Eric Lee / smarc-fsl-linux-kernel

05 Jun, 2019

1 commit

  • b886d83c5   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441 ... Browse Code »

    Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation version 2 of the license

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 315 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Allison Randal
    Reviewed-by: Armijn Hemel
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190531190115.503150771@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

21 Dec, 2018

1 commit

03 May, 2018

1 commit

10 Feb, 2018

1 commit

  • d8889d49e   apparmor: move context.h to cred.h ... Browse Code »

    Now that file contexts have been moved into file, and task context
    fns() and data have been split from the context, only the cred context
    remains in context.h so rename to cred.h to better reflect what it
    deals with.

    Signed-off-by: John Johansen

    John Johansen
     

06 Jan, 2018

1 commit

  • 5b9f57cf4   apparmor: fix regression in mount mediation when feature set is pinned ... Browse Code »

    When the mount code was refactored for Labels it was not correctly
    updated to check whether policy supported mediation of the mount
    class. This causes a regression when the kernel feature set is
    reported as supporting mount and policy is pinned to a feature set
    that does not support mount mediation.

    BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882697#41
    Fixes: 2ea3ffb7782a ("apparmor: add mount mediation")
    Reported-by: Fabian Grünbichler
    Cc: Stable
    Signed-off-by: John Johansen

    John Johansen
     

21 Nov, 2017

1 commit

  • 7bba39ae5   apparmor: initialized returned struct aa_perms ... Browse Code »

    gcc-4.4 points out suspicious code in compute_mnt_perms, where
    the aa_perms structure is only partially initialized before getting
    returned:

    security/apparmor/mount.c: In function 'compute_mnt_perms':
    security/apparmor/mount.c:227: error: 'perms.prompt' is used uninitialized in this function
    security/apparmor/mount.c:227: error: 'perms.hide' is used uninitialized in this function
    security/apparmor/mount.c:227: error: 'perms.cond' is used uninitialized in this function
    security/apparmor/mount.c:227: error: 'perms.complain' is used uninitialized in this function
    security/apparmor/mount.c:227: error: 'perms.stop' is used uninitialized in this function
    security/apparmor/mount.c:227: error: 'perms.deny' is used uninitialized in this function

    Returning or assigning partially initialized structures is a bit tricky,
    in particular it is explicitly allowed in c99 to assign a partially
    initialized structure to another, as long as only members are read that
    have been initialized earlier. Looking at what various compilers do here,
    the version that produced the warning copied uninitialized stack data,
    while newer versions (and also clang) either set the other members to
    zero or don't update the parts of the return buffer that are not modified
    in the temporary structure, but they never warn about this.

    In case of apparmor, it seems better to be a little safer and always
    initialize the aa_perms structure. Most users already do that, this
    changes the remaining ones, including the one instance that I got the
    warning for.

    Fixes: fa488437d0f9 ("apparmor: add mount mediation")
    Signed-off-by: Arnd Bergmann
    Reviewed-by: Seth Arnold
    Acked-by: Geert Uytterhoeven
    Signed-off-by: John Johansen

    Arnd Bergmann
     

23 Sep, 2017

1 commit

  • 2ea3ffb77   apparmor: add mount mediation ... Browse Code »

    Add basic mount mediation. That allows controlling based on basic
    mount parameters. It does not include special mount parameters for
    apparmor, super block labeling, or any triggers for apparmor namespace
    parameter modifications on pivot root.

    default userspace policy rules have the form of
    MOUNT RULE = ( MOUNT | REMOUNT | UMOUNT )

    MOUNT = [ QUALIFIERS ] 'mount' [ MOUNT CONDITIONS ] [ SOURCE FILEGLOB ]
    [ '->' MOUNTPOINT FILEGLOB ]

    REMOUNT = [ QUALIFIERS ] 'remount' [ MOUNT CONDITIONS ]
    MOUNTPOINT FILEGLOB

    UMOUNT = [ QUALIFIERS ] 'umount' [ MOUNT CONDITIONS ] MOUNTPOINT FILEGLOB

    MOUNT CONDITIONS = [ ( 'fstype' | 'vfstype' ) ( '=' | 'in' )
    MOUNT FSTYPE EXPRESSION ]
    [ 'options' ( '=' | 'in' ) MOUNT FLAGS EXPRESSION ]

    MOUNT FSTYPE EXPRESSION = ( MOUNT FSTYPE LIST | MOUNT EXPRESSION )

    MOUNT FSTYPE LIST = Comma separated list of valid filesystem and
    virtual filesystem types (eg ext4, debugfs, etc)

    MOUNT FLAGS EXPRESSION = ( MOUNT FLAGS LIST | MOUNT EXPRESSION )

    MOUNT FLAGS LIST = Comma separated list of MOUNT FLAGS.

    MOUNT FLAGS = ( 'ro' | 'rw' | 'nosuid' | 'suid' | 'nodev' | 'dev' |
    'noexec' | 'exec' | 'sync' | 'async' | 'remount' |
    'mand' | 'nomand' | 'dirsync' | 'noatime' | 'atime' |
    'nodiratime' | 'diratime' | 'bind' | 'rbind' | 'move' |
    'verbose' | 'silent' | 'loud' | 'acl' | 'noacl' |
    'unbindable' | 'runbindable' | 'private' | 'rprivate' |
    'slave' | 'rslave' | 'shared' | 'rshared' |
    'relatime' | 'norelatime' | 'iversion' | 'noiversion' |
    'strictatime' | 'nouser' | 'user' )

    MOUNT EXPRESSION = ( ALPHANUMERIC | AARE ) ...

    PIVOT ROOT RULE = [ QUALIFIERS ] pivot_root [ oldroot=OLD PUT FILEGLOB ]
    [ NEW ROOT FILEGLOB ]

    SOURCE FILEGLOB = FILEGLOB

    MOUNTPOINT FILEGLOB = FILEGLOB

    eg.
    mount,
    mount /dev/foo,
    mount options=ro /dev/foo -> /mnt/,
    mount options in (ro,atime) /dev/foo -> /mnt/,
    mount options=ro options=atime,

    Signed-off-by: John Johansen
    Acked-by: Seth Arnold

    John Johansen