Eric Lee / smarc-fsl-linux-kernel

12 Oct, 2012

1 commit

03 Oct, 2012

1 commit

  • 88265322c   Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security ... Browse Code »

    Pull security subsystem updates from James Morris:
    "Highlights:

    - Integrity: add local fs integrity verification to detect offline
    attacks
    - Integrity: add digital signature verification
    - Simple stacking of Yama with other LSMs (per LSS discussions)
    - IBM vTPM support on ppc64
    - Add new driver for Infineon I2C TIS TPM
    - Smack: add rule revocation for subject labels"

    Fixed conflicts with the user namespace support in kernel/auditsc.c and
    security/integrity/ima/ima_policy.c.

    * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (39 commits)
    Documentation: Update git repository URL for Smack userland tools
    ima: change flags container data type
    Smack: setprocattr memory leak fix
    Smack: implement revoking all rules for a subject label
    Smack: remove task_wait() hook.
    ima: audit log hashes
    ima: generic IMA action flag handling
    ima: rename ima_must_appraise_or_measure
    audit: export audit_log_task_info
    tpm: fix tpm_acpi sparse warning on different address spaces
    samples/seccomp: fix 31 bit build on s390
    ima: digital signature verification support
    ima: add support for different security.ima data types
    ima: add ima_inode_setxattr/removexattr function and calls
    ima: add inode_post_setattr call
    ima: replace iint spinblock with rwlock/read_lock
    ima: allocating iint improvements
    ima: add appraise action keywords and default rules
    ima: integrity appraisal extension
    vfs: move ima_file_free before releasing the file
    ...

    Linus Torvalds
     

21 Sep, 2012

1 commit

08 Sep, 2012

1 commit

  • 42c63330f   ima: add ima_inode_setxattr/removexattr function and calls ... Browse Code »

    Based on xattr_permission comments, the restriction to modify 'security'
    xattr is left up to the underlying fs or lsm. Ensure that not just anyone
    can modify or remove 'security.ima'.

    Changelog v1:
    - Unless IMA-APPRAISE is configured, use stub ima_inode_removexattr()/setxattr()
    functions. (Moved ima_inode_removexattr()/setxattr() to ima_appraise.c)

    Changelog:
    - take i_mutex to fix locking (Dmitry Kasatkin)
    - ima_reset_appraise_flags should only be called when modifying or
    removing the 'security.ima' xattr. Requires CAP_SYS_ADMIN privilege.
    (Incorporated fix from Roberto Sassu)
    - Even if allowed to update security.ima, reset the appraisal flags,
    forcing re-appraisal.
    - Replace CAP_MAC_ADMIN with CAP_SYS_ADMIN
    - static inline ima_inode_setxattr()/ima_inode_removexattr() stubs
    - ima_protect_xattr should be static

    Signed-off-by: Mimi Zohar
    Signed-off-by: Dmitry Kasatkin

    Mimi Zohar
     

06 Sep, 2012

1 commit

  • c6993e4ac   security: allow Yama to be unconditionally stacked ... Browse Code »

    Unconditionally call Yama when CONFIG_SECURITY_YAMA_STACKED is selected,
    no matter what LSM module is primary.

    Ubuntu and Chrome OS already carry patches to do this, and Fedora
    has voiced interest in doing this as well. Instead of having multiple
    distributions (or LSM authors) carrying these patches, just allow Yama
    to be called unconditionally when selected by the new CONFIG.

    Signed-off-by: Kees Cook
    Acked-by: Serge E. Hallyn
    Acked-by: Eric Paris
    Acked-by: John Johansen
    Signed-off-by: James Morris

    Kees Cook
     

03 Jul, 2012

1 commit

  • 75331a597   security: Fix nommu build. ... Browse Code »

    The security + nommu configuration presently blows up with an undefined
    reference to BDI_CAP_EXEC_MAP:

    security/security.c: In function 'mmap_prot':
    security/security.c:687:36: error: dereferencing pointer to incomplete type
    security/security.c:688:16: error: 'BDI_CAP_EXEC_MAP' undeclared (first use in this function)
    security/security.c:688:16: note: each undeclared identifier is reported only once for each function it appears in

    include backing-dev.h directly to fix it up.

    Signed-off-by: Paul Mundt
    Signed-off-by: James Morris

    Paul Mundt
     

02 Jul, 2012

1 commit

  • 659b5e765   security: Fix nommu build. ... Browse Code »

    The security + nommu configuration presently blows up with an undefined
    reference to BDI_CAP_EXEC_MAP:

    security/security.c: In function 'mmap_prot':
    security/security.c:687:36: error: dereferencing pointer to incomplete type
    security/security.c:688:16: error: 'BDI_CAP_EXEC_MAP' undeclared (first use in this function)
    security/security.c:688:16: note: each undeclared identifier is reported only once for each function it appears in

    include backing-dev.h directly to fix it up.

    Signed-off-by: Paul Mundt
    Signed-off-by: James Morris

    Paul Mundt
     

01 Jun, 2012

3 commits

10 Apr, 2012

1 commit

14 Feb, 2012

2 commits

10 Feb, 2012

1 commit

  • 1a2a4d06e   security: create task_free security callback ... Browse Code »

    The current LSM interface to cred_free is not sufficient for allowing
    an LSM to track the life and death of a task. This patch adds the
    task_free hook so that an LSM can clean up resources on task death.

    Signed-off-by: Kees Cook
    Signed-off-by: James Morris

    Kees Cook
     

15 Jan, 2012

1 commit

  • c49c41a41   Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security ... Browse Code »

    * 'for-linus' of git://selinuxproject.org/~jmorris/linux-security:
    capabilities: remove __cap_full_set definition
    security: remove the security_netlink_recv hook as it is equivalent to capable()
    ptrace: do not audit capability check when outputing /proc/pid/stat
    capabilities: remove task_ns_* functions
    capabitlies: ns_capable can use the cap helpers rather than lsm call
    capabilities: style only - move capable below ns_capable
    capabilites: introduce new has_ns_capabilities_noaudit
    capabilities: call has_ns_capability from has_capability
    capabilities: remove all _real_ interfaces
    capabilities: introduce security_capable_noaudit
    capabilities: reverse arguments to security_capable
    capabilities: remove the task from capable LSM hook entirely
    selinux: sparse fix: fix several warnings in the security server cod
    selinux: sparse fix: fix warnings in netlink code
    selinux: sparse fix: eliminate warnings for selinuxfs
    selinux: sparse fix: declare selinux_disable() in security.h
    selinux: sparse fix: move selinux_complete_init
    selinux: sparse fix: make selinux_secmark_refcount static
    SELinux: Fix RCU deref check warning in sel_netport_insert()

    Manually fix up a semantic mis-merge wrt security_netlink_recv():

    - the interface was removed in commit fd7784615248 ("security: remove
    the security_netlink_recv hook as it is equivalent to capable()")

    - a new user of it appeared in commit a38f7907b926 ("crypto: Add
    userspace configuration API")

    causing no automatic merge conflict, but Eric Paris pointed out the
    issue.

    Linus Torvalds
     

07 Jan, 2012

1 commit

06 Jan, 2012

5 commits

  • fd7784615   security: remove the security_netlink_recv hook as it is equivalent to capable() ... Browse Code »

    Once upon a time netlink was not sync and we had to get the effective
    capabilities from the skb that was being received. Today we instead get
    the capabilities from the current task. This has rendered the entire
    purpose of the hook moot as it is now functionally equivalent to the
    capable() call.

    Signed-off-by: Eric Paris

    Eric Paris
     
  • 2920a8409   capabilities: remove all _real_ interfaces ... Browse Code »

    The name security_real_capable and security_real_capable_noaudit just don't
    make much sense to me. Convert them to use security_capable and
    security_capable_noaudit.

    Signed-off-by: Eric Paris
    Acked-by: Serge E. Hallyn

    Eric Paris
     
  • c7eba4a97   capabilities: introduce security_capable_noaudit ... Browse Code »

    Exactly like security_capable except don't audit any denials. This is for
    places where the kernel may make decisions about what to do if a task has a
    given capability, but which failing that capability is not a sign of a
    security policy violation. An example is checking if a task has
    CAP_SYS_ADMIN to lower it's likelyhood of being killed by the oom killer.
    This check is not a security violation if it is denied.

    Signed-off-by: Eric Paris
    Acked-by: Serge E. Hallyn

    Eric Paris
     
  • b7e724d30   capabilities: reverse arguments to security_capable ... Browse Code »

    security_capable takes ns, cred, cap. But the LSM capable() hook takes
    cred, ns, cap. The capability helper functions also take cred, ns, cap.
    Rather than flip argument order just to flip it back, leave them alone.
    Heck, this should be a little faster since argument will be in the right
    place!

    Signed-off-by: Eric Paris

    Eric Paris
     
  • 6a9de4911   capabilities: remove the task from capable LSM hook entirely ... Browse Code »

    The capabilities framework is based around credentials, not necessarily the
    current task. Yet we still passed the current task down into LSMs from the
    security_capable() LSM hook as if it was a meaningful portion of the security
    decision. This patch removes the 'generic' passing of current and instead
    forces individual LSMs to use current explicitly if they think it is
    appropriate. In our case those LSMs are SELinux and AppArmor.

    I believe the AppArmor use of current is incorrect, but that is wholely
    unrelated to this patch. This patch does not change what AppArmor does, it
    just makes it clear in the AppArmor code that it is doing it.

    The SELinux code still uses current in it's audit message, which may also be
    wrong and needs further investigation. Again this is NOT a change, it may
    have always been wrong, this patch just makes it clear what is happening.

    Signed-off-by: Eric Paris

    Eric Paris
     

04 Jan, 2012

7 commits

25 Oct, 2011

1 commit

  • 36b8d186e   Merge branch 'next' of git://selinuxproject.org/~jmorris/linux-security ... Browse Code »

    * 'next' of git://selinuxproject.org/~jmorris/linux-security: (95 commits)
    TOMOYO: Fix incomplete read after seek.
    Smack: allow to access /smack/access as normal user
    TOMOYO: Fix unused kernel config option.
    Smack: fix: invalid length set for the result of /smack/access
    Smack: compilation fix
    Smack: fix for /smack/access output, use string instead of byte
    Smack: domain transition protections (v3)
    Smack: Provide information for UDS getsockopt(SO_PEERCRED)
    Smack: Clean up comments
    Smack: Repair processing of fcntl
    Smack: Rule list lookup performance
    Smack: check permissions from user space (v2)
    TOMOYO: Fix quota and garbage collector.
    TOMOYO: Remove redundant tasklist_lock.
    TOMOYO: Fix domain transition failure warning.
    TOMOYO: Remove tomoyo_policy_memory_lock spinlock.
    TOMOYO: Simplify garbage collector.
    TOMOYO: Fix make namespacecheck warnings.
    target: check hex2bin result
    encrypted-keys: check hex2bin result
    ...

    Linus Torvalds
     

19 Oct, 2011

1 commit

  • 6230c9b4f   bluetooth: Properly clone LSM attributes to newly created child connections ... Browse Code »

    The Bluetooth stack has internal connection handlers for all of the various
    Bluetooth protocols, and unfortunately, they are currently lacking the LSM
    hooks found in the core network stack's connection handlers. I say
    unfortunately, because this can cause problems for users who have have an
    LSM enabled and are using certain Bluetooth devices. See one problem
    report below:

    * http://bugzilla.redhat.com/show_bug.cgi?id=741703

    In order to keep things simple at this point in time, this patch fixes the
    problem by cloning the parent socket's LSM attributes to the newly created
    child socket. If we decide we need a more elaborate LSM marking mechanism
    for Bluetooth (I somewhat doubt this) we can always revisit this decision
    in the future.

    Reported-by: James M. Cape
    Signed-off-by: Paul Moore
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Paul Moore
     

15 Sep, 2011

1 commit

10 Sep, 2011

1 commit

09 Aug, 2011

1 commit

20 Jul, 2011

2 commits

19 Jul, 2011

5 commits

  • 817b54aa4   evm: add evm_inode_setattr to prevent updating an invalid security.evm ... Browse Code »

    Permit changing of security.evm only when valid, unless in fixmode.

    Reported-by: Roberto Sassu
    Signed-off-by: Mimi Zohar

    Mimi Zohar
     
  • 823eb1ccd   evm: call evm_inode_init_security from security_inode_init_security ... Browse Code »

    Changelog v7:
    - moved the initialization call to security_inode_init_security,
    renaming evm_inode_post_init_security to evm_inode_init_security
    - increase size of xattr array for EVM xattr

    Signed-off-by: Mimi Zohar

    Mimi Zohar
     
  • 3e1be52d6   security: imbed evm calls in security hooks ... Browse Code »

    Imbed the evm calls evm_inode_setxattr(), evm_inode_post_setxattr(),
    evm_inode_removexattr() in the security hooks. evm_inode_setxattr()
    protects security.evm xattr. evm_inode_post_setxattr() and
    evm_inode_removexattr() updates the hmac associated with an inode.

    (Assumes an LSM module protects the setting/removing of xattr.)

    Changelog:
    - Don't define evm_verifyxattr(), unless CONFIG_INTEGRITY is enabled.
    - xattr_name is a 'const', value is 'void *'

    Signed-off-by: Mimi Zohar
    Acked-by: Serge Hallyn

    Mimi Zohar
     
  • f381c2722   integrity: move ima inode integrity data management ... Browse Code »

    Move the inode integrity data(iint) management up to the integrity directory
    in order to share the iint among the different integrity models.

    Changelog:
    - don't define MAX_DIGEST_SIZE
    - rename several globally visible 'ima_' prefixed functions, structs,
    locks, etc to 'integrity_'
    - replace '20' with SHA1_DIGEST_SIZE
    - reflect location change in appropriate Kconfig and Makefiles
    - remove unnecessary initialization of iint_initialized to 0
    - rebased on current ima_iint.c
    - define integrity_iint_store/lock as static

    There should be no other functional changes.

    Signed-off-by: Mimi Zohar
    Acked-by: Serge Hallyn

    Mimi Zohar
     
  • 9d8f13ba3   security: new security_inode_init_security API adds function callback ... Browse Code »

    This patch changes the security_inode_init_security API by adding a
    filesystem specific callback to write security extended attributes.
    This change is in preparation for supporting the initialization of
    multiple LSM xattrs and the EVM xattr. Initially the callback function
    walks an array of xattrs, writing each xattr separately, but could be
    optimized to write multiple xattrs at once.

    For existing security_inode_init_security() calls, which have not yet
    been converted to use the new callback function, such as those in
    reiserfs and ocfs2, this patch defines security_old_inode_init_security().

    Signed-off-by: Mimi Zohar

    Mimi Zohar