Doug / smarc-fsl-linux-kernel

31 Oct, 2005

4 commits

  • bfd51626c   [PATCH] SELinux: remove unecessary size_t checks in selinuxfs ... Browse Code »

    This patch removes a bunch of unecessary checks for (size_t < 0) in
    selinuxfs.

    Signed-off-by: James Morris
    Acked-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Davi Arnaut
     
  • ce4c2bd1a   [PATCH] selinux-canonicalize-getxattr-fix ... Browse Code »

    security/selinux/hooks.c: In function `selinux_inode_getxattr':
    security/selinux/hooks.c:2193: warning: unused variable `sbsec'

    Cc: James Morris
    Cc: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andrew Morton
     
  • d381d8a9a   [PATCH] SELinux: canonicalize getxattr() ... Browse Code »

    This patch allows SELinux to canonicalize the value returned from
    getxattr() via the security_inode_getsecurity() hook, which is called after
    the fs level getxattr() function.

    The purpose of this is to allow the in-core security context for an inode
    to override the on-disk value. This could happen in cases such as
    upgrading a system to a different labeling form (e.g. standard SELinux to
    MLS) without needing to do a full relabel of the filesystem.

    In such cases, we want getxattr() to return the canonical security context
    that the kernel is using rather than what is stored on disk.

    The implementation hooks into the inode_getsecurity(), adding another
    parameter to indicate the result of the preceding fs-level getxattr() call,
    so that SELinux knows whether to compare a value obtained from disk with
    the kernel value.

    We also now allow getxattr() to work for mountpoint labeled filesystems
    (i.e. mount with option context=foo_t), as we are able to return the
    kernel value to the user.

    Signed-off-by: James Morris
    Signed-off-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    James Morris
     
  • 89d155ef6   [PATCH] SELinux: convert to kzalloc ... Browse Code »

    This patch converts SELinux code from kmalloc/memset to the new kazalloc
    unction. On i386, this results in a text saving of over 1K.

    Before:
    text data bss dec hex filename
    86319 4642 15236 106197 19ed5 security/selinux/built-in.o

    After:
    text data bss dec hex filename
    85278 4642 15236 105156 19ac4 security/selinux/built-in.o

    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    James Morris
     

28 Oct, 2005

1 commit

24 Oct, 2005

2 commits

09 Oct, 2005

4 commits

01 Oct, 2005

1 commit

  • 134025800   [PATCH] SELinux - fix SCTP socket bug and general IP protocol handling ... Browse Code »

    The following patch updates the way SELinux classifies and handles IP
    based protocols.

    Currently, IP sockets are classified by SELinux as being either TCP, UDP
    or 'Raw', the latter being a default for IP socket that is not TCP or UDP.

    The classification code is out of date and uses only the socket type
    parameter to socket(2) to determine the class of IP socket. So, any
    socket created with SOCK_STREAM will be classified by SELinux as TCP, and
    SOCK_DGRAM as UDP. Also, other socket types such as SOCK_SEQPACKET and
    SOCK_DCCP are currently ignored by SELinux, which classifies them as
    generic sockets, which means they don't even get basic IP level checking.

    This patch changes the SELinux IP socket classification logic, so that
    only an IPPROTO_IP protocol value passed to socket(2) classify the socket
    as TCP or UDP. The patch also drops the check for SOCK_RAW and converts
    it into a default, so that socket types like SOCK_DCCP and SOCK_SEQPACKET
    are classified as SECCLASS_RAWIP_SOCKET (instead of generic sockets).

    Note that protocol-specific support for SCTP, DCCP etc. is not addressed
    here, we're just getting these protocols checked at the IP layer.

    This fixes a reported problem where SCTP sockets were being recognized as
    generic SELinux sockets yet still being passed in one case to an IP level
    check, which then fails for generic sockets.

    It will also fix bugs where any SOCK_STREAM socket is classified as TCP or
    any SOCK_DGRAM socket is classified as UDP.

    This patch also unifies the way IP sockets classes are determined in
    selinux_socket_bind(), so we use the already calculated value instead of
    trying to recalculate it.

    Signed-off-by: James Morris
    Signed-off-by: Stephen Smalley
    Signed-off-by: Linus Torvalds

    James Morris
     

29 Sep, 2005

1 commit

  • 664cceb00   [PATCH] Keys: Add possessor permissions to keys [try #3] ... Browse Code »

    The attached patch adds extra permission grants to keys for the possessor of a
    key in addition to the owner, group and other permissions bits. This makes
    SUID binaries easier to support without going as far as labelling keys and key
    targets using the LSM facilities.

    This patch adds a second "pointer type" to key structures (struct key_ref *)
    that can have the bottom bit of the address set to indicate the possession of
    a key. This is propagated through searches from the keyring to the discovered
    key. It has been made a separate type so that the compiler can spot attempts
    to dereference a potentially incorrect pointer.

    The "possession" attribute can't be attached to a key structure directly as
    it's not an intrinsic property of a key.

    Pointers to keys have been replaced with struct key_ref *'s wherever
    possession information needs to be passed through.

    This does assume that the bottom bit of the pointer will always be zero on
    return from kmem_cache_alloc().

    The key reference type has been made into a typedef so that at least it can be
    located in the sources, even though it's basically a pointer to an undefined
    type. I've also renamed the accessor functions to be more useful, and all
    reference variables should now end in "_ref".

    Signed-Off-By: David Howells
    Signed-off-by: Linus Torvalds

    David Howells
     

18 Sep, 2005

2 commits

14 Sep, 2005

2 commits

10 Sep, 2005

6 commits

  • b835996f6   [PATCH] files: lock-free fd look-up ... Browse Code »

    With the use of RCU in files structure, the look-up of files using fds can now
    be lock-free. The lookup is protected by rcu_read_lock()/rcu_read_unlock().
    This patch changes the readers to use lock-free lookup.

    Signed-off-by: Maneesh Soni
    Signed-off-by: Ravikiran Thirumalai
    Signed-off-by: Dipankar Sarma
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dipankar Sarma
     
  • badf16621   [PATCH] files: break up files struct ... Browse Code »

    In order for the RCU to work, the file table array, sets and their sizes must
    be updated atomically. Instead of ensuring this through too many memory
    barriers, we put the arrays and their sizes in a separate structure. This
    patch takes the first step of putting the file table elements in a separate
    structure fdtable that is embedded withing files_struct. It also changes all
    the users to refer to the file table using files_fdtable() macro. Subsequent
    applciation of RCU becomes easier after this.

    Signed-off-by: Dipankar Sarma
    Signed-Off-By: David Howells
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dipankar Sarma
     
  • e31e14ec3   [PATCH] remove the inode_post_link and inode_post_rename LSM hooks ... Browse Code »

    This patch removes the inode_post_link and inode_post_rename LSM hooks as
    they are unused (and likely useless).

    Signed-off-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • a74574aaf   [PATCH] Remove security_inode_post_create/mkdir/symlink/mknod hooks ... Browse Code »

    This patch removes the inode_post_create/mkdir/mknod/symlink LSM hooks as
    they are obsoleted by the new inode_init_security hook that enables atomic
    inode security labeling.

    If anyone sees any reason to retain these hooks, please speak now. Also,
    is anyone using the post_rename/link hooks; if not, those could also be
    removed.

    Signed-off-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • 570bc1c2e   [PATCH] tmpfs: Enable atomic inode security labeling ... Browse Code »

    This patch modifies tmpfs to call the inode_init_security LSM hook to set
    up the incore inode security state for new inodes before the inode becomes
    accessible via the dcache.

    As there is no underlying storage of security xattrs in this case, it is
    not necessary for the hook to return the (name, value, len) triple to the
    tmpfs code, so this patch also modifies the SELinux hook function to
    correctly handle the case where the (name, value, len) pointers are NULL.

    The hook call is needed in tmpfs in order to support proper security
    labeling of tmpfs inodes (e.g. for udev with tmpfs /dev in Fedora). With
    this change in place, we should then be able to remove the
    security_inode_post_create/mkdir/... hooks safely.

    Signed-off-by: Stephen Smalley
    Cc: Hugh Dickins
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • 5e41ff9e0   [PATCH] security: enable atomic inode security labeling ... Browse Code »

    The following patch set enables atomic security labeling of newly created
    inodes by altering the fs code to invoke a new LSM hook to obtain the security
    attribute to apply to a newly created inode and to set up the incore inode
    security state during the inode creation transaction. This parallels the
    existing processing for setting ACLs on newly created inodes. Otherwise, it
    is possible for new inodes to be accessed by another thread via the dcache
    prior to complete security setup (presently handled by the
    post_create/mkdir/... LSM hooks in the VFS) and a newly created inode may be
    left unlabeled on the disk in the event of a crash. SELinux presently works
    around the issue by ensuring that the incore inode security label is
    initialized to a special SID that is inaccessible to unprivileged processes
    (in accordance with policy), thereby preventing inappropriate access but
    potentially causing false denials on legitimate accesses. A simple test
    program demonstrates such false denials on SELinux, and the patch solves the
    problem. Similar such false denials have been encountered in real
    applications.

    This patch defines a new inode_init_security LSM hook to obtain the security
    attribute to apply to a newly created inode and to set up the incore inode
    security state for it, and adds a corresponding hook function implementation
    to SELinux.

    Signed-off-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     

05 Sep, 2005

3 commits

  • 48467641b   Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Browse Code »
    Linus Torvalds
     
  • b5bf6c55e   [PATCH] selinux: endian notations ... Browse Code »

    This patch adds endian notations to the SELinux code.

    Signed-off-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     
  • 782ebb992   [PATCH] selinux: Reduce memory use by avtab ... Browse Code »

    This patch improves memory use by SELinux by both reducing the avtab node
    size and reducing the number of avtab nodes. The memory savings are
    substantial, e.g. on a 64-bit system after boot, James Morris reported the
    following data for the targeted and strict policies:

    #objs objsize kernmem
    Targeted:
    Before: 237888 40 9.1MB
    After: 19968 24 468KB

    Strict:
    Before: 571680 40 21.81MB
    After: 221052 24 5.06MB

    The improvement in memory use comes at a cost in the speed of security
    server computations of access vectors, but these computations are only
    required on AVC cache misses, and performance measurements by James Morris
    using a number of benchmarks have shown that the change does not cause any
    significant degradation.

    Note that a rebuilt policy via an updated policy toolchain
    (libsepol/checkpolicy) is required in order to gain the full benefits of
    this patch, although some memory savings benefits are immediately applied
    even to older policies (in particular, the reduction in avtab node size).
    Sources for the updated toolchain are presently available from the
    sourceforge CVS tree (http://sourceforge.net/cvs/?group_id=21266), and
    tarballs are available from http://www.flux.utah.edu/~sds.

    Signed-off-by: Stephen Smalley
    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     

02 Sep, 2005

1 commit

30 Aug, 2005

5 commits

23 Aug, 2005

1 commit

  • 2c40579bd   [PATCH] SECURITY must depend on SYSFS ... Browse Code »

    CONFIG_SECURITY=y and CONFIG_SYSFS=n results in the following compile
    error:

    ...
    LD vmlinux
    security/built-in.o: In function `securityfs_init':
    inode.c:(.init.text+0x1c2): undefined reference to `kernel_subsys'
    make: *** [vmlinux] Error 1

    Signed-off-by: Adrian Bunk
    Signed-off-by: Chris Wright

    Adrian Bunk
     

09 Aug, 2005

1 commit

05 Aug, 2005

2 commits

  • 94efe72f7   [PATCH] Destruction of failed keyring oopses ... Browse Code »

    The attached patch makes sure that a keyring that failed to instantiate
    properly is destroyed without oopsing [CAN-2005-2099].

    The problem occurs in three stages:

    (1) The key allocator initialises the type-specific data to all zeroes. In
    the case of a keyring, this will become a link in the keyring name list
    when the keyring is instantiated.

    (2) If a user (any user) attempts to add a keyring with anything other than
    an empty payload, the keyring instantiation function will fail with an
    error and won't add the keyring to the name list.

    (3) The keyring's destructor then sees that the keyring has a description
    (name) and tries to remove the keyring from the name list, which oopses
    because the link pointers are both zero.

    This bug permits any user to take down a box trivially.

    Signed-Off-By: David Howells
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     
  • bcf945d36   [PATCH] Error during attempt to join key management session can leave semaphore pinned ... Browse Code »

    The attached patch prevents an error during the key session joining operation
    from hanging future joins in the D state [CAN-2005-2098].

    The problem is that the error handling path for the KEYCTL_JOIN_SESSION_KEYRING
    operation has one error path that doesn't release the session management
    semaphore. Further attempts to get the semaphore will then sleep for ever in
    the D state.

    This can happen in four situations, all involving an attempt to allocate a new
    session keyring:

    (1) ENOMEM.

    (2) The users key quota being reached.

    (3) A keyring name that is an empty string.

    (4) A keyring name that is too long.

    Any user may attempt this operation, and so any user can cause the problem to
    occur.

    Signed-Off-By: David Howells
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     

04 Aug, 2005

1 commit

  • 1260f801b   [PATCH] Keys: Fix key management syscall interface bugs ... Browse Code »

    This fixes five bugs in the key management syscall interface:

    (1) add_key() returns 0 rather than EINVAL if the key type is "".

    Checking the key type isn't "" should be left to lookup_user_key().

    (2) request_key() returns ENOKEY rather than EPERM if the key type begins
    with a ".".

    lookup_user_key() can't do this because internal key types begin with a
    ".".

    (3) Key revocation always returns 0, even if it fails.

    (4) Key read can return EAGAIN rather than EACCES under some circumstances.

    A key is permitted to by read by a process if it doesn't grant read
    access, but it does grant search access and it is in the process's
    keyrings. That search returns EAGAIN if it fails, and this needs
    translating to EACCES.

    (5) request_key() never adds the new key to the destination keyring if one is
    supplied.

    The wrong macro was being used to test for an error condition: PTR_ERR()
    will always return true, whether or not there's an error; this should've
    been IS_ERR().

    Signed-Off-By: David Howells
    Signed-Off-By: Linus Torvalds

    David Howells
     

29 Jul, 2005

1 commit

  • 911656f8a   [PATCH] selinux: Fix address length checks in connect hook ... Browse Code »

    This patch fixes the address length checks in the selinux_socket_connect
    hook to be no more restrictive than the underlying ipv4 and ipv6 code;
    otherwise, this hook can reject valid connect calls. This patch is in
    response to a bug report where an application was calling connect on an
    INET6 socket with an address that didn't include the optional scope id and
    failing due to these checks.

    Signed-off-by: Stephen Smalley
    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     

28 Jul, 2005

1 commit

  • f5c1d5b2a   [PATCH] SELinux: default labeling of MLS field ... Browse Code »

    Implement kernel labeling of the MLS (multilevel security) field of
    security contexts for files which have no existing MLS field. This is to
    enable upgrades of a system from non-MLS to MLS without performing a full
    filesystem relabel including all of the mountpoints, which would be quite
    painful for users.

    With this patch, with MLS enabled, if a file has no MLS field, the kernel
    internally adds an MLS field to the in-core inode (but not to the on-disk
    file). This MLS field added is the default for the superblock, allowing
    per-mountpoint control over the values via fixed policy or mount options.

    This patch has been tested by enabling MLS without relabeling its
    filesystem, and seems to be working correctly.

    Signed-off-by: James Morris
    Signed-off-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    James Morris
     

13 Jul, 2005

1 commit