Eric Lee / smarc-fsl-linux-kernel

30 Jul, 2016

2 commits

  • 7a1e8b80f   Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security ... Browse Code »

    Pull security subsystem updates from James Morris:
    "Highlights:

    - TPM core and driver updates/fixes
    - IPv6 security labeling (CALIPSO)
    - Lots of Apparmor fixes
    - Seccomp: remove 2-phase API, close hole where ptrace can change
    syscall #"

    * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (156 commits)
    apparmor: fix SECURITY_APPARMOR_HASH_DEFAULT parameter handling
    tpm: Add TPM 2.0 support to the Nuvoton i2c driver (NPCT6xx family)
    tpm: Factor out common startup code
    tpm: use devm_add_action_or_reset
    tpm2_i2c_nuvoton: add irq validity check
    tpm: read burstcount from TPM_STS in one 32-bit transaction
    tpm: fix byte-order for the value read by tpm2_get_tpm_pt
    tpm_tis_core: convert max timeouts from msec to jiffies
    apparmor: fix arg_size computation for when setprocattr is null terminated
    apparmor: fix oops, validate buffer size in apparmor_setprocattr()
    apparmor: do not expose kernel stack
    apparmor: fix module parameters can be changed after policy is locked
    apparmor: fix oops in profile_unpack() when policy_db is not present
    apparmor: don't check for vmalloc_addr if kvzalloc() failed
    apparmor: add missing id bounds check on dfa verification
    apparmor: allow SYS_CAP_RESOURCE to be sufficient to prlimit another task
    apparmor: use list_next_entry instead of list_entry_next
    apparmor: fix refcount race when finding a child profile
    apparmor: fix ref count leak when profile sha1 hash is read
    apparmor: check that xindex is in trans_table bounds
    ...

    Linus Torvalds
     
  • a867d7349   Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace ... Browse Code »

    Pull userns vfs updates from Eric Biederman:
    "This tree contains some very long awaited work on generalizing the
    user namespace support for mounting filesystems to include filesystems
    with a backing store. The real world target is fuse but the goal is
    to update the vfs to allow any filesystem to be supported. This
    patchset is based on a lot of code review and testing to approach that
    goal.

    While looking at what is needed to support the fuse filesystem it
    became clear that there were things like xattrs for security modules
    that needed special treatment. That the resolution of those concerns
    would not be fuse specific. That sorting out these general issues
    made most sense at the generic level, where the right people could be
    drawn into the conversation, and the issues could be solved for
    everyone.

    At a high level what this patchset does a couple of simple things:

    - Add a user namespace owner (s_user_ns) to struct super_block.

    - Teach the vfs to handle filesystem uids and gids not mapping into
    to kuids and kgids and being reported as INVALID_UID and
    INVALID_GID in vfs data structures.

    By assigning a user namespace owner filesystems that are mounted with
    only user namespace privilege can be detected. This allows security
    modules and the like to know which mounts may not be trusted. This
    also allows the set of uids and gids that are communicated to the
    filesystem to be capped at the set of kuids and kgids that are in the
    owning user namespace of the filesystem.

    One of the crazier corner casees this handles is the case of inodes
    whose i_uid or i_gid are not mapped into the vfs. Most of the code
    simply doesn't care but it is easy to confuse the inode writeback path
    so no operation that could cause an inode write-back is permitted for
    such inodes (aka only reads are allowed).

    This set of changes starts out by cleaning up the code paths involved
    in user namespace permirted mounts. Then when things are clean enough
    adds code that cleanly sets s_user_ns. Then additional restrictions
    are added that are possible now that the filesystem superblock
    contains owner information.

    These changes should not affect anyone in practice, but there are some
    parts of these restrictions that are changes in behavior.

    - Andy's restriction on suid executables that does not honor the
    suid bit when the path is from another mount namespace (think
    /proc/[pid]/fd/) or when the filesystem was mounted by a less
    privileged user.

    - The replacement of the user namespace implicit setting of MNT_NODEV
    with implicitly setting SB_I_NODEV on the filesystem superblock
    instead.

    Using SB_I_NODEV is a stronger form that happens to make this state
    user invisible. The user visibility can be managed but it caused
    problems when it was introduced from applications reasonably
    expecting mount flags to be what they were set to.

    There is a little bit of work remaining before it is safe to support
    mounting filesystems with backing store in user namespaces, beyond
    what is in this set of changes.

    - Verifying the mounter has permission to read/write the block device
    during mount.

    - Teaching the integrity modules IMA and EVM to handle filesystems
    mounted with only user namespace root and to reduce trust in their
    security xattrs accordingly.

    - Capturing the mounters credentials and using that for permission
    checks in d_automount and the like. (Given that overlayfs already
    does this, and we need the work in d_automount it make sense to
    generalize this case).

    Furthermore there are a few changes that are on the wishlist:

    - Get all filesystems supporting posix acls using the generic posix
    acls so that posix_acl_fix_xattr_from_user and
    posix_acl_fix_xattr_to_user may be removed. [Maintainability]

    - Reducing the permission checks in places such as remount to allow
    the superblock owner to perform them.

    - Allowing the superblock owner to chown files with unmapped uids and
    gids to something that is mapped so the files may be treated
    normally.

    I am not considering even obvious relaxations of permission checks
    until it is clear there are no more corner cases that need to be
    locked down and handled generically.

    Many thanks to Seth Forshee who kept this code alive, and putting up
    with me rewriting substantial portions of what he did to handle more
    corner cases, and for his diligent testing and reviewing of my
    changes"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (30 commits)
    fs: Call d_automount with the filesystems creds
    fs: Update i_[ug]id_(read|write) to translate relative to s_user_ns
    evm: Translate user/group ids relative to s_user_ns when computing HMAC
    dquot: For now explicitly don't support filesystems outside of init_user_ns
    quota: Handle quota data stored in s_user_ns in quota_setxquota
    quota: Ensure qids map to the filesystem
    vfs: Don't create inodes with a uid or gid unknown to the vfs
    vfs: Don't modify inodes with a uid or gid unknown to the vfs
    cred: Reject inodes with invalid ids in set_create_file_as()
    fs: Check for invalid i_uid in may_follow_link()
    vfs: Verify acls are valid within superblock's s_user_ns.
    userns: Handle -1 in k[ug]id_has_mapping when !CONFIG_USER_NS
    fs: Refuse uid/gid changes which don't map into s_user_ns
    selinux: Add support for unprivileged mounts from user namespaces
    Smack: Handle labels consistently in untrusted mounts
    Smack: Add support for unprivileged mounts from user namespaces
    fs: Treat foreign mounts as nosuid
    fs: Limit file caps to the user namespace of the super block
    userns: Remove the now unnecessary FS_USERNS_DEV_MOUNT flag
    userns: Remove implicit MNT_NODEV fragility.
    ...

    Linus Torvalds
     

29 Jul, 2016

2 commits

  • 6784725ab   Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

    Pull vfs updates from Al Viro:
    "Assorted cleanups and fixes.

    Probably the most interesting part long-term is ->d_init() - that will
    have a bunch of followups in (at least) ceph and lustre, but we'll
    need to sort the barrier-related rules before it can get used for
    really non-trivial stuff.

    Another fun thing is the merge of ->d_iput() callers (dentry_iput()
    and dentry_unlink_inode()) and a bunch of ->d_compare() ones (all
    except the one in __d_lookup_lru())"

    * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (26 commits)
    fs/dcache.c: avoid soft-lockup in dput()
    vfs: new d_init method
    vfs: Update lookup_dcache() comment
    bdev: get rid of ->bd_inodes
    Remove last traces of ->sync_page
    new helper: d_same_name()
    dentry_cmp(): use lockless_dereference() instead of smp_read_barrier_depends()
    vfs: clean up documentation
    vfs: document ->d_real()
    vfs: merge .d_select_inode() into .d_real()
    unify dentry_iput() and dentry_unlink_inode()
    binfmt_misc: ->s_root is not going anywhere
    drop redundant ->owner initializations
    ufs: get rid of redundant checks
    orangefs: constify inode_operations
    missed comment updates from ->direct_IO() prototype change
    file_inode(f)->i_mapping is f->f_mapping
    trim fsnotify hooks a bit
    9p: new helper - v9fs_parent_fid()
    debugfs: ->d_parent is never NULL or negative
    ...

    Linus Torvalds
     
  • 554828ee0   Merge branch 'salted-string-hash' ... Browse Code »

    This changes the vfs dentry hashing to mix in the parent pointer at the
    _beginning_ of the hash, rather than at the end.

    That actually improves both the hash and the code generation, because we
    can move more of the computation to the "static" part of the dcache
    setup, and do less at lookup runtime.

    It turns out that a lot of other hash users also really wanted to mix in
    a base pointer as a 'salt' for the hash, and so the slightly extended
    interface ends up working well for other cases too.

    Users that want a string hash that is purely about the string pass in a
    'salt' pointer of NULL.

    * merge branch 'salted-string-hash':
    fs/dcache.c: Save one 32-bit multiply in dcache lookup
    vfs: make the string hashes salt the hash

    Linus Torvalds
     

27 Jul, 2016

2 commits

  • 7616ac70d   apparmor: fix SECURITY_APPARMOR_HASH_DEFAULT parameter handling ... Browse Code »

    The newly added Kconfig option could never work and just causes a build error
    when disabled:

    security/apparmor/lsm.c:675:25: error: 'CONFIG_SECURITY_APPARMOR_HASH_DEFAULT' undeclared here (not in a function)
    bool aa_g_hash_policy = CONFIG_SECURITY_APPARMOR_HASH_DEFAULT;

    The problem is that the macro undefined in this case, and we need to use the IS_ENABLED()
    helper to turn it into a boolean constant.

    Another minor problem with the original patch is that the option is even offered
    in sysfs when SECURITY_APPARMOR_HASH is not enabled, so this also hides the option
    in that case.

    Signed-off-by: Arnd Bergmann
    Fixes: 6059f71f1e94 ("apparmor: add parameter to control whether policy hashing is used")
    Signed-off-by: John Johansen
    Signed-off-by: James Morris

    Arnd Bergmann
     
  • bbce2ad2d   Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 ... Browse Code »

    Pull crypto updates from Herbert Xu:
    "Here is the crypto update for 4.8:

    API:
    - first part of skcipher low-level conversions
    - add KPP (Key-agreement Protocol Primitives) interface.

    Algorithms:
    - fix IPsec/cryptd reordering issues that affects aesni
    - RSA no longer does explicit leading zero removal
    - add SHA3
    - add DH
    - add ECDH
    - improve DRBG performance by not doing CTR by hand

    Drivers:
    - add x86 AVX2 multibuffer SHA256/512
    - add POWER8 optimised crc32c
    - add xts support to vmx
    - add DH support to qat
    - add RSA support to caam
    - add Layerscape support to caam
    - add SEC1 AEAD support to talitos
    - improve performance by chaining requests in marvell/cesa
    - add support for Araneus Alea I USB RNG
    - add support for Broadcom BCM5301 RNG
    - add support for Amlogic Meson RNG
    - add support Broadcom NSP SoC RNG"

    * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (180 commits)
    crypto: vmx - Fix aes_p8_xts_decrypt build failure
    crypto: vmx - Ignore generated files
    crypto: vmx - Adding support for XTS
    crypto: vmx - Adding asm subroutines for XTS
    crypto: skcipher - add comment for skcipher_alg->base
    crypto: testmgr - Print akcipher algorithm name
    crypto: marvell - Fix wrong flag used for GFP in mv_cesa_dma_add_iv_op
    crypto: nx - off by one bug in nx_of_update_msc()
    crypto: rsa-pkcs1pad - fix rsa-pkcs1pad request struct
    crypto: scatterwalk - Inline start/map/done
    crypto: scatterwalk - Remove unnecessary BUG in scatterwalk_start
    crypto: scatterwalk - Remove unnecessary advance in scatterwalk_pagedone
    crypto: scatterwalk - Fix test in scatterwalk_done
    crypto: api - Optimise away crypto_yield when hard preemption is on
    crypto: scatterwalk - add no-copy support to copychunks
    crypto: scatterwalk - Remove scatterwalk_bytes_sglen
    crypto: omap - Stop using crypto scatterwalk_bytes_sglen
    crypto: skcipher - Remove top-level givcipher interface
    crypto: user - Remove crypto_lookup_skcipher call
    crypto: cts - Convert to skcipher
    ...

    Linus Torvalds
     

12 Jul, 2016

24 commits

09 Jul, 2016

1 commit

08 Jul, 2016

2 commits

  • c63280995   Merge branch 'smack-for-4.8' of https://github.com/cschaufler/smack-next into next Browse Code »
    James Morris
     
  • 30a46a464   apparmor: fix oops, validate buffer size in apparmor_setprocattr() ... Browse Code »

    When proc_pid_attr_write() was changed to use memdup_user apparmor's
    (interface violating) assumption that the setprocattr buffer was always
    a single page was violated.

    The size test is not strictly speaking needed as proc_pid_attr_write()
    will reject anything larger, but for the sake of robustness we can keep
    it in.

    SMACK and SELinux look safe to me, but somebody else should probably
    have a look just in case.

    Based on original patch from Vegard Nossum
    modified for the case that apparmor provides null termination.

    Fixes: bb646cdb12e75d82258c2f2e7746d5952d3e321a
    Reported-by: Vegard Nossum
    Cc: Al Viro
    Cc: John Johansen
    Cc: Paul Moore
    Cc: Stephen Smalley
    Cc: Eric Paris
    Cc: Casey Schaufler
    Cc: stable@kernel.org
    Signed-off-by: John Johansen
    Reviewed-by: Tyler Hicks
    Signed-off-by: James Morris

    Vegard Nossum
     

07 Jul, 2016

1 commit

06 Jul, 2016

1 commit

01 Jul, 2016

1 commit

30 Jun, 2016

4 commits

  • 544e1cea0   ima: extend the measurement entry specific pcr ... Browse Code »

    Extend the PCR supplied as a parameter, instead of assuming that the
    measurement entry uses the default configured PCR.

    Signed-off-by: Eric Richter
    Signed-off-by: Mimi Zohar

    Eric Richter
     
  • a422638d4   ima: change integrity cache to store measured pcr ... Browse Code »

    IMA avoids re-measuring files by storing the current state as a flag in
    the integrity cache. It will then skip adding a new measurement log entry
    if the cache reports the file as already measured.

    If a policy measures an already measured file to a new PCR, the measurement
    will not be added to the list. This patch implements a new bitfield for
    specifying which PCR the file was measured into, rather than if it was
    measured.

    Signed-off-by: Eric Richter
    Signed-off-by: Mimi Zohar

    Eric Richter
     
  • 67696f6d7   ima: redefine duplicate template entries ... Browse Code »

    Template entry duplicates are prevented from being added to the
    measurement list by checking a hash table that contains the template
    entry digests. However, the PCR value is not included in this comparison,
    so duplicate template entry digests with differing PCRs may be dropped.

    This patch redefines duplicate template entries as template entries with
    the same digest and same PCR values.

    Reported-by: Mimi Zohar
    Signed-off-by: Eric Richter
    Signed-off-by: Mimi Zohar

    Eric Richter
     
  • 5f6f027b5   ima: change ima_measurements_show() to display the entry specific pcr ... Browse Code »

    IMA assumes that the same default Kconfig PCR is extended for each
    entry. This patch replaces the default configured PCR with the policy
    defined PCR.

    Signed-off-by: Eric Richter
    Signed-off-by: Mimi Zohar

    Eric Richter