17 Dec, 2012

1 commit

  • Pull security subsystem updates from James Morris:
    "A quiet cycle for the security subsystem with just a few maintenance
    updates."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
    Smack: create a sysfs mount point for smackfs
    Smack: use select not depends in Kconfig
    Yama: remove locking from delete path
    Yama: add RCU to drop read locking
    drivers/char/tpm: remove tasklet and cleanup
    KEYS: Use keyring_alloc() to create special keyrings
    KEYS: Reduce initial permissions on keys
    KEYS: Make the session and process keyrings per-thread
    seccomp: Make syscall skipping and nr changes more consistent
    key: Fix resource leak
    keys: Fix unreachable code
    KEYS: Add payload preparsing opportunity prior to key instantiate or update

    Linus Torvalds
     

15 Dec, 2012

2 commits

  • There are a number of "conventions" for where to put LSM filesystems.
    Smack adheres to none of them. Create a mount point at /sys/fs/smackfs
    for mounting smackfs so that Smack can be conventional.

    Targeted for git://git.gitorious.org/smack-next/kernel.git

    Signed-off-by: Casey Schaufler

    Casey Schaufler
     
  • The components NETLABEL and SECURITY_NETWORK are required by
    Smack. Using "depends" in Kconfig hides the Smack option
    if the user hasn't figured out that they need to be enabled
    while using make menuconfig. Using select is a better choice.
    Because select is not recursive depends on NET and SECURITY
    are added. The reflects similar usage in TOMOYO and AppArmor.

    Targeted for git://git.gitorious.org/smack-next/kernel.git

    Signed-off-by: Casey Schaufler

    Casey Schaufler
     

14 Dec, 2012

1 commit

  • Pull trivial branch from Jiri Kosina:
    "Usual stuff -- comment/printk typo fixes, documentation updates, dead
    code elimination."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (39 commits)
    HOWTO: fix double words typo
    x86 mtrr: fix comment typo in mtrr_bp_init
    propagate name change to comments in kernel source
    doc: Update the name of profiling based on sysfs
    treewide: Fix typos in various drivers
    treewide: Fix typos in various Kconfig
    wireless: mwifiex: Fix typo in wireless/mwifiex driver
    messages: i2o: Fix typo in messages/i2o
    scripts/kernel-doc: check that non-void fcts describe their return value
    Kernel-doc: Convention: Use a "Return" section to describe return values
    radeon: Fix typo and copy/paste error in comments
    doc: Remove unnecessary declarations from Documentation/accounting/getdelays.c
    various: Fix spelling of "asynchronous" in comments.
    Fix misspellings of "whether" in comments.
    eisa: Fix spelling of "asynchronous".
    various: Fix spelling of "registered" in comments.
    doc: fix quite a few typos within Documentation
    target: iscsi: fix comment typos in target/iscsi drivers
    treewide: fix typo of "suport" in various comments and Kconfig
    treewide: fix typo of "suppport" in various comments
    ...

    Linus Torvalds
     

13 Dec, 2012

2 commits

  • Pull networking changes from David Miller:

    1) Allow to dump, monitor, and change the bridge multicast database
    using netlink. From Cong Wang.

    2) RFC 5961 TCP blind data injection attack mitigation, from Eric
    Dumazet.

    3) Networking user namespace support from Eric W. Biederman.

    4) tuntap/virtio-net multiqueue support by Jason Wang.

    5) Support for checksum offload of encapsulated packets (basically,
    tunneled traffic can still be checksummed by HW). From Joseph
    Gasparakis.

    6) Allow BPF filter access to VLAN tags, from Eric Dumazet and
    Daniel Borkmann.

    7) Bridge port parameters over netlink and BPDU blocking support
    from Stephen Hemminger.

    8) Improve data access patterns during inet socket demux by rearranging
    socket layout, from Eric Dumazet.

    9) TIPC protocol updates and cleanups from Ying Xue, Paul Gortmaker, and
    Jon Maloy.

    10) Update TCP socket hash sizing to be more in line with current day
    realities. The existing heurstics were choosen a decade ago.
    From Eric Dumazet.

    11) Fix races, queue bloat, and excessive wakeups in ATM and
    associated drivers, from Krzysztof Mazur and David Woodhouse.

    12) Support DOVE (Distributed Overlay Virtual Ethernet) extensions
    in VXLAN driver, from David Stevens.

    13) Add "oops_only" mode to netconsole, from Amerigo Wang.

    14) Support set and query of VEB/VEPA bridge mode via PF_BRIDGE, also
    allow DCB netlink to work on namespaces other than the initial
    namespace. From John Fastabend.

    15) Support PTP in the Tigon3 driver, from Matt Carlson.

    16) tun/vhost zero copy fixes and improvements, plus turn it on
    by default, from Michael S. Tsirkin.

    17) Support per-association statistics in SCTP, from Michele
    Baldessari.

    And many, many, driver updates, cleanups, and improvements. Too
    numerous to mention individually.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1722 commits)
    net/mlx4_en: Add support for destination MAC in steering rules
    net/mlx4_en: Use generic etherdevice.h functions.
    net: ethtool: Add destination MAC address to flow steering API
    bridge: add support of adding and deleting mdb entries
    bridge: notify mdb changes via netlink
    ndisc: Unexport ndisc_{build,send}_skb().
    uapi: add missing netconf.h to export list
    pkt_sched: avoid requeues if possible
    solos-pci: fix double-free of TX skb in DMA mode
    bnx2: Fix accidental reversions.
    bna: Driver Version Updated to 3.1.2.1
    bna: Firmware update
    bna: Add RX State
    bna: Rx Page Based Allocation
    bna: TX Intr Coalescing Fix
    bna: Tx and Rx Optimizations
    bna: Code Cleanup and Enhancements
    ath9k: check pdata variable before dereferencing it
    ath5k: RX timestamp is reported at end of frame
    ath9k_htc: RX timestamp is reported at end of frame
    ...

    Linus Torvalds
     
  • Pull cgroup changes from Tejun Heo:
    "A lot of activities on cgroup side. The big changes are focused on
    making cgroup hierarchy handling saner.

    - cgroup_rmdir() had peculiar semantics - it allowed cgroup
    destruction to be vetoed by individual controllers and tried to
    drain refcnt synchronously. The vetoing never worked properly and
    caused good deal of contortions in cgroup. memcg was the last
    reamining user. Michal Hocko removed the usage and cgroup_rmdir()
    path has been simplified significantly. This was done in a
    separate branch so that the memcg people can base further memcg
    changes on top.

    - The above allowed cleaning up cgroup lifecycle management and
    implementation of generic cgroup iterators which are used to
    improve hierarchy support.

    - cgroup_freezer updated to allow migration in and out of a frozen
    cgroup and handle hierarchy. If a cgroup is frozen, all descendant
    cgroups are frozen.

    - netcls_cgroup and netprio_cgroup updated to handle hierarchy
    properly.

    - Various fixes and cleanups.

    - Two merge commits. One to pull in memcg and rmdir cleanups (needed
    to build iterators). The other pulled in cgroup/for-3.7-fixes for
    device_cgroup fixes so that further device_cgroup patches can be
    stacked on top."

    Fixed up a trivial conflict in mm/memcontrol.c as per Tejun (due to
    commit bea8c150a7 ("memcg: fix hotplugged memory zone oops") in master
    touching code close to commit 2ef37d3fe4 ("memcg: Simplify
    mem_cgroup_force_empty_list error handling") in for-3.8)

    * 'for-3.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (65 commits)
    cgroup: update Documentation/cgroups/00-INDEX
    cgroup_rm_file: don't delete the uncreated files
    cgroup: remove subsystem files when remounting cgroup
    cgroup: use cgroup_addrm_files() in cgroup_clear_directory()
    cgroup: warn about broken hierarchies only after css_online
    cgroup: list_del_init() on removed events
    cgroup: fix lockdep warning for event_control
    cgroup: move list add after list head initilization
    netprio_cgroup: allow nesting and inherit config on cgroup creation
    netprio_cgroup: implement netprio[_set]_prio() helpers
    netprio_cgroup: use cgroup->id instead of cgroup_netprio_state->prioidx
    netprio_cgroup: reimplement priomap expansion
    netprio_cgroup: shorten variable names in extend_netdev_table()
    netprio_cgroup: simplify write_priomap()
    netcls_cgroup: move config inheritance to ->css_online() and remove .broken_hierarchy marking
    cgroup: remove obsolete guarantee from cgroup_task_migrate.
    cgroup: add cgroup->id
    cgroup, cpuset: remove cgroup_subsys->post_clone()
    cgroup: s/CGRP_CLONE_CHILDREN/CGRP_CPUSET_CLONE_CHILDREN/
    cgroup: rename ->create/post_create/pre_destroy/destroy() to ->css_alloc/online/offline/free()
    ...

    Linus Torvalds
     

11 Dec, 2012

1 commit


08 Dec, 2012

1 commit

  • V5: fix two bugs pointed out by Thomas
    remove seq check for now, mark it as TODO

    V4: remove some useless #include
    some coding style fix

    V3: drop debugging printk's
    update selinux perm table as well

    V2: drop patch 1/2, export ifindex directly
    Redesign netlink attributes
    Improve netlink seq check
    Handle IPv6 addr as well

    This patch exports bridge multicast database via netlink
    message type RTM_GETMDB. Similar to fdb, but currently bridge-specific.
    We may need to support modify multicast database too (RTM_{ADD,DEL}MDB).

    (Thanks to Thomas for patient reviews)

    Cc: Herbert Xu
    Cc: Stephen Hemminger
    Cc: "David S. Miller"
    Cc: Thomas Graf
    Cc: Jesper Dangaard Brouer
    Signed-off-by: Cong Wang
    Acked-by: Thomas Graf
    Signed-off-by: David S. Miller

    Cong Wang
     

21 Nov, 2012

3 commits

  • ===============================
    [ INFO: suspicious RCU usage. ]
    3.5.0-rc1+ #63 Not tainted
    -------------------------------
    security/selinux/netnode.c:178 suspicious rcu_dereference_check() usage!

    other info that might help us debug this:

    rcu_scheduler_active = 1, debug_locks = 0
    1 lock held by trinity-child1/8750:
    #0: (sel_netnode_lock){+.....}, at: [] sel_netnode_sid+0x16a/0x3e0

    stack backtrace:
    Pid: 8750, comm: trinity-child1 Not tainted 3.5.0-rc1+ #63
    Call Trace:
    [] lockdep_rcu_suspicious+0xfd/0x130
    [] sel_netnode_sid+0x3b1/0x3e0
    [] ? sel_netnode_find+0x1a0/0x1a0
    [] selinux_socket_bind+0xf6/0x2c0
    [] ? trace_hardirqs_off+0xd/0x10
    [] ? lock_release_holdtime.part.9+0x15/0x1a0
    [] ? lock_hrtimer_base+0x31/0x60
    [] security_socket_bind+0x16/0x20
    [] sys_bind+0x7a/0x100
    [] ? sysret_check+0x22/0x5d
    [] ? trace_hardirqs_on_caller+0x10d/0x1a0
    [] ? trace_hardirqs_on_thunk+0x3a/0x3f
    [] system_call_fastpath+0x16/0x1b

    This patch below does what Paul McKenney suggested in the previous thread.

    Signed-off-by: Dave Jones
    Reviewed-by: Paul E. McKenney
    Acked-by: Paul Moore
    Cc: Eric Paris
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: James Morris

    Dave Jones
     
  • Instead of locking the list during a delete, mark entries as invalid
    and trigger a workqueue to clean them up. This lets us easily handle
    task_free from interrupt context.

    Signed-off-by: Kees Cook

    Kees Cook
     
  • Stop using spinlocks in the read path. Add RCU list to handle the readers.

    Signed-off-by: Kees Cook
    Reviewed-by: Serge E. Hallyn
    Acked-by: John Johansen

    Kees Cook
     

20 Nov, 2012

1 commit


07 Nov, 2012

2 commits

  • device_cgroup uses RCU safe ->exceptions list which is write-protected
    by devcgroup_mutex and has had some issues using locking correctly.
    Add lockdep asserts to utility functions so that future errors can be
    easily detected.

    Signed-off-by: Tejun Heo
    Acked-by: Serge E. Hallyn
    Cc: Aristeu Rozanski
    Cc: Li Zefan

    Tejun Heo
     
  • dev_cgroup->exceptions is protected with devcgroup_mutex for writes
    and RCU for reads; however, RCU usage isn't correct.

    * dev_exception_clean() doesn't use RCU variant of list_del() and
    kfree(). The function can race with may_access() and may_access()
    may end up dereferencing already freed memory. Use list_del_rcu()
    and kfree_rcu() instead.

    * may_access() may be called only with RCU read locked but doesn't use
    RCU safe traversal over ->exceptions. Use list_for_each_entry_rcu().

    Signed-off-by: Tejun Heo
    Acked-by: Serge E. Hallyn
    Cc: stable@vger.kernel.org
    Cc: Aristeu Rozanski
    Cc: Li Zefan

    Tejun Heo
     

06 Nov, 2012

1 commit

  • In 4cef7299b478687 ("device_cgroup: add proper checking when changing
    default behavior") the cgroup parent usage is unchecked. root will not
    have a parent and trying to use device.{allow,deny} will cause problems.
    For some reason my stressing scripts didn't test the root directory so I
    didn't catch it on my regular tests.

    Signed-off-by: Aristeu Rozanski
    Cc: Li Zefan
    Cc: James Morris
    Cc: Pavel Emelyanov
    Acked-by: Serge E. Hallyn
    Cc: Jiri Slaby
    Cc: Tejun Heo
    Signed-off-by: Tejun Heo

    Aristeu Rozanski
     

29 Oct, 2012

1 commit


26 Oct, 2012

5 commits

  • Before changing a group's default behavior to ALLOW, we must check if
    its parent's behavior is also ALLOW.

    Signed-off-by: Aristeu Rozanski
    Cc: Tejun Heo
    Cc: Li Zefan
    Cc: James Morris
    Cc: Pavel Emelyanov
    Acked-by: Serge Hallyn
    Cc: Jiri Slaby
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Aristeu Rozanski
     
  • Convert the code to use kstrtou32() instead of simple_strtoul() which is
    deprecated. The real size of the variables are u32, so use kstrtou32
    instead of kstrtoul

    Signed-off-by: Aristeu Rozanski
    Cc: Dave Jones
    Cc: Tejun Heo
    Cc: Li Zefan
    Cc: James Morris
    Cc: Pavel Emelyanov
    Acked-by: Serge Hallyn
    Cc: Jiri Slaby
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Aristeu Rozanski
     
  • This was done in a v2 patch but v1 ended up being committed. The
    variable name is less confusing and stores the default behavior when no
    matching exception exists.

    Signed-off-by: Aristeu Rozanski
    Cc: Dave Jones
    Cc: Tejun Heo
    Cc: Li Zefan
    Cc: James Morris
    Cc: Pavel Emelyanov
    Acked-by: Serge Hallyn
    Cc: Jiri Slaby
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Aristeu Rozanski
     
  • Commit ad676077a2ae ("device_cgroup: convert device_cgroup internally to
    policy + exceptions") removed rcu locks which are needed in
    task_devcgroup called in this chain:

    devcgroup_inode_mknod OR __devcgroup_inode_permission ->
    __devcgroup_inode_permission ->
    task_devcgroup ->
    task_subsys_state ->
    task_subsys_state_check.

    Change the code so that task_devcgroup is safely called with rcu read
    lock held.

    ===============================
    [ INFO: suspicious RCU usage. ]
    3.6.0-rc5-next-20120913+ #42 Not tainted
    -------------------------------
    include/linux/cgroup.h:553 suspicious rcu_dereference_check() usage!

    other info that might help us debug this:

    rcu_scheduler_active = 1, debug_locks = 0
    2 locks held by kdevtmpfs/23:
    #0: (sb_writers){.+.+.+}, at: []
    mnt_want_write+0x1f/0x50
    #1: (&sb->s_type->i_mutex_key#3/1){+.+.+.}, at: []
    kern_path_create+0x7f/0x170

    stack backtrace:
    Pid: 23, comm: kdevtmpfs Not tainted 3.6.0-rc5-next-20120913+ #42
    Call Trace:
    lockdep_rcu_suspicious+0xfd/0x130
    devcgroup_inode_mknod+0x19d/0x240
    vfs_mknod+0x71/0xf0
    handle_create.isra.2+0x72/0x200
    devtmpfsd+0x114/0x140
    ? handle_create.isra.2+0x200/0x200
    kthread+0xd6/0xe0
    kernel_thread_helper+0x4/0x10

    Signed-off-by: Jiri Slaby
    Cc: Dave Jones
    Cc: Tejun Heo
    Cc: Li Zefan
    Cc: James Morris
    Cc: Pavel Emelyanov
    Acked-by: Serge Hallyn
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jiri Slaby
     
  • We set ret to NULL then test it. Remove the bogus test

    Signed-off-by: Alan Cox
    Signed-off-by: Jiri Kosina

    Alan Cox
     

24 Oct, 2012

1 commit

  • BugLink: http://bugs.launchpad.net/bugs/1056078

    Profile replacement can cause long chains of profiles to build up when
    the profile being replaced is pinned. When the pinned profile is finally
    freed, it puts the reference to its replacement, which may in turn nest
    another call to free_profile on the stack. Because this may happen for
    each profile in the replacedby chain this can result in a recusion that
    causes the stack to overflow.

    Break this nesting by directly walking the chain of replacedby profiles
    (ie. use iteration instead of recursion to free the list). This results
    in at most 2 levels of free_profile being called, while freeing a
    replacedby chain.

    Signed-off-by: John Johansen
    Signed-off-by: James Morris

    John Johansen
     

18 Oct, 2012

1 commit

  • The capability defines have moved causing the auto generated names
    of capabilities that apparmor uses in logging to be incorrect.

    Fix the autogenerated table source to uapi/linux/capability.h

    Reported-by: YanHong
    Reported-by: Krzysztof Kolasa
    Analyzed-by: Al Viro
    Signed-off-by: John Johansen
    Acked-by: David Howells
    Acked-by: James Morris
    Signed-off-by: Linus Torvalds

    John Johansen
     

17 Oct, 2012

1 commit

  • replace_fd() began with "eats a reference, tries to insert into
    descriptor table" semantics; at some point I'd switched it to
    much saner current behaviour ("try to insert into descriptor
    table, grabbing a new reference if inserted; caller should do
    fput() in any case"), but forgot to update the callers.
    Mea culpa...

    [Spotted by Pavel Roskin, who has really weird system with pipe-fed
    coredumps as part of what he considers a normal boot ;-)]

    Signed-off-by: Al Viro

    Al Viro
     

15 Oct, 2012

1 commit

  • Pull module signing support from Rusty Russell:
    "module signing is the highlight, but it's an all-over David Howells frenzy..."

    Hmm "Magrathea: Glacier signing key". Somebody has been reading too much HHGTTG.

    * 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: (37 commits)
    X.509: Fix indefinite length element skip error handling
    X.509: Convert some printk calls to pr_devel
    asymmetric keys: fix printk format warning
    MODSIGN: Fix 32-bit overflow in X.509 certificate validity date checking
    MODSIGN: Make mrproper should remove generated files.
    MODSIGN: Use utf8 strings in signer's name in autogenerated X.509 certs
    MODSIGN: Use the same digest for the autogen key sig as for the module sig
    MODSIGN: Sign modules during the build process
    MODSIGN: Provide a script for generating a key ID from an X.509 cert
    MODSIGN: Implement module signature checking
    MODSIGN: Provide module signing public keys to the kernel
    MODSIGN: Automatically generate module signing keys if missing
    MODSIGN: Provide Kconfig options
    MODSIGN: Provide gitignore and make clean rules for extra files
    MODSIGN: Add FIPS policy
    module: signature checking hook
    X.509: Add a crypto key parser for binary (DER) X.509 certificates
    MPILIB: Provide a function to read raw data into an MPI
    X.509: Add an ASN.1 decoder
    X.509: Add simple ASN.1 grammar compiler
    ...

    Linus Torvalds
     

12 Oct, 2012

1 commit


09 Oct, 2012

4 commits

  • Merge patches from Andrew Morton:
    "A few misc things and very nearly all of the MM tree. A tremendous
    amount of stuff (again), including a significant rbtree library
    rework."

    * emailed patches from Andrew Morton : (160 commits)
    sparc64: Support transparent huge pages.
    mm: thp: Use more portable PMD clearing sequenece in zap_huge_pmd().
    mm: Add and use update_mmu_cache_pmd() in transparent huge page code.
    sparc64: Document PGD and PMD layout.
    sparc64: Eliminate PTE table memory wastage.
    sparc64: Halve the size of PTE tables
    sparc64: Only support 4MB huge pages and 8KB base pages.
    memory-hotplug: suppress "Trying to free nonexistent resource " warning
    mm: memcg: clean up mm_match_cgroup() signature
    mm: document PageHuge somewhat
    mm: use %pK for /proc/vmallocinfo
    mm, thp: fix mlock statistics
    mm, thp: fix mapped pages avoiding unevictable list on mlock
    memory-hotplug: update memory block's state and notify userspace
    memory-hotplug: preparation to notify memory block's state at memory hot remove
    mm: avoid section mismatch warning for memblock_type_name
    make GFP_NOTRACK definition unconditional
    cma: decrease cc.nr_migratepages after reclaiming pagelist
    CMA: migrate mlocked pages
    kpageflags: fix wrong KPF_THP on non-huge compound pages
    ...

    Linus Torvalds
     
  • A long time ago, in v2.4, VM_RESERVED kept swapout process off VMA,
    currently it lost original meaning but still has some effects:

    | effect | alternative flags
    -+------------------------+---------------------------------------------
    1| account as reserved_vm | VM_IO
    2| skip in core dump | VM_IO, VM_DONTDUMP
    3| do not merge or expand | VM_IO, VM_DONTEXPAND, VM_HUGETLB, VM_PFNMAP
    4| do not mlock | VM_IO, VM_DONTEXPAND, VM_HUGETLB, VM_PFNMAP

    This patch removes reserved_vm counter from mm_struct. Seems like nobody
    cares about it, it does not exported into userspace directly, it only
    reduces total_vm showed in proc.

    Thus VM_RESERVED can be replaced with VM_IO or pair VM_DONTEXPAND | VM_DONTDUMP.

    remap_pfn_range() and io_remap_pfn_range() set VM_IO|VM_DONTEXPAND|VM_DONTDUMP.
    remap_vmalloc_range() set VM_DONTEXPAND | VM_DONTDUMP.

    [akpm@linux-foundation.org: drivers/vfio/pci/vfio_pci.c fixup]
    Signed-off-by: Konstantin Khlebnikov
    Cc: Alexander Viro
    Cc: Carsten Otte
    Cc: Chris Metcalf
    Cc: Cyrill Gorcunov
    Cc: Eric Paris
    Cc: H. Peter Anvin
    Cc: Hugh Dickins
    Cc: Ingo Molnar
    Cc: James Morris
    Cc: Jason Baron
    Cc: Kentaro Takeda
    Cc: Matt Helsley
    Cc: Nick Piggin
    Cc: Oleg Nesterov
    Cc: Peter Zijlstra
    Cc: Robert Richter
    Cc: Suresh Siddha
    Cc: Tetsuo Handa
    Cc: Venkatesh Pallipadi
    Acked-by: Linus Torvalds
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Konstantin Khlebnikov
     
  • Some security modules and oprofile still uses VM_EXECUTABLE for retrieving
    a task's executable file. After this patch they will use mm->exe_file
    directly. mm->exe_file is protected with mm->mmap_sem, so locking stays
    the same.

    Signed-off-by: Konstantin Khlebnikov
    Acked-by: Chris Metcalf [arch/tile]
    Acked-by: Tetsuo Handa [tomoyo]
    Cc: Alexander Viro
    Cc: Carsten Otte
    Cc: Cyrill Gorcunov
    Cc: Eric Paris
    Cc: H. Peter Anvin
    Cc: Hugh Dickins
    Cc: Ingo Molnar
    Acked-by: James Morris
    Cc: Jason Baron
    Cc: Kentaro Takeda
    Cc: Matt Helsley
    Cc: Nick Piggin
    Cc: Oleg Nesterov
    Cc: Peter Zijlstra
    Cc: Robert Richter
    Cc: Suresh Siddha
    Cc: Venkatesh Pallipadi
    Acked-by: Linus Torvalds
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Konstantin Khlebnikov
     
  • Pull asm-generic updates from Arnd Bergmann:
    "This has three changes for asm-generic that did not really fit into
    any other branch as normal asm-generic changes do. One is a fix for a
    build warning, the other two are more interesting:

    * A patch from Mark Brown to allow using the common clock
    infrastructure on all architectures, so we can use the clock API in
    architecture independent device drivers.

    * The UAPI split patches from David Howells for the asm-generic
    files. There are other architecture specific series that are going
    through the arch maintainer tree and that depend on this one.

    There may be a few small merge conflicts between Mark's patch and the
    following arch header file split patches. In each case the solution
    will be to keep the new "generic-y += clkdev.h" line, even if it ends
    up being the only line in the Kbuild file."

    * tag 'asm-generic' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
    UAPI: (Scripted) Disintegrate include/asm-generic
    asm-generic: Add default clkdev.h
    asm-generic: xor: mark static functions as __maybe_unused

    Linus Torvalds
     

08 Oct, 2012

1 commit

  • Give the key type the opportunity to preparse the payload prior to the
    instantiation and update routines being called. This is done with the
    provision of two new key type operations:

    int (*preparse)(struct key_preparsed_payload *prep);
    void (*free_preparse)(struct key_preparsed_payload *prep);

    If the first operation is present, then it is called before key creation (in
    the add/update case) or before the key semaphore is taken (in the update and
    instantiate cases). The second operation is called to clean up if the first
    was called.

    preparse() is given the opportunity to fill in the following structure:

    struct key_preparsed_payload {
    char *description;
    void *type_data[2];
    void *payload;
    const void *data;
    size_t datalen;
    size_t quotalen;
    };

    Before the preparser is called, the first three fields will have been cleared,
    the payload pointer and size will be stored in data and datalen and the default
    quota size from the key_type struct will be stored into quotalen.

    The preparser may parse the payload in any way it likes and may store data in
    the type_data[] and payload fields for use by the instantiate() and update()
    ops.

    The preparser may also propose a description for the key by attaching it as a
    string to the description field. This can be used by passing a NULL or ""
    description to the add_key() system call or the key_create_or_update()
    function. This cannot work with request_key() as that required the description
    to tell the upcall about the key to be created.

    This, for example permits keys that store PGP public keys to generate their own
    name from the user ID and public key fingerprint in the key.

    The instantiate() and update() operations are then modified to look like this:

    int (*instantiate)(struct key *key, struct key_preparsed_payload *prep);
    int (*update)(struct key *key, struct key_preparsed_payload *prep);

    and the new payload data is passed in *prep, whether or not it was preparsed.

    Signed-off-by: David Howells
    Signed-off-by: Rusty Russell

    David Howells
     

07 Oct, 2012

1 commit


06 Oct, 2012

4 commits

  • This patch replaces the "whitelist" usage in the code and comments and replace
    them by exception list related information.

    Signed-off-by: Aristeu Rozanski
    Cc: Tejun Heo
    Cc: Li Zefan
    Cc: James Morris
    Cc: Pavel Emelyanov
    Acked-by: Serge E. Hallyn
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Aristeu Rozanski
     
  • The original model of device_cgroup is having a whitelist where all the
    allowed devices are listed. The problem with this approach is that is
    impossible to have the case of allowing everything but few devices.

    The reason for that lies in the way the whitelist is handled internally:
    since there's only a whitelist, the "all devices" entry would have to be
    removed and replaced by the entire list of possible devices but the ones
    that are being denied. Since dev_t is 32 bits long, representing the allowed
    devices as a bitfield is not memory efficient.

    This patch replaces the "whitelist" by a "exceptions" list and the default
    policy is kept as "deny_all" variable in dev_cgroup structure.

    The current interface determines that whenever "a" is written to devices.allow
    or devices.deny, the entry masking all devices will be added or removed,
    respectively. This behavior is kept and it's what will determine the default
    policy:

    # cat devices.list
    a *:* rwm
    # echo a >devices.deny
    # cat devices.list
    # echo a >devices.allow
    # cat devices.list
    a *:* rwm

    The interface is also preserved. For example, if one wants to block only access
    to /dev/null:
    # ls -l /dev/null
    crw-rw-rw- 1 root root 1, 3 Jul 24 16:17 /dev/null
    # echo a >devices.allow
    # echo "c 1:3 rwm" >devices.deny
    # cat /dev/null
    cat: /dev/null: Operation not permitted
    # echo >/dev/null
    bash: /dev/null: Operation not permitted
    mknod /tmp/null c 1 3
    mknod: `/tmp/null': Operation not permitted
    # echo "c 1:3 r" >devices.allow
    # cat /dev/null
    # echo >/dev/null
    bash: /dev/null: Operation not permitted
    mknod /tmp/null c 1 3
    mknod: `/tmp/null': Operation not permitted
    # echo "c 1:3 rw" >devices.allow
    # echo >/dev/null
    # cat /dev/null
    # mknod /tmp/null c 1 3
    mknod: `/tmp/null': Operation not permitted
    # echo "c 1:3 rwm" >devices.allow
    # echo >/dev/null
    # cat /dev/null
    # mknod /tmp/null c 1 3
    #

    Note that I didn't rename the functions/variables in this patch, but in the
    next one to make reviewing easier.

    Signed-off-by: Aristeu Rozanski
    Cc: Tejun Heo
    Cc: Li Zefan
    Cc: James Morris
    Cc: Pavel Emelyanov
    Acked-by: Serge E. Hallyn
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Aristeu Rozanski
     
  • This function cleans all the items in a whitelist and will be used by the next
    patches.

    Signed-off-by: Aristeu Rozanski
    Cc: Tejun Heo
    Cc: Li Zefan
    Cc: James Morris
    Cc: Pavel Emelyanov
    Acked-by: Serge E. Hallyn
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Aristeu Rozanski
     
  • deny_all will determine if the default policy is to deny all device access
    unless for the ones in the exception list.

    This variable will be used in the next patches to convert device_cgroup
    internally into a default policy + rules.

    Signed-off-by: Aristeu Rozanski
    Cc: Tejun Heo
    Cc: Li Zefan
    Cc: James Morris
    Cc: Pavel Emelyanov
    Acked-by: Serge E. Hallyn
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Aristeu Rozanski
     

05 Oct, 2012

2 commits


03 Oct, 2012

2 commits

  • Pull security subsystem updates from James Morris:
    "Highlights:

    - Integrity: add local fs integrity verification to detect offline
    attacks
    - Integrity: add digital signature verification
    - Simple stacking of Yama with other LSMs (per LSS discussions)
    - IBM vTPM support on ppc64
    - Add new driver for Infineon I2C TIS TPM
    - Smack: add rule revocation for subject labels"

    Fixed conflicts with the user namespace support in kernel/auditsc.c and
    security/integrity/ima/ima_policy.c.

    * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (39 commits)
    Documentation: Update git repository URL for Smack userland tools
    ima: change flags container data type
    Smack: setprocattr memory leak fix
    Smack: implement revoking all rules for a subject label
    Smack: remove task_wait() hook.
    ima: audit log hashes
    ima: generic IMA action flag handling
    ima: rename ima_must_appraise_or_measure
    audit: export audit_log_task_info
    tpm: fix tpm_acpi sparse warning on different address spaces
    samples/seccomp: fix 31 bit build on s390
    ima: digital signature verification support
    ima: add support for different security.ima data types
    ima: add ima_inode_setxattr/removexattr function and calls
    ima: add inode_post_setattr call
    ima: replace iint spinblock with rwlock/read_lock
    ima: allocating iint improvements
    ima: add appraise action keywords and default rules
    ima: integrity appraisal extension
    vfs: move ima_file_free before releasing the file
    ...

    Linus Torvalds
     
  • Pull vfs update from Al Viro:

    - big one - consolidation of descriptor-related logics; almost all of
    that is moved to fs/file.c

    (BTW, I'm seriously tempted to rename the result to fd.c. As it is,
    we have a situation when file_table.c is about handling of struct
    file and file.c is about handling of descriptor tables; the reasons
    are historical - file_table.c used to be about a static array of
    struct file we used to have way back).

    A lot of stray ends got cleaned up and converted to saner primitives,
    disgusting mess in android/binder.c is still disgusting, but at least
    doesn't poke so much in descriptor table guts anymore. A bunch of
    relatively minor races got fixed in process, plus an ext4 struct file
    leak.

    - related thing - fget_light() partially unuglified; see fdget() in
    there (and yes, it generates the code as good as we used to have).

    - also related - bits of Cyrill's procfs stuff that got entangled into
    that work; _not_ all of it, just the initial move to fs/proc/fd.c and
    switch of fdinfo to seq_file.

    - Alex's fs/coredump.c spiltoff - the same story, had been easier to
    take that commit than mess with conflicts. The rest is a separate
    pile, this was just a mechanical code movement.

    - a few misc patches all over the place. Not all for this cycle,
    there'll be more (and quite a few currently sit in akpm's tree)."

    Fix up trivial conflicts in the android binder driver, and some fairly
    simple conflicts due to two different changes to the sock_alloc_file()
    interface ("take descriptor handling from sock_alloc_file() to callers"
    vs "net: Providing protocol type via system.sockprotoname xattr of
    /proc/PID/fd entries" adding a dentry name to the socket)

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (72 commits)
    MAX_LFS_FILESIZE should be a loff_t
    compat: fs: Generic compat_sys_sendfile implementation
    fs: push rcu_barrier() from deactivate_locked_super() to filesystems
    btrfs: reada_extent doesn't need kref for refcount
    coredump: move core dump functionality into its own file
    coredump: prevent double-free on an error path in core dumper
    usb/gadget: fix misannotations
    fcntl: fix misannotations
    ceph: don't abuse d_delete() on failure exits
    hypfs: ->d_parent is never NULL or negative
    vfs: delete surplus inode NULL check
    switch simple cases of fget_light to fdget
    new helpers: fdget()/fdput()
    switch o2hb_region_dev_write() to fget_light()
    proc_map_files_readdir(): don't bother with grabbing files
    make get_file() return its argument
    vhost_set_vring(): turn pollstart/pollstop into bool
    switch prctl_set_mm_exe_file() to fget_light()
    switch xfs_find_handle() to fget_light()
    switch xfs_swapext() to fget_light()
    ...

    Linus Torvalds