Eric Lee / smarc-fsl-linux-kernel

15 Jan, 2012

1 commit

  • c49c41a41   Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security ... Browse Code »

    * 'for-linus' of git://selinuxproject.org/~jmorris/linux-security:
    capabilities: remove __cap_full_set definition
    security: remove the security_netlink_recv hook as it is equivalent to capable()
    ptrace: do not audit capability check when outputing /proc/pid/stat
    capabilities: remove task_ns_* functions
    capabitlies: ns_capable can use the cap helpers rather than lsm call
    capabilities: style only - move capable below ns_capable
    capabilites: introduce new has_ns_capabilities_noaudit
    capabilities: call has_ns_capability from has_capability
    capabilities: remove all _real_ interfaces
    capabilities: introduce security_capable_noaudit
    capabilities: reverse arguments to security_capable
    capabilities: remove the task from capable LSM hook entirely
    selinux: sparse fix: fix several warnings in the security server cod
    selinux: sparse fix: fix warnings in netlink code
    selinux: sparse fix: eliminate warnings for selinuxfs
    selinux: sparse fix: declare selinux_disable() in security.h
    selinux: sparse fix: move selinux_complete_init
    selinux: sparse fix: make selinux_secmark_refcount static
    SELinux: Fix RCU deref check warning in sel_netport_insert()

    Manually fix up a semantic mis-merge wrt security_netlink_recv():

    - the interface was removed in commit fd7784615248 ("security: remove
    the security_netlink_recv hook as it is equivalent to capable()")

    - a new user of it appeared in commit a38f7907b926 ("crypto: Add
    userspace configuration API")

    causing no automatic merge conflict, but Eric Paris pointed out the
    issue.

    Linus Torvalds
     

09 Jan, 2012

1 commit

  • a0e86bd42   audit: always follow va_copy() with va_end() ... Browse Code »

    A call to va_copy() should always be followed by a call to va_end() in
    the same function. In kernel/autit.c::audit_log_vformat() this is not
    always done. This patch makes sure va_end() is always called.

    Signed-off-by: Jesper Juhl
    Cc: Al Viro
    Cc: Eric Paris
    Cc: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jesper Juhl
     

06 Jan, 2012

1 commit

31 Oct, 2011

1 commit

  • 9984de1a5   kernel: Map most files to use export.h instead of module.h ... Browse Code »

    The changed files were only including linux/module.h for the
    EXPORT_SYMBOL infrastructure, and nothing else. Revector them
    onto the isolated export header for faster compile times.

    Nothing to see here but a whole lot of instances of:

    -#include
    +#include

    This commit is only changing the kernel dir; next targets
    will probably be mm, fs, the arch dirs, etc.

    Signed-off-by: Paul Gortmaker

    Paul Gortmaker
     

27 Jul, 2011

1 commit

  • 60063497a   atomic: use <linux/atomic.h> ... Browse Code »

    This allows us to move duplicated code in
    (atomic_inc_not_zero() for now) to

    Signed-off-by: Arun Sharma
    Reviewed-by: Eric Dumazet
    Cc: Ingo Molnar
    Cc: David Miller
    Cc: Eric Dumazet
    Acked-by: Mike Frysinger
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Arun Sharma
     

30 Jun, 2011

1 commit

  • 131ad62d8   netfilter: add SELinux context support to AUDIT target ... Browse Code »

    In this revision the conversion of secid to SELinux context and adding it
    to the audit log is moved from xt_AUDIT.c to audit.c with the aid of a
    separate helper function - audit_log_secctx - which does both the conversion
    and logging of SELinux context, thus also preventing internal secid number
    being leaked to userspace. If conversion is not successful an error is raised.

    With the introduction of this helper function the work done in xt_AUDIT.c is
    much more simplified. It also opens the possibility of this helper function
    being used by other modules (including auditd itself), if desired. With this
    addition, typical (raw auditd) output after applying the patch would be:

    type=NETFILTER_PKT msg=audit(1305852240.082:31012): action=0 hook=1 len=52 inif=? outif=eth0 saddr=10.1.1.7 daddr=10.1.2.1 ipid=16312 proto=6 sport=56150 dport=22 obj=system_u:object_r:ssh_client_packet_t:s0
    type=NETFILTER_PKT msg=audit(1306772064.079:56): action=0 hook=3 len=48 inif=eth0 outif=? smac=00:05:5d:7c:27:0b dmac=00:02:b3:0a:7f:81 macproto=0x0800 saddr=10.1.2.1 daddr=10.1.1.7 ipid=462 proto=6 sport=22 dport=3561 obj=system_u:object_r:ssh_server_packet_t:s0

    Acked-by: Eric Paris
    Signed-off-by: Mr Dash Four
    Signed-off-by: Patrick McHardy

    Mr Dash Four
     

04 Mar, 2011

1 commit

20 Jan, 2011

1 commit

18 Jan, 2011

1 commit

04 Nov, 2010

1 commit

30 Oct, 2010

4 commits

  • ab263f47c   audit: Use rcu for task lookup protection ... Browse Code »

    Protect the task lookups in audit_receive_msg() with rcu_read_lock()
    instead of tasklist_lock and use lock/unlock_sighand to protect
    against the exit race.

    Signed-off-by: Thomas Gleixner
    Cc: Al Viro
    Cc: Eric Paris
    Cc: Oleg Nesterov
    Signed-off-by: Al Viro

    Thomas Gleixner
     
  • 207032051   audit: Do not send uninitialized data for AUDIT_TTY_GET ... Browse Code »

    audit_receive_msg() sends uninitialized data for AUDIT_TTY_GET when
    the task was not found.

    Send reply only when task was found.

    Signed-off-by: Thomas Gleixner
    Cc: Al Viro
    Cc: Eric Paris
    Signed-off-by: Al Viro

    Thomas Gleixner
     
  • 3c80fe4ac   audit: Call tty_audit_push_task() outside preempt disabled ... Browse Code »

    While auditing all tasklist_lock read_lock sites I stumbled over the
    following call chain:

    audit_prepare_user_tty()
    read_lock(&tasklist_lock);
    tty_audit_push_task();
    mutex_lock(&buf->mutex);

    --> buf->mutex is locked with preemption disabled.

    Solve this by acquiring a reference to the task struct under
    rcu_read_lock and call tty_audit_push_task outside of the preempt
    disabled region.

    Move all code which needs to be protected by sighand lock into
    tty_audit_push_task() and use lock/unlock_sighand as we do not hold
    tasklist_lock.

    Signed-off-by: Thomas Gleixner
    Cc: Al Viro
    Cc: Eric Paris
    Cc: Oleg Nesterov
    Signed-off-by: Al Viro

    Thomas Gleixner
     
  • b8800aa5d   audit: make functions static ... Browse Code »

    I was doing some namespace checks and found some simple stuff in
    audit that could be cleaned up. Make some functions static, and
    put const on make_reply payload arg.

    Signed-off-by: Stephen Hemminger
    Signed-off-by: Al Viro

    Stephen Hemminger
     

11 Aug, 2010

1 commit

  • 8c8946f50   Merge branch 'for-linus' of git://git.infradead.org/users/eparis/notify ... Browse Code »

    * 'for-linus' of git://git.infradead.org/users/eparis/notify: (132 commits)
    fanotify: use both marks when possible
    fsnotify: pass both the vfsmount mark and inode mark
    fsnotify: walk the inode and vfsmount lists simultaneously
    fsnotify: rework ignored mark flushing
    fsnotify: remove global fsnotify groups lists
    fsnotify: remove group->mask
    fsnotify: remove the global masks
    fsnotify: cleanup should_send_event
    fanotify: use the mark in handler functions
    audit: use the mark in handler functions
    dnotify: use the mark in handler functions
    inotify: use the mark in handler functions
    fsnotify: send fsnotify_mark to groups in event handling functions
    fsnotify: Exchange list heads instead of moving elements
    fsnotify: srcu to protect read side of inode and vfsmount locks
    fsnotify: use an explicit flag to indicate fsnotify_destroy_mark has been called
    fsnotify: use _rcu functions for mark list traversal
    fsnotify: place marks on object in order of group memory address
    vfs/fsnotify: fsnotify_close can delay the final work in fput
    fsnotify: store struct file not struct path
    ...

    Fix up trivial delete/modify conflict in fs/notify/inotify/inotify.c.

    Linus Torvalds
     

28 Jul, 2010

1 commit

21 Jul, 2010

1 commit

  • 70d4bf6d4   drop_monitor: convert some kfree_skb call sites to consume_skb ... Browse Code »

    Convert a few calls from kfree_skb to consume_skb

    Noticed while I was working on dropwatch that I was detecting lots of internal
    skb drops in several places. While some are legitimate, several were not,
    freeing skbs that were at the end of their life, rather than being discarded due
    to an error. This patch converts those calls sites from using kfree_skb to
    consume_skb, which quiets the in-kernel drop_monitor code from detecting them as
    drops. Tested successfully by myself

    Signed-off-by: Neil Horman
    Signed-off-by: David S. Miller

    Neil Horman
     

30 Mar, 2010

1 commit

  • 5a0e3ad6a   include cleanup: Update gfp.h and slab.h includes to prepare for breaking implic… ... Browse Code »

    …it slab.h inclusion from percpu.h

    percpu.h is included by sched.h and module.h and thus ends up being
    included when building most .c files. percpu.h includes slab.h which
    in turn includes gfp.h making everything defined by the two files
    universally available and complicating inclusion dependencies.

    percpu.h -> slab.h dependency is about to be removed. Prepare for
    this change by updating users of gfp and slab facilities include those
    headers directly instead of assuming availability. As this conversion
    needs to touch large number of source files, the following script is
    used as the basis of conversion.

    http://userweb.kernel.org/~tj/misc/slabh-sweep.py

    The script does the followings.

    * Scan files for gfp and slab usages and update includes such that
    only the necessary includes are there. ie. if only gfp is used,
    gfp.h, if slab is used, slab.h.

    * When the script inserts a new include, it looks at the include
    blocks and try to put the new include such that its order conforms
    to its surrounding. It's put in the include block which contains
    core kernel includes, in the same order that the rest are ordered -
    alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
    doesn't seem to be any matching order.

    * If the script can't find a place to put a new include (mostly
    because the file doesn't have fitting include block), it prints out
    an error message indicating which .h file needs to be added to the
    file.

    The conversion was done in the following steps.

    1. The initial automatic conversion of all .c files updated slightly
    over 4000 files, deleting around 700 includes and adding ~480 gfp.h
    and ~3000 slab.h inclusions. The script emitted errors for ~400
    files.

    2. Each error was manually checked. Some didn't need the inclusion,
    some needed manual addition while adding it to implementation .h or
    embedding .c file was more appropriate for others. This step added
    inclusions to around 150 files.

    3. The script was run again and the output was compared to the edits
    from #2 to make sure no file was left behind.

    4. Several build tests were done and a couple of problems were fixed.
    e.g. lib/decompress_*.c used malloc/free() wrappers around slab
    APIs requiring slab.h to be added manually.

    5. The script was run on all .h files but without automatically
    editing them as sprinkling gfp.h and slab.h inclusions around .h
    files could easily lead to inclusion dependency hell. Most gfp.h
    inclusion directives were ignored as stuff from gfp.h was usually
    wildly available and often used in preprocessor macros. Each
    slab.h inclusion directive was examined and added manually as
    necessary.

    6. percpu.h was updated not to include slab.h.

    7. Build test were done on the following configurations and failures
    were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
    distributed build env didn't work with gcov compiles) and a few
    more options had to be turned off depending on archs to make things
    build (like ipr on powerpc/64 which failed due to missing writeq).

    * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
    * powerpc and powerpc64 SMP allmodconfig
    * sparc and sparc64 SMP allmodconfig
    * ia64 SMP allmodconfig
    * s390 SMP allmodconfig
    * alpha SMP allmodconfig
    * um on x86_64 SMP allmodconfig

    8. percpu.h modifications were reverted so that it could be applied as
    a separate patch and serve as bisection point.

    Given the fact that I had only a couple of failures from tests on step
    6, I'm fairly confident about the coverage of this conversion patch.
    If there is a breakage, it's likely to be something in one of the arch
    headers which should be easily discoverable easily on most builds of
    the specific arch.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>

    Tejun Heo
     

05 Feb, 2010

1 commit

24 Sep, 2009

1 commit

  • 939cbf260   Audit: send signal info if selinux is disabled ... Browse Code »

    Audit will not respond to signal requests if selinux is disabled since it is
    unable to translate the 0 sid from the sending process to a context. This
    patch just doesn't send the context info if there isn't any.

    Signed-off-by: Eric Paris
    Signed-off-by: Al Viro

    Eric Paris
     

24 Jun, 2009

6 commits

06 Apr, 2009

3 commits

  • def575434   Audit: remove spaces from audit_log_d_path ... Browse Code »

    audit_log_d_path had spaces in the strings which would be emitted on the
    error paths. This patch simply replaces those spaces with an _ or removes
    the needless spaces entirely.

    Signed-off-by: Eric Paris
    Signed-off-by: Al Viro

    Eric Paris
     
  • 55ad2f8d3   audit: ignore terminating NUL in AUDIT_USER_TTY messages ... Browse Code »

    AUDIT_USER_TTY, like all other messages sent from user-space, is sent
    NUL-terminated. Unlike other user-space audit messages, which come only
    from trusted sources, AUDIT_USER_TTY messages are processed using
    audit_log_n_untrustedstring().

    This patch modifies AUDIT_USER_TTY handling to ignore the trailing NUL
    and use the "quoted_string" representation of the message if possible.

    Signed-off-by: Miloslav Trmac
    Cc: Eric Paris
    Cc: Al Viro
    Cc: Steve Grubb
    Signed-off-by: Andrew Morton
    Signed-off-by: Al Viro

    Miloslav Trmac
     
  • b3897f567   Audit: fix handling of 'strings' with NULL characters ... Browse Code »

    currently audit_log_n_untrustedstring() uses audit_string_contains_control()
    to check if the 'string' has any control characters. If the 'string' has an
    embedded NULL audit_string_contains_control() will return that the data has
    no control characters and will then pass the string to audit_log_n_string
    with the total length, not the length up to the first NULL.
    audit_log_n_string() does a memcpy of the entire length and so the actual
    audit record emitted may then contain a NULL and then whatever random memory
    is after the NULL.

    Since we want to log the entire octet stream (if we can't trust the data
    to be a string we can't trust that a NULL isn't actually a part of it)
    we should just consider NULL as a control character. If the caller is
    certain they want to stop at the first NULL they should be using
    audit_log_untrustedstring.

    Signed-off-by: Eric Paris
    Signed-off-by: Al Viro

    Miloslav Trmac
     

09 Dec, 2008

2 commits

02 Aug, 2008

2 commits

  • 20c6aaa39   [PATCH] Fix the bug of using AUDIT_STATUS_RATE_LIMIT when set fail, no error output. ... Browse Code »

    When the "status_get->mask" is "AUDIT_STATUS_RATE_LIMIT || AUDIT_STATUS_BACKLOG_LIMIT".
    If "audit_set_rate_limit" fails and "audit_set_backlog_limit" succeeds, the "err" value
    will be greater than or equal to 0. It will miss the failure of rate set.

    Signed-off-by: Zhang Xiliang
    Acked-by: Eric Paris
    Signed-off-by: Al Viro

    zhangxiliang
     
  • 1d6c9649e   kernel/audit.c control character detection is off-by-one ... Browse Code »

    Hello,

    According to my understanding there is an off-by-one bug in the
    function:

    audit_string_contains_control()

    in:

    kernel/audit.c

    Patch is included.

    I do not know from how many places the function is called from, but for
    example, SELinux Access Vector Cache tries to log untrusted filenames via
    call path:

    avc_audit()
    audit_log_untrustedstring()
    audit_log_n_untrustedstring()
    audit_string_contains_control()

    If audit_string_contains_control() detects control characters, then the
    string is hex-encoded. But the hex=0x7f dec=127, DEL-character, is not
    detected.

    I guess this could have at least some minor security implications, since a
    user can create a filename with 0x7f in it, causing logged filename to
    possibly look different when someone reads it on the terminal.

    Signed-off-by: Vesa-Matti Kari
    Signed-off-by: Al Viro

    Vesa-Matti J Kari
     

25 Jun, 2008

2 commits

17 May, 2008

1 commit

28 Apr, 2008

4 commits

  • 4a761b8c1   [patch 2/2] Use find_task_by_vpid in audit code ... Browse Code »

    The pid to lookup a task by is passed inside audit code via netlink message.

    Thanks to Denis Lunev, netlink packets are now (since 2.6.24) _always_
    processed in the context of the sending task. So this is correct to lookup
    the task with find_task_by_vpid() here.

    Signed-off-by: Pavel Emelyanov
    Cc: "Eric W. Biederman"
    Cc: Al Viro
    Signed-off-by: Andrew Morton
    Signed-off-by: Al Viro

    Pavel Emelyanov
     
  • 7719e437f   [PATCH 2/2] audit: fix sparse shadowed variable warnings ... Browse Code »

    Use msglen as the identifier.
    kernel/audit.c:724:10: warning: symbol 'len' shadows an earlier one
    kernel/audit.c:575:8: originally declared here

    Don't use ino_f to check the inode field at the end of the functions.
    kernel/auditfilter.c:429:22: warning: symbol 'f' shadows an earlier one
    kernel/auditfilter.c:420:21: originally declared here
    kernel/auditfilter.c:542:22: warning: symbol 'f' shadows an earlier one
    kernel/auditfilter.c:529:21: originally declared here

    i always used as a counter for a for loop and initialized to zero before
    use. Eliminate the inner i variables.
    kernel/auditsc.c:1295:8: warning: symbol 'i' shadows an earlier one
    kernel/auditsc.c:1152:6: originally declared here
    kernel/auditsc.c:1320:7: warning: symbol 'i' shadows an earlier one
    kernel/auditsc.c:1152:6: originally declared here

    Signed-off-by: Harvey Harrison
    Signed-off-by: Al Viro

    Harvey Harrison
     
  • b556f8ad5   Audit: standardize string audit interfaces ... Browse Code »

    This patch standardized the string auditing interfaces. No userspace
    changes will be visible and this is all just cleanup and consistancy
    work. We have the following string audit interfaces to use:

    void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf, size_t len);

    void audit_log_n_string(struct audit_buffer *ab, const char *buf, size_t n);
    void audit_log_string(struct audit_buffer *ab, const char *buf);

    void audit_log_n_untrustedstring(struct audit_buffer *ab, const char *string, size_t n);
    void audit_log_untrustedstring(struct audit_buffer *ab, const char *string);

    This may be the first step to possibly fixing some of the issues that
    people have with the string output from the kernel audit system. But we
    still don't have an agreed upon solution to that problem.

    Signed-off-by: Eric Paris
    Signed-off-by: Al Viro

    Eric Paris
     
  • f09ac9db2   Audit: stop deadlock from signals under load ... Browse Code »

    A deadlock is possible between kauditd and auditd under load if auditd
    receives a signal. When auditd receives a signal it sends a netlink
    message to the kernel asking for information about the sender of the
    signal. In that same context the audit system will attempt to send a
    netlink message back to the userspace auditd. If kauditd has already
    filled the socket buffer (see netlink_attachskb()) auditd will now put
    itself to sleep waiting for room to send the message. Since auditd is
    responsible for draining that socket we have a deadlock. The fix, since
    the response from the kernel does not need to be synchronous is to send
    the signal information back to auditd in a separate thread. And thus
    auditd can continue to drain the audit queue normally.

    Signed-off-by: Eric Paris
    Signed-off-by: Al Viro

    Eric Paris