Eric Lee / linux-smarc-t335x-v3.2

09 Nov, 2005

3 commits

  • ce9982d04   [PATCH] selinux: extend selinuxfs context interface ... Browse Code »

    This patch extends the selinuxfs context interface to allow return the
    canonical form of the context to userspace.

    Signed-off-by: Stephen Smalley
    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • 25a74f3ba   [PATCH] selinux: disable setxattr on mountpoint labeled filesystems ... Browse Code »

    This patch disables the setting of SELinux xattrs on files created in
    filesystems labeled via mountpoint labeling (mounted with the context=
    option). selinux_inode_setxattr already prevents explicit setxattr from
    userspace on such filesystems, so this provides consistent behavior for
    file creation.

    Signed-off-by: Stephen Smalley
    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • e517a0cd8   [PATCH] selinux: MLS compatibility ... Browse Code »

    This patch enables files created on a MLS-enabled SELinux system to be
    accessible on a non-MLS SELinux system, by skipping the MLS component of
    the security context in the non-MLS case.

    Signed-off-by: Stephen Smalley
    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     

07 Nov, 2005

2 commits

31 Oct, 2005

9 commits

  • 621d31219   [PATCH] cleanup the usage of SEND_SIG_xxx constants ... Browse Code »

    This patch simplifies some checks for magic siginfo values. It should not
    change the behaviour in any way.

    Signed-off-by: Oleg Nesterov
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Oleg Nesterov
     
  • b67a1b9e4   [PATCH] remove hardcoded SEND_SIG_xxx constants ... Browse Code »

    This patch replaces hardcoded SEND_SIG_xxx constants with
    their symbolic names.

    No changes in affected .o files.

    Signed-off-by: Oleg Nesterov
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Oleg Nesterov
     
  • 29db91906   [PATCH] Keys: Add LSM hooks for key management [try #3] ... Browse Code »

    The attached patch adds LSM hooks for key management facilities. The notable
    changes are:

    (1) The key struct now supports a security pointer for the use of security
    modules. This will permit key labelling and restrictions on which
    programs may access a key.

    (2) Security modules get a chance to note (or abort) the allocation of a key.

    (3) The key permission checking can now be enhanced by the security modules;
    the permissions check consults LSM if all other checks bear out.

    (4) The key permissions checking functions now return an error code rather
    than a boolean value.

    (5) An extra permission has been added to govern the modification of
    attributes (UID, GID, permissions).

    Note that there isn't an LSM hook specifically for each keyctl() operation,
    but rather the permissions hook allows control of individual operations based
    on the permission request bits.

    Key management access control through LSM is enabled by automatically if both
    CONFIG_KEYS and CONFIG_SECURITY are enabled.

    This should be applied on top of the patch ensubjected:

    [PATCH] Keys: Possessor permissions should be additive

    Signed-Off-By: David Howells
    Signed-off-by: Chris Wright
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     
  • 2aa349f6e   [PATCH] Keys: Export user-defined keyring operations ... Browse Code »

    Export user-defined key operations so that those who wish to define their
    own key type based on the user-defined key operations may do so (as has
    been requested).

    The header file created has been placed into include/keys/user-type.h, thus
    creating a directory where other key types may also be placed. Any
    objections to doing this?

    Signed-Off-By: David Howells
    Signed-Off-By: Arjan van de Ven
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     
  • 2f5120166   [PATCH] reduce sizeof(struct file) ... Browse Code »

    Now that RCU applied on 'struct file' seems stable, we can place f_rcuhead
    in a memory location that is not anymore used at call_rcu(&f->f_rcuhead,
    file_free_rcu) time, to reduce the size of this critical kernel object.

    The trick I used is to move f_rcuhead and f_list in an union called f_u

    The callers are changed so that f_rcuhead becomes f_u.fu_rcuhead and f_list
    becomes f_u.f_list

    Signed-off-by: Eric Dumazet
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Eric Dumazet
     
  • bfd51626c   [PATCH] SELinux: remove unecessary size_t checks in selinuxfs ... Browse Code »

    This patch removes a bunch of unecessary checks for (size_t < 0) in
    selinuxfs.

    Signed-off-by: James Morris
    Acked-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Davi Arnaut
     
  • ce4c2bd1a   [PATCH] selinux-canonicalize-getxattr-fix ... Browse Code »

    security/selinux/hooks.c: In function `selinux_inode_getxattr':
    security/selinux/hooks.c:2193: warning: unused variable `sbsec'

    Cc: James Morris
    Cc: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andrew Morton
     
  • d381d8a9a   [PATCH] SELinux: canonicalize getxattr() ... Browse Code »

    This patch allows SELinux to canonicalize the value returned from
    getxattr() via the security_inode_getsecurity() hook, which is called after
    the fs level getxattr() function.

    The purpose of this is to allow the in-core security context for an inode
    to override the on-disk value. This could happen in cases such as
    upgrading a system to a different labeling form (e.g. standard SELinux to
    MLS) without needing to do a full relabel of the filesystem.

    In such cases, we want getxattr() to return the canonical security context
    that the kernel is using rather than what is stored on disk.

    The implementation hooks into the inode_getsecurity(), adding another
    parameter to indicate the result of the preceding fs-level getxattr() call,
    so that SELinux knows whether to compare a value obtained from disk with
    the kernel value.

    We also now allow getxattr() to work for mountpoint labeled filesystems
    (i.e. mount with option context=foo_t), as we are able to return the
    kernel value to the user.

    Signed-off-by: James Morris
    Signed-off-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    James Morris
     
  • 89d155ef6   [PATCH] SELinux: convert to kzalloc ... Browse Code »

    This patch converts SELinux code from kmalloc/memset to the new kazalloc
    unction. On i386, this results in a text saving of over 1K.

    Before:
    text data bss dec hex filename
    86319 4642 15236 106197 19ed5 security/selinux/built-in.o

    After:
    text data bss dec hex filename
    85278 4642 15236 105156 19ac4 security/selinux/built-in.o

    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    James Morris
     

28 Oct, 2005

1 commit

24 Oct, 2005

2 commits

09 Oct, 2005

4 commits

01 Oct, 2005

1 commit

  • 134025800   [PATCH] SELinux - fix SCTP socket bug and general IP protocol handling ... Browse Code »

    The following patch updates the way SELinux classifies and handles IP
    based protocols.

    Currently, IP sockets are classified by SELinux as being either TCP, UDP
    or 'Raw', the latter being a default for IP socket that is not TCP or UDP.

    The classification code is out of date and uses only the socket type
    parameter to socket(2) to determine the class of IP socket. So, any
    socket created with SOCK_STREAM will be classified by SELinux as TCP, and
    SOCK_DGRAM as UDP. Also, other socket types such as SOCK_SEQPACKET and
    SOCK_DCCP are currently ignored by SELinux, which classifies them as
    generic sockets, which means they don't even get basic IP level checking.

    This patch changes the SELinux IP socket classification logic, so that
    only an IPPROTO_IP protocol value passed to socket(2) classify the socket
    as TCP or UDP. The patch also drops the check for SOCK_RAW and converts
    it into a default, so that socket types like SOCK_DCCP and SOCK_SEQPACKET
    are classified as SECCLASS_RAWIP_SOCKET (instead of generic sockets).

    Note that protocol-specific support for SCTP, DCCP etc. is not addressed
    here, we're just getting these protocols checked at the IP layer.

    This fixes a reported problem where SCTP sockets were being recognized as
    generic SELinux sockets yet still being passed in one case to an IP level
    check, which then fails for generic sockets.

    It will also fix bugs where any SOCK_STREAM socket is classified as TCP or
    any SOCK_DGRAM socket is classified as UDP.

    This patch also unifies the way IP sockets classes are determined in
    selinux_socket_bind(), so we use the already calculated value instead of
    trying to recalculate it.

    Signed-off-by: James Morris
    Signed-off-by: Stephen Smalley
    Signed-off-by: Linus Torvalds

    James Morris
     

29 Sep, 2005

1 commit

  • 664cceb00   [PATCH] Keys: Add possessor permissions to keys [try #3] ... Browse Code »

    The attached patch adds extra permission grants to keys for the possessor of a
    key in addition to the owner, group and other permissions bits. This makes
    SUID binaries easier to support without going as far as labelling keys and key
    targets using the LSM facilities.

    This patch adds a second "pointer type" to key structures (struct key_ref *)
    that can have the bottom bit of the address set to indicate the possession of
    a key. This is propagated through searches from the keyring to the discovered
    key. It has been made a separate type so that the compiler can spot attempts
    to dereference a potentially incorrect pointer.

    The "possession" attribute can't be attached to a key structure directly as
    it's not an intrinsic property of a key.

    Pointers to keys have been replaced with struct key_ref *'s wherever
    possession information needs to be passed through.

    This does assume that the bottom bit of the pointer will always be zero on
    return from kmem_cache_alloc().

    The key reference type has been made into a typedef so that at least it can be
    located in the sources, even though it's basically a pointer to an undefined
    type. I've also renamed the accessor functions to be more useful, and all
    reference variables should now end in "_ref".

    Signed-Off-By: David Howells
    Signed-off-by: Linus Torvalds

    David Howells
     

18 Sep, 2005

2 commits

14 Sep, 2005

2 commits

10 Sep, 2005

6 commits

  • b835996f6   [PATCH] files: lock-free fd look-up ... Browse Code »

    With the use of RCU in files structure, the look-up of files using fds can now
    be lock-free. The lookup is protected by rcu_read_lock()/rcu_read_unlock().
    This patch changes the readers to use lock-free lookup.

    Signed-off-by: Maneesh Soni
    Signed-off-by: Ravikiran Thirumalai
    Signed-off-by: Dipankar Sarma
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dipankar Sarma
     
  • badf16621   [PATCH] files: break up files struct ... Browse Code »

    In order for the RCU to work, the file table array, sets and their sizes must
    be updated atomically. Instead of ensuring this through too many memory
    barriers, we put the arrays and their sizes in a separate structure. This
    patch takes the first step of putting the file table elements in a separate
    structure fdtable that is embedded withing files_struct. It also changes all
    the users to refer to the file table using files_fdtable() macro. Subsequent
    applciation of RCU becomes easier after this.

    Signed-off-by: Dipankar Sarma
    Signed-Off-By: David Howells
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dipankar Sarma
     
  • e31e14ec3   [PATCH] remove the inode_post_link and inode_post_rename LSM hooks ... Browse Code »

    This patch removes the inode_post_link and inode_post_rename LSM hooks as
    they are unused (and likely useless).

    Signed-off-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • a74574aaf   [PATCH] Remove security_inode_post_create/mkdir/symlink/mknod hooks ... Browse Code »

    This patch removes the inode_post_create/mkdir/mknod/symlink LSM hooks as
    they are obsoleted by the new inode_init_security hook that enables atomic
    inode security labeling.

    If anyone sees any reason to retain these hooks, please speak now. Also,
    is anyone using the post_rename/link hooks; if not, those could also be
    removed.

    Signed-off-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • 570bc1c2e   [PATCH] tmpfs: Enable atomic inode security labeling ... Browse Code »

    This patch modifies tmpfs to call the inode_init_security LSM hook to set
    up the incore inode security state for new inodes before the inode becomes
    accessible via the dcache.

    As there is no underlying storage of security xattrs in this case, it is
    not necessary for the hook to return the (name, value, len) triple to the
    tmpfs code, so this patch also modifies the SELinux hook function to
    correctly handle the case where the (name, value, len) pointers are NULL.

    The hook call is needed in tmpfs in order to support proper security
    labeling of tmpfs inodes (e.g. for udev with tmpfs /dev in Fedora). With
    this change in place, we should then be able to remove the
    security_inode_post_create/mkdir/... hooks safely.

    Signed-off-by: Stephen Smalley
    Cc: Hugh Dickins
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • 5e41ff9e0   [PATCH] security: enable atomic inode security labeling ... Browse Code »

    The following patch set enables atomic security labeling of newly created
    inodes by altering the fs code to invoke a new LSM hook to obtain the security
    attribute to apply to a newly created inode and to set up the incore inode
    security state during the inode creation transaction. This parallels the
    existing processing for setting ACLs on newly created inodes. Otherwise, it
    is possible for new inodes to be accessed by another thread via the dcache
    prior to complete security setup (presently handled by the
    post_create/mkdir/... LSM hooks in the VFS) and a newly created inode may be
    left unlabeled on the disk in the event of a crash. SELinux presently works
    around the issue by ensuring that the incore inode security label is
    initialized to a special SID that is inaccessible to unprivileged processes
    (in accordance with policy), thereby preventing inappropriate access but
    potentially causing false denials on legitimate accesses. A simple test
    program demonstrates such false denials on SELinux, and the patch solves the
    problem. Similar such false denials have been encountered in real
    applications.

    This patch defines a new inode_init_security LSM hook to obtain the security
    attribute to apply to a newly created inode and to set up the incore inode
    security state for it, and adds a corresponding hook function implementation
    to SELinux.

    Signed-off-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     

05 Sep, 2005

3 commits

  • 48467641b   Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Browse Code »
    Linus Torvalds
     
  • b5bf6c55e   [PATCH] selinux: endian notations ... Browse Code »

    This patch adds endian notations to the SELinux code.

    Signed-off-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     
  • 782ebb992   [PATCH] selinux: Reduce memory use by avtab ... Browse Code »

    This patch improves memory use by SELinux by both reducing the avtab node
    size and reducing the number of avtab nodes. The memory savings are
    substantial, e.g. on a 64-bit system after boot, James Morris reported the
    following data for the targeted and strict policies:

    #objs objsize kernmem
    Targeted:
    Before: 237888 40 9.1MB
    After: 19968 24 468KB

    Strict:
    Before: 571680 40 21.81MB
    After: 221052 24 5.06MB

    The improvement in memory use comes at a cost in the speed of security
    server computations of access vectors, but these computations are only
    required on AVC cache misses, and performance measurements by James Morris
    using a number of benchmarks have shown that the change does not cause any
    significant degradation.

    Note that a rebuilt policy via an updated policy toolchain
    (libsepol/checkpolicy) is required in order to gain the full benefits of
    this patch, although some memory savings benefits are immediately applied
    even to older policies (in particular, the reduction in avtab node size).
    Sources for the updated toolchain are presently available from the
    sourceforge CVS tree (http://sourceforge.net/cvs/?group_id=21266), and
    tarballs are available from http://www.flux.utah.edu/~sds.

    Signed-off-by: Stephen Smalley
    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     

02 Sep, 2005

1 commit

30 Aug, 2005

3 commits