu_read(cpu_tlbstate.cr4);
++	BUG_ON(cr4 != __read_cr4());
+ 	/* toggle PGE */
+ 	native_write_cr4(cr4 ^ X86_CR4_PGE);
+ 	/* write old PGE again and flush TLBs */
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0080-add-writable-function-pointer-detection.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0080-add-writable-function-pointer-detection.patch
new file mode 100644
index 000000000000..2e32f8a36092
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0080-add-writable-function-pointer-detection.patch
@@ -0,0 +1,98 @@
+From af9386b3db772d9d09972ca34530fd1a9d3d9ab1 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 9 Jul 2017 17:53:23 -0400
+Subject: [PATCH 080/113] add writable function pointer detection
+
+Taken from the public PaX patches.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ scripts/mod/modpost.c | 28 +++++++++++++++++++++++++---
+ 1 file changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index f882ce0d9327..50e9baefc4e7 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -34,6 +34,7 @@ static int external_module = 0;
+ static int warn_unresolved = 0;
+ /* How a symbol is exported */
+ static int sec_mismatch_count = 0;
++static int writable_fptr_count = 0;
+ static int sec_mismatch_fatal = 0;
+ /* ignore missing files */
+ static int ignore_missing_files;
+@@ -1007,6 +1008,7 @@ enum mismatch {
+ 	ANY_EXIT_TO_ANY_INIT,
+ 	EXPORT_TO_INIT_EXIT,
+ 	EXTABLE_TO_NON_TEXT,
++	DATA_TO_TEXT
+ };
+ 
+ /**
+@@ -1133,6 +1135,12 @@ static const struct sectioncheck sectioncheck[] = {
+ 	.good_tosec = {ALL_TEXT_SECTIONS , NULL},
+ 	.mismatch = EXTABLE_TO_NON_TEXT,
+ 	.handler = extable_mismatch_handler,
++},
++/* Do not reference code from writable data */
++{
++	.fromsec = { DATA_SECTIONS, NULL },
++	.bad_tosec = { ALL_TEXT_SECTIONS, NULL },
++	.mismatch = DATA_TO_TEXT
+ }
+ };
+ 
+@@ -1320,10 +1328,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
+ 			continue;
+ 		if (!is_valid_name(elf, sym))
+ 			continue;
+-		if (sym->st_value == addr)
+-			return sym;
+ 		/* Find a symbol nearby - addr are maybe negative */
+ 		d = sym->st_value - addr;
++		if (d == 0)
++			return sym;
+ 		if (d < 0)
+ 			d = addr - sym->st_value;
+ 		if (d < distance) {
+@@ -1458,7 +1466,10 @@ static void report_sec_mismatch(const char *modname,
+ 	char *prl_from;
+ 	char *prl_to;
+ 
+-	sec_mismatch_count++;
++	if (mismatch->mismatch == DATA_TO_TEXT)
++		writable_fptr_count++;
++	else
++		sec_mismatch_count++;
+ 
+ 	get_pretty_name(from_is_func, &from, &from_p);
+ 	get_pretty_name(to_is_func, &to, &to_p);
+@@ -1580,6 +1591,14 @@ static void report_sec_mismatch(const char *modname,
+ 		fatal("There's a special handler for this mismatch type, "
+ 		      "we should never get here.");
+ 		break;
++	case DATA_TO_TEXT:
++#if 0
++		fprintf(stderr,
++		"The %s %s:%s references\n"
++		"the %s %s:%s%s\n",
++		from, fromsec, fromsym, to, tosec, tosym, to_p);
++#endif
++		break;
+ 	}
+ 	fprintf(stderr, "\n");
+ }
+@@ -2670,6 +2689,9 @@ int main(int argc, char **argv)
+ 	}
+ 
+ 	free(buf.p);
++	if (writable_fptr_count)
++		warn("modpost: Found %d writable function pointer(s).\n",
++		     writable_fptr_count);
+ 
+ 	return err;
+ }
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0081-support-overriding-early-audit-kernel-cmdline.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0081-support-overriding-early-audit-kernel-cmdline.patch
new file mode 100644
index 000000000000..be8c63e3b291
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0081-support-overriding-early-audit-kernel-cmdline.patch
@@ -0,0 +1,26 @@
+From e69f0ae05bcdffc733a1ae6857ccfcdd3405bcf8 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 9 Jul 2017 17:20:29 -0400
+Subject: [PATCH 081/113] support overriding early audit kernel cmdline
+
+---
+ kernel/audit.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 68cee3bc8cfe..2059c66f7c9b 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -1693,6 +1693,9 @@ static int __init audit_enable(char *str)
+ 
+ 	if (audit_default == AUDIT_OFF)
+ 		audit_initialized = AUDIT_DISABLED;
++	else if (!audit_ever_enabled)
++		audit_initialized = AUDIT_UNINITIALIZED;
++
+ 	if (audit_set_enabled(audit_default))
+ 		pr_err("audit: error setting audit state (%d)\n",
+ 		       audit_default);
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0082-FORTIFY_SOURCE-intra-object-overflow-checking.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0082-FORTIFY_SOURCE-intra-object-overflow-checking.patch
new file mode 100644
index 000000000000..8417f43c08da
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0082-FORTIFY_SOURCE-intra-object-overflow-checking.patch
@@ -0,0 +1,135 @@
+From cd183c69bbc5c9815e04e78a1c9ab8de0985e706 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sat, 3 Jun 2017 17:34:13 -0400
+Subject: [PATCH 082/113] FORTIFY_SOURCE intra-object overflow checking
+
+This adds supporting for detecting buffer overflows from inner objects
+for the fortified string family functions. It's comparable to the
+_FORTIFY_SOURCE=2 feature in glibc with the additional coverage of
+intra-object read overflows for supported functions.
+
+The mem* family functions are left with only the inter-object overflow
+checks as is the case with glibc _FORTIFY_SOURCE=2.
+
+This feature is currently hidden behind CONFIG_EXPERT because it's a lot
+more likely to uncover benign / intended issues and will need a lot of
+runtime testing. It's already useful for finding bugs but it may not yet
+be a good idea to use it for hardening unless panics for benign issues
+are seen as a lesser evil than the vulnerabilities it can catch.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ include/linux/string.h | 26 ++++++++++++++++----------
+ security/Kconfig       | 10 ++++++++++
+ 2 files changed, 26 insertions(+), 10 deletions(-)
+
+diff --git a/include/linux/string.h b/include/linux/string.h
+index b1f3894a0a3e..4c5564a6ad80 100644
+--- a/include/linux/string.h
++++ b/include/linux/string.h
+@@ -264,6 +264,12 @@ void __read_overflow2(void) __compiletime_error("detected read beyond size of ob
+ void __read_overflow3(void) __compiletime_error("detected read beyond size of object passed as 3rd parameter");
+ void __write_overflow(void) __compiletime_error("detected write beyond size of object passed as 1st parameter");
+ 
++#ifdef CONFIG_FORTIFY_SOURCE_STRICT_STRING
++#define __string_size(p) __builtin_object_size(p, 1)
++#else
++#define __string_size(p) __builtin_object_size(p, 0)
++#endif
++
+ #if !defined(__NO_FORTIFY) && defined(__OPTIMIZE__) && defined(CONFIG_FORTIFY_SOURCE)
+ 
+ #ifdef CONFIG_KASAN
+@@ -292,7 +298,7 @@ extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size)
+ 
+ __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size)
+ {
+-	size_t p_size = __builtin_object_size(p, 0);
++	size_t p_size = __string_size(p);
+ 	if (__builtin_constant_p(size) && p_size < size)
+ 		__write_overflow();
+ 	if (p_size < size)
+@@ -302,7 +308,7 @@ __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size)
+ 
+ __FORTIFY_INLINE char *strcat(char *p, const char *q)
+ {
+-	size_t p_size = __builtin_object_size(p, 0);
++	size_t p_size = __string_size(p);
+ 	if (p_size == (size_t)-1)
+ 		return __underlying_strcat(p, q);
+ 	if (strlcat(p, q, p_size) >= p_size)
+@@ -313,7 +319,7 @@ __FORTIFY_INLINE char *strcat(char *p, const char *q)
+ __FORTIFY_INLINE __kernel_size_t strlen(const char *p)
+ {
+ 	__kernel_size_t ret;
+-	size_t p_size = __builtin_object_size(p, 0);
++	size_t p_size = __string_size(p);
+ 
+ 	/* Work around gcc excess stack consumption issue */
+ 	if (p_size == (size_t)-1 ||
+@@ -328,7 +334,7 @@ __FORTIFY_INLINE __kernel_size_t strlen(const char *p)
+ extern __kernel_size_t __real_strnlen(const char *, __kernel_size_t) __RENAME(strnlen);
+ __FORTIFY_INLINE __kernel_size_t strnlen(const char *p, __kernel_size_t maxlen)
+ {
+-	size_t p_size = __builtin_object_size(p, 0);
++	size_t p_size = __string_size(p);
+ 	__kernel_size_t ret = __real_strnlen(p, maxlen < p_size ? maxlen : p_size);
+ 	if (p_size <= ret && maxlen != ret)
+ 		fortify_panic(__func__);
+@@ -340,8 +346,8 @@ extern size_t __real_strlcpy(char *, const char *, size_t) __RENAME(strlcpy);
+ __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size)
+ {
+ 	size_t ret;
+-	size_t p_size = __builtin_object_size(p, 0);
+-	size_t q_size = __builtin_object_size(q, 0);
++	size_t p_size = __string_size(p);
++	size_t q_size = __string_size(q);
+ 	if (p_size == (size_t)-1 && q_size == (size_t)-1)
+ 		return __real_strlcpy(p, q, size);
+ 	ret = strlen(q);
+@@ -361,8 +367,8 @@ __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size)
+ __FORTIFY_INLINE char *strncat(char *p, const char *q, __kernel_size_t count)
+ {
+ 	size_t p_len, copy_len;
+-	size_t p_size = __builtin_object_size(p, 0);
+-	size_t q_size = __builtin_object_size(q, 0);
++	size_t p_size = __string_size(p);
++	size_t q_size = __string_size(q);
+ 	if (p_size == (size_t)-1 && q_size == (size_t)-1)
+ 		return __underlying_strncat(p, q, count);
+ 	p_len = strlen(p);
+@@ -475,8 +481,8 @@ __FORTIFY_INLINE void *kmemdup(const void *p, size_t size, gfp_t gfp)
+ /* defined after fortified strlen and memcpy to reuse them */
+ __FORTIFY_INLINE char *strcpy(char *p, const char *q)
+ {
+-	size_t p_size = __builtin_object_size(p, 0);
+-	size_t q_size = __builtin_object_size(q, 0);
++	size_t p_size = __string_size(p);
++	size_t q_size = __string_size(q);
+ 	if (p_size == (size_t)-1 && q_size == (size_t)-1)
+ 		return __underlying_strcpy(p, q);
+ 	memcpy(p, q, strlen(q) + 1);
+diff --git a/security/Kconfig b/security/Kconfig
+index 2348ff7d4e1d..f3c995bd79cf 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -208,6 +208,16 @@ config FORTIFY_SOURCE
+ 	  Detect overflows of buffers in common string and memory functions
+ 	  where the compiler can determine and validate the buffer sizes.
+ 
++config FORTIFY_SOURCE_STRICT_STRING
++	bool "Harden common functions against buffer overflows"
++	depends on FORTIFY_SOURCE
++	depends on EXPERT
++	help
++	  Perform stricter overflow checks catching overflows within objects
++	  for common C string functions rather than only between objects.
++
++	  This is not yet intended for production use, only bug finding.
++
+ config STATIC_USERMODEHELPER
+ 	bool "Force all usermode helper calls through a single binary"
+ 	help
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0083-Revert-mm-revert-x86_64-and-arm64-ELF_ET_DYN_BASE-ba.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0083-Revert-mm-revert-x86_64-and-arm64-ELF_ET_DYN_BASE-ba.patch
new file mode 100644
index 000000000000..25b46addd6cd
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0083-Revert-mm-revert-x86_64-and-arm64-ELF_ET_DYN_BASE-ba.patch
@@ -0,0 +1,54 @@
+From 076b37f37b0ff591c58f0d73ef6da6e79a3b3d1f Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sat, 26 Aug 2017 20:16:03 -0400
+Subject: [PATCH 083/113] Revert "mm: revert x86_64 and arm64 ELF_ET_DYN_BASE
+ base changes"
+
+This reverts commit aab425db4279aeb83b7911693f0cccbd3644c9fd.
+---
+ arch/arm64/include/asm/elf.h | 8 ++------
+ arch/x86/include/asm/elf.h   | 4 ++--
+ 2 files changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
+index 8d1c8dcb87fd..26d27c7a2c2e 100644
+--- a/arch/arm64/include/asm/elf.h
++++ b/arch/arm64/include/asm/elf.h
+@@ -124,14 +124,10 @@
+ 
+ /*
+  * This is the base location for PIE (ET_DYN with INTERP) loads. On
+- * 64-bit, this is above 4GB to leave the entire 32-bit address
++ * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+  * space open for things that want to use the area for 32-bit pointers.
+  */
+-#ifdef CONFIG_ARM64_FORCE_52BIT
+-#define ELF_ET_DYN_BASE		(2 * TASK_SIZE_64 / 3)
+-#else
+-#define ELF_ET_DYN_BASE		(2 * DEFAULT_MAP_WINDOW_64 / 3)
+-#endif /* CONFIG_ARM64_FORCE_52BIT */
++#define ELF_ET_DYN_BASE		0x100000000UL
+ 
+ #ifndef __ASSEMBLY__
+ 
+diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
+index b9a5d488f1a5..b55054566ece 100644
+--- a/arch/x86/include/asm/elf.h
++++ b/arch/x86/include/asm/elf.h
+@@ -246,11 +246,11 @@ extern int force_personality32;
+ 
+ /*
+  * This is the base location for PIE (ET_DYN with INTERP) loads. On
+- * 64-bit, this is above 4GB to leave the entire 32-bit address
++ * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+  * space open for things that want to use the area for 32-bit pointers.
+  */
+ #define ELF_ET_DYN_BASE		(mmap_is_ia32() ? 0x000400000UL : \
+-						  (DEFAULT_MAP_WINDOW / 3 * 2))
++						  0x100000000UL)
+ 
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports.  This could be done in user space,
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0084-x86_64-move-vdso-to-mmap-region-from-stack-region.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0084-x86_64-move-vdso-to-mmap-region-from-stack-region.patch
new file mode 100644
index 000000000000..e42daa3bc863
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0084-x86_64-move-vdso-to-mmap-region-from-stack-region.patch
@@ -0,0 +1,118 @@
+From 02274e27e971f3bfd099ee7b938d0531dc7a1fca Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 11 May 2017 16:52:00 -0400
+Subject: [PATCH 084/113] x86_64: move vdso to mmap region from stack region
+
+This removes the only executable code from the stack region and gives
+the vdso the same randomized base as other mmap mappings including the
+linker and other shared objects. It results in a sane amount of entropy
+being provided and there's little to no advantage in separating this
+from the existing executable code there.
+
+It's sensible for userspace to reserve the initial mmap base as a region
+for executable code with a random gap for other mmap allocations, along
+with providing randomization within that region. However, there isn't
+much the kernel can do to help due to how dynamic linkers load the
+shared objects.
+
+This was extracted from the PaX RANDMMAP feature.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ arch/x86/entry/vdso/vma.c    | 48 +-----------------------------------
+ arch/x86/include/asm/elf.h   |  1 -
+ arch/x86/kernel/sys_x86_64.c |  7 ------
+ 3 files changed, 1 insertion(+), 55 deletions(-)
+
+diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c
+index 9185cb1d13b9..543912071557 100644
+--- a/arch/x86/entry/vdso/vma.c
++++ b/arch/x86/entry/vdso/vma.c
+@@ -315,55 +315,9 @@ static int map_vdso(const struct vdso_image *image, unsigned long addr)
+ }
+ 
+ #ifdef CONFIG_X86_64
+-/*
+- * Put the vdso above the (randomized) stack with another randomized
+- * offset.  This way there is no hole in the middle of address space.
+- * To save memory make sure it is still in the same PTE as the stack
+- * top.  This doesn't give that many random bits.
+- *
+- * Note that this algorithm is imperfect: the distribution of the vdso
+- * start address within a PMD is biased toward the end.
+- *
+- * Only used for the 64-bit and x32 vdsos.
+- */
+-static unsigned long vdso_addr(unsigned long start, unsigned len)
+-{
+-	unsigned long addr, end;
+-	unsigned offset;
+-
+-	/*
+-	 * Round up the start address.  It can start out unaligned as a result
+-	 * of stack start randomization.
+-	 */
+-	start = PAGE_ALIGN(start);
+-
+-	/* Round the lowest possible end address up to a PMD boundary. */
+-	end = (start + len + PMD_SIZE - 1) & PMD_MASK;
+-	if (end >= TASK_SIZE_MAX)
+-		end = TASK_SIZE_MAX;
+-	end -= len;
+-
+-	if (end > start) {
+-		offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1);
+-		addr = start + (offset << PAGE_SHIFT);
+-	} else {
+-		addr = start;
+-	}
+-
+-	/*
+-	 * Forcibly align the final address in case we have a hardware
+-	 * issue that requires alignment for performance reasons.
+-	 */
+-	addr = align_vdso_addr(addr);
+-
+-	return addr;
+-}
+-
+ static int map_vdso_randomized(const struct vdso_image *image)
+ {
+-	unsigned long addr = vdso_addr(current->mm->start_stack, image->size-image->sym_vvar_start);
+-
+-	return map_vdso(image, addr);
++	return map_vdso(image, 0);
+ }
+ #endif
+ 
+diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
+index b55054566ece..58292600112d 100644
+--- a/arch/x86/include/asm/elf.h
++++ b/arch/x86/include/asm/elf.h
+@@ -398,5 +398,4 @@ struct va_alignment {
+ } ____cacheline_aligned;
+ 
+ extern struct va_alignment va_align;
+-extern unsigned long align_vdso_addr(unsigned long);
+ #endif /* _ASM_X86_ELF_H */
+diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
+index 504fa5425bce..c4e35a3b3733 100644
+--- a/arch/x86/kernel/sys_x86_64.c
++++ b/arch/x86/kernel/sys_x86_64.c
+@@ -52,13 +52,6 @@ static unsigned long get_align_bits(void)
+ 	return va_align.bits & get_align_mask();
+ }
+ 
+-unsigned long align_vdso_addr(unsigned long addr)
+-{
+-	unsigned long align_mask = get_align_mask();
+-	addr = (addr + align_mask) & ~align_mask;
+-	return addr | get_align_bits();
+-}
+-
+ static int __init control_va_addr_alignment(char *str)
+ {
+ 	/* guard against enabling this on other CPU families */
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0085-x86-determine-stack-entropy-based-on-mmap-entropy.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0085-x86-determine-stack-entropy-based-on-mmap-entropy.patch
new file mode 100644
index 000000000000..510c352ac943
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0085-x86-determine-stack-entropy-based-on-mmap-entropy.patch
@@ -0,0 +1,60 @@
+From ad88f96ed3ec9394614f2a43a184158e838bbd2b Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 21 May 2017 20:30:44 -0400
+Subject: [PATCH 085/113] x86: determine stack entropy based on mmap entropy
+
+Stack mapping entropy is currently hard-wired to 11 bits of entropy on
+32-bit and 22 bits of entropy on 64-bit. The stack itself gains an extra
+8 bits of entropy from lower bit randomization within 16 byte alignment
+constraints. The argument block could have all lower bits randomized but
+it currently only gets the mapping randomization.
+
+Rather than hard-wiring values this switches to using the mmap entropy
+configuration like the mmap base and executable base, resulting in a
+range of 8 to 16 bits on 32-bit and 28 to 32 bits on 64-bit depending on
+kernel configuration and overridable via the sysctl entries.
+
+It's worth noting that since these kernel configuration options default
+to the minimum supported entropy value, the entropy on 32-bit will drop
+from 11 to 8 bits for builds using the defaults. However, following the
+configuration seems like the right thing to do regardless. At the very
+least, changing the defaults for COMPAT (32-bit processes on 64-bit)
+should be considered due to the larger address space compared to real
+32-bit.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ arch/x86/include/asm/elf.h | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
+index 58292600112d..608cca19cf8c 100644
+--- a/arch/x86/include/asm/elf.h
++++ b/arch/x86/include/asm/elf.h
+@@ -330,8 +330,8 @@ extern bool mmap_address_hint_valid(unsigned long addr, unsigned long len);
+ 
+ #ifdef CONFIG_X86_32
+ 
+-#define __STACK_RND_MASK(is32bit) (0x7ff)
+-#define STACK_RND_MASK (0x7ff)
++#define __STACK_RND_MASK(is32bit) ((1UL << mmap_rnd_bits) - 1)
++#define STACK_RND_MASK ((1UL << mmap_rnd_bits) - 1)
+ 
+ #define ARCH_DLINFO		ARCH_DLINFO_IA32
+ 
+@@ -340,7 +340,11 @@ extern bool mmap_address_hint_valid(unsigned long addr, unsigned long len);
+ #else /* CONFIG_X86_32 */
+ 
+ /* 1GB for 64bit, 8MB for 32bit */
+-#define __STACK_RND_MASK(is32bit) ((is32bit) ? 0x7ff : 0x3fffff)
++#ifdef CONFIG_COMPAT
++#define __STACK_RND_MASK(is32bit) ((is32bit) ? (1UL << mmap_rnd_compat_bits) - 1 : (1UL << mmap_rnd_bits) - 1)
++#else
++#define __STACK_RND_MASK(is32bit) ((1UL << mmap_rnd_bits) - 1)
++#endif
+ #define STACK_RND_MASK __STACK_RND_MASK(mmap_is_ia32())
+ 
+ #define ARCH_DLINFO							\
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0086-arm64-determine-stack-entropy-based-on-mmap-entropy.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0086-arm64-determine-stack-entropy-based-on-mmap-entropy.patch
new file mode 100644
index 000000000000..664cbb9d96dc
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0086-arm64-determine-stack-entropy-based-on-mmap-entropy.patch
@@ -0,0 +1,51 @@
+From b755a10376071bb32f3b0707c2c72aad777da3c9 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 22 May 2017 05:06:20 -0400
+Subject: [PATCH 086/113] arm64: determine stack entropy based on mmap entropy
+
+Stack mapping entropy is currently hard-wired to 11 bits of entropy on
+32-bit and 18 bits of entropy on 64-bit. The stack itself gains an extra
+8 bits of entropy from lower bit randomization within 16 byte alignment
+constraints. The argument block could have all lower bits randomized but
+it currently only gets the mapping randomization.
+
+Rather than hard-wiring values this switches to using the mmap entropy
+configuration like the mmap base and executable base, resulting in a
+range of 8 to 16 bits on 32-bit and 18 to 24 bits on 64-bit (with 4k
+pages and 3 level page tables) depending on kernel configuration and
+overridable via the sysctl entries.
+
+It's worth noting that since these kernel configuration options default
+to the minimum supported entropy value, the entropy on 32-bit will drop
+from 11 to 8 bits for builds using the defaults. However, following the
+configuration seems like the right thing to do regardless. At the very
+least, changing the defaults for COMPAT (32-bit processes on 64-bit)
+should be considered due to the larger address space compared to real
+32-bit.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ arch/arm64/include/asm/elf.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
+index 26d27c7a2c2e..32c1609a1158 100644
+--- a/arch/arm64/include/asm/elf.h
++++ b/arch/arm64/include/asm/elf.h
+@@ -185,10 +185,10 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
+ /* 1GB of VA */
+ #ifdef CONFIG_COMPAT
+ #define STACK_RND_MASK			(test_thread_flag(TIF_32BIT) ? \
+-						0x7ff >> (PAGE_SHIFT - 12) : \
+-						0x3ffff >> (PAGE_SHIFT - 12))
++						((1UL << mmap_rnd_compat_bits) - 1) >> (PAGE_SHIFT - 12) : \
++						((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12))
+ #else
+-#define STACK_RND_MASK			(0x3ffff >> (PAGE_SHIFT - 12))
++#define STACK_RND_MASK			(((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12))
+ #endif
+ 
+ #ifdef __AARCH64EB__
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0087-randomize-lower-bits-of-the-argument-block.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0087-randomize-lower-bits-of-the-argument-block.patch
new file mode 100644
index 000000000000..f6674fee0909
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0087-randomize-lower-bits-of-the-argument-block.patch
@@ -0,0 +1,47 @@
+From 45445659726dba25e10f19f31ee9d4fdaca6ba69 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 11 May 2017 16:02:49 -0400
+Subject: [PATCH 087/113] randomize lower bits of the argument block
+
+This was based on the PaX RANDUSTACK feature in grsecurity, where all of
+the lower bits are randomized. PaX keeps 16-byte alignment.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+[levente@leventepolyak.net: do not randomize with ADDR_NO_RANDOMIZE personality]
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ fs/exec.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/exec.c b/fs/exec.c
+index ca89e0e3ef10..d2a03d32e195 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -34,6 +34,7 @@
+ #include <linux/swap.h>
+ #include <linux/string.h>
+ #include <linux/init.h>
++#include <linux/sched.h>
+ #include <linux/sched/mm.h>
+ #include <linux/sched/coredump.h>
+ #include <linux/sched/signal.h>
+@@ -64,6 +65,7 @@
+ #include <linux/compat.h>
+ #include <linux/vmalloc.h>
+ #include <linux/io_uring.h>
++#include <linux/random.h>
+ 
+ #include <linux/uaccess.h>
+ #include <asm/mmu_context.h>
+@@ -280,6 +282,8 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+ 	mm->stack_vm = mm->total_vm = 1;
+ 	mmap_write_unlock(mm);
+ 	bprm->p = vma->vm_end - sizeof(void *);
++	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
++		bprm->p ^= get_random_int() & ~PAGE_MASK;
+ 	return 0;
+ err:
+ 	mmap_write_unlock(mm);
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0088-x86_64-match-arm64-brk-randomization-entropy.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0088-x86_64-match-arm64-brk-randomization-entropy.patch
new file mode 100644
index 000000000000..34aaa04326f5
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0088-x86_64-match-arm64-brk-randomization-entropy.patch
@@ -0,0 +1,38 @@
+From 10bc4e5a26427743e381be6ced0732f5403e933a Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 30 May 2017 07:19:48 -0400
+Subject: [PATCH 088/113] x86_64: match arm64 brk randomization entropy
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ arch/x86/kernel/process.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 058941e9ae40..61460d55dd72 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -43,6 +43,8 @@
+ #include <asm/io_bitmap.h>
+ #include <asm/proto.h>
+ #include <asm/frame.h>
++#include <asm/elf.h>
++#include <linux/sizes.h>
+ 
+ #include "process.h"
+ 
+@@ -906,7 +908,10 @@ unsigned long arch_align_stack(unsigned long sp)
+ 
+ unsigned long arch_randomize_brk(struct mm_struct *mm)
+ {
+-	return randomize_page(mm->brk, 0x02000000);
++	if (mmap_is_ia32())
++		return randomize_page(mm->brk, SZ_32M);
++	else
++		return randomize_page(mm->brk, SZ_1G);
+ }
+ 
+ /*
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0089-support-randomizing-the-lower-bits-of-brk.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0089-support-randomizing-the-lower-bits-of-brk.patch
new file mode 100644
index 000000000000..ddcaf2565baf
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0089-support-randomizing-the-lower-bits-of-brk.patch
@@ -0,0 +1,42 @@
+From faaa4cd5a2c92491cbb7c437b1d6e132e2aa0764 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 30 May 2017 18:03:30 -0400
+Subject: [PATCH 089/113] support randomizing the lower bits of brk
+
+This adds support for arch_randomize_brk implementations not performing
+page alignment in order to randomize the lower bits of the brk heap.
+
+This idea is taken from PaX but the approach is different. This reuses
+the existing code and avoids forcing early creation of the heap mapping,
+avoiding mapping it if it's not used which is the case with many modern
+allocators based solely on mmap.
+
+The malloc implementation can be relied upon to align this as needed to
+the requirements it has, so using 16 byte alignment here is unnecessary.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ mm/mmap.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 5c8b4485860d..0e26c225bb53 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -231,6 +231,13 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
+ 
+ 	newbrk = PAGE_ALIGN(brk);
+ 	oldbrk = PAGE_ALIGN(mm->brk);
++	/* properly handle unaligned min_brk as an empty heap */
++	if (min_brk & ~PAGE_MASK) {
++		if (brk == min_brk)
++			newbrk -= PAGE_SIZE;
++		if (mm->brk == min_brk)
++			oldbrk -= PAGE_SIZE;
++	}
+ 	if (oldbrk == newbrk) {
+ 		mm->brk = brk;
+ 		goto success;
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0090-mm-randomize-lower-bits-of-brk.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0090-mm-randomize-lower-bits-of-brk.patch
new file mode 100644
index 000000000000..317899e25acc
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0090-mm-randomize-lower-bits-of-brk.patch
@@ -0,0 +1,31 @@
+From 6d2ebb7e809172288d8e45412edf5424f38fc4a8 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 1 Jun 2017 03:22:38 -0400
+Subject: [PATCH 090/113] mm: randomize lower bits of brk
+
+Per PaX, but for this alternate brk randomization approach.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ mm/util.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mm/util.c b/mm/util.c
+index 4ddb6e186dd5..4ca72f952329 100644
+--- a/mm/util.c
++++ b/mm/util.c
+@@ -336,9 +336,9 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
+ {
+ 	/* Is the current task 32bit ? */
+ 	if (!IS_ENABLED(CONFIG_64BIT) || is_compat_task())
+-		return randomize_page(mm->brk, SZ_32M);
++		return mm->brk + get_random_long() % SZ_32M;
+ 
+-	return randomize_page(mm->brk, SZ_1G);
++	return mm->brk + get_random_long() % SZ_1G;
+ }
+ 
+ unsigned long arch_mmap_rnd(void)
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0091-x86-randomize-lower-bits-of-brk.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0091-x86-randomize-lower-bits-of-brk.patch
new file mode 100644
index 000000000000..15e58b0ce70a
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0091-x86-randomize-lower-bits-of-brk.patch
@@ -0,0 +1,31 @@
+From 6db87dd4450d75558fee95d84c6c7cef7481ef41 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 1 Jun 2017 03:23:06 -0400
+Subject: [PATCH 091/113] x86: randomize lower bits of brk
+
+Per PaX, but for this alternate brk randomization approach.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ arch/x86/kernel/process.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 61460d55dd72..0d4c3887229d 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -909,9 +909,9 @@ unsigned long arch_align_stack(unsigned long sp)
+ unsigned long arch_randomize_brk(struct mm_struct *mm)
+ {
+ 	if (mmap_is_ia32())
+-		return randomize_page(mm->brk, SZ_32M);
++		return mm->brk + get_random_long() % SZ_32M;
+ 	else
+-		return randomize_page(mm->brk, SZ_1G);
++		return mm->brk + get_random_long() % SZ_1G;
+ }
+ 
+ /*
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0092-mm-guarantee-brk-gap-is-at-least-one-page.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0092-mm-guarantee-brk-gap-is-at-least-one-page.patch
new file mode 100644
index 000000000000..f43463bd9ce3
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0092-mm-guarantee-brk-gap-is-at-least-one-page.patch
@@ -0,0 +1,31 @@
+From 48afdc21481c65eaa8b56238e0e983f0c2635e65 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 1 Jun 2017 03:23:39 -0400
+Subject: [PATCH 092/113] mm: guarantee brk gap is at least one page
+
+Per PaX, but for this alternate brk randomization approach.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ mm/util.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mm/util.c b/mm/util.c
+index 4ca72f952329..62ed34dfceb7 100644
+--- a/mm/util.c
++++ b/mm/util.c
+@@ -336,9 +336,9 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
+ {
+ 	/* Is the current task 32bit ? */
+ 	if (!IS_ENABLED(CONFIG_64BIT) || is_compat_task())
+-		return mm->brk + get_random_long() % SZ_32M;
++		return mm->brk + get_random_long() % SZ_32M + PAGE_SIZE;
+ 
+-	return mm->brk + get_random_long() % SZ_1G;
++	return mm->brk + get_random_long() % SZ_1G + PAGE_SIZE;
+ }
+ 
+ unsigned long arch_mmap_rnd(void)
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0093-x86-guarantee-brk-gap-is-at-least-one-page.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0093-x86-guarantee-brk-gap-is-at-least-one-page.patch
new file mode 100644
index 000000000000..6e2712a21c54
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0093-x86-guarantee-brk-gap-is-at-least-one-page.patch
@@ -0,0 +1,31 @@
+From 7a7856e97e9e0a8ca341107a8a9d593787687cd4 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 1 Jun 2017 03:23:48 -0400
+Subject: [PATCH 093/113] x86: guarantee brk gap is at least one page
+
+Per PaX, but for this alternate brk randomization approach.
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ arch/x86/kernel/process.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 0d4c3887229d..161e25d02fd5 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -909,9 +909,9 @@ unsigned long arch_align_stack(unsigned long sp)
+ unsigned long arch_randomize_brk(struct mm_struct *mm)
+ {
+ 	if (mmap_is_ia32())
+-		return mm->brk + get_random_long() % SZ_32M;
++		return mm->brk + get_random_long() % SZ_32M + PAGE_SIZE;
+ 	else
+-		return mm->brk + get_random_long() % SZ_1G;
++		return mm->brk + get_random_long() % SZ_1G + PAGE_SIZE;
+ }
+ 
+ /*
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0094-x86_64-bound-mmap-between-legacy-modern-bases.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0094-x86_64-bound-mmap-between-legacy-modern-bases.patch
new file mode 100644
index 000000000000..0c4b52905e2f
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0094-x86_64-bound-mmap-between-legacy-modern-bases.patch
@@ -0,0 +1,37 @@
+From c30867dd77734d7b2b894878719358c026ee0d05 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 4 Jul 2017 14:50:54 -0400
+Subject: [PATCH 094/113] x86_64: bound mmap between legacy/modern bases
+
+---
+ arch/x86/kernel/sys_x86_64.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
+index c4e35a3b3733..e30ec4c750d1 100644
+--- a/arch/x86/kernel/sys_x86_64.c
++++ b/arch/x86/kernel/sys_x86_64.c
+@@ -113,10 +113,7 @@ static void find_start_end(unsigned long addr, unsigned long flags,
+ 	}
+ 
+ 	*begin	= get_mmap_base(1);
+-	if (in_32bit_syscall())
+-		*end = task_size_32bit();
+-	else
+-		*end = task_size_64bit(addr > DEFAULT_MAP_WINDOW);
++	*end	= get_mmap_base(0);
+ }
+ 
+ unsigned long
+@@ -193,7 +190,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 
+ 	info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+ 	info.length = len;
+-	info.low_limit = PAGE_SIZE;
++	info.low_limit = get_mmap_base(1);
+ 	info.high_limit = get_mmap_base(0);
+ 
+ 	/*
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0095-restrict-device-timing-side-channels.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0095-restrict-device-timing-side-channels.patch
new file mode 100644
index 000000000000..1de38f564c76
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0095-restrict-device-timing-side-channels.patch
@@ -0,0 +1,174 @@
+From 92277813dcd237bafd1ccf1eec8d4ed67d7144b8 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 16 May 2017 18:26:10 -0400
+Subject: [PATCH 095/113] restrict device timing side channels
+
+Based on the public grsecurity patches.
+
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ fs/inode.c                 |  4 ++++
+ fs/stat.c                  | 20 +++++++++++++++-----
+ include/linux/capability.h |  5 +++++
+ include/linux/fs.h         | 11 +++++++++++
+ include/linux/fsnotify.h   |  4 ++++
+ kernel/capability.c        |  6 ++++++
+ kernel/sysctl.c            |  9 +++++++++
+ 7 files changed, 54 insertions(+), 5 deletions(-)
+
+diff --git a/fs/inode.c b/fs/inode.c
+index 5eea9912a0b9..f86f383a3e1d 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -116,6 +116,10 @@ int proc_nr_inodes(struct ctl_table *table, int write,
+ }
+ #endif
+ 
++/* sysctl */
++int device_sidechannel_restrict __read_mostly = 1;
++EXPORT_SYMBOL(device_sidechannel_restrict);
++
+ static int no_open(struct inode *inode, struct file *file)
+ {
+ 	return -ENXIO;
+diff --git a/fs/stat.c b/fs/stat.c
+index dacecdda2e79..14173d0f777d 100644
+--- a/fs/stat.c
++++ b/fs/stat.c
+@@ -43,8 +43,13 @@ void generic_fillattr(struct inode *inode, struct kstat *stat)
+ 	stat->gid = inode->i_gid;
+ 	stat->rdev = inode->i_rdev;
+ 	stat->size = i_size_read(inode);
+-	stat->atime = inode->i_atime;
+-	stat->mtime = inode->i_mtime;
++	if (is_sidechannel_device(inode) && !capable_noaudit(CAP_MKNOD)) {
++		stat->atime = inode->i_ctime;
++		stat->mtime = inode->i_ctime;
++	} else {
++		stat->atime = inode->i_atime;
++		stat->mtime = inode->i_mtime;
++	}
+ 	stat->ctime = inode->i_ctime;
+ 	stat->blksize = i_blocksize(inode);
+ 	stat->blocks = inode->i_blocks;
+@@ -83,9 +88,14 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat,
+ 	if (IS_DAX(inode))
+ 		stat->attributes |= STATX_ATTR_DAX;
+ 
+-	if (inode->i_op->getattr)
+-		return inode->i_op->getattr(path, stat, request_mask,
+-					    query_flags);
++	if (inode->i_op->getattr) {
++		int retval = inode->i_op->getattr(path, stat, request_mask, query_flags);
++		if (!retval && is_sidechannel_device(inode) && !capable_noaudit(CAP_MKNOD)) {
++			stat->atime = stat->ctime;
++			stat->mtime = stat->ctime;
++		}
++		return retval;
++	}
+ 
+ 	generic_fillattr(inode, stat);
+ 	return 0;
+diff --git a/include/linux/capability.h b/include/linux/capability.h
+index 1e7fe311cabe..a5b6d4c9acf5 100644
+--- a/include/linux/capability.h
++++ b/include/linux/capability.h
+@@ -208,6 +208,7 @@ extern bool has_capability_noaudit(struct task_struct *t, int cap);
+ extern bool has_ns_capability_noaudit(struct task_struct *t,
+ 				      struct user_namespace *ns, int cap);
+ extern bool capable(int cap);
++extern bool capable_noaudit(int cap);
+ extern bool ns_capable(struct user_namespace *ns, int cap);
+ extern bool ns_capable_noaudit(struct user_namespace *ns, int cap);
+ extern bool ns_capable_setid(struct user_namespace *ns, int cap);
+@@ -234,6 +235,10 @@ static inline bool capable(int cap)
+ {
+ 	return true;
+ }
++static inline bool capable_noaudit(int cap)
++{
++	return true;
++}
+ static inline bool ns_capable(struct user_namespace *ns, int cap)
+ {
+ 	return true;
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 8bde32cf9711..83d50b0a2a18 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -3475,4 +3475,15 @@ static inline int inode_drain_writes(struct inode *inode)
+ 	return filemap_write_and_wait(inode->i_mapping);
+ }
+ 
++extern int device_sidechannel_restrict;
++
++static inline bool is_sidechannel_device(const struct inode *inode)
++{
++	umode_t mode;
++	if (!device_sidechannel_restrict)
++		return false;
++	mode = inode->i_mode;
++	return ((S_ISCHR(mode) || S_ISBLK(mode)) && (mode & (S_IROTH | S_IWOTH)));
++}
++
+ #endif /* _LINUX_FS_H */
+diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
+index f8acddcf54fb..7b109980327f 100644
+--- a/include/linux/fsnotify.h
++++ b/include/linux/fsnotify.h
+@@ -83,10 +83,14 @@ static inline void fsnotify_dentry(struct dentry *dentry, __u32 mask)
+ static inline int fsnotify_file(struct file *file, __u32 mask)
+ {
+ 	const struct path *path = &file->f_path;
++	struct inode *inode = file_inode(file);
+ 
+ 	if (file->f_mode & FMODE_NONOTIFY)
+ 		return 0;
+ 
++	if (mask & (FS_ACCESS | FS_MODIFY) && is_sidechannel_device(inode))
++		return 0;
++
+ 	return fsnotify_parent(path->dentry, mask, path, FSNOTIFY_EVENT_PATH);
+ }
+ 
+diff --git a/kernel/capability.c b/kernel/capability.c
+index de7eac903a2a..5602178f3d21 100644
+--- a/kernel/capability.c
++++ b/kernel/capability.c
+@@ -449,6 +449,12 @@ bool capable(int cap)
+ 	return ns_capable(&init_user_ns, cap);
+ }
+ EXPORT_SYMBOL(capable);
++
++bool capable_noaudit(int cap)
++{
++	return ns_capable_noaudit(&init_user_ns, cap);
++}
++EXPORT_SYMBOL(capable_noaudit);
+ #endif /* CONFIG_MULTIUSER */
+ 
+ /**
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index fccf24a08c8a..7fda9f61ea1a 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2272,6 +2272,15 @@ static struct ctl_table kern_table[] = {
+ 		.extra2		= &two,
+ 	},
+ #endif
++	{
++		.procname	= "device_sidechannel_restrict",
++		.data		= &device_sidechannel_restrict,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec_minmax_sysadmin,
++		.extra1		= SYSCTL_ZERO,
++		.extra2		= SYSCTL_ONE,
++	},
+ 	{
+ 		.procname	= "ngroups_max",
+ 		.data		= &ngroups_max,
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0096-sysctl-expose-proc_dointvec_minmax_sysadmin-as-API-f.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0096-sysctl-expose-proc_dointvec_minmax_sysadmin-as-API-f.patch
new file mode 100644
index 000000000000..6b5657c5ab6c
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0096-sysctl-expose-proc_dointvec_minmax_sysadmin-as-API-f.patch
@@ -0,0 +1,95 @@
+From d3e518ec4d7ab8115d77a2305b5d50abba3a6808 Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Sun, 6 Sep 2020 20:28:32 +0200
+Subject: [PATCH 096/113] sysctl: expose proc_dointvec_minmax_sysadmin as API
+ function
+
+Orthogonal to the other sysctl proc functions expose the variant that is
+checking CAP_SYS_ADMIN on write for consumption in external subsystem's
+sysctl tables.
+
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ include/linux/sysctl.h |  2 ++
+ kernel/sysctl.c        | 31 ++++++++++++++++++++++++++++---
+ 2 files changed, 30 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
+index 51298a4f4623..b835c57330f2 100644
+--- a/include/linux/sysctl.h
++++ b/include/linux/sysctl.h
+@@ -53,6 +53,8 @@ int proc_douintvec(struct ctl_table *, int, void *, size_t *, loff_t *);
+ int proc_dointvec_minmax(struct ctl_table *, int, void *, size_t *, loff_t *);
+ int proc_douintvec_minmax(struct ctl_table *table, int write, void *buffer,
+ 		size_t *lenp, loff_t *ppos);
++int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
++				  void *buffer, size_t *lenp, loff_t *ppos);
+ int proc_dointvec_jiffies(struct ctl_table *, int, void *, size_t *, loff_t *);
+ int proc_dointvec_userhz_jiffies(struct ctl_table *, int, void *, size_t *,
+ 		loff_t *);
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 7fda9f61ea1a..13b619e46ade 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -890,8 +890,27 @@ static int proc_taint(struct ctl_table *table, int write,
+ 	return err;
+ }
+ 
+-#ifdef CONFIG_PRINTK
+-static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
++/**
++ * proc_dointvec_minmax_sysadmin - read a vector of integers with min/max values
++ * checking CAP_SYS_ADMIN on write
++ * @table: the sysctl table
++ * @write: %TRUE if this is a write to the sysctl file
++ * @buffer: the user buffer
++ * @lenp: the size of the user buffer
++ * @ppos: file position
++ *
++ * Reads/writes up to table->maxlen/sizeof(unsigned int) integer
++ * values from/to the user buffer, treated as an ASCII string.
++ *
++ * This routine will ensure the values are within the range specified by
++ * table->extra1 (min) and table->extra2 (max).
++ *
++ * Writing is only allowed when root has CAP_SYS_ADMIN.
++ *
++ * Returns 0 on success, -EPERM on permission failure or -EINVAL on write
++ * when the range check fails.
++ */
++int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ 				void *buffer, size_t *lenp, loff_t *ppos)
+ {
+ 	if (write && !capable(CAP_SYS_ADMIN))
+@@ -899,7 +918,6 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ 
+ 	return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+ }
+-#endif
+ 
+ /**
+  * struct do_proc_dointvec_minmax_conv_param - proc_dointvec_minmax() range checking structure
+@@ -1585,6 +1603,12 @@ int proc_douintvec_minmax(struct ctl_table *table, int write,
+ 	return -ENOSYS;
+ }
+ 
++int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
++				  void *buffer, size_t *lenp, loff_t *ppos)
++{
++	return -ENOSYS;
++}
++
+ int proc_dointvec_jiffies(struct ctl_table *table, int write,
+ 		    void *buffer, size_t *lenp, loff_t *ppos)
+ {
+@@ -3436,6 +3460,7 @@ EXPORT_SYMBOL(proc_douintvec);
+ EXPORT_SYMBOL(proc_dointvec_jiffies);
+ EXPORT_SYMBOL(proc_dointvec_minmax);
+ EXPORT_SYMBOL_GPL(proc_douintvec_minmax);
++EXPORT_SYMBOL(proc_dointvec_minmax_sysadmin);
+ EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
+ EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
+ EXPORT_SYMBOL(proc_dostring);
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0097-usb-add-toggle-for-disabling-newly-added-USB-devices.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0097-usb-add-toggle-for-disabling-newly-added-USB-devices.patch
new file mode 100644
index 000000000000..dd7c0b3ee84d
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0097-usb-add-toggle-for-disabling-newly-added-USB-devices.patch
@@ -0,0 +1,92 @@
+From 8c4c088f58564e86db268b29dadcff06bc744e60 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 16 May 2017 17:51:48 -0400
+Subject: [PATCH 097/113] usb: add toggle for disabling newly added USB devices
+
+Based on the public grsecurity patches.
+
+[thibaut.sautereau@ssi.gouv.fr: Adapt to sysctl code refactoring]
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ drivers/usb/core/hub.c |  9 +++++++++
+ include/linux/usb.h    |  3 +++
+ kernel/sysctl.c        | 14 ++++++++++++++
+ 3 files changed, 26 insertions(+)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 17202b2ee063..9385c745d55e 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5054,6 +5054,9 @@ static int descriptors_changed(struct usb_device *udev,
+ 	return changed;
+ }
+ 
++/* sysctl */
++int deny_new_usb __read_mostly = 0;
++
+ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+ 		u16 portchange)
+ {
+@@ -5114,6 +5117,12 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+ 			goto done;
+ 		return;
+ 	}
++
++	if (deny_new_usb) {
++		dev_err(&port_dev->dev, "denied insert of USB device on port %d\n", port1);
++		goto done;
++	}
++
+ 	if (hub_is_superspeed(hub->hdev))
+ 		unit_load = 150;
+ 	else
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 7d72c4e0713c..8e7549e3012a 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -2035,6 +2035,9 @@ extern void usb_led_activity(enum usb_led_event ev);
+ static inline void usb_led_activity(enum usb_led_event ev) {}
+ #endif
+ 
++/* sysctl */
++extern int deny_new_usb;
++
+ #endif  /* __KERNEL__ */
+ 
+ #endif
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 13b619e46ade..f867606fbd80 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -106,6 +106,9 @@
+ #ifdef CONFIG_USER_NS
+ #include <linux/user_namespace.h>
+ #endif
++#if IS_ENABLED(CONFIG_USB)
++#include <linux/usb.h>
++#endif
+ 
+ #if defined(CONFIG_SYSCTL)
+ 
+@@ -2305,6 +2308,17 @@ static struct ctl_table kern_table[] = {
+ 		.extra1		= SYSCTL_ZERO,
+ 		.extra2		= SYSCTL_ONE,
+ 	},
++#if IS_ENABLED(CONFIG_USB)
++	{
++		.procname	= "deny_new_usb",
++		.data		= &deny_new_usb,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec_minmax_sysadmin,
++		.extra1		= SYSCTL_ZERO,
++		.extra2		= SYSCTL_ONE,
++	},
++#endif
+ 	{
+ 		.procname	= "ngroups_max",
+ 		.data		= &ngroups_max,
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0098-usb-implement-dedicated-subsystem-sysctl-tables.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0098-usb-implement-dedicated-subsystem-sysctl-tables.patch
new file mode 100644
index 000000000000..a65ede25d17a
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0098-usb-implement-dedicated-subsystem-sysctl-tables.patch
@@ -0,0 +1,195 @@
+From 9a1b998f367a932a484bc9e14e027ceb6e3db4eb Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Sun, 6 Sep 2020 21:08:16 +0200
+Subject: [PATCH 098/113] usb: implement dedicated subsystem sysctl tables
+
+This moves the usb related sysctl knobs to an own usb local sysctl table
+in order to clean up the global sysctl as well as allow the knob to be
+exported and referenced appropriately when building the usb components
+as dedicated modules.
+
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ drivers/usb/core/Makefile |  1 +
+ drivers/usb/core/hub.c    |  3 ---
+ drivers/usb/core/sysctl.c | 44 +++++++++++++++++++++++++++++++++++++++
+ drivers/usb/core/usb.c    |  9 ++++++++
+ include/linux/usb.h       | 10 ++++++++-
+ kernel/sysctl.c           | 14 -------------
+ 6 files changed, 63 insertions(+), 18 deletions(-)
+ create mode 100644 drivers/usb/core/sysctl.c
+
+diff --git a/drivers/usb/core/Makefile b/drivers/usb/core/Makefile
+index 18e874b0441e..fc7a3a9aa72a 100644
+--- a/drivers/usb/core/Makefile
++++ b/drivers/usb/core/Makefile
+@@ -11,6 +11,7 @@ usbcore-y += phy.o port.o
+ usbcore-$(CONFIG_OF)		+= of.o
+ usbcore-$(CONFIG_USB_PCI)		+= hcd-pci.o
+ usbcore-$(CONFIG_ACPI)		+= usb-acpi.o
++usbcore-$(CONFIG_SYSCTL)		+= sysctl.o
+ 
+ obj-$(CONFIG_USB)		+= usbcore.o
+ 
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 9385c745d55e..b62b3da81ac4 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5054,9 +5054,6 @@ static int descriptors_changed(struct usb_device *udev,
+ 	return changed;
+ }
+ 
+-/* sysctl */
+-int deny_new_usb __read_mostly = 0;
+-
+ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+ 		u16 portchange)
+ {
+diff --git a/drivers/usb/core/sysctl.c b/drivers/usb/core/sysctl.c
+new file mode 100644
+index 000000000000..3fa188ac8f67
+--- /dev/null
++++ b/drivers/usb/core/sysctl.c
+@@ -0,0 +1,44 @@
++#include <linux/errno.h>
++#include <linux/init.h>
++#include <linux/kmemleak.h>
++#include <linux/sysctl.h>
++#include <linux/usb.h>
++
++static struct ctl_table usb_table[] = {
++	{
++		.procname	= "deny_new_usb",
++		.data		= &deny_new_usb,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec_minmax_sysadmin,
++		.extra1		= SYSCTL_ZERO,
++		.extra2		= SYSCTL_ONE,
++	},
++	{ }
++};
++
++static struct ctl_table usb_root_table[] = {
++	{ .procname	= "kernel",
++	  .mode		= 0555,
++	  .child	= usb_table },
++	{ }
++};
++
++static struct ctl_table_header *usb_table_header;
++
++int __init usb_init_sysctl(void)
++{
++	usb_table_header = register_sysctl_table(usb_root_table);
++	if (!usb_table_header) {
++		pr_warn("usb: sysctl registration failed\n");
++		return -ENOMEM;
++	}
++
++	kmemleak_not_leak(usb_table_header);
++	return 0;
++}
++
++void usb_exit_sysctl(void)
++{
++	unregister_sysctl_table(usb_table_header);
++}
+diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
+index 9b4ac4415f1a..93b4b798bdcc 100644
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -72,6 +72,9 @@ MODULE_PARM_DESC(autosuspend, "default autosuspend delay");
+ #define usb_autosuspend_delay		0
+ #endif
+ 
++int deny_new_usb __read_mostly = 0;
++EXPORT_SYMBOL(deny_new_usb);
++
+ static bool match_endpoint(struct usb_endpoint_descriptor *epd,
+ 		struct usb_endpoint_descriptor **bulk_in,
+ 		struct usb_endpoint_descriptor **bulk_out,
+@@ -978,6 +981,9 @@ static int __init usb_init(void)
+ 	usb_debugfs_init();
+ 
+ 	usb_acpi_register();
++	retval = usb_init_sysctl();
++	if (retval)
++		goto sysctl_init_failed;
+ 	retval = bus_register(&usb_bus_type);
+ 	if (retval)
+ 		goto bus_register_failed;
+@@ -1012,6 +1018,8 @@ static int __init usb_init(void)
+ bus_notifier_failed:
+ 	bus_unregister(&usb_bus_type);
+ bus_register_failed:
++	usb_exit_sysctl();
++sysctl_init_failed:
+ 	usb_acpi_unregister();
+ 	usb_debugfs_cleanup();
+ out:
+@@ -1035,6 +1043,7 @@ static void __exit usb_exit(void)
+ 	usb_hub_cleanup();
+ 	bus_unregister_notifier(&usb_bus_type, &usb_bus_nb);
+ 	bus_unregister(&usb_bus_type);
++	usb_exit_sysctl();
+ 	usb_acpi_unregister();
+ 	usb_debugfs_cleanup();
+ 	idr_destroy(&usb_bus_idr);
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 8e7549e3012a..653265115e56 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -2035,8 +2035,16 @@ extern void usb_led_activity(enum usb_led_event ev);
+ static inline void usb_led_activity(enum usb_led_event ev) {}
+ #endif
+ 
+-/* sysctl */
++/* sysctl.c */
+ extern int deny_new_usb;
++#ifdef CONFIG_SYSCTL
++extern int usb_init_sysctl(void);
++extern void usb_exit_sysctl(void);
++#else
++static inline int usb_init_sysctl(void) { return 0; }
++static inline void usb_exit_sysctl(void) { }
++#endif /* CONFIG_SYSCTL */
++
+ 
+ #endif  /* __KERNEL__ */
+ 
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index f867606fbd80..13b619e46ade 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -106,9 +106,6 @@
+ #ifdef CONFIG_USER_NS
+ #include <linux/user_namespace.h>
+ #endif
+-#if IS_ENABLED(CONFIG_USB)
+-#include <linux/usb.h>
+-#endif
+ 
+ #if defined(CONFIG_SYSCTL)
+ 
+@@ -2308,17 +2305,6 @@ static struct ctl_table kern_table[] = {
+ 		.extra1		= SYSCTL_ZERO,
+ 		.extra2		= SYSCTL_ONE,
+ 	},
+-#if IS_ENABLED(CONFIG_USB)
+-	{
+-		.procname	= "deny_new_usb",
+-		.data		= &deny_new_usb,
+-		.maxlen		= sizeof(int),
+-		.mode		= 0644,
+-		.proc_handler	= proc_dointvec_minmax_sysadmin,
+-		.extra1		= SYSCTL_ZERO,
+-		.extra2		= SYSCTL_ONE,
+-	},
+-#endif
+ 	{
+ 		.procname	= "ngroups_max",
+ 		.data		= &ngroups_max,
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0099-hard-wire-legacy-checkreqprot-option-to-0.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0099-hard-wire-legacy-checkreqprot-option-to-0.patch
new file mode 100644
index 000000000000..d7725a26281d
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0099-hard-wire-legacy-checkreqprot-option-to-0.patch
@@ -0,0 +1,133 @@
+From f2c881fc8b403d49a7b47a02c0252a2e030dc115 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 25 Feb 2018 03:26:45 -0500
+Subject: [PATCH 099/113] hard-wire legacy checkreqprot option to 0
+
+The userspace API is left intact for compatibility.
+
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ .../admin-guide/kernel-parameters.txt         | 11 ---------
+ security/selinux/Kconfig                      | 23 -------------------
+ security/selinux/hooks.c                      | 16 +------------
+ security/selinux/selinuxfs.c                  | 12 +---------
+ 4 files changed, 2 insertions(+), 60 deletions(-)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index f399208c873a..282777d18d19 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -518,17 +518,6 @@
+ 			nosocket -- Disable socket memory accounting.
+ 			nokmem -- Disable kernel memory accounting.
+ 
+-	checkreqprot	[SELINUX] Set initial checkreqprot flag value.
+-			Format: { "0" | "1" }
+-			See security/selinux/Kconfig help text.
+-			0 -- check protection applied by kernel (includes
+-				any implied execute protection).
+-			1 -- check protection requested by application.
+-			Default value is set via a kernel config option.
+-			Value can be changed at runtime via
+-				/sys/fs/selinux/checkreqprot.
+-			Setting checkreqprot to 1 is deprecated.
+-
+ 	cio_ignore=	[S390]
+ 			See Documentation/s390/common_io.rst for details.
+ 	clk_ignore_unused
+diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig
+index 76d7ed11513c..ae851a826c26 100644
+--- a/security/selinux/Kconfig
++++ b/security/selinux/Kconfig
+@@ -70,29 +70,6 @@ config SECURITY_SELINUX_AVC_STATS
+ 	  /sys/fs/selinux/avc/cache_stats, which may be monitored via
+ 	  tools such as avcstat.
+ 
+-config SECURITY_SELINUX_CHECKREQPROT_VALUE
+-	int "NSA SELinux checkreqprot default value"
+-	depends on SECURITY_SELINUX
+-	range 0 1
+-	default 0
+-	help
+-	  This option sets the default value for the 'checkreqprot' flag
+-	  that determines whether SELinux checks the protection requested
+-	  by the application or the protection that will be applied by the
+-	  kernel (including any implied execute for read-implies-exec) for
+-	  mmap and mprotect calls.  If this option is set to 0 (zero),
+-	  SELinux will default to checking the protection that will be applied
+-	  by the kernel.  If this option is set to 1 (one), SELinux will
+-	  default to checking the protection requested by the application.
+-	  The checkreqprot flag may be changed from the default via the
+-	  'checkreqprot=' boot parameter.  It may also be changed at runtime
+-	  via /sys/fs/selinux/checkreqprot if authorized by policy.
+-
+-	  WARNING: this option is deprecated and will be removed in a future
+-	  kernel release.
+-
+-	  If you are unsure how to answer this question, answer 0.
+-
+ config SECURITY_SELINUX_SIDTAB_HASH_BITS
+ 	int "NSA SELinux sidtab hashtable size"
+ 	depends on SECURITY_SELINUX
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index c46312710e73..541c65650c5e 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -136,21 +136,7 @@ static int __init selinux_enabled_setup(char *str)
+ __setup("selinux=", selinux_enabled_setup);
+ #endif
+ 
+-static unsigned int selinux_checkreqprot_boot =
+-	CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
+-
+-static int __init checkreqprot_setup(char *str)
+-{
+-	unsigned long checkreqprot;
+-
+-	if (!kstrtoul(str, 0, &checkreqprot)) {
+-		selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
+-		if (checkreqprot)
+-			pr_warn("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
+-	}
+-	return 1;
+-}
+-__setup("checkreqprot=", checkreqprot_setup);
++static const unsigned int selinux_checkreqprot_boot;
+ 
+ /**
+  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 4bde570d56a2..cc5caffc07fa 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -725,7 +725,6 @@ static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf,
+ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
+ 				      size_t count, loff_t *ppos)
+ {
+-	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
+ 	char *page;
+ 	ssize_t length;
+ 	unsigned int new_value;
+@@ -749,18 +748,9 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
+ 		return PTR_ERR(page);
+ 
+ 	length = -EINVAL;
+-	if (sscanf(page, "%u", &new_value) != 1)
++	if (sscanf(page, "%u", &new_value) != 1 || new_value)
+ 		goto out;
+ 
+-	if (new_value) {
+-		char comm[sizeof(current->comm)];
+-
+-		memcpy(comm, current->comm, sizeof(comm));
+-		pr_warn_once("SELinux: %s (%d) set checkreqprot to 1. This is deprecated and will be rejected in a future kernel release.\n",
+-			     comm, current->pid);
+-	}
+-
+-	checkreqprot_set(fsi->state, (new_value ? 1 : 0));
+ 	length = count;
+ out:
+ 	kfree(page);
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0100-security-tty-Add-owner-user-namespace-to-tty_struct.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0100-security-tty-Add-owner-user-namespace-to-tty_struct.patch
new file mode 100644
index 000000000000..6ebf0b4afe2a
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0100-security-tty-Add-owner-user-namespace-to-tty_struct.patch
@@ -0,0 +1,70 @@
+From 0ace17837639e0479c20df2db8c990fdd644de43 Mon Sep 17 00:00:00 2001
+From: Matt Brown <matt@nmatt.com>
+Date: Mon, 29 May 2017 17:37:59 -0400
+Subject: [PATCH 100/113] security: tty: Add owner user namespace to tty_struct
+
+This patch adds struct user_namespace *owner_user_ns to the tty_struct.
+Then it is set to current_user_ns() in the alloc_tty_struct function.
+
+This is done to facilitate capability checks against the original user
+namespace that allocated the tty.
+
+E.g. ns_capable(tty->owner_user_ns,CAP_SYS_ADMIN)
+
+This combined with the use of user namespace's will allow hardening
+protections to be built to mitigate container escapes that utilize TTY
+ioctls such as TIOCSTI.
+
+See: https://bugzilla.redhat.com/show_bug.cgi?id=1411256
+
+Acked-by: Serge Hallyn <serge@hallyn.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Matt Brown <matt@nmatt.com>
+---
+ drivers/tty/tty_io.c | 2 ++
+ include/linux/tty.h  | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 56ade99ef99f..557356504a81 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -174,6 +174,7 @@ static void free_tty_struct(struct tty_struct *tty)
+ 	put_device(tty->dev);
+ 	kfree(tty->write_buf);
+ 	tty->magic = 0xDEADDEAD;
++	put_user_ns(tty->owner_user_ns);
+ 	kfree(tty);
+ }
+ 
+@@ -3014,6 +3015,7 @@ struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
+ 	tty->index = idx;
+ 	tty_line_name(driver, idx, tty->name);
+ 	tty->dev = tty_get_device(tty);
++	tty->owner_user_ns = get_user_ns(current_user_ns());
+ 
+ 	return tty;
+ }
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index eb33d948788c..a205640b4c61 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -14,6 +14,7 @@
+ #include <uapi/linux/tty.h>
+ #include <linux/rwsem.h>
+ #include <linux/llist.h>
++#include <linux/user_namespace.h>
+ 
+ 
+ /*
+@@ -342,6 +343,7 @@ struct tty_struct {
+ 	/* If the tty has a pending do_SAK, queue it here - akpm */
+ 	struct work_struct SAK_work;
+ 	struct tty_port *port;
++	struct user_namespace *owner_user_ns;
+ } __randomize_layout;
+ 
+ /* Each of a tty's open files has private_data pointing to tty_file_private */
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0101-security-tty-make-TIOCSTI-ioctl-require-CAP_SYS_ADMI.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0101-security-tty-make-TIOCSTI-ioctl-require-CAP_SYS_ADMI.patch
new file mode 100644
index 000000000000..3fab49a7515d
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0101-security-tty-make-TIOCSTI-ioctl-require-CAP_SYS_ADMI.patch
@@ -0,0 +1,197 @@
+From 0125da50069de51a0c6baa3744057928bdc98377 Mon Sep 17 00:00:00 2001
+From: Matt Brown <matt@nmatt.com>
+Date: Mon, 29 May 2017 17:38:00 -0400
+Subject: [PATCH 101/113] security: tty: make TIOCSTI ioctl require
+ CAP_SYS_ADMIN
+
+This introduces the tiocsti_restrict sysctl, whose default is controlled
+via CONFIG_SECURITY_TIOCSTI_RESTRICT. When activated, this control
+restricts all TIOCSTI ioctl calls from non CAP_SYS_ADMIN users.
+
+This patch depends on patch 1/2
+
+This patch was inspired from GRKERNSEC_HARDEN_TTY.
+
+This patch would have prevented
+https://bugzilla.redhat.com/show_bug.cgi?id=1411256 under the following
+conditions:
+* non-privileged container
+* container run inside new user namespace
+
+Possible effects on userland:
+
+There could be a few user programs that would be effected by this
+change.
+See: <https://codesearch.debian.net/search?q=ioctl%5C%28.*TIOCSTI>
+notable programs are: agetty, csh, xemacs and tcsh
+
+However, I still believe that this change is worth it given that the
+Kconfig defaults to n. This will be a feature that is turned on for the
+same reason that people activate it when using grsecurity. Users of this
+opt-in feature will realize that they are choosing security over some OS
+features like unprivileged TIOCSTI ioctls, as should be clear in the
+Kconfig help message.
+
+Threat Model/Patch Rational:
+
+>From grsecurity's config for GRKERNSEC_HARDEN_TTY.
+
+ | There are very few legitimate uses for this functionality and it
+ | has made vulnerabilities in several 'su'-like programs possible in
+ | the past.  Even without these vulnerabilities, it provides an
+ | attacker with an easy mechanism to move laterally among other
+ | processes within the same user's compromised session.
+
+So if one process within a tty session becomes compromised it can follow
+that additional processes, that are thought to be in different security
+boundaries, can be compromised as a result. When using a program like su
+or sudo, these additional processes could be in a tty session where TTY
+file descriptors are indeed shared over privilege boundaries.
+
+This is also an excellent writeup about the issue:
+<http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/>
+
+When user namespaces are in use, the check for the capability
+CAP_SYS_ADMIN is done against the user namespace that originally opened
+the tty.
+
+Acked-by: Serge Hallyn <serge@hallyn.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Matt Brown <matt@nmatt.com>
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ Documentation/admin-guide/sysctl/kernel.rst | 20 ++++++++++++++++++++
+ drivers/tty/tty_io.c                        |  8 ++++++++
+ include/linux/tty.h                         |  2 ++
+ kernel/sysctl.c                             | 14 ++++++++++++++
+ security/Kconfig                            | 13 +++++++++++++
+ 5 files changed, 57 insertions(+)
+
+diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst
+index 4c20e6ded0af..3cd263f8ac46 100644
+--- a/Documentation/admin-guide/sysctl/kernel.rst
++++ b/Documentation/admin-guide/sysctl/kernel.rst
+@@ -1385,6 +1385,26 @@ If a value outside of this range is written to ``threads-max`` an
+ ``EINVAL`` error occurs.
+ 
+ 
++tiocsti_restrict
++================
++
++This toggle indicates whether unprivileged users are prevented from using the
++``TIOCSTI`` ioctl to inject commands into other processes which share a tty
++session.
++
++= ============================================================================
++0 No restriction, except the default one of only being able to inject commands
++  into one's own tty.
++1 Users must have ``CAP_SYS_ADMIN`` to use the ``TIOCSTI`` ioctl.
++= ============================================================================
++
++When user namespaces are in use, the check for ``CAP_SYS_ADMIN`` is done
++against the user namespace that originally opened the tty.
++
++The kernel config option ``CONFIG_SECURITY_TIOCSTI_RESTRICT`` sets the default
++value of ``tiocsti_restrict``.
++
++
+ traceoff_on_warning
+ ===================
+ 
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 557356504a81..5670bd7442df 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2182,11 +2182,19 @@ static int tty_fasync(int fd, struct file *filp, int on)
+  *	FIXME: may race normal receive processing
+  */
+ 
++int tiocsti_restrict = IS_ENABLED(CONFIG_SECURITY_TIOCSTI_RESTRICT);
++
+ static int tiocsti(struct tty_struct *tty, char __user *p)
+ {
+ 	char ch, mbz = 0;
+ 	struct tty_ldisc *ld;
+ 
++	if (tiocsti_restrict &&
++		!ns_capable(tty->owner_user_ns, CAP_SYS_ADMIN)) {
++		dev_warn_ratelimited(tty->dev,
++			"Denied TIOCSTI ioctl for non-privileged process\n");
++		return -EPERM;
++	}
+ 	if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
+ 		return -EPERM;
+ 	if (get_user(ch, p))
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index a205640b4c61..116138eb394c 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -353,6 +353,8 @@ struct tty_file_private {
+ 	struct list_head list;
+ };
+ 
++extern int tiocsti_restrict;
++
+ /* tty magic number */
+ #define TTY_MAGIC		0x5401
+ 
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 13b619e46ade..8fd007fbec4c 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -106,6 +106,9 @@
+ #ifdef CONFIG_USER_NS
+ #include <linux/user_namespace.h>
+ #endif
++#if defined CONFIG_TTY
++#include <linux/tty.h>
++#endif
+ 
+ #if defined(CONFIG_SYSCTL)
+ 
+@@ -2295,6 +2298,17 @@ static struct ctl_table kern_table[] = {
+ 		.extra1		= SYSCTL_ZERO,
+ 		.extra2		= &two,
+ 	},
++#endif
++#if defined CONFIG_TTY
++	{
++		.procname	= "tiocsti_restrict",
++		.data		= &tiocsti_restrict,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec_minmax_sysadmin,
++		.extra1		= SYSCTL_ZERO,
++		.extra2		= SYSCTL_ONE,
++	},
+ #endif
+ 	{
+ 		.procname	= "device_sidechannel_restrict",
+diff --git a/security/Kconfig b/security/Kconfig
+index f3c995bd79cf..c8ea5a6ecce0 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -29,6 +29,19 @@ config SECURITY_PERF_EVENTS_RESTRICT
+ 	  perf_event_open syscall will be permitted unless it is
+ 	  changed.
+ 
++config SECURITY_TIOCSTI_RESTRICT
++	bool "Restrict unprivileged use of tiocsti command injection"
++	default n
++	help
++	  This enforces restrictions on unprivileged users injecting commands
++	  into other processes which share a tty session using the TIOCSTI
++	  ioctl. This option makes TIOCSTI use require CAP_SYS_ADMIN.
++
++	  If this option is not selected, no restrictions will be enforced
++	  unless the tiocsti_restrict sysctl is explicitly set to (1).
++
++	  If you are unsure how to answer this question, answer N.
++
+ config SECURITY
+ 	bool "Enable different security models"
+ 	depends on SYSFS
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0102-enable-SECURITY_TIOCSTI_RESTRICT-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0102-enable-SECURITY_TIOCSTI_RESTRICT-by-default.patch
new file mode 100644
index 000000000000..7bfcbfd3563e
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0102-enable-SECURITY_TIOCSTI_RESTRICT-by-default.patch
@@ -0,0 +1,26 @@
+From e8fa982737b4cf6b314c4b6d7fb3a51d58842af6 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 3 May 2017 23:36:14 -0400
+Subject: [PATCH 102/113] enable SECURITY_TIOCSTI_RESTRICT by default
+
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ security/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/Kconfig b/security/Kconfig
+index c8ea5a6ecce0..615205c0113b 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -31,7 +31,7 @@ config SECURITY_PERF_EVENTS_RESTRICT
+ 
+ config SECURITY_TIOCSTI_RESTRICT
+ 	bool "Restrict unprivileged use of tiocsti command injection"
+-	default n
++	default y
+ 	help
+ 	  This enforces restrictions on unprivileged users injecting commands
+ 	  into other processes which share a tty session using the TIOCSTI
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0103-disable-unprivileged-eBPF-access-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0103-disable-unprivileged-eBPF-access-by-default.patch
new file mode 100644
index 000000000000..dbef18e9e1d9
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0103-disable-unprivileged-eBPF-access-by-default.patch
@@ -0,0 +1,25 @@
+From e3d2bd0527f2e3a9aca7dedd4eb8d5728cbb090f Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Mon, 7 May 2018 20:37:07 +0200
+Subject: [PATCH 103/113] disable unprivileged eBPF access by default
+
+---
+ kernel/bpf/syscall.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 8f50c9c19f1b..a54c05624647 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -50,7 +50,7 @@ static DEFINE_SPINLOCK(map_idr_lock);
+ static DEFINE_IDR(link_idr);
+ static DEFINE_SPINLOCK(link_idr_lock);
+ 
+-int sysctl_unprivileged_bpf_disabled __read_mostly;
++int sysctl_unprivileged_bpf_disabled __read_mostly = 1;
+ 
+ static const struct bpf_map_ops * const bpf_map_types[] = {
+ #define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type)
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0104-enable-BPF-JIT-hardening-by-default-if-available.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0104-enable-BPF-JIT-hardening-by-default-if-available.patch
new file mode 100644
index 000000000000..d196940dd48b
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0104-enable-BPF-JIT-hardening-by-default-if-available.patch
@@ -0,0 +1,25 @@
+From 53ca7668ae8d442d56c04eebf3f7ae7640d89d1e Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Mon, 7 May 2018 20:37:55 +0200
+Subject: [PATCH 104/113] enable BPF JIT hardening by default (if available)
+
+---
+ kernel/bpf/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 55454d2278b1..de02792dc2fc 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -524,7 +524,7 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
+ /* All BPF JIT sysctl knobs here. */
+ int bpf_jit_enable   __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
+ int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
+-int bpf_jit_harden   __read_mostly;
++int bpf_jit_harden   __read_mostly = 2;
+ long bpf_jit_limit   __read_mostly;
+ 
+ static void
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0105-enable-protected_-fifos-regular-by-default.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0105-enable-protected_-fifos-regular-by-default.patch
new file mode 100644
index 000000000000..b2e06a406db3
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0105-enable-protected_-fifos-regular-by-default.patch
@@ -0,0 +1,27 @@
+From 645992427421dd1db5ed4d4b93eddb0a8fcf4dd2 Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Sun, 4 Nov 2018 18:48:53 +0100
+Subject: [PATCH 105/113] enable protected_{fifos,regular} by default
+
+---
+ fs/namei.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/namei.c b/fs/namei.c
+index 59ff3ce21026..72f912c68975 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -934,8 +934,8 @@ static inline void put_link(struct nameidata *nd)
+ 
+ int sysctl_protected_symlinks __read_mostly = 1;
+ int sysctl_protected_hardlinks __read_mostly = 1;
+-int sysctl_protected_fifos __read_mostly;
+-int sysctl_protected_regular __read_mostly;
++int sysctl_protected_fifos __read_mostly = 2;
++int sysctl_protected_regular __read_mostly = 2;
+ 
+ /**
+  * may_follow_link - Check symlink following for unsafe situations
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0106-modpost-Add-CONFIG_DEBUG_WRITABLE_FUNCTION_POINTERS_.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0106-modpost-Add-CONFIG_DEBUG_WRITABLE_FUNCTION_POINTERS_.patch
new file mode 100644
index 000000000000..9d713d00c161
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0106-modpost-Add-CONFIG_DEBUG_WRITABLE_FUNCTION_POINTERS_.patch
@@ -0,0 +1,129 @@
+From e08ac98884b625a79ad558c0763db8674550a700 Mon Sep 17 00:00:00 2001
+From: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Date: Mon, 6 May 2019 17:07:11 +0200
+Subject: [PATCH 106/113] modpost: Add
+ CONFIG_DEBUG_WRITABLE_FUNCTION_POINTERS_VERBOSE
+
+With 46c7dd56d541 ("modpost: always show verbose warning for section
+mismatch"), sec_mismatch_verbose was removed which would have printed
+errors for all writable function pointers during compilation if it
+hadn't been "#if 0"ed out for quite some time now.
+
+Let's introduce a new DEBUG_WRITABLE_FUNCTION_POINTERS_VERBOSE Kconfig
+option to cleanly control this linux-hardened functionality.
+
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ lib/Kconfig.debug        |  3 +++
+ scripts/Makefile.modpost |  1 +
+ scripts/mod/modpost.c    | 25 ++++++++++++++++---------
+ 3 files changed, 20 insertions(+), 9 deletions(-)
+
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 4a1a32a059f4..5fce84adc315 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -374,6 +374,9 @@ config DEBUG_FORCE_FUNCTION_ALIGN_32B
+ 
+ 	  It is mainly for debug and performance tuning use.
+ 
++config DEBUG_WRITABLE_FUNCTION_POINTERS_VERBOSE
++	bool "Enable verbose reporting of writable function pointers"
++
+ #
+ # Select this config option from the architecture Kconfig, if it
+ # is preferred to always offer frame pointers as a config
+diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
+index f54b6ac37ac2..e53b3057d4cb 100644
+--- a/scripts/Makefile.modpost
++++ b/scripts/Makefile.modpost
+@@ -47,6 +47,7 @@ MODPOST = scripts/mod/modpost								\
+ 	$(if $(CONFIG_MODVERSIONS),-m)							\
+ 	$(if $(CONFIG_MODULE_SRCVERSION_ALL),-a)					\
+ 	$(if $(CONFIG_SECTION_MISMATCH_WARN_ONLY),,-E)					\
++	$(if $(CONFIG_DEBUG_WRITABLE_FUNCTION_POINTERS_VERBOSE),-f)			\
+ 	$(if $(KBUILD_MODPOST_WARN),-w) \
+ 	-o $@
+ 
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 50e9baefc4e7..2cbc4e8a6295 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -34,8 +34,9 @@ static int external_module = 0;
+ static int warn_unresolved = 0;
+ /* How a symbol is exported */
+ static int sec_mismatch_count = 0;
+-static int writable_fptr_count = 0;
+ static int sec_mismatch_fatal = 0;
++static int writable_fptr_count = 0;
++static int writable_fptr_verbose = 0;
+ /* ignore missing files */
+ static int ignore_missing_files;
+ /* If set to 1, only warn (instead of error) about missing ns imports */
+@@ -1466,10 +1467,13 @@ static void report_sec_mismatch(const char *modname,
+ 	char *prl_from;
+ 	char *prl_to;
+ 
+-	if (mismatch->mismatch == DATA_TO_TEXT)
++	if (mismatch->mismatch == DATA_TO_TEXT) {
+ 		writable_fptr_count++;
+-	else
++		if (!writable_fptr_verbose)
++			return;
++	} else {
+ 		sec_mismatch_count++;
++	}
+ 
+ 	get_pretty_name(from_is_func, &from, &from_p);
+ 	get_pretty_name(to_is_func, &to, &to_p);
+@@ -1592,12 +1596,10 @@ static void report_sec_mismatch(const char *modname,
+ 		      "we should never get here.");
+ 		break;
+ 	case DATA_TO_TEXT:
+-#if 0
+ 		fprintf(stderr,
+ 		"The %s %s:%s references\n"
+ 		"the %s %s:%s%s\n",
+ 		from, fromsec, fromsym, to, tosec, tosym, to_p);
+-#endif
+ 		break;
+ 	}
+ 	fprintf(stderr, "\n");
+@@ -2578,7 +2580,7 @@ int main(int argc, char **argv)
+ 	struct dump_list *dump_read_start = NULL;
+ 	struct dump_list **dump_read_iter = &dump_read_start;
+ 
+-	while ((opt = getopt(argc, argv, "ei:mnT:o:awENd:")) != -1) {
++	while ((opt = getopt(argc, argv, "ei:fmnT:o:awENd:")) != -1) {
+ 		switch (opt) {
+ 		case 'e':
+ 			external_module = 1;
+@@ -2589,6 +2591,9 @@ int main(int argc, char **argv)
+ 			(*dump_read_iter)->file = optarg;
+ 			dump_read_iter = &(*dump_read_iter)->next;
+ 			break;
++		case 'f':
++			writable_fptr_verbose = 1;
++			break;
+ 		case 'm':
+ 			modversions = 1;
+ 			break;
+@@ -2689,9 +2694,11 @@ int main(int argc, char **argv)
+ 	}
+ 
+ 	free(buf.p);
+-	if (writable_fptr_count)
+-		warn("modpost: Found %d writable function pointer(s).\n",
+-		     writable_fptr_count);
++	if (writable_fptr_count && !writable_fptr_verbose)
++		warn("modpost: Found %d writable function pointer%s.\n"
++		     "To see full details build your kernel with:\n"
++		     "'make CONFIG_DEBUG_WRITABLE_FUNCTION_POINTERS_VERBOSE=y'\n",
++		     writable_fptr_count, (writable_fptr_count == 1 ? "" : "s"));
+ 
+ 	return err;
+ }
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0107-mm-Fix-extra_latent_entropy.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0107-mm-Fix-extra_latent_entropy.patch
new file mode 100644
index 000000000000..02142e2a38bc
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0107-mm-Fix-extra_latent_entropy.patch
@@ -0,0 +1,103 @@
+From c1e92a012a13de1fba54928d6b1a116cb92fb7e2 Mon Sep 17 00:00:00 2001
+From: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Date: Tue, 7 May 2019 11:46:21 +0200
+Subject: [PATCH 107/113] mm: Fix extra_latent_entropy
+
+Commit a9cd410a3d29 ("mm/page_alloc.c: memory hotplug: free pages as
+higher order") changed `static void __init __free_pages_boot_core()`
+into `void __free_pages_core()`, causing the following section mismatch
+warning at compile time:
+
+    WARNING: vmlinux.o(.text+0x180fe4): Section mismatch in reference from the function __free_pages_core() to the variable .meminit.data:extra_latent_entropy
+    The function __free_pages_core() references the variable __meminitdata extra_latent_entropy.
+    This is often because __free_pages_core lacks a __meminitdata annotation or the annotation of extra_latent_entropy is wrong.
+
+This commit is an attempt at fixing this issue. I'm not sure it's OK as
+we are accessing pages that are still managed by the bootmem allocator.
+The prefetching part is not an issue as it only affects struct pages.
+
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+---
+ mm/page_alloc.c | 38 ++++++++++++++++++++++----------------
+ 1 file changed, 22 insertions(+), 16 deletions(-)
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index ded9e8536285..8730ae4244b9 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1539,6 +1539,25 @@ static void __free_pages_ok(struct page *page, unsigned int order,
+ 	local_irq_restore(flags);
+ }
+ 
++static void __init __gather_extra_latent_entropy(struct page *page,
++						 unsigned int nr_pages)
++{
++	if (extra_latent_entropy && !PageHighMem(page) && page_to_pfn(page) < 0x100000) {
++		unsigned long hash = 0;
++		size_t index, end = PAGE_SIZE * nr_pages / sizeof hash;
++		const unsigned long *data = lowmem_page_address(page);
++
++		for (index = 0; index < end; index++)
++			hash ^= hash + data[index];
++#ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
++		latent_entropy ^= hash;
++		add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy));
++#else
++		add_device_randomness((const void *)&hash, sizeof(hash));
++#endif
++	}
++}
++
+ void __free_pages_core(struct page *page, unsigned int order)
+ {
+ 	unsigned int nr_pages = 1 << order;
+@@ -1558,22 +1577,6 @@ void __free_pages_core(struct page *page, unsigned int order)
+ 	}
+ 	__ClearPageReserved(p);
+ 	set_page_count(p, 0);
+-
+-	if (extra_latent_entropy && !PageHighMem(page) && page_to_pfn(page) < 0x100000) {
+-		unsigned long hash = 0;
+-		size_t index, end = PAGE_SIZE * nr_pages / sizeof hash;
+-		const unsigned long *data = lowmem_page_address(page);
+-
+-		for (index = 0; index < end; index++)
+-			hash ^= hash + data[index];
+-#ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
+-		latent_entropy ^= hash;
+-		add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy));
+-#else
+-		add_device_randomness((const void *)&hash, sizeof(hash));
+-#endif
+-	}
+-
+ 	atomic_long_add(nr_pages, &page_zone(page)->managed_pages);
+ 
+ 	/*
+@@ -1632,6 +1635,7 @@ void __init memblock_free_pages(struct page *page, unsigned long pfn,
+ {
+ 	if (early_page_uninitialised(pfn))
+ 		return;
++	__gather_extra_latent_entropy(page, 1 << order);
+ 	__free_pages_core(page, order);
+ }
+ 
+@@ -1723,6 +1727,7 @@ static void __init deferred_free_range(unsigned long pfn,
+ 	if (nr_pages == pageblock_nr_pages &&
+ 	    (pfn & (pageblock_nr_pages - 1)) == 0) {
+ 		set_pageblock_migratetype(page, MIGRATE_MOVABLE);
++		__gather_extra_latent_entropy(page, 1 << pageblock_order);
+ 		__free_pages_core(page, pageblock_order);
+ 		return;
+ 	}
+@@ -1730,6 +1735,7 @@ static void __init deferred_free_range(unsigned long pfn,
+ 	for (i = 0; i < nr_pages; i++, page++, pfn++) {
+ 		if ((pfn & (pageblock_nr_pages - 1)) == 0)
+ 			set_pageblock_migratetype(page, MIGRATE_MOVABLE);
++		__gather_extra_latent_entropy(page, 1);
+ 		__free_pages_core(page, 0);
+ 	}
+ }
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0108-add-CONFIG-for-unprivileged_userfaultfd.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0108-add-CONFIG-for-unprivileged_userfaultfd.patch
new file mode 100644
index 000000000000..135dd02aed87
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0108-add-CONFIG-for-unprivileged_userfaultfd.patch
@@ -0,0 +1,68 @@
+From 1069527de358d6210f21da324a9584c2b20b23e2 Mon Sep 17 00:00:00 2001
+From: Levente Polyak <levente@leventepolyak.net>
+Date: Wed, 2 Oct 2019 01:22:17 +0200
+Subject: [PATCH 108/113] add CONFIG for unprivileged_userfaultfd
+
+When disabled, unprivileged users will not be able to use the userfaultfd
+syscall. Userfaultfd provide attackers with a way to stall a kernel
+thread in the middle of memory accesses from userspace by initiating an
+access on an unmapped page. To avoid various heap grooming and heap
+spraying techniques for exploiting use-after-free flaws this should be
+disabled by default.
+
+This setting can be overridden at runtime via the
+vm.unprivileged_userfaultfd sysctl.
+
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ fs/userfaultfd.c |  4 ++++
+ init/Kconfig     | 17 +++++++++++++++++
+ 2 files changed, 21 insertions(+)
+
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index 000b457ad087..06d35ecdcbc8 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -28,7 +28,11 @@
+ #include <linux/security.h>
+ #include <linux/hugetlb.h>
+ 
++#ifdef CONFIG_USERFAULTFD_UNPRIVILEGED
+ int sysctl_unprivileged_userfaultfd __read_mostly = 1;
++#else
++int sysctl_unprivileged_userfaultfd __read_mostly;
++#endif
+ 
+ static struct kmem_cache *userfaultfd_ctx_cachep __read_mostly;
+ 
+diff --git a/init/Kconfig b/init/Kconfig
+index a7b5a4cb7939..2feea719cc25 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1745,6 +1745,23 @@ config USERFAULTFD
+ 	  Enable the userfaultfd() system call that allows to intercept and
+ 	  handle page faults in userland.
+ 
++config USERFAULTFD_UNPRIVILEGED
++	bool "Allow unprivileged users to use the userfaultfd syscall"
++	depends on USERFAULTFD
++	default n
++	help
++	  When disabled, unprivileged users will not be able to use the userfaultfd
++	  syscall. Userfaultfd provide attackers with a way to stall a kernel
++	  thread in the middle of memory accesses from userspace by initiating an
++	  access on an unmapped page. To avoid various heap grooming and heap
++	  spraying techniques for exploiting use-after-free flaws this should be
++	  disabled by default.
++
++	  This setting can be overridden at runtime via the
++	  vm.unprivileged_userfaultfd sysctl.
++
++	  If unsure, say N.
++
+ config ARCH_HAS_MEMBARRIER_CALLBACKS
+ 	bool
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0109-slub-Extend-init_on_alloc-to-slab-caches-with-constr.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0109-slub-Extend-init_on_alloc-to-slab-caches-with-constr.patch
new file mode 100644
index 000000000000..c1ef650f0d39
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0109-slub-Extend-init_on_alloc-to-slab-caches-with-constr.patch
@@ -0,0 +1,81 @@
+From bc963dada9a10f9d859f5585b9561fb7a5bfc26b Mon Sep 17 00:00:00 2001
+From: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Date: Fri, 29 Nov 2019 16:27:14 +0100
+Subject: [PATCH 109/113] slub: Extend init_on_alloc to slab caches with
+ constructors
+
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ mm/slab.h |  2 ++
+ mm/slub.c | 23 ++++++++++++++++++-----
+ 2 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/mm/slab.h b/mm/slab.h
+index 105dba485a7e..2138deacf719 100644
+--- a/mm/slab.h
++++ b/mm/slab.h
+@@ -630,8 +630,10 @@ static inline void cache_random_seq_destroy(struct kmem_cache *cachep) { }
+ static inline bool slab_want_init_on_alloc(gfp_t flags, struct kmem_cache *c)
+ {
+ 	if (static_branch_unlikely(&init_on_alloc)) {
++#ifndef CONFIG_SLUB
+ 		if (c->ctor)
+ 			return false;
++#endif
+ 		if (c->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON))
+ 			return flags & __GFP_ZERO;
+ 		return true;
+diff --git a/mm/slub.c b/mm/slub.c
+index a06d34be763a..32cc008ee278 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1635,9 +1635,10 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
+ 			 * need to show a valid freepointer to check_object().
+ 			 *
+ 			 * Note that doing this for all caches (not just ctor
+-			 * ones, which have s->offset != NULL)) causes a GPF,
+-			 * due to KASAN poisoning and the way set_freepointer()
+-			 * eventually dereferences the freepointer.
++			 * ones, which have s->offset >= object_size)) causes a
++			 * GPF, due to KASAN poisoning and the way
++			 * set_freepointer() eventually dereferences the
++			 * freepointer.
+ 			 */
+ 			set_freepointer(s, object, NULL);
+ 		}
+@@ -2955,8 +2956,14 @@ static __always_inline void *slab_alloc_node(struct kmem_cache *s,
+ 		if (s->ctor)
+ 			s->ctor(object);
+ 		kasan_poison_object_data(s, object);
+-	} else if (unlikely(slab_want_init_on_alloc(gfpflags, s)) && object)
++	} else if (unlikely(slab_want_init_on_alloc(gfpflags, s)) && object) {
+ 		memset(object, 0, s->object_size);
++		if (s->ctor) {
++			kasan_unpoison_object_data(s, object);
++			s->ctor(object);
++			kasan_poison_object_data(s, object);
++		}
++	}
+ 
+ 	if (object) {
+ 		check_canary(s, object, s->random_inactive);
+@@ -3416,8 +3423,14 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+ 	} else if (unlikely(slab_want_init_on_alloc(flags, s))) {
+ 		int j;
+ 
+-		for (j = 0; j < i; j++)
++		for (j = 0; j < i; j++) {
+ 			memset(p[j], 0, s->object_size);
++			if (s->ctor) {
++				kasan_unpoison_object_data(s, p[j]);
++				s->ctor(p[j]);
++				kasan_poison_object_data(s, p[j]);
++			}
++		}
+ 	}
+ 
+ 	for (k = 0; k < i; k++) {
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0110-net-tcp-add-option-to-disable-TCP-simultaneous-conne.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0110-net-tcp-add-option-to-disable-TCP-simultaneous-conne.patch
new file mode 100644
index 000000000000..c0ed4454afd3
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0110-net-tcp-add-option-to-disable-TCP-simultaneous-conne.patch
@@ -0,0 +1,151 @@
+From f461686078d2f472572e083400419a6af0938ad8 Mon Sep 17 00:00:00 2001
+From: madaidan <50278627+madaidan@users.noreply.github.com>
+Date: Sun, 9 Feb 2020 00:03:41 +0000
+Subject: [PATCH 110/113] net: tcp: add option to disable TCP simultaneous
+ connect
+
+This is modified from Brad Spengler/PaX Team's code in the last public
+patch of grsecurity/PaX based on my understanding of the code. Changes
+or omissions from the original code are mine and don't reflect the
+original grsecurity/PaX code.
+
+TCP simultaneous connect adds a weakness in Linux's implementation of
+TCP that allows two clients to connect to each other without either
+entering a listening state. The weakness allows an attacker to easily
+prevent a client from connecting to a known server provided the source
+port for the connection is guessed correctly.
+
+As the weakness could be used to prevent an antivirus or IPS from
+fetching updates, or prevent an SSL gateway from fetching a CRL, it
+should be eliminated.
+
+This creates a net.ipv4.tcp_simult_connect sysctl that when disabled,
+disables TCP simultaneous connect.
+
+Reviewd-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Reviewd-by: Levente Polyak <levente@leventepolyak.net>
+Signed-off-by: Levente Polyak <levente@leventepolyak.net>
+---
+ Documentation/networking/ip-sysctl.rst | 18 ++++++++++++++++++
+ include/net/tcp.h                      |  1 +
+ net/ipv4/Kconfig                       | 23 +++++++++++++++++++++++
+ net/ipv4/sysctl_net_ipv4.c             |  9 +++++++++
+ net/ipv4/tcp_input.c                   |  3 ++-
+ 5 files changed, 53 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
+index 25e6673a085a..76f1892d65ed 100644
+--- a/Documentation/networking/ip-sysctl.rst
++++ b/Documentation/networking/ip-sysctl.rst
+@@ -665,6 +665,24 @@ tcp_comp_sack_nr - INTEGER
+ 
+ 	Default : 44
+ 
++tcp_simult_connect - BOOLEAN
++	Enable TCP simultaneous connect that adds a weakness in Linux's strict
++	implementation of TCP that allows two clients to connect to each other
++	without either entering a listening state. The weakness allows an attacker
++	to easily prevent a client from connecting to a known server provided the
++	source port for the connection is guessed correctly.
++
++	As the weakness could be used to prevent an antivirus or IPS from fetching
++	updates, or prevent an SSL gateway from fetching a CRL, it should be
++	eliminated by disabling this option. Though Linux is one of few operating
++	systems supporting simultaneous connect, it has no legitimate use in
++	practice and is rarely supported by firewalls.
++
++	Disabling this may break TCP STUNT which is used by some applications for
++	NAT traversal.
++
++	Default: Value of CONFIG_TCP_SIMULT_CONNECT_DEFAULT_ON
++
+ tcp_slow_start_after_idle - BOOLEAN
+ 	If set, provide RFC2861 behavior and time out the congestion
+ 	window after an idle period.  An idle period is defined at
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index d4ef5bf94168..34d0d5438108 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -245,6 +245,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo);
+ /* sysctl variables for tcp */
+ extern int sysctl_tcp_max_orphans;
+ extern long sysctl_tcp_mem[3];
++extern int sysctl_tcp_simult_connect;
+ 
+ #define TCP_RACK_LOSS_DETECTION  0x1 /* Use RACK to detect losses */
+ #define TCP_RACK_STATIC_REO_WND  0x2 /* Use static RACK reo wnd */
+diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
+index 989e005bf698..d1584b4b39f9 100644
+--- a/net/ipv4/Kconfig
++++ b/net/ipv4/Kconfig
+@@ -743,3 +743,26 @@ config TCP_MD5SIG
+ 	  on the Internet.
+ 
+ 	  If unsure, say N.
++
++config TCP_SIMULT_CONNECT_DEFAULT_ON
++	bool "Enable TCP simultaneous connect"
++	help
++	  Enable TCP simultaneous connect that adds a weakness in Linux's strict
++	  implementation of TCP that allows two clients to connect to each other
++	  without either entering a listening state. The weakness allows an
++	  attacker to easily prevent a client from connecting to a known server
++	  provided the source port for the connection is guessed correctly.
++
++	  As the weakness could be used to prevent an antivirus or IPS from
++	  fetching updates, or prevent an SSL gateway from fetching a CRL, it
++	  should be eliminated by disabling this option. Though Linux is one of
++	  few operating systems supporting simultaneous connect, it has no
++	  legitimate use in practice and is rarely supported by firewalls.
++
++	  Disabling this may break TCP STUNT which is used by some applications
++	  for NAT traversal.
++
++	  This setting can be overridden at runtime via the
++	  net.ipv4.tcp_simult_connect sysctl.
++
++	  If unsure, say N.
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index 3e5f4f2e705e..791329c77dea 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -588,6 +588,15 @@ static struct ctl_table ipv4_table[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_do_static_key,
+ 	},
++	{
++		.procname	= "tcp_simult_connect",
++		.data		= &sysctl_tcp_simult_connect,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec_minmax,
++		.extra1		= SYSCTL_ZERO,
++		.extra2		= SYSCTL_ONE,
++	},
+ 	{ }
+ };
+ 
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index ef4bdb038a4b..86967b09a8e2 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -82,6 +82,7 @@
+ #include <net/mptcp.h>
+ 
+ int sysctl_tcp_max_orphans __read_mostly = NR_FILE;
++int sysctl_tcp_simult_connect __read_mostly = IS_ENABLED(CONFIG_TCP_SIMULT_CONNECT_DEFAULT_ON);
+ 
+ #define FLAG_DATA		0x01 /* Incoming frame contained data.		*/
+ #define FLAG_WIN_UPDATE		0x02 /* Incoming ACK was a window update.	*/
+@@ -6195,7 +6196,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
+ 	    tcp_paws_reject(&tp->rx_opt, 0))
+ 		goto discard_and_undo;
+ 
+-	if (th->syn) {
++	if (th->syn && sysctl_tcp_simult_connect) {
+ 		/* We see SYN without ACK. It is attempt of
+ 		 * simultaneous connect with crossed SYNs.
+ 		 * Particularly, it can be connect to self.
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0111-dccp-ccid-move-timers-to-struct-dccp_sock.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0111-dccp-ccid-move-timers-to-struct-dccp_sock.patch
new file mode 100644
index 000000000000..afef30230712
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0111-dccp-ccid-move-timers-to-struct-dccp_sock.patch
@@ -0,0 +1,238 @@
+From 0149a4586f7ab88cd4feaeed1a6c2be46efaf47c Mon Sep 17 00:00:00 2001
+From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Date: Tue, 13 Oct 2020 19:18:48 +0200
+Subject: [PATCH 111/113] dccp: ccid: move timers to struct dccp_sock
+
+When dccps_hc_tx_ccid is freed, ccid timers may still trigger. The reason
+del_timer_sync can't be used is because this relies on keeping a reference
+to struct sock. But as we keep a pointer to dccps_hc_tx_ccid and free that
+during disconnect, the timer should really belong to struct dccp_sock.
+
+This addresses CVE-2020-16119.
+
+Fixes: 839a6094140a (net: dccp: Convert timers to use timer_setup())
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
+---
+ include/linux/dccp.h   |  2 ++
+ net/dccp/ccids/ccid2.c | 32 +++++++++++++++++++-------------
+ net/dccp/ccids/ccid3.c | 30 ++++++++++++++++++++----------
+ 3 files changed, 41 insertions(+), 23 deletions(-)
+
+diff --git a/include/linux/dccp.h b/include/linux/dccp.h
+index 07e547c02fd8..504afa1a4be6 100644
+--- a/include/linux/dccp.h
++++ b/include/linux/dccp.h
+@@ -259,6 +259,7 @@ struct dccp_ackvec;
+  * @dccps_sync_scheduled - flag which signals "send out-of-band message soon"
+  * @dccps_xmitlet - tasklet scheduled by the TX CCID to dequeue data packets
+  * @dccps_xmit_timer - used by the TX CCID to delay sending (rate-based pacing)
++ * @dccps_ccid_timer - used by the CCIDs
+  * @dccps_syn_rtt - RTT sample from Request/Response exchange (in usecs)
+  */
+ struct dccp_sock {
+@@ -303,6 +304,7 @@ struct dccp_sock {
+ 	__u8				dccps_sync_scheduled:1;
+ 	struct tasklet_struct		dccps_xmitlet;
+ 	struct timer_list		dccps_xmit_timer;
++	struct timer_list		dccps_ccid_timer;
+ };
+ 
+ static inline struct dccp_sock *dccp_sk(const struct sock *sk)
+diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
+index 3da1f77bd039..dbca1f1e2449 100644
+--- a/net/dccp/ccids/ccid2.c
++++ b/net/dccp/ccids/ccid2.c
+@@ -126,21 +126,26 @@ static void dccp_tasklet_schedule(struct sock *sk)
+ 
+ static void ccid2_hc_tx_rto_expire(struct timer_list *t)
+ {
+-	struct ccid2_hc_tx_sock *hc = from_timer(hc, t, tx_rtotimer);
+-	struct sock *sk = hc->sk;
+-	const bool sender_was_blocked = ccid2_cwnd_network_limited(hc);
++	struct dccp_sock *dp = from_timer(dp, t, dccps_ccid_timer);
++	struct sock *sk = (struct sock *)dp;
++	struct ccid2_hc_tx_sock *hc;
++	bool sender_was_blocked;
+ 
+ 	bh_lock_sock(sk);
++
++	if (inet_sk_state_load(sk) == DCCP_CLOSED)
++		goto out;
++
++	hc = ccid_priv(dp->dccps_hc_tx_ccid);
++	sender_was_blocked = ccid2_cwnd_network_limited(hc);
++
+ 	if (sock_owned_by_user(sk)) {
+-		sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + HZ / 5);
++		sk_reset_timer(sk, &dp->dccps_ccid_timer, jiffies + HZ / 5);
+ 		goto out;
+ 	}
+ 
+ 	ccid2_pr_debug("RTO_EXPIRE\n");
+ 
+-	if (sk->sk_state == DCCP_CLOSED)
+-		goto out;
+-
+ 	/* back-off timer */
+ 	hc->tx_rto <<= 1;
+ 	if (hc->tx_rto > DCCP_RTO_MAX)
+@@ -166,7 +171,7 @@ static void ccid2_hc_tx_rto_expire(struct timer_list *t)
+ 	if (sender_was_blocked)
+ 		dccp_tasklet_schedule(sk);
+ 	/* restart backed-off timer */
+-	sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
++	sk_reset_timer(sk, &dp->dccps_ccid_timer, jiffies + hc->tx_rto);
+ out:
+ 	bh_unlock_sock(sk);
+ 	sock_put(sk);
+@@ -330,7 +335,7 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, unsigned int len)
+ 	}
+ #endif
+ 
+-	sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
++	sk_reset_timer(sk, &dp->dccps_ccid_timer, jiffies + hc->tx_rto);
+ 
+ #ifdef CONFIG_IP_DCCP_CCID2_DEBUG
+ 	do {
+@@ -700,9 +705,9 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
+ 
+ 	/* restart RTO timer if not all outstanding data has been acked */
+ 	if (hc->tx_pipe == 0)
+-		sk_stop_timer(sk, &hc->tx_rtotimer);
++		sk_stop_timer(sk, &dp->dccps_ccid_timer);
+ 	else
+-		sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
++		sk_reset_timer(sk, &dp->dccps_ccid_timer, jiffies + hc->tx_rto);
+ done:
+ 	/* check if incoming Acks allow pending packets to be sent */
+ 	if (sender_was_blocked && !ccid2_cwnd_network_limited(hc))
+@@ -737,17 +742,18 @@ static int ccid2_hc_tx_init(struct ccid *ccid, struct sock *sk)
+ 	hc->tx_last_cong = hc->tx_lsndtime = hc->tx_cwnd_stamp = ccid2_jiffies32;
+ 	hc->tx_cwnd_used = 0;
+ 	hc->sk		 = sk;
+-	timer_setup(&hc->tx_rtotimer, ccid2_hc_tx_rto_expire, 0);
++	timer_setup(&dp->dccps_ccid_timer, ccid2_hc_tx_rto_expire, 0);
+ 	INIT_LIST_HEAD(&hc->tx_av_chunks);
+ 	return 0;
+ }
+ 
+ static void ccid2_hc_tx_exit(struct sock *sk)
+ {
++	struct dccp_sock *dp = dccp_sk(sk);
+ 	struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
+ 	int i;
+ 
+-	sk_stop_timer(sk, &hc->tx_rtotimer);
++	sk_stop_timer(sk, &dp->dccps_ccid_timer);
+ 
+ 	for (i = 0; i < hc->tx_seqbufc; i++)
+ 		kfree(hc->tx_seqbuf[i]);
+diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
+index b9ee1a4a8955..685f4d046c0d 100644
+--- a/net/dccp/ccids/ccid3.c
++++ b/net/dccp/ccids/ccid3.c
+@@ -184,17 +184,24 @@ static inline void ccid3_hc_tx_update_win_count(struct ccid3_hc_tx_sock *hc,
+ 
+ static void ccid3_hc_tx_no_feedback_timer(struct timer_list *t)
+ {
+-	struct ccid3_hc_tx_sock *hc = from_timer(hc, t, tx_no_feedback_timer);
+-	struct sock *sk = hc->sk;
++	struct dccp_sock *dp = from_timer(dp, t, dccps_ccid_timer);
++	struct ccid3_hc_tx_sock *hc;
++	struct sock *sk = (struct sock *)dp;
+ 	unsigned long t_nfb = USEC_PER_SEC / 5;
+ 
+ 	bh_lock_sock(sk);
++
++	if (inet_sk_state_load(sk) == DCCP_CLOSED)
++		goto out;
++
+ 	if (sock_owned_by_user(sk)) {
+ 		/* Try again later. */
+ 		/* XXX: set some sensible MIB */
+ 		goto restart_timer;
+ 	}
+ 
++	hc = ccid_priv(dp->dccps_hc_tx_ccid);
++
+ 	ccid3_pr_debug("%s(%p, state=%s) - entry\n", dccp_role(sk), sk,
+ 		       ccid3_tx_state_name(hc->tx_state));
+ 
+@@ -250,8 +257,8 @@ static void ccid3_hc_tx_no_feedback_timer(struct timer_list *t)
+ 		t_nfb = max(hc->tx_t_rto, 2 * hc->tx_t_ipi);
+ 
+ restart_timer:
+-	sk_reset_timer(sk, &hc->tx_no_feedback_timer,
+-			   jiffies + usecs_to_jiffies(t_nfb));
++	sk_reset_timer(sk, &dp->dccps_ccid_timer,
++		       jiffies + usecs_to_jiffies(t_nfb));
+ out:
+ 	bh_unlock_sock(sk);
+ 	sock_put(sk);
+@@ -280,7 +287,7 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
+ 		return -EBADMSG;
+ 
+ 	if (hc->tx_state == TFRC_SSTATE_NO_SENT) {
+-		sk_reset_timer(sk, &hc->tx_no_feedback_timer, (jiffies +
++		sk_reset_timer(sk, &dp->dccps_ccid_timer, (jiffies +
+ 			       usecs_to_jiffies(TFRC_INITIAL_TIMEOUT)));
+ 		hc->tx_last_win_count	= 0;
+ 		hc->tx_t_last_win_count = now;
+@@ -354,6 +361,7 @@ static void ccid3_hc_tx_packet_sent(struct sock *sk, unsigned int len)
+ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
+ {
+ 	struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
++	struct dccp_sock *dp = dccp_sk(sk);
+ 	struct tfrc_tx_hist_entry *acked;
+ 	ktime_t now;
+ 	unsigned long t_nfb;
+@@ -420,7 +428,7 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
+ 			       (unsigned int)(hc->tx_x >> 6));
+ 
+ 	/* unschedule no feedback timer */
+-	sk_stop_timer(sk, &hc->tx_no_feedback_timer);
++	sk_stop_timer(sk, &dp->dccps_ccid_timer);
+ 
+ 	/*
+ 	 * As we have calculated new ipi, delta, t_nom it is possible
+@@ -445,8 +453,8 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
+ 		       "expire in %lu jiffies (%luus)\n",
+ 		       dccp_role(sk), sk, usecs_to_jiffies(t_nfb), t_nfb);
+ 
+-	sk_reset_timer(sk, &hc->tx_no_feedback_timer,
+-			   jiffies + usecs_to_jiffies(t_nfb));
++	sk_reset_timer(sk, &dp->dccps_ccid_timer,
++		       jiffies + usecs_to_jiffies(t_nfb));
+ }
+ 
+ static int ccid3_hc_tx_parse_options(struct sock *sk, u8 packet_type,
+@@ -488,21 +496,23 @@ static int ccid3_hc_tx_parse_options(struct sock *sk, u8 packet_type,
+ 
+ static int ccid3_hc_tx_init(struct ccid *ccid, struct sock *sk)
+ {
++	struct dccp_sock *dp = dccp_sk(sk);
+ 	struct ccid3_hc_tx_sock *hc = ccid_priv(ccid);
+ 
+ 	hc->tx_state = TFRC_SSTATE_NO_SENT;
+ 	hc->tx_hist  = NULL;
+ 	hc->sk	     = sk;
+-	timer_setup(&hc->tx_no_feedback_timer,
++	timer_setup(&dp->dccps_ccid_timer,
+ 		    ccid3_hc_tx_no_feedback_timer, 0);
+ 	return 0;
+ }
+ 
+ static void ccid3_hc_tx_exit(struct sock *sk)
+ {
++	struct dccp_sock *dp = dccp_sk(sk);
+ 	struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
+ 
+-	sk_stop_timer(sk, &hc->tx_no_feedback_timer);
++	sk_stop_timer(sk, &dp->dccps_ccid_timer);
+ 	tfrc_tx_hist_purge(&hc->tx_hist);
+ }
+ 
+-- 
+2.30.0
+
diff --git a/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0112-Revert-dccp-don-t-free-ccid2_hc_tx_sock-struct-in-dc.patch b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0112-Revert-dccp-don-t-free-ccid2_hc_tx_sock-struct-in-dc.patch
new file mode 100644
index 000000000000..59521fc6cd29
--- /dev/null
+++ b/sys-kernel/cairn-sources/files/5.10.9/hardened-patches/0112-Revert-dccp-don-t-free-ccid2_hc_tx_sock-struct-in-dc.patch
@@ -0,0 +1,40 @@
+From 81951627594eb1463fbc6b7da8f20410a068e88a Mon Sep 17 00:00:00 2001
+From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Date: Tue, 13 Oct 2020 19:18:49 +0200
+Subject: [PATCH 112/113] Revert "dccp: don't free ccid2_hc_tx_sock struct in
+ dccp_disconnect()"
+
+This reverts commit 2677d20677314101293e6da0094ede7b5526d2b1.
+
+This fixes an issue that after disconnect, dccps_hc_tx_ccid will still be
+kept, allowing the socket to be reused as a listener socket, and the cloned
+socket will free its dccps_hc_tx_ccid, leading to a later use after free,
+when the listener socket is closed.
+
+This addresses CVE-2020-16119.
+
+Fixes: 2677d2067731 (dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect())
+Reported-by: Hadar Manor
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
+---
+ net/dccp/proto.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/dccp/proto.c b/net/dccp/proto.c
+index 6d705d90c614..359e848dba6c 100644
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -279,7 +279,9 @@ int dccp_disconnect(struct sock *sk, int flags)
+ 
+ 	dccp_clear_xmit_timers(sk);
+ 	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
++	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+ 	dp->dccps_hc_rx_ccid = NULL;
++	dp->dccps_hc_tx_ccid = NULL;
+ 
+ 	__skb_queue_purge(&sk->sk_receive_queue);
+ 	__skb_queue_purge(&sk->sk_write_queue);
+-- 
+2.30.0
+