24 Nov, 2009
4 commits
-
As far as I know, all distros currently ship kernels with default
CONFIG_SECURITY_FILE_CAPABILITIES=y. Since having the option on
leaves a 'no_file_caps' option to boot without file capabilities,
the main reason to keep the option is that turning it off saves
you (on my s390x partition) 5k. In particular, vmlinux sizes
came to:without patch fscaps=n: 53598392
without patch fscaps=y: 53603406
with this patch applied: 53603342with the security-next tree.
Against this we must weigh the fact that there is no simple way for
userspace to figure out whether file capabilities are supported,
while things like per-process securebits, capability bounding
sets, and adding bits to pI if CAP_SETPCAP is in pE are not supported
with SECURITY_FILE_CAPABILITIES=n, leaving a bit of a problem for
applications wanting to know whether they can use them and/or why
something failed.It also adds another subtly different set of semantics which we must
maintain at the risk of severe security regressions.So this patch removes the SECURITY_FILE_CAPABILITIES compile
option. It drops the kernel size by about 50k over the stock
SECURITY_FILE_CAPABILITIES=y kernel, by removing the
cap_limit_ptraced_target() function.Changelog:
Nov 20: remove cap_limit_ptraced_target() as it's logic
was ifndef'ed.Signed-off-by: Serge E. Hallyn
Acked-by: Andrew G. Morgan"
Signed-off-by: James Morris -
Historically we've seen cases where permissions are requested for classes
where they do not exist. In particular we have seen CIFS forget to set
i_mode to indicate it is a directory so when we later check something like
remove_name we have problems since it wasn't defined in tclass file. This
used to result in a avc which included the permission 0x2000 or something.
Currently the kernel will deny the operations (good thing) but will not
print ANY information (bad thing). First the auditdeny field is no
extended to include unknown permissions. After that is fixed the logic in
avc_dump_query to output this information isn't right since it will remove
the permission from the av and print the phrase "". This takes us
back to the behavior before the classmap rewrite.Signed-off-by: Eric Paris
Signed-off-by: James Morris -
When libcap, or other libraries attempt to confirm/determine the supported
capability version magic, they generally supply a NULL dataptr to capget().In this case, while returning the supported/preferred magic (via a
modified header content), the return code of this system call may be 0,
-EINVAL, or -EFAULT.No libcap code depends on the previous -EINVAL etc. return code, and
all of the above three return codes can accompany a valid (successful)
attempt to determine the requested magic value.This patch cleans up the system call to return 0, if the call is
successfully being used to determine the supported/preferred capability
magic value.Signed-off-by: Andrew G. Morgan
Acked-by: Steve Grubb
Acked-by: Serge Hallyn
Signed-off-by: James Morris -
We should call security_path_chmod()/security_path_chown() after mutex_lock()
in order to avoid races.Signed-off-by: Tetsuo Handa
Acked-by: John Johansen
Signed-off-by: James Morris
23 Nov, 2009
1 commit
-
If a permission name is long enough the selinux class definition generation
tool will go into a infinite loop. This is because it's macro max() is
fooled into thinking it is dealing with unsigned numbers. This patch makes
sure the macro always uses signed number so 1 > -1.Signed-off-by: Eric Paris
Signed-off-by: James Morris
19 Nov, 2009
1 commit
-
scripts/selinux/genheaders/genheaders.c:20: warning: no previous prototype
for ?usage?
scripts/selinux/genheaders/genheaders.c:26: warning: no previous prototype
for ?stoupperx?Signed-off-by: Alan Cox
Acked-by: WANG Cong
Signed-off-by: James Morris
10 Nov, 2009
1 commit
-
For SELinux to do better filtering in userspace we send the name of the
module along with the AVC denial when a program is denied module_request.Example output:
type=SYSCALL msg=audit(11/03/2009 10:59:43.510:9) : arch=x86_64 syscall=write success=yes exit=2 a0=3 a1=7fc28c0d56c0 a2=2 a3=7fffca0d7440 items=0 ppid=1727 pid=1729 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpc.nfsd exe=/usr/sbin/rpc.nfsd subj=system_u:system_r:nfsd_t:s0 key=(null)
type=AVC msg=audit(11/03/2009 10:59:43.510:9) : avc: denied { module_request } for pid=1729 comm=rpc.nfsd kmod="net-pf-10" scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=systemSigned-off-by: Eric Paris
Signed-off-by: James Morris
09 Nov, 2009
2 commits
-
The LSM currently requires setting a kernel parameter at boot to select
a specific LSM. This adds a config option that allows specifying a default
LSM that is used unless overridden with the security= kernel parameter.
If the the config option is not set the current behavior of first LSM
to register is used.Signed-off-by: John Johansen
Acked-by: Serge Hallyn
Signed-off-by: James Morris -
Currently the mmap_min_addr value can only be bypassed during mmap when
the task has CAP_SYS_RAWIO. However, the mmap_min_addr sysctl value itself
can be adjusted to 0 if euid == 0, allowing a bypass without CAP_SYS_RAWIO.
This patch adds a check for the capability before allowing mmap_min_addr to
be changed.Signed-off-by: Kees Cook
Acked-by: Serge Hallyn
Signed-off-by: James Morris
03 Nov, 2009
1 commit
-
The tpm_tis driver already has a list of supported pnp_device_ids.
This patch simply exports that list as a MODULE_DEVICE_TABLE() so that
the module autoloader will discover and load the module at boottime.Signed-off-by: Matt Domsch
Acked-by: Rajiv Andrade
Signed-off-by: Andrew Morton
Signed-off-by: James Morris
02 Nov, 2009
1 commit
-
Some newer Lenovo models are shipped with a TPM that doesn't seem to set the TPM_STS_DATA_EXPECT status bit
when sending it a burst of data, so the code understands it as a failure and doesn't proceed sending the chip
the intended data. In this patch we bypass this bit check in case the itpm module parameter was set.This patch is based on Andy Isaacson's one:
http://marc.info/?l=linux-kernel&m=124650185023495&w=2
It was heavily discussed how should we deal with identifying the chip in kernel space, but the required
patch to do so was NACK'd:http://marc.info/?l=linux-kernel&m=124650186423711&w=2
This way we let the user choose using this workaround or not based on his
observations on this code behavior when trying to use the TPM.Fixed a checkpatch issue present on the previous patch, thanks to Daniel Walker.
Signed-off-by: Rajiv Andrade
Acked-by: Eric Paris
Tested-by: Seiji Munetoh
Signed-off-by: James Morris
30 Oct, 2009
1 commit
-
Hi James, would you mind taking the following into
security-testing?The securebits are used by passing them to prctl with the
PR_{S,G}ET_SECUREBITS commands. But the defines must be
shifted to be used in prctl, which begs to be confused and
misused by userspace. So define some more convenient
values for userspace to specify. This way userspace doesprctl(PR_SET_SECUREBITS, SECBIT_NOROOT);
instead of
prctl(PR_SET_SECUREBITS, 1 << SECURE_NOROOT);
(Thanks to Michael for the idea)
This patch also adds include/linux/securebits to the installed headers.
Then perhaps it can be included by glibc's sys/prctl.h.Changelog:
Oct 29: Stephen Rothwell points out that issecure can
be under __KERNEL__.
Oct 14: (Suggestions by Michael Kerrisk):
1. spell out SETUID in SECBIT_NO_SETUID*
2. SECBIT_X_LOCKED does not imply SECBIT_X
3. add definitions for keepcaps
Oct 14: As suggested by Michael Kerrisk, don't
use SB_* as that convention is already in
use. Use SECBIT_ prefix instead.Signed-off-by: Serge E. Hallyn
Acked-by: Andrew G. Morgan
Acked-by: Michael Kerrisk
Cc: Ulrich Drepper
Cc: James Morris
Signed-off-by: James Morris
29 Oct, 2009
2 commits
-
Fix build for TCG_TPM=m. Header file doesn't handle this
and incorrectly builds stubs.drivers/char/tpm/tpm.c:720: error: redefinition of 'tpm_pcr_read'
include/linux/tpm.h:35: error:previous definition of 'tpm_pcr_read' was here
drivers/char/tpm/tpm.c:752: error: redefinition of 'tpm_pcr_extend'
include/linux/tpm.h:38: error:previous definition of 'tpm_pcr_extend' was hereRepairs linux-next's
commit d6ba452128178091dab7a04d54f7e66fdc32fb39
Author: Mimi Zohar
Date: Mon Oct 26 09:26:18 2009 -0400tpm add default function definitions
Signed-off-by: Randy Dunlap
Cc: Rajiv Andrade
Cc: Mimi Zohar
Cc: James Morris
Cc: Eric Paris
Signed-off-by: Andrew Morton
Signed-off-by: James Morris -
When examining the network device name hash, it was discovered that
the low order bits of full_name_hash() are not very well dispersed
across the possible values. When used by filesystem code, this is handled
by folding with the function hash_long().The only other non-filesystem usage of full_name_hash() at this time
appears to be in TOMOYO. This patch should fix that.I do not use TOMOYO at this time, so this patch is build tested only.
Signed-off-by: Stephen Hemminger
Acked-by: Tetsuo Handa
Signed-off-by: James Morris
28 Oct, 2009
1 commit
-
Add default tpm_pcr_read/extend function definitions required
by IMA/Kconfig changes.Signed-off-by: Mimi Zohar
Reviewed-by: Eric Paris
Signed-off-by: James Morris
25 Oct, 2009
1 commit
-
Based on discussions on LKML and LSM, where there are consecutive
security_ and ima_ calls in the vfs layer, move the ima_ calls to
the existing security_ hooks.Signed-off-by: Mimi Zohar
Signed-off-by: James Morris
24 Oct, 2009
1 commit
-
The SELinux dynamic class work in c6d3aaa4e35c71a32a86ececacd4eea7ecfc316c
creates a number of dynamic header files and scripts. Add .gitignore files
so git doesn't complain about these.Signed-off-by: Eric Paris
Acked-by: Stephen D. Smalley
Signed-off-by: James Morris
20 Oct, 2009
2 commits
-
Remove the root_plug example LSM code. It's unmaintained and
increasingly broken in various ways.Made at the 2009 Kernel Summit in Tokyo!
Acked-by: Greg Kroah-Hartman
Signed-off-by: James Morris -
Ensure that we release the policy read lock on all exit paths from
security_compute_av.Signed-off-by: Stephen D. Smalley
Signed-off-by: James Morris
14 Oct, 2009
1 commit
-
The capabilities syscall has a copy_from_user() call where gcc currently
cannot prove to itself that the copy is always within bounds.This patch adds a very explicity bound check to prove to gcc that this
copy_from_user cannot overflow its destination buffer.Signed-off-by: Arjan van de Ven
Acked-by: James Morris
Signed-off-by: Andrew Morton
Signed-off-by: James Morris
12 Oct, 2009
3 commits
-
This patch allows LSM modules to determine based on original mount flags
passed to mount(). A LSM module can get masked mount flags (if needed) byflags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE |
MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
MS_STRICTATIME);Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
This patch allows pathname based LSM modules to check chroot() operations.
This hook is used by TOMOYO.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
This patch allows pathname based LSM modules to check chmod()/chown()
operations. Since notify_change() does not receive "struct vfsmount *",
we add security_path_chmod() and security_path_chown() to the caller of
notify_change().These hooks are used by TOMOYO.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris
07 Oct, 2009
3 commits
-
Drop remapping of netlink classes and bypass of permission checking
based on netlink message type for policy version < 18. This removes
compatibility code introduced when the original single netlink
security class used for all netlink sockets was split into
finer-grained netlink classes based on netlink protocol and when
permission checking was added based on netlink message type in Linux
2.6.8. The only known distribution that shipped with SELinux and
policy < 18 was Fedora Core 2, which was EOL'd on 2005-04-11.Given that the remapping code was never updated to address the
addition of newer netlink classes, that the corresponding userland
support was dropped in 2005, and that the assumptions made by the
remapping code about the fixed ordering among netlink classes in the
policy may be violated in the future due to the dynamic class/perm
discovery support, we should drop this compatibility code now.Signed-off-by: Stephen Smalley
Signed-off-by: James Morris -
Add a simple utility (scripts/selinux/genheaders) and invoke it to
generate the kernel-private class and permission indices in flask.h
and av_permissions.h automatically during the kernel build from the
security class mapping definitions in classmap.h. Adding new kernel
classes and permissions can then be done just by adding them to classmap.h.Signed-off-by: Stephen Smalley
Signed-off-by: James Morris -
Modify SELinux to dynamically discover class and permission values
upon policy load, based on the dynamic object class/perm discovery
logic from libselinux. A mapping is created between kernel-private
class and permission indices used outside the security server and the
policy values used within the security server.The mappings are only applied upon kernel-internal computations;
similar mappings for the private indices of userspace object managers
is handled on a per-object manager basis by the userspace AVC. The
interfaces for compute_av and transition_sid are split for kernel
vs. userspace; the userspace functions are distinguished by a _user
suffix.The kernel-private class indices are no longer tied to the policy
values and thus do not need to skip indices for userspace classes;
thus the kernel class index values are compressed. The flask.h
definitions were regenerated by deleting the userspace classes from
refpolicy's definitions and then regenerating the headers. Going
forward, we can just maintain the flask.h, av_permissions.h, and
classmap.h definitions separately from policy as they are no longer
tied to the policy values. The next patch introduces a utility to
automate generation of flask.h and av_permissions.h from the
classmap.h definitions.The older kernel class and permission string tables are removed and
replaced by a single security class mapping table that is walked at
policy load to generate the mapping. The old kernel class validation
logic is completely replaced by the mapping logic.The handle unknown logic is reworked. reject_unknown=1 is handled
when the mappings are computed at policy load time, similar to the old
handling by the class validation logic. allow_unknown=1 is handled
when computing and mapping decisions - if the permission was not able
to be mapped (i.e. undefined, mapped to zero), then it is
automatically added to the allowed vector. If the class was not able
to be mapped (i.e. undefined, mapped to zero), then all permissions
are allowed for it if allow_unknown=1.avc_audit leverages the new security class mapping table to lookup the
class and permission names from the kernel-private indices.The mdp program is updated to use the new table when generating the
class definitions and allow rules for a minimal boot policy for the
kernel. It should be noted that this policy will not include any
userspace classes, nor will its policy index values for the kernel
classes correspond with the ones in refpolicy (they will instead match
the kernel-private indices).Signed-off-by: Stephen Smalley
Signed-off-by: James Morris
01 Oct, 2009
1 commit
-
The previously sent patch:
http://marc.info/?l=tpmdd-devel&m=125208945007834&w=2
Had its first hunk cropped when merged, submitting only this first hunk
again.Signed-off-by: Jason Gunthorpe
Cc: Debora Velarde
Cc: Marcel Selhorst
Cc: James Morris
Signed-off-by: Andrew Morton
Signed-off-by: Rajiv Andrade
Acked-by: Mimi Zohar
Tested-by: Mimi Zohar
Signed-off-by: James Morris
30 Sep, 2009
2 commits
-
This patch resets the security_ops to the secondary_ops before it flushes
the avc. It's still possible that a task on another processor could have
already passed the security_ops dereference and be executing an selinux hook
function which would add a new avc entry. That entry would still not be
freed. This should however help to reduce the number of needless avcs the
kernel has when selinux is disabled at run time. There is no wasted
memory if selinux is disabled on the command line or not compiled.Signed-off-by: Eric Paris
Signed-off-by: James Morris
28 Sep, 2009
8 commits
-
.. duplicated by merging the same fix twice, for details see commit
0d9df2515dbceb67d343c0f10fd3ff218380d524 ("Merge
git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fixes")Signed-off-by: Linus Torvalds
-
The following commit made console open fails while booting:
commit b50989dc444599c8b21edc23536fc305f4e9b7d5
Author: Alan Cox
Date: Sat Sep 19 13:13:22 2009 -0700tty: make the kref destructor occur asynchronously
Due to tty release routines run in a workqueue now, error like the
following will be reported while booting:INIT open /dev/console Input/output error
It also causes hibernation regression to appear as reported at
http://bugzilla.kernel.org/show_bug.cgi?id=14229The reason is that now there's latency issue with closing, but when
we open a "closing not finished" tty, -EIO will be returned.Fix it as per the following Alan's suggestion:
Fun but it's actually not a bug and the fix is wrong in itself as
the port may be closing but not yet being destructed, in which case
it seems to do the wrong thing. Opening a tty that is closing (and
could be closing for long periods) is supposed to return -EIO.I suspect a better way to deal with this and keep the old console
timing is to split tty->shutdown into two functions.tty->shutdown() - called synchronously just before we dump the tty
onto the waitqueue for destructiontty->cleanup() - called when the destructor runs.
We would then do the shutdown part which can occur in IRQ context
fine, before queueing the rest of the release (from tty->magic = 0
... the end) to occur asynchronouslyThe USB update in -next would then need a call like
if (tty->cleanup)
tty->cleanup(tty);at the top of the async function and the USB shutdown to be split
between shutdown and cleanup as the USB resource cleanup and final
tidy cannot occur synchronously as it needs to sleep.In other words the logic becomes
final kref put
make object unfindableasync
clean it upSigned-off-by: Dave Young
[ rjw: Rebased on top of 2.6.31-git, reworked the changelog. ]
Signed-off-by: "Rafael J. Wysocki"
[ Changed serial naming to match new rules, dropped tty_shutdown as per
comments from Alan Stern - Linus ]
Signed-off-by: Linus Torvalds -
Commit 3d5b6fb47a8e68fa311ca2c3447e7f8a7c3a9cf3 ("ACPI: Kill overly
verbose "power state" log messages") removed the actual use of this
variable, but didn't remove the variable itself, resulting in build
warnings likedrivers/acpi/processor_idle.c: In function ‘acpi_processor_power_init’:
drivers/acpi/processor_idle.c:1169: warning: unused variable ‘i’Just get rid of the now unused variable.
Signed-off-by: Linus Torvalds
-
* mark struct vm_area_struct::vm_ops as const
* mark vm_ops in AGP codeBut leave TTM code alone, something is fishy there with global vm_ops
being used.Signed-off-by: Alexey Dobriyan
Signed-off-by: Linus Torvalds -
* 'timers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
hrtimer: Eliminate needless reprogramming of clock events device -
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6:
ACPI: IA64=y ACPI=n build fix
ACPI: Kill overly verbose "power state" log messages
ACPI: fix Compaq Evo N800c (Pentium 4m) boot hang regression
ACPI: Clarify resource conflict message
thinkpad-acpi: fix CONFIG_THINKPAD_ACPI_HOTKEY_POLL build problem -
…git/tip/linux-2.6-tip
* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86: Fix hwpoison code related build failure on 32-bit NUMAQ
27 Sep, 2009
3 commits
-
ia64's sim_defconfig uses CONFIG_ACPI=n
which now #define's acpi_disabled inSo we shouldn't re-define it here in
Signed-off-by: Len Brown
-
I was recently lucky enough to get a 64-CPU system, so my kernel log
ends up with 64 lines like:ACPI: CPU0 (power states: C1[C1] C2[C3])
This is pretty useless clutter because this info is already available
after boot from both /sys/devices/system/cpu/cpu*/cpuidle/state?/ as
well as /proc/acpi/processor/CPU*/power.So just delete the code that prints the C-states in processor_idle.c.
Signed-off-by: Roland Dreier
Signed-off-by: Len Brown -
This build failure triggers:
In file included from include/linux/suspend.h:8,
from arch/x86/kernel/asm-offsets_32.c:11,
from arch/x86/kernel/asm-offsets.c:2:
include/linux/mm.h:503:2: error: #error SECTIONS_WIDTH+NODES_WIDTH+ZONES_WIDTH > BITS_PER_LONG - NR_PAGEFLAGSBecause due to the hwpoison page flag we ran out of page
flags on 32-bit.Dont turn on hwpoison on 32-bit NUMA (it's rare in any
case).Also clean up the Kconfig dependencies in the generic MM
code by introducing ARCH_SUPPORTS_MEMORY_FAILURE.Signed-off-by: Linus Torvalds
Signed-off-by: Ingo Molnar
