22 Apr, 2008

19 commits


19 Apr, 2008

21 commits

  • …s/security-testing-2.6

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
    security: fix up documentation for security_module_enable
    Security: Introduce security= boot parameter
    Audit: Final renamings and cleanup
    SELinux: use new audit hooks, remove redundant exports
    Audit: internally use the new LSM audit hooks
    LSM/Audit: Introduce generic Audit LSM hooks
    SELinux: remove redundant exports
    Netlink: Use generic LSM hook
    Audit: use new LSM hooks instead of SELinux exports
    SELinux: setup new inode/ipc getsecid hooks
    LSM: Introduce inode_getsecid and ipc_getsecid hooks

    Linus Torvalds
     
  • * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6.26: (1090 commits)
    [NET]: Fix and allocate less memory for ->priv'less netdevices
    [IPV6]: Fix dangling references on error in fib6_add().
    [NETLABEL]: Fix NULL deref in netlbl_unlabel_staticlist_gen() if ifindex not found
    [PKT_SCHED]: Fix datalen check in tcf_simp_init().
    [INET]: Uninline the __inet_inherit_port call.
    [INET]: Drop the inet_inherit_port() call.
    SCTP: Initialize partial_bytes_acked to 0, when all of the data is acked.
    [netdrvr] forcedeth: internal simplifications; changelog removal
    phylib: factor out get_phy_id from within get_phy_device
    PHY: add BCM5464 support to broadcom PHY driver
    cxgb3: Fix __must_check warning with dev_dbg.
    tc35815: Statistics cleanup
    natsemi: fix MMIO for PPC 44x platforms
    [TIPC]: Cleanup of TIPC reference table code
    [TIPC]: Optimized initialization of TIPC reference table
    [TIPC]: Remove inlining of reference table locking routines
    e1000: convert uint16_t style integers to u16
    ixgb: convert uint16_t style integers to u16
    sb1000.c: make const arrays static
    sb1000.c: stop inlining largish static functions
    ...

    Linus Torvalds
     
  • security_module_enable() can only be called during kernel init.

    Signed-off-by: James Morris

    James Morris
     
  • Add the security= boot parameter. This is done to avoid LSM
    registration clashes in case of more than one bult-in module.

    User can choose a security module to enable at boot. If no
    security= boot parameter is specified, only the first LSM
    asking for registration will be loaded. An invalid security
    module name will be treated as if no module has been chosen.

    LSM modules must check now if they are allowed to register
    by calling security_module_enable(ops) first. Modify SELinux
    and SMACK to do so.

    Do not let SMACK register smackfs if it was not chosen on
    boot. Smackfs assumes that smack hooks are registered and
    the initial task security setup (swapper->security) is done.

    Signed-off-by: Ahmed S. Darwish
    Acked-by: James Morris

    Ahmed S. Darwish
     
  • Rename the se_str and se_rule audit fields elements to
    lsm_str and lsm_rule to avoid confusion.

    Signed-off-by: Casey Schaufler
    Signed-off-by: Ahmed S. Darwish
    Acked-by: James Morris

    Ahmed S. Darwish
     
  • Setup the new Audit LSM hooks for SELinux.
    Remove the now redundant exported SELinux Audit interface.

    Audit: Export 'audit_krule' and 'audit_field' to the public
    since their internals are needed by the implementation of the
    new LSM hook 'audit_rule_known'.

    Signed-off-by: Casey Schaufler
    Signed-off-by: Ahmed S. Darwish
    Acked-by: James Morris

    Ahmed S. Darwish
     
  • Convert Audit to use the new LSM Audit hooks instead of
    the exported SELinux interface.

    Basically, use:
    security_audit_rule_init
    secuirty_audit_rule_free
    security_audit_rule_known
    security_audit_rule_match

    instad of (respectively) :
    selinux_audit_rule_init
    selinux_audit_rule_free
    audit_rule_has_selinux
    selinux_audit_rule_match

    Signed-off-by: Casey Schaufler
    Signed-off-by: Ahmed S. Darwish
    Acked-by: James Morris

    Ahmed S. Darwish
     
  • Introduce a generic Audit interface for security modules
    by adding the following new LSM hooks:

    audit_rule_init(field, op, rulestr, lsmrule)
    audit_rule_known(krule)
    audit_rule_match(secid, field, op, rule, actx)
    audit_rule_free(rule)

    Those hooks are only available if CONFIG_AUDIT is enabled.

    Signed-off-by: Casey Schaufler
    Signed-off-by: Ahmed S. Darwish
    Acked-by: James Morris
    Reviewed-by: Paul Moore

    Ahmed S. Darwish
     
  • Remove the following exported SELinux interfaces:
    selinux_get_inode_sid(inode, sid)
    selinux_get_ipc_sid(ipcp, sid)
    selinux_get_task_sid(tsk, sid)
    selinux_sid_to_string(sid, ctx, len)

    They can be substitued with the following generic equivalents
    respectively:
    new LSM hook, inode_getsecid(inode, secid)
    new LSM hook, ipc_getsecid*(ipcp, secid)
    LSM hook, task_getsecid(tsk, secid)
    LSM hook, sid_to_secctx(sid, ctx, len)

    Signed-off-by: Casey Schaufler
    Signed-off-by: Ahmed S. Darwish
    Acked-by: James Morris
    Reviewed-by: Paul Moore

    Ahmed S. Darwish
     
  • Don't use SELinux exported selinux_get_task_sid symbol.
    Use the generic LSM equivalent instead.

    Signed-off-by: Casey Schaufler
    Signed-off-by: Ahmed S. Darwish
    Acked-by: James Morris
    Acked-by: David S. Miller
    Reviewed-by: Paul Moore

    Ahmed S. Darwish
     
  • Stop using the following exported SELinux interfaces:
    selinux_get_inode_sid(inode, sid)
    selinux_get_ipc_sid(ipcp, sid)
    selinux_get_task_sid(tsk, sid)
    selinux_sid_to_string(sid, ctx, len)
    kfree(ctx)

    and use following generic LSM equivalents respectively:
    security_inode_getsecid(inode, secid)
    security_ipc_getsecid*(ipcp, secid)
    security_task_getsecid(tsk, secid)
    security_sid_to_secctx(sid, ctx, len)
    security_release_secctx(ctx, len)

    Call security_release_secctx only if security_secid_to_secctx
    succeeded.

    Signed-off-by: Casey Schaufler
    Signed-off-by: Ahmed S. Darwish
    Acked-by: James Morris
    Reviewed-by: Paul Moore

    Ahmed S. Darwish
     
  • Setup the new inode_getsecid and ipc_getsecid() LSM hooks
    for SELinux.

    Signed-off-by: Casey Schaufler
    Signed-off-by: Ahmed S. Darwish
    Acked-by: James Morris
    Reviewed-by: Paul Moore

    Ahmed S. Darwish
     
  • Introduce inode_getsecid(inode, secid) and ipc_getsecid(ipcp, secid)
    LSM hooks. These hooks will be used instead of similar exported
    SELinux interfaces.

    Let {inode,ipc,task}_getsecid hooks set the secid to 0 by default
    if CONFIG_SECURITY is not defined or if the hook is set to
    NULL (dummy). This is done to notify the caller that no valid
    secid exists.

    Signed-off-by: Casey Schaufler
    Signed-off-by: Ahmed S. Darwish
    Acked-by: James Morris
    Reviewed-by: Paul Moore

    Ahmed S. Darwish
     
  • This patch effectively reverts commit d0498d9ae1a5cebac363e38907266d5cd2eedf89
    aka "[NET]: Do not allocate unneeded memory for dev->priv alignment."
    It was found to be buggy because of final unconditional += NETDEV_ALIGN_CONST
    removal.

    For example, for sizeof(struct net_device) being 2048 bytes, "alloc_size"
    was also 2048 bytes, but allocator with debugging options turned on started
    giving out !32-byte aligned memory resulting in redzones overwrites.

    Patch does small optimization in ->priv'less case: bumping size to next
    32-byte boundary was always done to ensure ->priv will also be aligned.
    But, no ->priv, no need to do that.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     
  • do not return a -EINVAL when mmap()-ing PCI holes.

    Signed-off-by: Ingo Molnar
    Acked-by: Venkatesh Pallipadi
    Acked-by: Suresh Siddha
    Acked-by: H. Peter Anvin
    Acked-by: Thomas Gleixner
    Acked-by: Arjan van de Ven

    Ingo Molnar
     
  • * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (137 commits)
    [SCSI] iscsi: bidi support for iscsi_tcp
    [SCSI] iscsi: bidi support at the generic libiscsi level
    [SCSI] iscsi: extended cdb support
    [SCSI] zfcp: Fix error handling for blocked unit for send FCP command
    [SCSI] zfcp: Remove zfcp_erp_wait from slave destory handler to fix deadlock
    [SCSI] zfcp: fix 31 bit compile warnings
    [SCSI] bsg: no need to set BSG_F_BLOCK bit in bsg_complete_all_commands
    [SCSI] bsg: remove minor in struct bsg_device
    [SCSI] bsg: use better helper list functions
    [SCSI] bsg: replace kobject_get with blk_get_queue
    [SCSI] bsg: takes a ref to struct device in fops->open
    [SCSI] qla1280: remove version check
    [SCSI] libsas: fix endianness bug in sas_ata
    [SCSI] zfcp: fix compiler warning caused by poking inside new semaphore (linux-next)
    [SCSI] aacraid: Do not describe check_reset parameter with its value
    [SCSI] aacraid: Fix down_interruptible() to check the return value
    [SCSI] sun3_scsi_vme: add MODULE_LICENSE
    [SCSI] st: rename flush_write_buffer()
    [SCSI] tgt: use KMEM_CACHE macro
    [SCSI] initio: fix big endian problems for auto request sense
    ...

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6: (43 commits)
    firewire: cleanups
    firewire: fix synchronization of gap counts
    firewire: wait until PHY configuration packet was transmitted (fix bus reset loop)
    firewire: remove unused struct member
    firewire: use bitwise and to get reg in handle_registers
    firewire: replace more hex values with defined csr constants
    firewire: reread config ROM when device reset the bus
    firewire: replace static ROM cache by allocated cache
    firewire: fw-ohci: work around generation bug in TI controllers (fix AV/C and more)
    firewire: fw-ohci: extend logging of bus generations and node ID
    firewire: fw-ohci: conditionally log busReset interrupts
    firewire: fw-ohci: don't append to AT context when it's not active
    firewire: fw-ohci: log regAccessFail events
    firewire: fw-ohci: make sure HCControl register LPS bit is set
    firewire: fw-ohci: missing PPC PMac feature calls in failure path
    firewire: fw-ohci: untangle a mixed unsigned/signed expression
    firewire: debug interrupt events
    firewire: fw-ohci: catch self_id_count == 0
    firewire: fw-ohci: add self ID error check
    firewire: fw-ohci: refactor probe, remove, suspend, resume
    ...

    Linus Torvalds
     
  • The kernel now panics reliably on boot if you have a SATAPI device
    connected.

    The problem was introduced by the libata merge trying to pull out all
    the SFF code into a separate module. Unfortunately, if you're a satapi
    device you usually need to call atapi_request_sense, which has a bare
    invocation of a SFF callback which is NULL on non-SFF HBAs. Fix this by
    making the call conditional.

    Signed-off-by: James Bottomley
    Signed-off-by: Linus Torvalds

    James Bottomley
     
  • * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2: (64 commits)
    ocfs2/net: Add debug interface to o2net
    ocfs2: Only build ocfs2/dlm with the o2cb stack module
    ocfs2/cluster: Get rid of arguments to the timeout routines
    ocfs2: Put tree in MAINTAINERS
    ocfs2: Use BUG_ON
    ocfs2: Convert ocfs2 over to unlocked_ioctl
    ocfs2: Improve rename locking
    fs/ocfs2/aops.c: test for IS_ERR rather than 0
    ocfs2: Add inode stealing for ocfs2_reserve_new_inode
    ocfs2: Add ac_alloc_slot in ocfs2_alloc_context
    ocfs2: Add a new parameter for ocfs2_reserve_suballoc_bits
    ocfs2: Enable cross extent block merge.
    ocfs2: Add support for cross extent block
    ocfs2: Move /sys/o2cb to /sys/fs/o2cb
    sysfs: Allow removal of symlinks in the sysfs root
    ocfs2: Reconnect after idle time out.
    ocfs2/dlm: Cleanup lockres print
    ocfs2/dlm: Fix lockname in lockres print function
    ocfs2/dlm: Move dlm_print_one_mle() from dlmmaster.c to dlmdebug.c
    ocfs2/dlm: Dumps the purgelist into a debugfs file
    ...

    Linus Torvalds
     
  • * git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-nmw: (49 commits)
    [GFS2] fix assertion in log_refund()
    [GFS2] fix GFP_KERNEL misuses
    [GFS2] test for IS_ERR rather than 0
    [GFS2] Invalidate cache at correct point
    [GFS2] fs/gfs2/recovery.c: suppress warnings
    [GFS2] Faster gfs2_bitfit algorithm
    [GFS2] Streamline quota lock/check for no-quota case
    [GFS2] Remove drop of module ref where not needed
    [GFS2] gfs2_adjust_quota has broken unstuffing code
    [GFS2] possible null pointer dereference fixup
    [GFS2] Need to ensure that sector_t is 64bits for GFS2
    [GFS2] re-support special inode
    [GFS2] remove gfs2_dev_iops
    [GFS2] fix file_system_type leak on gfs2meta mount
    [GFS2] Allow bmap to allocate extents
    [GFS2] Fix a page lock / glock deadlock
    [GFS2] proper extern for gfs2/locking/dlm/mount.c:gdlm_ops
    [GFS2] gfs2/ops_file.c should #include "ops_inode.h"
    [GFS2] be*_add_cpu conversion
    [GFS2] Fix bug where we called drop_bh incorrectly
    ...

    Linus Torvalds
     
  • TF_MASK is no longer defined, use X86_EFLAGS_TF.

    Signed-off-by: Harvey Harrison
    Signed-off-by: Linus Torvalds

    Harvey Harrison