Known exploit detection

The idea is simple -- since different kernel versions are vulnerable to
different root exploits, hackers most likely try multiple exploits before
they actually succeed.

Fixing an exploitable kernel bug usually means adding a check to see if
what a userspace program tried to do is allowed and makes sense (for
example, writing beyond the end of an array is a bug and can be fixed by
checking that the index provided by userspace is indeed within the array
bounds).

Instead of just returning an error when these extra checks fail, we can
also give the system administrator a heads up that somebody supplied this
invalid input that would have lead to elevated privileges on earlier
versions of the kernel.

This serves as a practical, low-overhead early-detection of malicious users
(and/or buggy userspace programs) to system administrators.

I propose limiting the annotation of known exploits to the most serious
type of exploit, namely where the attacker otherwise silently gains
root/elevated capabilities. For sure, there is little point in calling
exploit() where an older kernel would just panic or OOM.

I also propose to keep each exploit() annotation around for only ~5 years
after the bug was discovered/fixed. This will allow us to catch most of the
intrusion attempts while still not littering the kernel code forever.

Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
exploit: report to audit subsystem when available

Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
hfs: Known exploit detection for CVE-2011-4330

See bc5b8a9003132ae44559edd63a1623b7b99dfb68.

Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
net: Known exploit detection for CVE-2012-2136

See cc9b17ad29ecaa20bfe426a8d4dbfb94b13ff1cc.

Cc: Jason Wang <jasowang@redhat.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
hfsplus: Known exploit detection for CVE-2012-2319

See 6f24f892871acc47b40dd594c63606a17c714f77.

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
x86: Known exploit detection for CVE-2013-0268

See c903f0456bc69176912dee6dd25c6a66ee1aed00.

Cc: Alan Cox <alan@linux.intel.com>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
drm/i915: Known exploit detection for CVE-2013-0913

See 3118a4f652c7b12c752f3222af0447008f9b2368.

Cc: Kees Cook <keescook@chromium.org>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
userns: Known exploit detection for CVE-2013-1959

See 6708075f104c3c9b04b23336bb0366ca30c3931b and
e3211c120a85b792978bcb4be7b2886df18d27f0.

Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
perf: Known exploit detection for CVE-2013-2094

See 8176cced706b5e5d15887584150764894e94e02f.

Cc: Tommi Rantala <tt.rantala@gmail.com>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>