19 Nov, 2009
1 commit
-
While running fsstress tests on the NFSv4 mounted ext3 and ext4
filesystem, the following call trace was generated on the nfs
server machine.Replace GFP_KERNEL with GFP_NOFS in ima_iint_insert() to avoid a
potential deadlock.=================================
[ INFO: inconsistent lock state ]
2.6.31-31.el6.x86_64 #1
---------------------------------
inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-W} usage.
kswapd2/75 [HC0[0]:SC0[0]:HE1:SE1] takes:
(jbd2_handle){+.+.?.}, at: [] jbd2_journal_start+0xfe/0x13f
{RECLAIM_FS-ON-W} state was registered at:
[] mark_held_locks+0x65/0x99
[] lockdep_trace_alloc+0xbd/0xf5
[] kmem_cache_alloc+0x40/0x185
[] ima_iint_insert+0x3d/0xf1
[] ima_inode_alloc+0x25/0x44
[] inode_init_always+0xec/0x271
[] alloc_inode+0x51/0xa1
[] new_inode+0x2e/0x94
[] ext4_new_inode+0xb8/0xdc9
[] ext4_create+0xcf/0x175
[] vfs_create+0x82/0xb8
[] do_filp_open+0x32c/0x9ee
[] do_sys_open+0x6c/0x12c
[] sys_open+0x2e/0x44
[] system_call_fastpath+0x16/0x1b
[] 0xffffffffffffffff
irq event stamp: 90371
hardirqs last enabled at (90371): []
kmem_cache_alloc+0xf0/0x185
hardirqs last disabled at (90370): []
kmem_cache_alloc+0x89/0x185
softirqs last enabled at (89492): []
__do_softirq+0x1bf/0x1eb
softirqs last disabled at (89477): [] call_softirq+0x1c/0x30other info that might help us debug this:
2 locks held by kswapd2/75:
#0: (shrinker_rwsem){++++..}, at: [] shrink_slab+0x44/0x177
#1: (&type->s_umount_key#25){++++..}, at: []Reported-by: Muni P. Beerakam
Reported-by: Amit K. Arora
Cc: stable@kernel.org
Signed-off-by: Mimi Zohar
Signed-off-by: James Morris
16 Oct, 2009
1 commit
-
The destination keyring specified to request_key() and co. is made available to
the process that instantiates the key (the slave process started by
/sbin/request-key typically). This is passed in the request_key_auth struct as
the dest_keyring member.keyctl_instantiate_key and keyctl_negate_key() call get_instantiation_keyring()
to get the keyring to attach the newly constructed key to at the end of
instantiation. This may be given a specific keyring into which a link will be
made later, or it may be asked to find the keyring passed to request_key(). In
the former case, it returns a keyring with the refcount incremented by
lookup_user_key(); in the latter case, it returns the keyring from the
request_key_auth struct - and does _not_ increment the refcount.The latter case will eventually result in an oops when the keyring prematurely
runs out of references and gets destroyed. The effect may take some time to
show up as the key is destroyed lazily.To fix this, the keyring returned by get_instantiation_keyring() must always
have its refcount incremented, no matter where it comes from.This can be tested by setting /etc/request-key.conf to:
#OP TYPE DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ...
#====== ======= =============== =============== ===============================
create * test:* * |/bin/false %u %g %d %{user:_display}
negate * * * /bin/keyctl negate %k 10 @uand then doing:
keyctl add user _display aaaaaaaa @u
while keyctl request2 user test:x test:x @u &&
keyctl list @u;
do
keyctl request2 user test:x test:x @u;
sleep 31;
keyctl list @u;
donewhich will oops eventually. Changing the negate line to have @u rather than
%S at the end is important as that forces the latter case by passing a special
keyring ID rather than an actual keyring ID.Reported-by: Alexander Zangerl
Signed-off-by: David Howells
Tested-by: Alexander Zangerl
Signed-off-by: Linus Torvalds
02 Oct, 2009
1 commit
-
[akpm@linux-foundation.org: fix KVM]
Signed-off-by: Alexey Dobriyan
Acked-by: Mike Frysinger
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
24 Sep, 2009
8 commits
-
* git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current:
lsm: Use a compressed IPv6 string format in audit events
Audit: send signal info if selinux is disabled
Audit: rearrange audit_context to save 16 bytes per struct
Audit: reorganize struct audit_watch to save 8 bytes -
It's unused.
It isn't needed -- read or write flag is already passed and sysctl
shouldn't care about the rest.It _was_ used in two places at arch/frv for some reason.
Signed-off-by: Alexey Dobriyan
Cc: David Howells
Cc: "Eric W. Biederman"
Cc: Al Viro
Cc: Ralf Baechle
Cc: Martin Schwidefsky
Cc: Ingo Molnar
Cc: "David S. Miller"
Cc: James Morris
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
Ratan Nalumasu reported that in a process with many threads doing
unnecessary wakeups. Every waiting thread in the process wakes up to loop
through the children and see that the only ones it cares about are still
not ready.Now that we have struct wait_opts we can change do_wait/__wake_up_parent
to use filtered wakeups.We can make child_wait_callback() more clever later, right now it only
checks eligible_child().Signed-off-by: Oleg Nesterov
Acked-by: Roland McGrath
Cc: Ingo Molnar
Cc: Ratan Nalumasu
Cc: Vitaly Mayatskikh
Acked-by: James Morris
Tested-by: Valdis Kletnieks
Acked-by: David Howells
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
Alter the ss->can_attach and ss->attach functions to be able to deal with
a whole threadgroup at a time, for use in cgroup_attach_proc. (This is a
pre-patch to cgroup-procs-writable.patch.)Currently, new mode of the attach function can only tell the subsystem
about the old cgroup of the threadgroup leader. No subsystem currently
needs that information for each thread that's being moved, but if one were
to be added (for example, one that counts tasks within a group) this bit
would need to be reworked a bit to tell the subsystem the right
information.[hidave.darkstar@gmail.com: fix build]
Signed-off-by: Ben Blum
Signed-off-by: Paul Menage
Acked-by: Li Zefan
Reviewed-by: Matt Helsley
Cc: "Eric W. Biederman"
Cc: Oleg Nesterov
Cc: Peter Zijlstra
Cc: Ingo Molnar
Cc: Dave Young
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
Currently the audit subsystem prints uncompressed IPv6 addresses which not
only differs from common usage but also results in ridiculously large audit
strings which is not a good thing. This patch fixes this by simply converting
audit to always print compressed IPv6 addresses.Old message example:
audit(1253576792.161:30): avc: denied { ingress } for
saddr=0000:0000:0000:0000:0000:0000:0000:0001 src=5000
daddr=0000:0000:0000:0000:0000:0000:0000:0001 dest=35502 netif=lo
scontext=system_u:object_r:unlabeled_t:s15:c0.c1023
tcontext=system_u:object_r:lo_netif_t:s0-s15:c0.c1023 tclass=netifNew message example:
audit(1253576792.161:30): avc: denied { ingress } for
saddr=::1 src=5000 daddr=::1 dest=35502 netif=lo
scontext=system_u:object_r:unlabeled_t:s15:c0.c1023
tcontext=system_u:object_r:lo_netif_t:s0-s15:c0.c1023 tclass=netifSigned-off-by: Paul Moore
Signed-off-by: Eric Paris
Signed-off-by: Al Viro -
…s/security-testing-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
SELinux: do not destroy the avc_cache_nodep
KEYS: Have the garbage collector set its timer for live expired keys
tpm-fixup-pcrs-sysfs-file-update
creds_are_invalid() needs to be exported for use by modules:
include/linux/cred.h: fix buildFix trivial BUILD_BUG_ON-induced conflicts in drivers/char/tpm/tpm.c
-
The security_ops reset done when SELinux is disabled at run time is done
after the avc cache is freed and after the kmem_cache for the avc is also
freed. This means that between the time the selinux disable code destroys
the avc_node_cachep another process could make a security request and could
try to allocate from the cache. We are just going to leave the cachep around,
like we always have.SELinux: Disabled at runtime.
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [] kmem_cache_alloc+0x9a/0x185
PGD 0
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
last sysfs file:
CPU 1
Modules linked in:
Pid: 12, comm: khelper Not tainted 2.6.31-tip-05525-g0eeacc6-dirty #14819
System Product Name
RIP: 0010:[] []
kmem_cache_alloc+0x9a/0x185
RSP: 0018:ffff88003f9258b0 EFLAGS: 00010086
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000078c0129e
RDX: 0000000000000000 RSI: ffffffff8130b626 RDI: ffffffff81122528
RBP: ffff88003f925900 R08: 0000000078c0129e R09: 0000000000000001
R10: 0000000000000000 R11: 0000000078c0129e R12: 0000000000000246
R13: 0000000000008020 R14: ffff88003f8586d8 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff880002b00000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000000 CR3: 0000000001001000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: ffffffff827bd420 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process khelper (pid: 12, threadinfo ffff88003f924000, task
ffff88003f928000)
Stack:
0000000000000246 0000802000000246 ffffffff8130b626 0000000000000001
0000000078c0129e 0000000000000000 ffff88003f925a70 0000000000000002
0000000000000001 0000000000000001 ffff88003f925960 ffffffff8130b626
Call Trace:
[] ? avc_alloc_node+0x36/0x273
[] avc_alloc_node+0x36/0x273
[] ? avc_latest_notif_update+0x7d/0x9e
[] avc_insert+0x51/0x18d
[] avc_has_perm_noaudit+0x9d/0x128
[] avc_has_perm+0x45/0x88
[] current_has_perm+0x52/0x6d
[] selinux_task_create+0x2f/0x45
[] security_task_create+0x29/0x3f
[] copy_process+0x82/0xdf0
[] ? register_lock_class+0x2f/0x36c
[] ? mark_lock+0x2e/0x1e1
[] do_fork+0x16e/0x382
[] ? register_lock_class+0x2f/0x36c
[] ? probe_workqueue_execution+0x57/0xf9
[] ? mark_lock+0x2e/0x1e1
[] ? probe_workqueue_execution+0x57/0xf9
[] kernel_thread+0x82/0xe0
[] ? ____call_usermodehelper+0x0/0x139
[] ? child_rip+0x0/0x20
[] ? __call_usermodehelper+0x65/0x9a
[] run_workqueue+0x171/0x27e
[] ? run_workqueue+0x11d/0x27e
[] ? __call_usermodehelper+0x0/0x9a
[] worker_thread+0xe8/0x10f
[] ? autoremove_wake_function+0x0/0x63
[] ? worker_thread+0x0/0x10f
[] kthread+0x91/0x99
[] child_rip+0xa/0x20
[] ? restore_args+0x0/0x30
[] ? kthread+0x0/0x99
[] ? child_rip+0x0/0x20
Code: 0f 85 99 00 00 00 9c 58 66 66 90 66 90 49 89 c4 fa 66 66 90 66 66 90
e8 83 34 fb ff e8 d7 e9 26 00 48 98 49 8b 94 c6 10 01 00 00 8b 1a 44
8b 7a 18 48 85 db 74 0f 8b 42 14 48 8b 04 c3 ff 42
RIP [] kmem_cache_alloc+0x9a/0x185
RSP
CR2: 0000000000000000
---[ end trace 42f41a982344e606 ]---Reported-by: Ingo Molnar
Signed-off-by: Eric Paris
Signed-off-by: James Morris -
The key garbage collector sets a timer to start a new collection cycle at the
point the earliest key to expire should be considered garbage. However, it
currently only does this if the key it is considering hasn't yet expired.If the key being considering has expired, but hasn't yet reached the collection
time then it is ignored, and won't be collected until some other key provokes a
round of collection.Make the garbage collector set the timer for the earliest key that hasn't yet
passed its collection time, rather than the earliest key that hasn't yet
expired.Signed-off-by: David Howells
Signed-off-by: James Morris
23 Sep, 2009
2 commits
-
Make all seq_operations structs const, to help mitigate against
revectoring user-triggerable function pointers.This is derived from the grsecurity patch, although generated from scratch
because it's simpler than extracting the changes from there.Signed-off-by: James Morris
Acked-by: Serge Hallyn
Acked-by: Casey Schaufler
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
Move various magic-number definitions into magic.h.
Signed-off-by: Nick Black
Acked-by: Pekka Enberg
Cc: Al Viro
Cc: "David S. Miller"
Cc: Casey Schaufler
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
16 Sep, 2009
1 commit
-
* 'x86-txt-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86, intel_txt: clean up the impact on generic code, unbreak non-x86
x86, intel_txt: Handle ACPI_SLEEP without X86_TRAMPOLINE
x86, intel_txt: Fix typos in Kconfig help
x86, intel_txt: Factor out the code for S3 setup
x86, intel_txt: tboot.c needs
intel_txt: Force IOMMU on for Intel TXT launch
x86, intel_txt: Intel TXT Sx shutdown support
x86, intel_txt: Intel TXT reboot/halt shutdown support
x86, intel_txt: Intel TXT boot support
15 Sep, 2009
2 commits
-
Fix a number of problems with the new key garbage collector:
(1) A rogue semicolon in keyring_gc() was causing the initial count of dead
keys to be miscalculated.(2) A missing return in keyring_gc() meant that under certain circumstances,
the keyring semaphore would be unlocked twice.(3) The key serial tree iterator (key_garbage_collector()) part of the garbage
collector has been modified to:(a) Complete each scan of the keyrings before setting the new timer.
(b) Only set the new timer for keys that have yet to expire. This means
that the new timer is now calculated correctly, and the gc doesn't
get into a loop continually scanning for keys that have expired, and
preventing other things from happening, like RCU cleaning up the old
keyring contents.(c) Perform an extra scan if any keys were garbage collected in this one
as a key might become garbage during a scan, and (b) could mean we
don't set the timer again.(4) Made key_schedule_gc() take the time at which to do a collection run,
rather than the time at which the key expires. This means the collection
of dead keys (key type unregistered) can happen immediately.Signed-off-by: David Howells
Signed-off-by: James Morris -
When we exit early from keyctl_session_to_parent because of permissions or
because the session keyring is the same as the parent, we need to unlock the
tasklist.The missing unlock causes the system to hang completely when using
keyctl(KEYCTL_SESSION_TO_PARENT) with a keyring shared with the parent.Signed-off-by: Marc Dionne
Signed-off-by: David Howells
Signed-off-by: James Morris
14 Sep, 2009
3 commits
-
Before SELinux is disabled at boot it can create AVC entries. This patch
will flush those entries before disabling SELinux.Signed-off-by: Eric Paris
Signed-off-by: James Morris -
Move the avc_cache flushing into it's own function so it can be reused when
disabling SELinux.Signed-off-by: Eric Paris
Signed-off-by: James Morris -
__validate_process_creds should check if selinux is actually enabled before
running tests on the selinux portion of the credentials struct.Signed-off-by: Eric Paris
Signed-off-by: James Morris
11 Sep, 2009
1 commit
10 Sep, 2009
2 commits
-
This patch adds a setxattr handler to the file, directory, and symlink
inode_operations structures for sysfs. The patch uses hooks introduced in the
previous patch to handle the getting and setting of security information for
the sysfs inodes. As was suggested by Eric Biederman the struct iattr in the
sysfs_dirent structure has been replaced by a structure which contains the
iattr, secdata and secdata length to allow the changes to persist in the event
that the inode representing the sysfs_dirent is evicted. Because sysfs only
stores this information when a change is made all the optional data is moved
into one dynamically allocated field.This patch addresses an issue where SELinux was denying virtd access to the PCI
configuration entries in sysfs. The lack of setxattr handlers for sysfs
required that a single label be assigned to all entries in sysfs. Granting virtd
access to every entry in sysfs is not an acceptable solution so fine grained
labeling of sysfs is required such that individual entries can be labeled
appropriately.[sds: Fixed compile-time warnings, coding style, and setting of inode security init flags.]
Signed-off-by: David P. Quigley
Signed-off-by: Stephen D. Smalley
Signed-off-by: James Morris -
This patch introduces three new hooks. The inode_getsecctx hook is used to get
all relevant information from an LSM about an inode. The inode_setsecctx is
used to set both the in-core and on-disk state for the inode based on a context
derived from inode_getsecctx.The final hook inode_notifysecctx will notify the
LSM of a change for the in-core state of the inode in question. These hooks are
for use in the labeled NFS code and addresses concerns of how to set security
on an inode in a multi-xattr LSM. For historical reasons Stephen Smalley's
explanation of the reason for these hooks is pasted below.Quote Stephen Smalley
inode_setsecctx: Change the security context of an inode. Updates the
in core security context managed by the security module and invokes the
fs code as needed (via __vfs_setxattr_noperm) to update any backing
xattrs that represent the context. Example usage: NFS server invokes
this hook to change the security context in its incore inode and on the
backing file system to a value provided by the client on a SETATTR
operation.inode_notifysecctx: Notify the security module of what the security
context of an inode should be. Initializes the incore security context
managed by the security module for this inode. Example usage: NFS
client invokes this hook to initialize the security context in its
incore inode to the value provided by the server for the file when the
server returned the file's attributes to the client.Signed-off-by: David P. Quigley
Acked-by: Serge Hallyn
Signed-off-by: James Morris
07 Sep, 2009
1 commit
-
- As ima_counts_put() may be called after the inode has been freed,
verify that the inode is not NULL, before dereferencing it.- Maintain the IMA file counters in may_open() properly, decrementing
any counter increments on subsequent errors.Reported-by: Ciprian Docan
Reported-by: J.R. Okajima
Signed-off-by: Mimi Zohar
Acked-by: Eric Paris
02 Sep, 2009
10 commits
-
Add a keyctl to install a process's session keyring onto its parent. This
replaces the parent's session keyring. Because the COW credential code does
not permit one process to change another process's credentials directly, the
change is deferred until userspace next starts executing again. Normally this
will be after a wait*() syscall.To support this, three new security hooks have been provided:
cred_alloc_blank() to allocate unset security creds, cred_transfer() to fill in
the blank security creds and key_session_to_parent() - which asks the LSM if
the process may replace its parent's session keyring.The replacement may only happen if the process has the same ownership details
as its parent, and the process has LINK permission on the session keyring, and
the session keyring is owned by the process, and the LSM permits it.Note that this requires alteration to each architecture's notify_resume path.
This has been done for all arches barring blackfin, m68k* and xtensa, all of
which need assembly alteration to support TIF_NOTIFY_RESUME. This allows the
replacement to be performed at the point the parent process resumes userspace
execution.This allows the userspace AFS pioctl emulation to fully emulate newpag() and
the VIOCSETTOK and VIOCSETTOK2 pioctls, all of which require the ability to
alter the parent process's PAG membership. However, since kAFS doesn't use
PAGs per se, but rather dumps the keys into the session keyring, the session
keyring of the parent must be replaced if, for example, VIOCSETTOK is passed
the newpag flag.This can be tested with the following program:
#include
#include
#include#define KEYCTL_SESSION_TO_PARENT 18
#define OSERROR(X, S) do { if ((long)(X) == -1) { perror(S); exit(1); } } while(0)
int main(int argc, char **argv)
{
key_serial_t keyring, key;
long ret;keyring = keyctl_join_session_keyring(argv[1]);
OSERROR(keyring, "keyctl_join_session_keyring");key = add_key("user", "a", "b", 1, keyring);
OSERROR(key, "add_key");ret = keyctl(KEYCTL_SESSION_TO_PARENT);
OSERROR(ret, "KEYCTL_SESSION_TO_PARENT");return 0;
}Compiled and linked with -lkeyutils, you should see something like:
[dhowells@andromeda ~]$ keyctl show
Session Keyring
-3 --alswrv 4043 4043 keyring: _ses
355907932 --alswrv 4043 -1 \_ keyring: _uid.4043
[dhowells@andromeda ~]$ /tmp/newpag
[dhowells@andromeda ~]$ keyctl show
Session Keyring
-3 --alswrv 4043 4043 keyring: _ses
1055658746 --alswrv 4043 4043 \_ user: a
[dhowells@andromeda ~]$ /tmp/newpag hello
[dhowells@andromeda ~]$ keyctl show
Session Keyring
-3 --alswrv 4043 4043 keyring: hello
340417692 --alswrv 4043 4043 \_ user: aWhere the test program creates a new session keyring, sticks a user key named
'a' into it and then installs it on its parent.Signed-off-by: David Howells
Signed-off-by: James Morris -
Do some whitespace cleanups in the key management code.
Signed-off-by: David Howells
Acked-by: Serge Hallyn
Signed-off-by: James Morris -
Make the file position maintained by /proc/keys represent the ID of the key
just read rather than the number of keys read. This should make it faster to
perform a lookup as we don't have to scan the key ID tree from the beginning to
find the current position.Signed-off-by: Serge E. Hallyn
Signed-off-by: David Howells
Signed-off-by: James Morris -
Add garbage collection for dead, revoked and expired keys. This involved
erasing all links to such keys from keyrings that point to them. At that
point, the key will be deleted in the normal manner.Keyrings from which garbage collection occurs are shrunk and their quota
consumption reduced as appropriate.Dead keys (for which the key type has been removed) will be garbage collected
immediately.Revoked and expired keys will hang around for a number of seconds, as set in
/proc/sys/kernel/keys/gc_delay before being automatically removed. The default
is 5 minutes.Signed-off-by: David Howells
Signed-off-by: James Morris -
Set the KEY_FLAG_DEAD flag on keys for which the type has been removed. This
causes the key_permission() function to return EKEYREVOKED in response to
various commands. It does not, however, prevent unlinking or clearing of
keyrings from detaching the key.Signed-off-by: David Howells
Acked-by: Serge Hallyn
Signed-off-by: James Morris -
Allow keyctl_revoke() to operate on keys that have SETATTR but not WRITE
permission, rather than only on keys that have WRITE permission.Signed-off-by: David Howells
Acked-by: Serge Hallyn
Signed-off-by: James Morris -
Allow keys for which the key type has been removed to be unlinked. Currently
dead-type keys can only be disposed of by completely clearing the keyrings
that point to them.Signed-off-by: David Howells
Acked-by: Serge Hallyn
Signed-off-by: James Morris -
Add a config option (CONFIG_DEBUG_CREDENTIALS) to turn on some debug checking
for credential management. The additional code keeps track of the number of
pointers from task_structs to any given cred struct, and checks to see that
this number never exceeds the usage count of the cred struct (which includes
all references, not just those from task_structs).Furthermore, if SELinux is enabled, the code also checks that the security
pointer in the cred struct is never seen to be invalid.This attempts to catch the bug whereby inode_has_perm() faults in an nfsd
kernel thread on seeing cred->security be a NULL pointer (it appears that the
credential struct has been previously released):http://www.kerneloops.org/oops.php?number=252883
Signed-off-by: David Howells
Signed-off-by: James Morris -
Conflicts:
arch/x86/kernel/reboot.c
security/KconfigMerge reason: resolve the conflicts, bump up from rc3 to rc8.
Signed-off-by: Ingo Molnar
-
Move tboot.h from asm to linux to fix the build errors of intel_txt
patch on non-X86 platforms. Remove the tboot code from generic code
init/main.c and kernel/cpu.c.Signed-off-by: Shane Wang
Signed-off-by: H. Peter Anvin
01 Sep, 2009
2 commits
-
Add support for the new TUN LSM hooks: security_tun_dev_create(),
security_tun_dev_post_create() and security_tun_dev_attach(). This includes
the addition of a new object class, tun_socket, which represents the socks
associated with TUN devices. The _tun_dev_create() and _tun_dev_post_create()
hooks are fairly similar to the standard socket functions but _tun_dev_attach()
is a bit special. The _tun_dev_attach() is unique because it involves a
domain attaching to an existing TUN device and its associated tun_socket
object, an operation which does not exist with standard sockets and most
closely resembles a relabel operation.Signed-off-by: Paul Moore
Acked-by: Eric Paris
Signed-off-by: James Morris -
The TUN driver lacks any LSM hooks which makes it difficult for LSM modules,
such as SELinux, to enforce access controls on network traffic generated by
TUN users; this is particularly problematic for virtualization apps such as
QEMU and KVM. This patch adds three new LSM hooks designed to control the
creation and attachment of TUN devices, the hooks are:* security_tun_dev_create()
Provides access control for the creation of new TUN devices* security_tun_dev_post_create()
Provides the ability to create the necessary socket LSM state for newly
created TUN devices* security_tun_dev_attach()
Provides access control for attaching to existing, persistent TUN devices
and the ability to update the TUN device's socket LSM state as necessarySigned-off-by: Paul Moore
Acked-by: Eric Paris
Acked-by: Serge Hallyn
Acked-by: David S. Miller
Signed-off-by: James Morris
27 Aug, 2009
2 commits
-
…s/security-testing-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
IMA: iint put in ima_counts_get and put -
ima_counts_get() calls ima_iint_find_insert_get() which takes a reference
to the iint in question, but does not put that reference at the end of the
function. This can lead to a nasty memory leak. Easy enough to reproduce:#include
#includeint main (void)
{
int i;
void *ptr;for (i=0; i < 100000; i++) {
ptr = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_SHARED|MAP_ANONYMOUS, -1, 0);
if (ptr == MAP_FAILED)
return 2;
munmap(ptr, 4096);
}return 0;
}Signed-off-by: Eric Paris
Signed-off-by: James Morris
24 Aug, 2009
1 commit
-
Hashing files larger than INT_MAX causes process to loop.
Dependent on redefining kernel_read() offset type to loff_t.(http://bugzilla.kernel.org/show_bug.cgi?id=13909)
Cc: stable@kernel.org
Signed-off-by: Mimi Zohar
Signed-off-by: James Morris
21 Aug, 2009
1 commit
-
As suggested by OGAWA Hirofumi in thread:
http://lkml.org/lkml/2009/8/7/132, we should let selinux_inode_setattr()
to match our ATTR_* rules. ATTR_FORCE should not force things like
ATTR_SIZE.[hirofumi@mail.parknet.co.jp: tweaks]
Signed-off-by: WANG Cong
Signed-off-by: OGAWA Hirofumi
Acked-by: Stephen Smalley
Acked-by: Eric Paris
Cc: Eugene Teo
Cc: Al Viro
Cc: Christoph Hellwig
Acked-by: James Morris
Signed-off-by: Andrew Morton
Signed-off-by: James Morris
20 Aug, 2009
1 commit
-
Conflicts:
security/KconfigManual fix.
Signed-off-by: James Morris