Eric Lee / smarc-fsl-linux-kernel

27 Feb, 2007

2 commits

  • 4f4acf3a4   Always initialize scontext and scontext_len ... Browse Code »

    Always initialize *scontext and *scontext_len in security_sid_to_context.

    (via http://lkml.org/lkml/2007/2/23/135)

    Signed-off-by: Stephen Smalley
    Signed-off-by: James Morris

    Stephen Smalley
     
  • fadcdb451   Reassign printk levels in selinux kernel code ... Browse Code »

    Below is a patch which demotes many printk lines to KERN_DEBUG from
    KERN_INFO. It should help stop the spamming of logs with messages in
    which users are not interested nor is there any action that users should
    take. It also promotes some KERN_INFO to KERN_ERR such as when there
    are improper attempts to register/unregister security modules.

    A similar patch was discussed a while back on list:
    http://marc.theaimsgroup.com/?t=116656343500003&r=1&w=2
    This patch addresses almost all of the issues raised. I believe the
    only advice not taken was in the demoting of messages related to
    undefined permissions and classes.

    Signed-off-by: Eric Paris
    Acked-by: Stephen Smalley

    security/selinux/hooks.c | 20 ++++++++++----------
    security/selinux/ss/avtab.c | 2 +-
    security/selinux/ss/policydb.c | 6 +++---
    security/selinux/ss/sidtab.c | 2 +-
    4 files changed, 15 insertions(+), 15 deletions(-)
    Signed-off-by: James Morris

    Eric Paris
     

15 Feb, 2007

4 commits

  • bbaca6c2e   [PATCH] selinux: enhance selinux to always ignore private inodes ... Browse Code »

    Hmmm...turns out to not be quite enough, as the /proc/sys inodes aren't truly
    private to the fs, so we can run into them in a variety of security hooks
    beyond just the inode hooks, such as security_file_permission (when reading
    and writing them via the vfs helpers), security_sb_mount (when mounting other
    filesystems on directories in proc like binfmt_misc), and deeper within the
    security module itself (as in flush_unauthorized_files upon inheritance across
    execve). So I think we have to add an IS_PRIVATE() guard within SELinux, as
    below. Note however that the use of the private flag here could be confusing,
    as these inodes are _not_ private to the fs, are exposed to userspace, and
    security modules must implement the sysctl hook to get any access control over
    them.

    Signed-off-by: Eric W. Biederman
    Signed-off-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • b599fdfdb   [PATCH] sysctl: fix the selinux_sysctl_get_sid ... Browse Code »

    I goofed and when reenabling the fine grained selinux labels for
    sysctls and forgot to add the "/sys" prefix before consulting
    the policy database. When computing the same path using
    proc_dir_entries we got the "/sys" for free as it was part
    of the tree, but it isn't true for clt_table trees.

    Signed-off-by: Eric W. Biederman
    Acked-by: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Eric W. Biederman
     
  • 3fbfa9811   [PATCH] sysctl: remove the proc_dir_entry member for the sysctl tables ... Browse Code »

    It isn't needed anymore, all of the users are gone, and all of the ctl_table
    initializers have been converted to use explicit names of the fields they are
    initializing.

    [akpm@osdl.org: NTFS fix]
    Signed-off-by: Eric W. Biederman
    Acked-by: Stephen Smalley
    Cc: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Eric W. Biederman
     
  • cd354f1ae   [PATCH] remove many unneeded #includes of sched.h ... Browse Code »

    After Al Viro (finally) succeeded in removing the sched.h #include in module.h
    recently, it makes sense again to remove other superfluous sched.h includes.
    There are quite a lot of files which include it but don't actually need
    anything defined in there. Presumably these includes were once needed for
    macros that used to live in sched.h, but moved to other header files in the
    course of cleaning it up.

    To ease the pain, this time I did not fiddle with any header files and only
    removed #includes from .c-files, which tend to cause less trouble.

    Compile tested against 2.6.20-rc2 and 2.6.20-rc2-mm2 (with offsets) on alpha,
    arm, i386, ia64, mips, powerpc, and x86_64 with allnoconfig, defconfig,
    allmodconfig, and allyesconfig as well as a few randconfigs on x86_64 and all
    configs in arch/arm/configs on arm. I also checked that no new warnings were
    introduced by the patch (actually, some warnings are removed that were emitted
    by unnecessarily included header files).

    Signed-off-by: Tim Schmielau
    Acked-by: Russell King
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Tim Schmielau
     

13 Feb, 2007

1 commit

  • 9c2e08c59   [PATCH] mark struct file_operations const 9 ... Browse Code »

    Many struct file_operations in the kernel can be "const". Marking them const
    moves these to the .rodata section, which avoids false sharing with potential
    dirty data. In addition it'll catch accidental writes at compile time to
    these shared resources.

    Signed-off-by: Arjan van de Ven
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Arjan van de Ven
     

12 Feb, 2007

2 commits

07 Feb, 2007

1 commit

  • 9ad0830f3   [PATCH] Keys: Fix key serial number collision handling ... Browse Code »

    Fix the key serial number collision avoidance code in key_alloc_serial().

    This didn't use to be so much of a problem as the key serial numbers were
    allocated from a simple incremental counter, and it would have to go through
    two billion keys before it could possibly encounter a collision. However, now
    that random numbers are used instead, collisions are much more likely.

    This is fixed by finding a hole in the rbtree where the next unused serial
    number ought to be and using that by going almost back to the top of the
    insertion routine and redoing the insertion with the new serial number rather
    than trying to be clever and attempting to work out the insertion point
    pointer directly.

    This fixes kernel BZ #7727.

    Signed-off-by: David Howells
    Signed-off-by: Linus Torvalds

    David Howells
     

27 Jan, 2007

1 commit

24 Jan, 2007

1 commit

  • 334c85569   [SELINUX]: increment flow cache genid ... Browse Code »

    Currently, old flow cache entries remain valid even after
    a reload of SELinux policy.

    This patch increments the flow cache generation id
    on policy (re)loads so that flow cache entries are
    revalidated as needed.

    Thanks to Herbet Xu for pointing this out. See:
    http://marc.theaimsgroup.com/?l=linux-netdev&m=116841378704536&w=2

    There's also a general issue as well as a solution proposed
    by David Miller for when flow_cache_genid wraps. I might be
    submitting a separate patch for that later.

    I request that this be applied to 2.6.20 since it's
    a security relevant fix.

    Signed-off-by: Venkat Yekkirala
    Signed-off-by: David S. Miller

    Venkat Yekkirala
     

09 Jan, 2007

2 commits

03 Jan, 2007

1 commit

  • 9883a13c7   [PATCH] selinux: fix selinux_netlbl_inode_permission() locking ... Browse Code »

    do not call a sleeping lock API in an RCU read section.
    lock_sock_nested can sleep, its BH counterpart doesn't.
    selinux_netlbl_inode_permission() needs to use the BH counterpart
    unconditionally.

    Compile tested.

    From: Ingo Molnar

    added BH disabling, because this function can be called from non-atomic
    contexts too, so a naked bh_lock_sock() would be deadlock-prone.

    Boot-tested the resulting kernel.

    Signed-off-by: Parag Warudkar
    Signed-off-by: Ingo Molnar
    Signed-off-by: Linus Torvalds

    Parag Warudkar
     

11 Dec, 2006

1 commit

  • bbea9f696   [PATCH] fdtable: Make fdarray and fdsets equal in size ... Browse Code »

    Currently, each fdtable supports three dynamically-sized arrays of data: the
    fdarray and two fdsets. The code allows the number of fds supported by the
    fdarray (fdtable->max_fds) to differ from the number of fds supported by each
    of the fdsets (fdtable->max_fdset).

    In practice, it is wasteful for these two sizes to differ: whenever we hit a
    limit on the smaller-capacity structure, we will reallocate the entire fdtable
    and all the dynamic arrays within it, so any delta in the memory used by the
    larger-capacity structure will never be touched at all.

    Rather than hogging this excess, we shouldn't even allocate it in the first
    place, and keep the capacities of the fdarray and the fdsets equal. This
    patch removes fdtable->max_fdset. As an added bonus, most of the supporting
    code becomes simpler.

    Signed-off-by: Vadim Lobanov
    Cc: Christoph Hellwig
    Cc: Al Viro
    Cc: Dipankar Sarma
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Vadim Lobanov
     

09 Dec, 2006

2 commits

  • 3d5ff529e   [PATCH] struct path: convert selinux ... Browse Code »

    Signed-off-by: Josef Sipek
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Josef Sipek
     
  • 24ec839c4   [PATCH] tty: ->signal->tty locking ... Browse Code »

    Fix the locking of signal->tty.

    Use ->sighand->siglock to protect ->signal->tty; this lock is already used
    by most other members of ->signal/->sighand. And unless we are 'current'
    or the tasklist_lock is held we need ->siglock to access ->signal anyway.

    (NOTE: sys_unshare() is broken wrt ->sighand locking rules)

    Note that tty_mutex is held over tty destruction, so while holding
    tty_mutex any tty pointer remains valid. Otherwise the lifetime of ttys
    are governed by their open file handles. This leaves some holes for tty
    access from signal->tty (or any other non file related tty access).

    It solves the tty SLAB scribbles we were seeing.

    (NOTE: the change from group_send_sig_info to __group_send_sig_info needs to
    be examined by someone familiar with the security framework, I think
    it is safe given the SEND_SIG_PRIV from other __group_send_sig_info
    invocations)

    [schwidefsky@de.ibm.com: 3270 fix]
    [akpm@osdl.org: various post-viro fixes]
    Signed-off-by: Peter Zijlstra
    Acked-by: Alan Cox
    Cc: Oleg Nesterov
    Cc: Prarit Bhargava
    Cc: Chris Wright
    Cc: Roland McGrath
    Cc: Stephen Smalley
    Cc: James Morris
    Cc: "David S. Miller"
    Cc: Jeff Dike
    Cc: Martin Schwidefsky
    Cc: Jan Kara
    Signed-off-by: Martin Schwidefsky
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Peter Zijlstra
     

08 Dec, 2006

5 commits

06 Dec, 2006

1 commit

05 Dec, 2006

2 commits

03 Dec, 2006

11 commits

  • 6cbda6b6e   Rename class_destroy to avoid namespace conflicts. ... Browse Code »

    We're seeing increasing namespace conflicts between the global
    class_destroy() function declared in linux/device.h, and the private
    function in the SELinux core code. This patch renames the SELinux
    function to cls_destroy() to avoid this conflict.

    Acked-by: Stephen Smalley
    Signed-off-by: James Morris

    James Morris
     
  • 027527603   NetLabel: convert to an extensibile/sparse category bitmap ... Browse Code »

    The original NetLabel category bitmap was a straight char bitmap which worked
    fine for the initial release as it only supported 240 bits due to limitations
    in the CIPSO restricted bitmap tag (tag type 0x01). This patch converts that
    straight char bitmap into an extensibile/sparse bitmap in order to lay the
    foundation for other CIPSO tag types and protocols.

    This patch also has a nice side effect in that all of the security attributes
    passed by NetLabel into the LSM are now in a format which is in the host's
    native byte/bit ordering which makes the LSM specific code much simpler; look
    at the changes in security/selinux/ss/ebitmap.c as an example.

    Signed-off-by: Paul Moore
    Signed-off-by: James Morris

    Paul Moore
     
  • bb22f5808   Compile fix for "peer secid consolidation for external network labeling" ... Browse Code »

    Use a forward declaration instead of dragging in skbuff.h and
    related junk.

    Signed-off-by: James Morris

    James Morris
     
  • 3de4bab5b   SELinux: peer secid consolidation for external network labeling ... Browse Code »

    Now that labeled IPsec makes use of the peer_sid field in the
    sk_security_struct we can remove a lot of the special cases between labeled
    IPsec and NetLabel. In addition, create a new function,
    security_skb_extlbl_sid(), which we can use in several places to get the
    security context of the packet's external label which allows us to further
    simplify the code in a few places.

    Signed-off-by: Paul Moore
    Signed-off-by: James Morris

    Paul Moore
     
  • 9f2ad6650   NetLabel: SELinux cleanups ... Browse Code »

    This patch does a lot of cleanup in the SELinux NetLabel support code. A
    summary of the changes include:

    * Use RCU locking for the NetLabel state variable in the skk_security_struct
    instead of using the inode_security_struct mutex.
    * Remove unnecessary parameters in selinux_netlbl_socket_post_create().
    * Rename selinux_netlbl_sk_clone_security() to
    selinux_netlbl_sk_security_clone() to better fit the other NetLabel
    sk_security functions.
    * Improvements to selinux_netlbl_inode_permission() to help reduce the cost of
    the common case.

    Signed-off-by: Paul Moore
    Signed-off-by: James Morris

    Paul Moore
     
  • 701a90bad   NetLabel: make netlbl_lsm_secattr struct easier/quicker to understand ... Browse Code »

    The existing netlbl_lsm_secattr struct required the LSM to check all of the
    fields to determine if any security attributes were present resulting in a lot
    of work in the common case of no attributes. This patch adds a 'flags' field
    which is used to indicate which attributes are present in the structure; this
    should allow the LSM to do a quick comparison to determine if the structure
    holds any security attributes.

    Example:

    if (netlbl_lsm_secattr->flags)
    /* security attributes present */
    else
    /* NO security attributes present */

    Signed-off-by: Paul Moore
    Signed-off-by: James Morris

    Paul Moore
     
  • 6051e2f4f   [IPv6] prefix: Convert RTM_NEWPREFIX notifications to use the new netlink api ... Browse Code »

    RTM_GETPREFIX is completely unused and is thus removed.

    Signed-off-by: Thomas Graf
    Signed-off-by: David S. Miller

    Thomas Graf
     
  • 2ee92d46c   [SELinux]: Add support for DCCP ... Browse Code »

    This patch implements SELinux kernel support for DCCP
    (http://linux-net.osdl.org/index.php/DCCP), which is similar in
    operation to TCP in terms of connected state between peers.

    The SELinux support for DCCP is thus modeled on existing handling of
    TCP.

    A new DCCP socket class is introduced, to allow protocol
    differentation. The permissions for this class inherit all of the
    socket permissions, as well as the current TCP permissions (node_bind,
    name_bind etc). IPv4 and IPv6 are supported, although labeled
    networking is not, at this stage.

    Patches for SELinux userspace are at:
    http://people.redhat.com/jmorris/selinux/dccp/user/

    I've performed some basic testing, and it seems to be working as
    expected. Adding policy support is similar to TCP, the only real
    difference being that it's a different protocol.

    Acked-by: Stephen Smalley
    Signed-off-by: James Morris
    Signed-off-by: David S. Miller

    James Morris
     
  • 67f83cbf0   SELinux: Fix SA selection semantics ... Browse Code »

    Fix the selection of an SA for an outgoing packet to be at the same
    context as the originating socket/flow. This eliminates the SELinux
    policy's ability to use/sendto SAs with contexts other than the socket's.

    With this patch applied, the SELinux policy will require one or more of the
    following for a socket to be able to communicate with/without SAs:

    1. To enable a socket to communicate without using labeled-IPSec SAs:

    allow socket_t unlabeled_t:association { sendto recvfrom }

    2. To enable a socket to communicate with labeled-IPSec SAs:

    allow socket_t self:association { sendto };
    allow socket_t peer_sa_t:association { recvfrom };

    Signed-off-by: Venkat Yekkirala
    Signed-off-by: James Morris

    Venkat Yekkirala
     
  • 6b877699c   SELinux: Return correct context for SO_PEERSEC ... Browse Code »

    Fix SO_PEERSEC for tcp sockets to return the security context of
    the peer (as represented by the SA from the peer) as opposed to the
    SA used by the local/source socket.

    Signed-off-by: Venkat Yekkirala
    Signed-off-by: James Morris

    Venkat Yekkirala
     
  • c1a856c96   SELinux: Various xfrm labeling fixes ... Browse Code »

    Since the upstreaming of the mlsxfrm modification a few months back,
    testing has resulted in the identification of the following issues/bugs that
    are resolved in this patch set.

    1. Fix the security context used in the IKE negotiation to be the context
    of the socket as opposed to the context of the SPD rule.

    2. Fix SO_PEERSEC for tcp sockets to return the security context of
    the peer as opposed to the source.

    3. Fix the selection of an SA for an outgoing packet to be at the same
    context as the originating socket/flow.

    The following would be the result of applying this patchset:

    - SO_PEERSEC will now correctly return the peer's context.

    - IKE deamons will receive the context of the source socket/flow
    as opposed to the SPD rule's context so that the negotiated SA
    will be at the same context as the source socket/flow.

    - The SELinux policy will require one or more of the
    following for a socket to be able to communicate with/without SAs:

    1. To enable a socket to communicate without using labeled-IPSec SAs:

    allow socket_t unlabeled_t:association { sendto recvfrom }

    2. To enable a socket to communicate with labeled-IPSec SAs:

    allow socket_t self:association { sendto };
    allow socket_t peer_sa_t:association { recvfrom };

    This Patch: Pass correct security context to IKE for use in negotiation

    Fix the security context passed to IKE for use in negotiation to be the
    context of the socket as opposed to the context of the SPD rule so that
    the SA carries the label of the originating socket/flow.

    Signed-off-by: Venkat Yekkirala
    Signed-off-by: James Morris

    Venkat Yekkirala
     

02 Dec, 2006

1 commit

29 Nov, 2006

2 commits

  • b94c7e677   SELinux: validate kernel object classes and permissions ... Browse Code »

    This is a new object class and permission validation scheme that validates
    against the defined kernel headers. This scheme allows extra classes
    and permissions that do not conflict with the kernel definitions to be
    added to the policy. This validation is now done for all policy loads,
    not just subsequent loads after the first policy load.

    The implementation walks the three structrures containing the defined
    object class and permission values and ensures their values are the
    same in the policy being loaded. This includes verifying the object
    classes themselves, the permissions they contain, and the permissions
    they inherit from commons. Classes or permissions that are present in the
    kernel but missing from the policy cause a warning (printed to KERN_INFO)
    to be printed, but do not stop the policy from loading, emulating current
    behavior. Any other inconsistencies cause the load to fail.

    Signed-off-by: Chad Sellers
    Acked-by: Stephen Smalley
    Signed-off-by: James Morris

    Chad Sellers
     
  • bb2424974   SELinux: ensure keys constant in hashtab_search ... Browse Code »

    Makes the key argument passed into hashtab_search and all the functions
    it calls constant. These functions include hash table function pointers
    hash_value and keycmp. The only implementations of these currently
    are symhash and symcmp, which do not modify the key. The key parameter
    should never be changed by any of these, so it should be const. This
    is necessary to allow calling these functions with keys found in kernel
    object class and permission definitions.

    Signed-off-by: Chad Sellers
    Acked-by: Stephen Smalley
    Signed-off-by: James Morris

    Chad Sellers