Eric Lee / smarc-fsl-linux-kernel

12 Oct, 2011

1 commit

  • 545a72603   TOMOYO: Fix quota and garbage collector. ... Browse Code »

    Commit 059d84db "TOMOYO: Add socket operation restriction support" and
    commit 731d37aa "TOMOYO: Allow domain transition without execve()." forgot to
    update tomoyo_domain_quota_is_ok() and tomoyo_del_acl() which results in
    incorrect quota counting and memory leak.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

26 Sep, 2011

2 commits

  • a427fd14d   TOMOYO: Remove tomoyo_policy_memory_lock spinlock. ... Browse Code »

    tomoyo_policy_lock mutex already protects it.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     
  • f9732ea14   TOMOYO: Simplify garbage collector. ... Browse Code »

    When TOMOYO started using garbage collector at commit 847b173e "TOMOYO: Add
    garbage collector.", we waited for close() before kfree(). Thus, elements to be
    kfree()d were queued up using tomoyo_gc_list list.

    But it turned out that tomoyo_element_linked_by_gc() tends to choke garbage
    collector when certain pattern of entries are queued.

    Since garbage collector is no longer waiting for close() since commit 2e503bbb
    "TOMOYO: Fix lockdep warning.", we can remove tomoyo_gc_list list and
    tomoyo_element_linked_by_gc() by doing sequential processing.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

14 Sep, 2011

2 commits

  • 059d84dbb   TOMOYO: Add socket operation restriction support. ... Browse Code »

    This patch adds support for permission checks for PF_INET/PF_INET6/PF_UNIX
    socket's bind()/listen()/connect()/send() operations.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     
  • d58e0da85   TOMOYO: Add environment variable name restriction support. ... Browse Code »

    This patch adds support for checking environment variable's names.
    Although TOMOYO already provides ability to check argv[]/envp[] passed to
    execve() requests,

    file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="bar"

    will reject execution of /bin/sh if environment variable LD_LIBRARY_PATH is not
    defined. To grant execution of /bin/sh if LD_LIBRARY_PATH is not defined,
    administrators have to specify like

    file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="/system/lib"
    file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]=NULL

    . Since there are many environment variables whereas conditional checks are
    applied as "&&", it is difficult to cover all combinations. Therefore, this
    patch supports conditional checks that are applied as "||", by specifying like

    file execute /bin/sh
    misc env LD_LIBRARY_PATH exec.envp["LD_LIBRARY_PATH"]="/system/lib"

    which means "grant execution of /bin/sh if environment variable is not defined
    or is defined and its value is /system/lib".

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

17 Aug, 2011

1 commit

  • 09f464bf0   tomoyo: remove tomoyo_gc_thread()->daemonize() ... Browse Code »

    daemonize() is only needed when a user-space task does kernel_thread().

    tomoyo_gc_thread() is kthread_create()'ed and thus it doesn't need
    the soon-to-be-deprecated daemonize().

    Signed-off-by: Oleg Nesterov
    Acked-by: Tejun Heo
    Acked-by: Matt Fleming
    Signed-off-by: James Morris

    Oleg Nesterov
     

14 Jul, 2011

1 commit

11 Jul, 2011

3 commits

29 Jun, 2011

5 commits

  • 2e503bbb4   TOMOYO: Fix lockdep warning. ... Browse Code »

    Currently TOMOYO holds SRCU lock upon open() and releases it upon close()
    because list elements stored in the "struct tomoyo_io_buffer" instances are
    accessed until close() is called. However, such SRCU usage causes lockdep to
    complain about leaving the kernel with SRCU lock held.

    This patch solves the warning by holding/releasing SRCU upon each
    read()/write(). This patch is doing something similar to calling kfree()
    without calling synchronize_srcu(), by selectively deferring kfree() by keeping
    track of the "struct tomoyo_io_buffer" instances.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     
  • bd03a3e4c   TOMOYO: Add policy namespace support. ... Browse Code »

    Mauras Olivier reported that it is difficult to use TOMOYO in LXC environments,
    for TOMOYO cannot distinguish between environments outside the container and
    environments inside the container since LXC environments are created using
    pivot_root(). To address this problem, this patch introduces policy namespace.

    Each policy namespace has its own set of domain policy, exception policy and
    profiles, which are all independent of other namespaces. This independency
    allows users to develop policy without worrying interference among namespaces.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     
  • 32997144f   TOMOYO: Add ACL group support. ... Browse Code »

    ACL group allows administrator to globally grant not only "file read"
    permission but also other permissions.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     
  • 0df7e8b8f   TOMOYO: Cleanup part 3. ... Browse Code »

    Use common structure for ACL with "struct list_head" + "atomic_t".
    Use array/struct where possible.
    Remove is_group from "struct tomoyo_name_union"/"struct tomoyo_number_union".
    Pass "struct file"->private_data rather than "struct file".
    Update some of comments.
    Bring tomoyo_same_acl_head() from common.h to domain.c .
    Bring tomoyo_invalid()/tomoyo_valid() from common.h to util.c .

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     
  • 7c75964f4   TOMOYO: Cleanup part 1. ... Browse Code »

    In order to synchronize with TOMOYO 1.8's syntax,

    (1) Remove special handling for allow_read/write permission.
    (2) Replace deny_rewrite/allow_rewrite permission with allow_append permission.
    (3) Remove file_pattern keyword.
    (4) Remove allow_read permission from exception policy.
    (5) Allow creating domains in enforcing mode without calling supervisor.
    (6) Add permission check for opening directory for reading.
    (7) Add permission check for stat() operation.
    (8) Make "cat < /sys/kernel/security/tomoyo/self_domain" behave as if
    "cat /sys/kernel/security/tomoyo/self_domain".

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

02 Aug, 2010

15 commits

17 May, 2010

1 commit

06 May, 2010

1 commit

  • 292823814   TOMOYO: Use mutex_lock_interruptible. ... Browse Code »

    Some of TOMOYO's functions may sleep after mutex_lock(). If OOM-killer selected
    a process which is waiting at mutex_lock(), the to-be-killed process can't be
    killed. Thus, replace mutex_lock() with mutex_lock_interruptible() so that the
    to-be-killed process can immediately return from TOMOYO's functions.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

30 Mar, 2010

1 commit

  • 5a0e3ad6a   include cleanup: Update gfp.h and slab.h includes to prepare for breaking implic… ... Browse Code »

    …it slab.h inclusion from percpu.h

    percpu.h is included by sched.h and module.h and thus ends up being
    included when building most .c files. percpu.h includes slab.h which
    in turn includes gfp.h making everything defined by the two files
    universally available and complicating inclusion dependencies.

    percpu.h -> slab.h dependency is about to be removed. Prepare for
    this change by updating users of gfp and slab facilities include those
    headers directly instead of assuming availability. As this conversion
    needs to touch large number of source files, the following script is
    used as the basis of conversion.

    http://userweb.kernel.org/~tj/misc/slabh-sweep.py

    The script does the followings.

    * Scan files for gfp and slab usages and update includes such that
    only the necessary includes are there. ie. if only gfp is used,
    gfp.h, if slab is used, slab.h.

    * When the script inserts a new include, it looks at the include
    blocks and try to put the new include such that its order conforms
    to its surrounding. It's put in the include block which contains
    core kernel includes, in the same order that the rest are ordered -
    alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
    doesn't seem to be any matching order.

    * If the script can't find a place to put a new include (mostly
    because the file doesn't have fitting include block), it prints out
    an error message indicating which .h file needs to be added to the
    file.

    The conversion was done in the following steps.

    1. The initial automatic conversion of all .c files updated slightly
    over 4000 files, deleting around 700 includes and adding ~480 gfp.h
    and ~3000 slab.h inclusions. The script emitted errors for ~400
    files.

    2. Each error was manually checked. Some didn't need the inclusion,
    some needed manual addition while adding it to implementation .h or
    embedding .c file was more appropriate for others. This step added
    inclusions to around 150 files.

    3. The script was run again and the output was compared to the edits
    from #2 to make sure no file was left behind.

    4. Several build tests were done and a couple of problems were fixed.
    e.g. lib/decompress_*.c used malloc/free() wrappers around slab
    APIs requiring slab.h to be added manually.

    5. The script was run on all .h files but without automatically
    editing them as sprinkling gfp.h and slab.h inclusions around .h
    files could easily lead to inclusion dependency hell. Most gfp.h
    inclusion directives were ignored as stuff from gfp.h was usually
    wildly available and often used in preprocessor macros. Each
    slab.h inclusion directive was examined and added manually as
    necessary.

    6. percpu.h was updated not to include slab.h.

    7. Build test were done on the following configurations and failures
    were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
    distributed build env didn't work with gcov compiles) and a few
    more options had to be turned off depending on archs to make things
    build (like ipr on powerpc/64 which failed due to missing writeq).

    * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
    * powerpc and powerpc64 SMP allmodconfig
    * sparc and sparc64 SMP allmodconfig
    * ia64 SMP allmodconfig
    * s390 SMP allmodconfig
    * alpha SMP allmodconfig
    * um on x86_64 SMP allmodconfig

    8. percpu.h modifications were reverted so that it could be applied as
    a separate patch and serve as bisection point.

    Given the fact that I had only a couple of failures from tests on step
    6, I'm fairly confident about the coverage of this conversion patch.
    If there is a breakage, it's likely to be something in one of the arch
    headers which should be easily discoverable easily on most builds of
    the specific arch.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>

    Tejun Heo
     

16 Feb, 2010

1 commit

15 Feb, 2010

1 commit