Eric Lee / smarc-fsl-linux-kernel

21 Mar, 2006

4 commits

  • e6f507196   [SELINUX]: selinux_socket_getpeer_{stream,dgram} fixup ... Browse Code »

    Signed-off-by: Catherine Zhang
    Signed-off-by: Arnaldo Carvalho de Melo

    Catherine Zhang
     
  • c841aa030   [SECURITY] getpeersec: Fix build breakage ... Browse Code »

    A recent changeset removes dummy_socket_getpeersec, replacing it with
    two new functions, but still references the removed function in the
    security_fixup_ops table, fix it by doing the replacement operation in
    the fixup table too.

    Signed-off-by: Arnaldo Carvalho de Melo
    Signed-off-by: David S. Miller

    Arnaldo Carvalho de Melo
     
  • 2c7946a7b   [SECURITY]: TCP/UDP getpeersec ... Browse Code »

    This patch implements an application of the LSM-IPSec networking
    controls whereby an application can determine the label of the
    security association its TCP or UDP sockets are currently connected to
    via getsockopt and the auxiliary data mechanism of recvmsg.

    Patch purpose:

    This patch enables a security-aware application to retrieve the
    security context of an IPSec security association a particular TCP or
    UDP socket is using. The application can then use this security
    context to determine the security context for processing on behalf of
    the peer at the other end of this connection. In the case of UDP, the
    security context is for each individual packet. An example
    application is the inetd daemon, which could be modified to start
    daemons running at security contexts dependent on the remote client.

    Patch design approach:

    - Design for TCP
    The patch enables the SELinux LSM to set the peer security context for
    a socket based on the security context of the IPSec security
    association. The application may retrieve this context using
    getsockopt. When called, the kernel determines if the socket is a
    connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry
    cache on the socket to retrieve the security associations. If a
    security association has a security context, the context string is
    returned, as for UNIX domain sockets.

    - Design for UDP
    Unlike TCP, UDP is connectionless. This requires a somewhat different
    API to retrieve the peer security context. With TCP, the peer
    security context stays the same throughout the connection, thus it can
    be retrieved at any time between when the connection is established
    and when it is torn down. With UDP, each read/write can have
    different peer and thus the security context might change every time.
    As a result the security context retrieval must be done TOGETHER with
    the packet retrieval.

    The solution is to build upon the existing Unix domain socket API for
    retrieving user credentials. Linux offers the API for obtaining user
    credentials via ancillary messages (i.e., out of band/control messages
    that are bundled together with a normal message).

    Patch implementation details:

    - Implementation for TCP
    The security context can be retrieved by applications using getsockopt
    with the existing SO_PEERSEC flag. As an example (ignoring error
    checking):

    getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen);
    printf("Socket peer context is: %s\n", optbuf);

    The SELinux function, selinux_socket_getpeersec, is extended to check
    for labeled security associations for connected (TCP_ESTABLISHED ==
    sk->sk_state) TCP sockets only. If so, the socket has a dst_cache of
    struct dst_entry values that may refer to security associations. If
    these have security associations with security contexts, the security
    context is returned.

    getsockopt returns a buffer that contains a security context string or
    the buffer is unmodified.

    - Implementation for UDP
    To retrieve the security context, the application first indicates to
    the kernel such desire by setting the IP_PASSSEC option via
    getsockopt. Then the application retrieves the security context using
    the auxiliary data mechanism.

    An example server application for UDP should look like this:

    toggle = 1;
    toggle_len = sizeof(toggle);

    setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len);
    recvmsg(sockfd, &msg_hdr, 0);
    if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
    cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
    if (cmsg_hdr->cmsg_len cmsg_level == SOL_IP &&
    cmsg_hdr->cmsg_type == SCM_SECURITY) {
    memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
    }
    }

    ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow
    a server socket to receive security context of the peer. A new
    ancillary message type SCM_SECURITY.

    When the packet is received we get the security context from the
    sec_path pointer which is contained in the sk_buff, and copy it to the
    ancillary message space. An additional LSM hook,
    selinux_socket_getpeersec_udp, is defined to retrieve the security
    context from the SELinux space. The existing function,
    selinux_socket_getpeersec does not suit our purpose, because the
    security context is copied directly to user space, rather than to
    kernel space.

    Testing:

    We have tested the patch by setting up TCP and UDP connections between
    applications on two machines using the IPSec policies that result in
    labeled security associations being built. For TCP, we can then
    extract the peer security context using getsockopt on either end. For
    UDP, the receiving end can retrieve the security context using the
    auxiliary data mechanism of recvmsg.

    Signed-off-by: Catherine Zhang
    Acked-by: James Morris
    Acked-by: Herbert Xu
    Signed-off-by: David S. Miller

    Catherine Zhang
     
  • 8c29bfe1c   [IPSEC]: Sync series - update selinux ... Browse Code »

    Add new netlink messages to selinux framework

    Signed-off-by: Jamal Hadi Salim
    Signed-off-by: David S. Miller

    Jamal Hadi Salim
     

12 Mar, 2006

1 commit

  • 341c2d806   [PATCH] selinux: tracer SID fix ... Browse Code »

    Fix SELinux to not reset the tracer SID when the child is already being
    traced, since selinux_ptrace is also called by proc for access checking
    outside of the context of a ptrace attach.

    Signed-off-by: Stephen Smalley
    Acked-by: James Morris
    Acked-by: Chris Wright
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     

08 Feb, 2006

1 commit

  • 99f6d61bd   [PATCH] selinux: require AUDIT ... Browse Code »

    Make SELinux depend on AUDIT as it requires the basic audit support to log
    permission denials at all. Note that AUDITSYSCALL remains optional for
    SELinux, although it can be useful in providing further information upon
    denials.

    Signed-off-by: Stephen Smalley
    Acked-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     

06 Feb, 2006

1 commit

04 Feb, 2006

1 commit

02 Feb, 2006

3 commits

  • 9ac49d221   [PATCH] selinux: remove security struct magic number fields and tests ... Browse Code »

    Remove the SELinux security structure magic number fields and tests, along
    with some unnecessary tests for NULL security pointers. These fields and
    tests are leftovers from the early attempts to support SELinux as a
    loadable module during LSM development.

    Signed-off-by: Stephen Smalley
    Acked-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • 26d2a4be6   [PATCH] selinux: change file_alloc_security to use GFP_KERNEL ... Browse Code »

    This patch changes the SELinux file_alloc_security function to use
    GFP_KERNEL rather than GFP_ATOMIC; the use of GFP_ATOMIC appears to be a
    remnant of when this function was being called with the files_lock spinlock
    held, and is no longer necessary. Please apply.

    Signed-off-by: Stephen Smalley
    Acked-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • db4c9641d   [PATCH] selinux: fix and cleanup mprotect checks ... Browse Code »

    Fix the SELinux mprotect checks on executable mappings so that they are not
    re-applied when the mapping is already executable as well as cleaning up
    the code. This avoids a situation where e.g. an application is prevented
    from removing PROT_WRITE on an already executable mapping previously
    authorized via execmem permission due to an execmod denial.

    Signed-off-by: Stephen Smalley
    Acked-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     

01 Feb, 2006

1 commit

15 Jan, 2006

1 commit

14 Jan, 2006

1 commit

  • 46b86a2da   [NET]: Use NIP6_FMT in kernel.h ... Browse Code »

    There are errors and inconsistency in the display of NIP6 strings.
    ie: net/ipv6/ip6_flowlabel.c

    There are errors and inconsistency in the display of NIPQUAD strings too.
    ie: net/netfilter/nf_conntrack_ftp.c

    This patch:
    adds NIP6_FMT to kernel.h
    changes all code to use NIP6_FMT
    fixes net/ipv6/ip6_flowlabel.c
    adds NIPQUAD_FMT to kernel.h
    fixes net/netfilter/nf_conntrack_ftp.c
    changes a few uses of "%u.%u.%u.%u" to NIPQUAD_FMT for symmetry to NIP6_FMT

    Signed-off-by: Joe Perches
    Signed-off-by: David S. Miller

    Joe Perches
     

12 Jan, 2006

1 commit

  • c59ede7b7   [PATCH] move capable() to capability.h ... Browse Code »

    - Move capable() from sched.h to capability.h;

    - Use where capable() is used
    (in include/, block/, ipc/, kernel/, a few drivers/,
    mm/, security/, & sound/;
    many more drivers/ to go)

    Signed-off-by: Randy Dunlap
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Randy.Dunlap
     

11 Jan, 2006

1 commit

10 Jan, 2006

1 commit

09 Jan, 2006

5 commits

  • 5160ee6fc   [PATCH] shrink dentry struct ... Browse Code »

    Some long time ago, dentry struct was carefully tuned so that on 32 bits
    UP, sizeof(struct dentry) was exactly 128, ie a power of 2, and a multiple
    of memory cache lines.

    Then RCU was added and dentry struct enlarged by two pointers, with nice
    results for SMP, but not so good on UP, because breaking the above tuning
    (128 + 8 = 136 bytes)

    This patch reverts this unwanted side effect, by using an union (d_u),
    where d_rcu and d_child are placed so that these two fields can share their
    memory needs.

    At the time d_free() is called (and d_rcu is really used), d_child is known
    to be empty and not touched by the dentry freeing.

    Lockless lookups only access d_name, d_parent, d_lock, d_op, d_flags (so
    the previous content of d_child is not needed if said dentry was unhashed
    but still accessed by a CPU because of RCU constraints)

    As dentry cache easily contains millions of entries, a size reduction is
    worth the extra complexity of the ugly C union.

    Signed-off-by: Eric Dumazet
    Cc: Dipankar Sarma
    Cc: Maneesh Soni
    Cc: Miklos Szeredi
    Cc: "Paul E. McKenney"
    Cc: Ian Kent
    Cc: Paul Jackson
    Cc: Al Viro
    Cc: Christoph Hellwig
    Cc: Trond Myklebust
    Cc: Neil Brown
    Cc: James Morris
    Cc: Stephen Smalley
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Eric Dumazet
     
  • b5f545c88   [PATCH] keys: Permit running process to instantiate keys ... Browse Code »

    Make it possible for a running process (such as gssapid) to be able to
    instantiate a key, as was requested by Trond Myklebust for NFS4.

    The patch makes the following changes:

    (1) A new, optional key type method has been added. This permits a key type
    to intercept requests at the point /sbin/request-key is about to be
    spawned and do something else with them - passing them over the
    rpc_pipefs files or netlink sockets for instance.

    The uninstantiated key, the authorisation key and the intended operation
    name are passed to the method.

    (2) The callout_info is no longer passed as an argument to /sbin/request-key
    to prevent unauthorised viewing of this data using ps or by looking in
    /proc/pid/cmdline.

    This means that the old /sbin/request-key program will not work with the
    patched kernel as it will expect to see an extra argument that is no
    longer there.

    A revised keyutils package will be made available tomorrow.

    (3) The callout_info is now attached to the authorisation key. Reading this
    key will retrieve the information.

    (4) A new field has been added to the task_struct. This holds the
    authorisation key currently active for a thread. Searches now look here
    for the caller's set of keys rather than looking for an auth key in the
    lowest level of the session keyring.

    This permits a thread to be servicing multiple requests at once and to
    switch between them. Note that this is per-thread, not per-process, and
    so is usable in multithreaded programs.

    The setting of this field is inherited across fork and exec.

    (5) A new keyctl function (KEYCTL_ASSUME_AUTHORITY) has been added that
    permits a thread to assume the authority to deal with an uninstantiated
    key. Assumption is only permitted if the authorisation key associated
    with the uninstantiated key is somewhere in the thread's keyrings.

    This function can also clear the assumption.

    (6) A new magic key specifier has been added to refer to the currently
    assumed authorisation key (KEY_SPEC_REQKEY_AUTH_KEY).

    (7) Instantiation will only proceed if the appropriate authorisation key is
    assumed first. The assumed authorisation key is discarded if
    instantiation is successful.

    (8) key_validate() is moved from the file of request_key functions to the
    file of permissions functions.

    (9) The documentation is updated.

    From:

    Build fix.

    Signed-off-by: David Howells
    Cc: Trond Myklebust
    Cc: Alexander Zangerl
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     
  • cab8eb594   [PATCH] keys: Discard duplicate keys from a keyring on link ... Browse Code »

    Cause any links within a keyring to keys that match a key to be linked into
    that keyring to be discarded as a link to the new key is added. The match is
    contingent on the type and description strings being the same.

    This permits requests, adds and searches to displace negative, expired,
    revoked and dead keys easily. After some discussion it was concluded that
    duplicate valid keys should probably be discarded also as they would otherwise
    hide the new key.

    Since request_key() is intended to be the primary method by which keys are
    added to a keyring, duplicate valid keys wouldn't be an issue there as that
    function would return an existing match in preference to creating a new key.

    Signed-off-by: David Howells
    Cc: Trond Myklebust
    Cc: Alexander Zangerl
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     
  • 017679c4d   [PATCH] keys: Permit key expiry time to be set ... Browse Code »

    Add a new keyctl function that allows the expiry time to be set on a key or
    removed from a key, provided the caller has attribute modification access.

    Signed-off-by: David Howells
    Cc: Trond Myklebust
    Cc: Alexander Zangerl
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     
  • 095975da2   [PATCH] rcu file: use atomic primitives ... Browse Code »

    Use atomic_inc_not_zero for rcu files instead of special case rcuref.

    Signed-off-by: Nick Piggin
    Cc: "Paul E. McKenney"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Nick Piggin
     

08 Jan, 2006

1 commit

07 Jan, 2006

8 commits

04 Jan, 2006

2 commits

  • d28d1e080   [LSM-IPSec]: Per-packet access control. ... Browse Code »

    This patch series implements per packet access control via the
    extension of the Linux Security Modules (LSM) interface by hooks in
    the XFRM and pfkey subsystems that leverage IPSec security
    associations to label packets. Extensions to the SELinux LSM are
    included that leverage the patch for this purpose.

    This patch implements the changes necessary to the SELinux LSM to
    create, deallocate, and use security contexts for policies
    (xfrm_policy) and security associations (xfrm_state) that enable
    control of a socket's ability to send and receive packets.

    Patch purpose:

    The patch is designed to enable the SELinux LSM to implement access
    control on individual packets based on the strongly authenticated
    IPSec security association. Such access controls augment the existing
    ones in SELinux based on network interface and IP address. The former
    are very coarse-grained, and the latter can be spoofed. By using
    IPSec, the SELinux can control access to remote hosts based on
    cryptographic keys generated using the IPSec mechanism. This enables
    access control on a per-machine basis or per-application if the remote
    machine is running the same mechanism and trusted to enforce the
    access control policy.

    Patch design approach:

    The patch's main function is to authorize a socket's access to a IPSec
    policy based on their security contexts. Since the communication is
    implemented by a security association, the patch ensures that the
    security association's negotiated and used have the same security
    context. The patch enables allocation and deallocation of such
    security contexts for policies and security associations. It also
    enables copying of the security context when policies are cloned.
    Lastly, the patch ensures that packets that are sent without using a
    IPSec security assocation with a security context are allowed to be
    sent in that manner.

    A presentation available at
    www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
    from the SELinux symposium describes the overall approach.

    Patch implementation details:

    The function which authorizes a socket to perform a requested
    operation (send/receive) on a IPSec policy (xfrm_policy) is
    selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
    that if a IPSec SA with a securit y association has not been used,
    then the socket is allowed to send or receive the packet,
    respectively.

    The patch implements SELinux function for allocating security contexts
    when policies (xfrm_policy) are created via the pfkey or xfrm_user
    interfaces via selinux_xfrm_policy_alloc. When a security association
    is built, SELinux allocates the security context designated by the
    XFRM subsystem which is based on that of the authorized policy via
    selinux_xfrm_state_alloc.

    When a xfrm_policy is cloned, the security context of that policy, if
    any, is copied to the clone via selinux_xfrm_policy_clone.

    When a xfrm_policy or xfrm_state is freed, its security context, if
    any is also freed at selinux_xfrm_policy_free or
    selinux_xfrm_state_free.

    Testing:

    The SELinux authorization function is tested using ipsec-tools. We
    created policies and security associations with particular security
    contexts and added SELinux access control policy entries to verify the
    authorization decision. We also made sure that packets for which no
    security context was supplied (which either did or did not use
    security associations) were authorized using an unlabelled context.

    Signed-off-by: Trent Jaeger
    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Trent Jaeger
     
  • df71837d5   [LSM-IPSec]: Security association restriction. ... Browse Code »

    This patch series implements per packet access control via the
    extension of the Linux Security Modules (LSM) interface by hooks in
    the XFRM and pfkey subsystems that leverage IPSec security
    associations to label packets. Extensions to the SELinux LSM are
    included that leverage the patch for this purpose.

    This patch implements the changes necessary to the XFRM subsystem,
    pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
    socket to use only authorized security associations (or no security
    association) to send/receive network packets.

    Patch purpose:

    The patch is designed to enable access control per packets based on
    the strongly authenticated IPSec security association. Such access
    controls augment the existing ones based on network interface and IP
    address. The former are very coarse-grained, and the latter can be
    spoofed. By using IPSec, the system can control access to remote
    hosts based on cryptographic keys generated using the IPSec mechanism.
    This enables access control on a per-machine basis or per-application
    if the remote machine is running the same mechanism and trusted to
    enforce the access control policy.

    Patch design approach:

    The overall approach is that policy (xfrm_policy) entries set by
    user-level programs (e.g., setkey for ipsec-tools) are extended with a
    security context that is used at policy selection time in the XFRM
    subsystem to restrict the sockets that can send/receive packets via
    security associations (xfrm_states) that are built from those
    policies.

    A presentation available at
    www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
    from the SELinux symposium describes the overall approach.

    Patch implementation details:

    On output, the policy retrieved (via xfrm_policy_lookup or
    xfrm_sk_policy_lookup) must be authorized for the security context of
    the socket and the same security context is required for resultant
    security association (retrieved or negotiated via racoon in
    ipsec-tools). This is enforced in xfrm_state_find.

    On input, the policy retrieved must also be authorized for the socket
    (at __xfrm_policy_check), and the security context of the policy must
    also match the security association being used.

    The patch has virtually no impact on packets that do not use IPSec.
    The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
    before.

    Also, if IPSec is used without security contexts, the impact is
    minimal. The LSM must allow such policies to be selected for the
    combination of socket and remote machine, but subsequent IPSec
    processing proceeds as in the original case.

    Testing:

    The pfkey interface is tested using the ipsec-tools. ipsec-tools have
    been modified (a separate ipsec-tools patch is available for version
    0.5) that supports assignment of xfrm_policy entries and security
    associations with security contexts via setkey and the negotiation
    using the security contexts via racoon.

    The xfrm_user interface is tested via ad hoc programs that set
    security contexts. These programs are also available from me, and
    contain programs for setting, getting, and deleting policy for testing
    this interface. Testing of sa functions was done by tracing kernel
    behavior.

    Signed-off-by: Trent Jaeger
    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Trent Jaeger
     

02 Dec, 2005

1 commit

  • db1d1d57e   [PATCH] Keys: Fix permissions check for update vs add ... Browse Code »

    Permit add_key() to once again update a matching key rather than adding a
    new one if a matching key already exists in the target keyring.

    This bug causes add_key() to always add a new key, displacing the old from
    the target keyring.

    Signed-off-by: David Howells
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     

09 Nov, 2005

3 commits

  • ce9982d04   [PATCH] selinux: extend selinuxfs context interface ... Browse Code »

    This patch extends the selinuxfs context interface to allow return the
    canonical form of the context to userspace.

    Signed-off-by: Stephen Smalley
    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • 25a74f3ba   [PATCH] selinux: disable setxattr on mountpoint labeled filesystems ... Browse Code »

    This patch disables the setting of SELinux xattrs on files created in
    filesystems labeled via mountpoint labeling (mounted with the context=
    option). selinux_inode_setxattr already prevents explicit setxattr from
    userspace on such filesystems, so this provides consistent behavior for
    file creation.

    Signed-off-by: Stephen Smalley
    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     
  • e517a0cd8   [PATCH] selinux: MLS compatibility ... Browse Code »

    This patch enables files created on a MLS-enabled SELinux system to be
    accessible on a non-MLS SELinux system, by skipping the MLS component of
    the security context in the non-MLS case.

    Signed-off-by: Stephen Smalley
    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     

07 Nov, 2005

2 commits

31 Oct, 2005

1 commit