Doug / smarc-fsl-linux-kernel

15 Jan, 2013

1 commit

  • 5dbbaf2de   tun: fix LSM/SELinux labeling of tun/tap devices ... Browse Code »

    This patch corrects some problems with LSM/SELinux that were introduced
    with the multiqueue patchset. The problem stems from the fact that the
    multiqueue work changed the relationship between the tun device and its
    associated socket; before the socket persisted for the life of the
    device, however after the multiqueue changes the socket only persisted
    for the life of the userspace connection (fd open). For non-persistent
    devices this is not an issue, but for persistent devices this can cause
    the tun device to lose its SELinux label.

    We correct this problem by adding an opaque LSM security blob to the
    tun device struct which allows us to have the LSM security state, e.g.
    SELinux labeling information, persist for the lifetime of the tun
    device. In the process we tweak the LSM hooks to work with this new
    approach to TUN device/socket labeling and introduce a new LSM hook,
    security_tun_dev_attach_queue(), to approve requests to attach to a
    TUN queue via TUNSETQUEUE.

    The SELinux code has been adjusted to match the new LSM hooks, the
    other LSMs do not make use of the LSM TUN controls. This patch makes
    use of the recently added "tun_socket:attach_queue" permission to
    restrict access to the TUNSETQUEUE operation. On older SELinux
    policies which do not define the "tun_socket:attach_queue" permission
    the access control decision for TUNSETQUEUE will be handled according
    to the SELinux policy's unknown permission setting.

    Signed-off-by: Paul Moore
    Acked-by: Eric Paris
    Tested-by: Jason Wang
    Signed-off-by: David S. Miller

    Paul Moore
     

14 Dec, 2012

2 commits

  • fdf90729e   ima: support new kernel module syscall ... Browse Code »

    With the addition of the new kernel module syscall, which defines two
    arguments - a file descriptor to the kernel module and a pointer to a NULL
    terminated string of module arguments - it is now possible to measure and
    appraise kernel modules like any other file on the file system.

    This patch adds support to measure and appraise kernel modules in an
    extensible and consistent manner.

    To support filesystems without extended attribute support, additional
    patches could pass the signature as the first parameter.

    Signed-off-by: Mimi Zohar
    Signed-off-by: Rusty Russell

    Mimi Zohar
     
  • 2e72d51b4   security: introduce kernel_module_from_file hook ... Browse Code »

    Now that kernel module origins can be reasoned about, provide a hook to
    the LSMs to make policy decisions about the module file. This will let
    Chrome OS enforce that loadable kernel modules can only come from its
    read-only hash-verified root filesystem. Other LSMs can, for example,
    read extended attributes for signatures, etc.

    Signed-off-by: Kees Cook
    Acked-by: Serge E. Hallyn
    Acked-by: Eric Paris
    Acked-by: Mimi Zohar
    Acked-by: James Morris
    Signed-off-by: Rusty Russell

    Kees Cook
     

12 Oct, 2012

1 commit

03 Oct, 2012

1 commit

  • 88265322c   Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security ... Browse Code »

    Pull security subsystem updates from James Morris:
    "Highlights:

    - Integrity: add local fs integrity verification to detect offline
    attacks
    - Integrity: add digital signature verification
    - Simple stacking of Yama with other LSMs (per LSS discussions)
    - IBM vTPM support on ppc64
    - Add new driver for Infineon I2C TIS TPM
    - Smack: add rule revocation for subject labels"

    Fixed conflicts with the user namespace support in kernel/auditsc.c and
    security/integrity/ima/ima_policy.c.

    * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (39 commits)
    Documentation: Update git repository URL for Smack userland tools
    ima: change flags container data type
    Smack: setprocattr memory leak fix
    Smack: implement revoking all rules for a subject label
    Smack: remove task_wait() hook.
    ima: audit log hashes
    ima: generic IMA action flag handling
    ima: rename ima_must_appraise_or_measure
    audit: export audit_log_task_info
    tpm: fix tpm_acpi sparse warning on different address spaces
    samples/seccomp: fix 31 bit build on s390
    ima: digital signature verification support
    ima: add support for different security.ima data types
    ima: add ima_inode_setxattr/removexattr function and calls
    ima: add inode_post_setattr call
    ima: replace iint spinblock with rwlock/read_lock
    ima: allocating iint improvements
    ima: add appraise action keywords and default rules
    ima: integrity appraisal extension
    vfs: move ima_file_free before releasing the file
    ...

    Linus Torvalds
     

21 Sep, 2012

1 commit

08 Sep, 2012

1 commit

  • 42c63330f   ima: add ima_inode_setxattr/removexattr function and calls ... Browse Code »

    Based on xattr_permission comments, the restriction to modify 'security'
    xattr is left up to the underlying fs or lsm. Ensure that not just anyone
    can modify or remove 'security.ima'.

    Changelog v1:
    - Unless IMA-APPRAISE is configured, use stub ima_inode_removexattr()/setxattr()
    functions. (Moved ima_inode_removexattr()/setxattr() to ima_appraise.c)

    Changelog:
    - take i_mutex to fix locking (Dmitry Kasatkin)
    - ima_reset_appraise_flags should only be called when modifying or
    removing the 'security.ima' xattr. Requires CAP_SYS_ADMIN privilege.
    (Incorporated fix from Roberto Sassu)
    - Even if allowed to update security.ima, reset the appraisal flags,
    forcing re-appraisal.
    - Replace CAP_MAC_ADMIN with CAP_SYS_ADMIN
    - static inline ima_inode_setxattr()/ima_inode_removexattr() stubs
    - ima_protect_xattr should be static

    Signed-off-by: Mimi Zohar
    Signed-off-by: Dmitry Kasatkin

    Mimi Zohar
     

06 Sep, 2012

1 commit

  • c6993e4ac   security: allow Yama to be unconditionally stacked ... Browse Code »

    Unconditionally call Yama when CONFIG_SECURITY_YAMA_STACKED is selected,
    no matter what LSM module is primary.

    Ubuntu and Chrome OS already carry patches to do this, and Fedora
    has voiced interest in doing this as well. Instead of having multiple
    distributions (or LSM authors) carrying these patches, just allow Yama
    to be called unconditionally when selected by the new CONFIG.

    Signed-off-by: Kees Cook
    Acked-by: Serge E. Hallyn
    Acked-by: Eric Paris
    Acked-by: John Johansen
    Signed-off-by: James Morris

    Kees Cook
     

03 Jul, 2012

1 commit

  • 75331a597   security: Fix nommu build. ... Browse Code »

    The security + nommu configuration presently blows up with an undefined
    reference to BDI_CAP_EXEC_MAP:

    security/security.c: In function 'mmap_prot':
    security/security.c:687:36: error: dereferencing pointer to incomplete type
    security/security.c:688:16: error: 'BDI_CAP_EXEC_MAP' undeclared (first use in this function)
    security/security.c:688:16: note: each undeclared identifier is reported only once for each function it appears in

    include backing-dev.h directly to fix it up.

    Signed-off-by: Paul Mundt
    Signed-off-by: James Morris

    Paul Mundt
     

02 Jul, 2012

1 commit

  • 659b5e765   security: Fix nommu build. ... Browse Code »

    The security + nommu configuration presently blows up with an undefined
    reference to BDI_CAP_EXEC_MAP:

    security/security.c: In function 'mmap_prot':
    security/security.c:687:36: error: dereferencing pointer to incomplete type
    security/security.c:688:16: error: 'BDI_CAP_EXEC_MAP' undeclared (first use in this function)
    security/security.c:688:16: note: each undeclared identifier is reported only once for each function it appears in

    include backing-dev.h directly to fix it up.

    Signed-off-by: Paul Mundt
    Signed-off-by: James Morris

    Paul Mundt
     

01 Jun, 2012

3 commits

10 Apr, 2012

1 commit

14 Feb, 2012

2 commits

10 Feb, 2012

1 commit

  • 1a2a4d06e   security: create task_free security callback ... Browse Code »

    The current LSM interface to cred_free is not sufficient for allowing
    an LSM to track the life and death of a task. This patch adds the
    task_free hook so that an LSM can clean up resources on task death.

    Signed-off-by: Kees Cook
    Signed-off-by: James Morris

    Kees Cook
     

15 Jan, 2012

1 commit

  • c49c41a41   Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security ... Browse Code »

    * 'for-linus' of git://selinuxproject.org/~jmorris/linux-security:
    capabilities: remove __cap_full_set definition
    security: remove the security_netlink_recv hook as it is equivalent to capable()
    ptrace: do not audit capability check when outputing /proc/pid/stat
    capabilities: remove task_ns_* functions
    capabitlies: ns_capable can use the cap helpers rather than lsm call
    capabilities: style only - move capable below ns_capable
    capabilites: introduce new has_ns_capabilities_noaudit
    capabilities: call has_ns_capability from has_capability
    capabilities: remove all _real_ interfaces
    capabilities: introduce security_capable_noaudit
    capabilities: reverse arguments to security_capable
    capabilities: remove the task from capable LSM hook entirely
    selinux: sparse fix: fix several warnings in the security server cod
    selinux: sparse fix: fix warnings in netlink code
    selinux: sparse fix: eliminate warnings for selinuxfs
    selinux: sparse fix: declare selinux_disable() in security.h
    selinux: sparse fix: move selinux_complete_init
    selinux: sparse fix: make selinux_secmark_refcount static
    SELinux: Fix RCU deref check warning in sel_netport_insert()

    Manually fix up a semantic mis-merge wrt security_netlink_recv():

    - the interface was removed in commit fd7784615248 ("security: remove
    the security_netlink_recv hook as it is equivalent to capable()")

    - a new user of it appeared in commit a38f7907b926 ("crypto: Add
    userspace configuration API")

    causing no automatic merge conflict, but Eric Paris pointed out the
    issue.

    Linus Torvalds
     

07 Jan, 2012

1 commit

06 Jan, 2012

5 commits

  • fd7784615   security: remove the security_netlink_recv hook as it is equivalent to capable() ... Browse Code »

    Once upon a time netlink was not sync and we had to get the effective
    capabilities from the skb that was being received. Today we instead get
    the capabilities from the current task. This has rendered the entire
    purpose of the hook moot as it is now functionally equivalent to the
    capable() call.

    Signed-off-by: Eric Paris

    Eric Paris
     
  • 2920a8409   capabilities: remove all _real_ interfaces ... Browse Code »

    The name security_real_capable and security_real_capable_noaudit just don't
    make much sense to me. Convert them to use security_capable and
    security_capable_noaudit.

    Signed-off-by: Eric Paris
    Acked-by: Serge E. Hallyn

    Eric Paris
     
  • c7eba4a97   capabilities: introduce security_capable_noaudit ... Browse Code »

    Exactly like security_capable except don't audit any denials. This is for
    places where the kernel may make decisions about what to do if a task has a
    given capability, but which failing that capability is not a sign of a
    security policy violation. An example is checking if a task has
    CAP_SYS_ADMIN to lower it's likelyhood of being killed by the oom killer.
    This check is not a security violation if it is denied.

    Signed-off-by: Eric Paris
    Acked-by: Serge E. Hallyn

    Eric Paris
     
  • b7e724d30   capabilities: reverse arguments to security_capable ... Browse Code »

    security_capable takes ns, cred, cap. But the LSM capable() hook takes
    cred, ns, cap. The capability helper functions also take cred, ns, cap.
    Rather than flip argument order just to flip it back, leave them alone.
    Heck, this should be a little faster since argument will be in the right
    place!

    Signed-off-by: Eric Paris

    Eric Paris
     
  • 6a9de4911   capabilities: remove the task from capable LSM hook entirely ... Browse Code »

    The capabilities framework is based around credentials, not necessarily the
    current task. Yet we still passed the current task down into LSMs from the
    security_capable() LSM hook as if it was a meaningful portion of the security
    decision. This patch removes the 'generic' passing of current and instead
    forces individual LSMs to use current explicitly if they think it is
    appropriate. In our case those LSMs are SELinux and AppArmor.

    I believe the AppArmor use of current is incorrect, but that is wholely
    unrelated to this patch. This patch does not change what AppArmor does, it
    just makes it clear in the AppArmor code that it is doing it.

    The SELinux code still uses current in it's audit message, which may also be
    wrong and needs further investigation. Again this is NOT a change, it may
    have always been wrong, this patch just makes it clear what is happening.

    Signed-off-by: Eric Paris

    Eric Paris
     

04 Jan, 2012

7 commits

25 Oct, 2011

1 commit

  • 36b8d186e   Merge branch 'next' of git://selinuxproject.org/~jmorris/linux-security ... Browse Code »

    * 'next' of git://selinuxproject.org/~jmorris/linux-security: (95 commits)
    TOMOYO: Fix incomplete read after seek.
    Smack: allow to access /smack/access as normal user
    TOMOYO: Fix unused kernel config option.
    Smack: fix: invalid length set for the result of /smack/access
    Smack: compilation fix
    Smack: fix for /smack/access output, use string instead of byte
    Smack: domain transition protections (v3)
    Smack: Provide information for UDS getsockopt(SO_PEERCRED)
    Smack: Clean up comments
    Smack: Repair processing of fcntl
    Smack: Rule list lookup performance
    Smack: check permissions from user space (v2)
    TOMOYO: Fix quota and garbage collector.
    TOMOYO: Remove redundant tasklist_lock.
    TOMOYO: Fix domain transition failure warning.
    TOMOYO: Remove tomoyo_policy_memory_lock spinlock.
    TOMOYO: Simplify garbage collector.
    TOMOYO: Fix make namespacecheck warnings.
    target: check hex2bin result
    encrypted-keys: check hex2bin result
    ...

    Linus Torvalds
     

19 Oct, 2011

1 commit

  • 6230c9b4f   bluetooth: Properly clone LSM attributes to newly created child connections ... Browse Code »

    The Bluetooth stack has internal connection handlers for all of the various
    Bluetooth protocols, and unfortunately, they are currently lacking the LSM
    hooks found in the core network stack's connection handlers. I say
    unfortunately, because this can cause problems for users who have have an
    LSM enabled and are using certain Bluetooth devices. See one problem
    report below:

    * http://bugzilla.redhat.com/show_bug.cgi?id=741703

    In order to keep things simple at this point in time, this patch fixes the
    problem by cloning the parent socket's LSM attributes to the newly created
    child socket. If we decide we need a more elaborate LSM marking mechanism
    for Bluetooth (I somewhat doubt this) we can always revisit this decision
    in the future.

    Reported-by: James M. Cape
    Signed-off-by: Paul Moore
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Paul Moore
     

15 Sep, 2011

1 commit

10 Sep, 2011

1 commit

09 Aug, 2011

1 commit

20 Jul, 2011

2 commits

19 Jul, 2011

2 commits