02 Aug, 2010
40 commits
-
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Commit d74725b9 "TOMOYO: Use callback for updating entries." broke
tomoyo_domain_quota_is_ok() by counting deleted entries. It needs to
count non-deleted entries.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
execmod "could" show up on non regular files and non chr files. The current
implementation would actually make these checks against non-existant bits
since the code assumes the execmod permission is same for all file types.
To make this line up for chr files we had to define execute_no_trans and
entrypoint permissions. These permissions are unreachable and only existed
to to make FILE__EXECMOD and CHR_FILE__EXECMOD the same. This patch drops
those needless perms as well.Signed-off-by: Eric Paris
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
kernel can dynamically remap perms. Drop the open lookup table and put open
in the common file perms.Signed-off-by: Eric Paris
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
Currently there are a number of applications (nautilus being the main one) which
calls access() on files in order to determine how they should be displayed. It
is normal and expected that nautilus will want to see if files are executable
or if they are really read/write-able. access() should return the real
permission. SELinux policy checks are done in access() and can result in lots
of AVC denials as policy denies RWX on files which DAC allows. Currently
SELinux must dontaudit actual attempts to read/write/execute a file in
order to silence these messages (and not flood the logs.) But dontaudit rules
like that can hide real attacks. This patch addes a new common file
permission audit_access. This permission is special in that it is meaningless
and should never show up in an allow rule. Instead the only place this
permission has meaning is in a dontaudit rule like so:dontaudit nautilus_t sbin_t:file audit_access
With such a rule if nautilus just checks access() we will still get denied and
thus userspace will still get the correct answer but we will not log the denial.
If nautilus attempted to actually perform one of the forbidden actions
(rather than just querying access(2) about it) we would still log a denial.
This type of dontaudit rule should be used sparingly, as it could be a
method for an attacker to probe the system permissions without detection.Signed-off-by: Eric Paris
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
SELinux needs to pass the MAY_ACCESS flag so it can handle auditting
correctly. Presently the masking of MAY_* flags is done in the VFS. In
order to allow LSMs to decide what flags they care about and what flags
they don't just pass them all and the each LSM mask off what they don't
need. This patch should contain no functional changes to either the VFS or
any LSM.Signed-off-by: Eric Paris
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
Currently MAY_ACCESS means that filesystems must check the permissions
right then and not rely on cached results or the results of future
operations on the object. This can be because of a call to sys_access() or
because of a call to chdir() which needs to check search without relying on
any future operations inside that dir. I plan to use MAY_ACCESS for other
purposes in the security system, so I split the MAY_ACCESS and the
MAY_CHDIR cases.Signed-off-by: Eric Paris
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
Move the reading of ocontext type data out of policydb_read() in a separate
function ocontext_read()Signed-off-by: Eric Paris
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
move genfs read functionality out of policydb_read() and into a new
function called genfs_read()Signed-off-by: Eric Paris
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
hashtab_create() only returns NULL on allocation failures to -ENOMEM is
appropriate here.Signed-off-by: Dan Carpenter
Acked-by: Eric Paris
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
The original code always returned -1 (-EPERM) on error. The new code
returns either -ENOMEM, or -EINVAL or it propagates the error codes from
lower level functions next_entry() or hashtab_insert().next_entry() returns -EINVAL.
hashtab_insert() returns -EINVAL, -EEXIST, or -ENOMEM.Signed-off-by: Dan Carpenter
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
It's better to propagate the error code from avtab_init() instead of
returning -1 (-EPERM). It turns out that avtab_init() never fails so
this patch doesn't change how the code runs but it's still a clean up.Signed-off-by: Dan Carpenter
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
Originally cond_read_node() returned -1 (-EPERM) on errors which was
incorrect. Now it either propagates the error codes from lower level
functions next_entry() or cond_read_av_list() or it returns -ENOMEM or
-EINVAL.next_entry() returns -EINVAL.
cond_read_av_list() returns -EINVAL or -ENOMEM.Signed-off-by: Dan Carpenter
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
After this patch cond_read_av_list() no longer returns -1 for any
errors. It just propagates error code back from lower levels. Those can
either be -EINVAL or -ENOMEM.I also modified cond_insertf() since cond_read_av_list() passes that as a
function pointer to avtab_read_item(). It isn't used anywhere else.Signed-off-by: Dan Carpenter
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
These are passed back when the security module gets loaded.
The original code always returned -1 (-EPERM) on error but after this
patch it can return -EINVAL, or -ENOMEM or propagate the error code from
cond_read_node(). cond_read_node() still returns -1 all the time, but I
fix that in a later patch.Signed-off-by: Dan Carpenter
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
The avtab_read_item() function tends to return -1 as a default error
code which is wrong (-1 means -EPERM). I modified it to return
appropriate error codes which is -EINVAL or the error code from
next_entry() or insertf().next_entry() returns -EINVAL.
insertf() is a function pointer to either avtab_insert() or
cond_insertf().
avtab_insert() returns -EINVAL, -ENOMEM, and -EEXIST.
cond_insertf() currently returns -1, but I will fix it in a later patch.There is code in avtab_read() which translates the -1 returns from
avtab_read_item() to -EINVAL. The translation is no longer needed, so I
removed it.Signed-off-by: Dan Carpenter
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris -
This fix a little code style issue deleting a space between a function
name and a open parenthesis.Signed-off-by: Chihau Chau
Acked-by: Andrew G. Morgan
Signed-off-by: James Morris -
lookup_one_len increments dentry reference count which is not decremented
when the create operation fails. This can cause a kernel BUG at
fs/dcache.c:676 at unmount time. Also error code returned when new_inode()
fails was replaced with more appropriate -ENOMEM.Signed-off-by: Tvrtko Ursulin
Acked-by: Serge E. Hallyn
Acked-by: Greg Kroah-Hartman
Signed-off-by: James Morris -
The default for llseek will change to no_llseek,
so selinuxfs needs to add explicit .llseek
assignments. Since we're dealing with regular
files from a VFS perspective, use generic_file_llseek.Signed-off-by: Arnd Bergmann
Cc: Stephen Smalley
Cc: Eric Paris
Signed-off-by: James Morris -
The default for llseek will change to no_llseek,
so securityfs users need to add explicit .llseek
assignments. Since we're dealing with regular
files from a VFS perspective, use generic_file_llseek.Signed-off-by: Arnd Bergmann
Cc: Mimi Zohar
Signed-off-by: James Morris -
TOMOYO does not deal offset pointer. Thus seek operation makes
no sense. Changing default seek operation from default_llseek()
to no_llseek() might break some applications. Thus, explicitly
set noop_llseek().Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Make the security extended attributes names global. Updated to move
the remaining Smack xattrs.Signed-off-by: Mimi Zohar
Acked-by: Serge Hallyn
Signed-off-by: James Morris -
In commit bb952bb98a7e479262c7eb25d5592545a3af147d there was the accidental
deletion of a statement from call_sbin_request_key() to render the process
keyring ID to a text string so that it can be passed to /sbin/request-key.With gcc 4.6.0 this causes the following warning:
CC security/keys/request_key.o
security/keys/request_key.c: In function 'call_sbin_request_key':
security/keys/request_key.c:102:15: warning: variable 'prkey' set but not usedThis patch reinstates that statement.
Without this statement, /sbin/request-key will get some random rubbish from the
stack as that parameter.Signed-off-by: Justin P. Mattock
Signed-off-by: David Howells
Signed-off-by: James Morris -
keyctl_describe_key() turns the key reference it gets into a usable key pointer
and assigns that to a variable called 'key', which it then ignores in favour of
recomputing the key pointer each time it needs it. Make it use the precomputed
pointer instead.Without this patch, gcc 4.6 reports that the variable key is set but not used:
building with gcc 4.6 I'm getting a warning message:
CC security/keys/keyctl.o
security/keys/keyctl.c: In function 'keyctl_describe_key':
security/keys/keyctl.c:472:14: warning: variable 'key' set but not usedReported-by: Justin P. Mattock
Signed-off-by: David Howells
Signed-off-by: James Morris -
Commit 1dae08c "TOMOYO: Add interactive enforcing mode." forgot to register
poll() hook. As a result, /usr/sbin/tomoyo-queryd was doing busy loop.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Use shorter name in order to make it easier to fit 80 columns limit.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Split tomoyo_write_profile() into several functions.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
When userspace program reads policy from /sys/kernel/security/tomoyo/
interface, TOMOYO uses line buffered mode. A line has at least one word.Commit 006dacc "TOMOYO: Support longer pathname." changed a word's max length
from 4000 bytes to max kmalloc()able bytes. By that commit, a line's max length
changed from 8192 bytes to more than max kmalloc()able bytes.Max number of words in a line remains finite. This patch changes the way of
buffering so that all words in a line are firstly directly copied to userspace
buffer as much as possible and are secondly queued for next read request.
Words queued are guaranteed to be valid until /sys/kernel/security/tomoyo/
interface is close()d.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
tomoyo_print_..._acl() are similar. Merge them.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Policy editor needs to know allow_execute entries in order to build domain
transition tree. Reading all entries is slow. Thus, allow reading only
allow_execute entries.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Change list_for_each_cookie to
(1) start from current position rather than next position
(2) remove temporary cursor
(3) check that srcu_read_lock() is heldSigned-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Use common code for "initialize_domain"/"no_initialize_domain"/"keep_domain"/
"no_keep_domain" keywords.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Some programs behave differently depending on argv[0] passed to execve().
TOMOYO has "alias" keyword in order to allow administrators to define different
domains if requested pathname passed to execve() is a symlink. But "alias"
keyword is incomplete because this keyword assumes that requested pathname and
argv[0] are identical. Thus, remove "alias" keyword (by this patch) and add
syntax for checking argv[0] (by future patches).Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Use common code for "path_group" and "number_group".
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Now lists are accessible via array index. Aggregate reader functions using index.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Assign list id and make the lists as array of "struct list_head".
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
"struct tomoyo_path_group" and "struct tomoyo_number_group" are identical.
Rename tomoyo_path_group/tomoyo_number_group to tomoyo_group and
tomoyo_path_group_member to tomoyo_path_group and
tomoyo_number_group_member to tomoyo_unmber_group.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
There were a number of places using the following code pattern:
struct cred *cred = current_cred();
struct task_security_struct *tsec = cred->security;... which were simplified to the following:
struct task_security_struct *tsec = current_security();
Signed-off-by: Paul Moore
Acked-by: Eric Paris
Signed-off-by: James Morris -
At present, the socket related access controls use a mix of inode and
socket labels; while there should be no practical difference (they
_should_ always be the same), it makes the code more confusing. This
patch attempts to convert all of the socket related access control
points (with the exception of some of the inode/fd based controls) to
use the socket's own label. In the process, I also converted the
socket_has_perm() function to take a 'sock' argument instead of a
'socket' since that was adding a bit more overhead in some cases.Signed-off-by: Paul Moore
Acked-by: Eric Paris
Signed-off-by: James Morris -
The sk_alloc_security() and sk_free_security() functions were only being
called by the selinux_sk_alloc_security() and selinux_sk_free_security()
functions so we just move the guts of the alloc/free routines to the
callers and eliminate a layer of indirection.Signed-off-by: Paul Moore
Acked-by: Eric Paris
Signed-off-by: James Morris
