Eric Lee / smarc-fsl-linux-kernel

21 Nov, 2016

1 commit

  • 3d40658c9   apparmor: fix change_hat not finding hat after policy replacement ... Browse Code »

    After a policy replacement, the task cred may be out of date and need
    to be updated. However change_hat is using the stale profiles from
    the out of date cred resulting in either: a stale profile being applied
    or, incorrect failure when searching for a hat profile as it has been
    migrated to the new parent profile.

    Fixes: 01e2b670aa898a39259bc85c78e3d74820f4d3b6 (failure to find hat)
    Fixes: 898127c34ec03291c86f4ff3856d79e9e18952bc (stale policy being applied)
    Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1000287
    Cc: stable@vger.kernel.org
    Signed-off-by: John Johansen
    Signed-off-by: James Morris

    John Johansen
     

28 Sep, 2016

1 commit

  • 078cd8279   fs: Replace CURRENT_TIME with current_time() for inode timestamps ... Browse Code »

    CURRENT_TIME macro is not appropriate for filesystems as it
    doesn't use the right granularity for filesystem timestamps.
    Use current_time() instead.

    CURRENT_TIME is also not y2038 safe.

    This is also in preparation for the patch that transitions
    vfs timestamps to use 64 bit time and hence make them
    y2038 safe. As part of the effort current_time() will be
    extended to do range checks. Hence, it is necessary for all
    file system timestamps to use current_time(). Also,
    current_time() will be transitioned along with vfs to be
    y2038 safe.

    Note that whenever a single call to current_time() is used
    to change timestamps in different inodes, it is because they
    share the same time granularity.

    Signed-off-by: Deepa Dinamani
    Reviewed-by: Arnd Bergmann
    Acked-by: Felipe Balbi
    Acked-by: Steven Whitehouse
    Acked-by: Ryusuke Konishi
    Acked-by: David Sterba
    Signed-off-by: Al Viro

    Deepa Dinamani
     

27 Jul, 2016

1 commit

  • 7616ac70d   apparmor: fix SECURITY_APPARMOR_HASH_DEFAULT parameter handling ... Browse Code »

    The newly added Kconfig option could never work and just causes a build error
    when disabled:

    security/apparmor/lsm.c:675:25: error: 'CONFIG_SECURITY_APPARMOR_HASH_DEFAULT' undeclared here (not in a function)
    bool aa_g_hash_policy = CONFIG_SECURITY_APPARMOR_HASH_DEFAULT;

    The problem is that the macro undefined in this case, and we need to use the IS_ENABLED()
    helper to turn it into a boolean constant.

    Another minor problem with the original patch is that the option is even offered
    in sysfs when SECURITY_APPARMOR_HASH is not enabled, so this also hides the option
    in that case.

    Signed-off-by: Arnd Bergmann
    Fixes: 6059f71f1e94 ("apparmor: add parameter to control whether policy hashing is used")
    Signed-off-by: John Johansen
    Signed-off-by: James Morris

    Arnd Bergmann
     

12 Jul, 2016

24 commits

28 Mar, 2016

12 commits

22 Oct, 2015

1 commit

  • 083c1290c   apparmor: clarify CRYPTO dependency ... Browse Code »

    The crypto framework can be built as a loadable module, but the
    apparmor hash code can only be built-in, which then causes a
    link error:

    security/built-in.o: In function `aa_calc_profile_hash':
    integrity_audit.c:(.text+0x21610): undefined reference to `crypto_shash_update'
    security/built-in.o: In function `init_profile_hash':
    integrity_audit.c:(.init.text+0xb4c): undefined reference to `crypto_alloc_shash'

    This changes Apparmor to use 'select CRYPTO' like a lot of other
    subsystems do.

    Signed-off-by: Arnd Bergmann
    Acked-by: John Johansen
    Signed-off-by: James Morris

    Arnd Bergmann