Eric Lee / smarc-fsl-linux-kernel

22 May, 2009

1 commit

22 Apr, 2009

1 commit

  • 50b2ff1bc   netlabel: Always remove the correct address selector ... Browse Code »

    The NetLabel address selector mechanism has a problem where it can get
    mistakenly remove the wrong selector when similar addresses are used. The
    problem is caused when multiple addresses are configured that have different
    netmasks but the same address, e.g. 127.0.0.0/8 and 127.0.0.0/24. This patch
    fixes the problem.

    Reported-by: Etienne Basset
    Signed-off-by: Paul Moore
    Acked-by: James Morris
    Tested-by: Etienne Basset
    Signed-off-by: David S. Miller

    Paul Moore
     

28 Mar, 2009

2 commits

  • 07feee8f8   netlabel: Cleanup the Smack/NetLabel code to fix incoming TCP connections ... Browse Code »

    This patch cleans up a lot of the Smack network access control code. The
    largest changes are to fix the labeling of incoming TCP connections in a
    manner similar to the recent SELinux changes which use the
    security_inet_conn_request() hook to label the request_sock and let the label
    move to the child socket via the normal network stack mechanisms. In addition
    to the incoming TCP connection fixes this patch also removes the smk_labled
    field from the socket_smack struct as the minor optimization advantage was
    outweighed by the difficulty in maintaining it's proper state.

    Signed-off-by: Paul Moore
    Acked-by: Casey Schaufler
    Signed-off-by: James Morris

    Paul Moore
     
  • 389fb800a   netlabel: Label incoming TCP connections correctly in SELinux ... Browse Code »

    The current NetLabel/SELinux behavior for incoming TCP connections works but
    only through a series of happy coincidences that rely on the limited nature of
    standard CIPSO (only able to convey MLS attributes) and the write equality
    imposed by the SELinux MLS constraints. The problem is that network sockets
    created as the result of an incoming TCP connection were not on-the-wire
    labeled based on the security attributes of the parent socket but rather based
    on the wire label of the remote peer. The issue had to do with how IP options
    were managed as part of the network stack and where the LSM hooks were in
    relation to the code which set the IP options on these newly created child
    sockets. While NetLabel/SELinux did correctly set the socket's on-the-wire
    label it was promptly cleared by the network stack and reset based on the IP
    options of the remote peer.

    This patch, in conjunction with a prior patch that adjusted the LSM hook
    locations, works to set the correct on-the-wire label format for new incoming
    connections through the security_inet_conn_request() hook. Besides the
    correct behavior there are many advantages to this change, the most significant
    is that all of the NetLabel socket labeling code in SELinux now lives in hooks
    which can return error codes to the core stack which allows us to finally get
    ride of the selinux_netlbl_inode_permission() logic which greatly simplfies
    the NetLabel/SELinux glue code. In the process of developing this patch I
    also ran into a small handful of AF_INET6 cleanliness issues that have been
    fixed which should make the code safer and easier to extend in the future.

    Signed-off-by: Paul Moore
    Acked-by: Casey Schaufler
    Signed-off-by: James Morris

    Paul Moore
     

01 Jan, 2009

1 commit

16 Dec, 2008

1 commit

12 Dec, 2008

1 commit

  • ec8f2375d   netlabel: Compiler warning and NULL pointer dereference fix ... Browse Code »

    Fix the two compiler warnings show below. Thanks to Geert Uytterhoeven for
    finding and reporting the problem.

    net/netlabel/netlabel_unlabeled.c:567: warning: 'entry' may be used
    uninitialized in this function
    net/netlabel/netlabel_unlabeled.c:629: warning: 'entry' may be used
    uninitialized in this function

    Signed-off-by: Paul Moore
    Signed-off-by: David S. Miller

    Paul Moore
     

06 Dec, 2008

1 commit

03 Dec, 2008

1 commit

22 Nov, 2008

1 commit

31 Oct, 2008

2 commits

30 Oct, 2008

3 commits

29 Oct, 2008

1 commit

10 Oct, 2008

10 commits

  • d91d40799   netlabel: Add configuration support for local labeling ... Browse Code »

    Add the necessary NetLabel support for the new CIPSO mapping,
    CIPSO_V4_MAP_LOCAL, which allows full LSM label/context support.

    Signed-off-by: Paul Moore
    Reviewed-by: James Morris

    Paul Moore
     
  • 15c45f7b2   cipso: Add support for native local labeling and fixup mapping names ... Browse Code »

    This patch accomplishes three minor tasks: add a new tag type for local
    labeling, rename the CIPSO_V4_MAP_STD define to CIPSO_V4_MAP_TRANS and
    replace some of the CIPSO "magic numbers" with constants from the header
    file. The first change allows CIPSO to support full LSM labels/contexts,
    not just MLS attributes. The second change brings the mapping names inline
    with what userspace is using, compatibility is preserved since we don't
    actually change the value. The last change is to aid readability and help
    prevent mistakes.

    Signed-off-by: Paul Moore

    Paul Moore
     
  • 014ab19a6   selinux: Set socket NetLabel based on connection endpoint ... Browse Code »

    Previous work enabled the use of address based NetLabel selectors, which while
    highly useful, brought the potential for additional per-packet overhead when
    used. This patch attempts to solve that by applying NetLabel socket labels
    when sockets are connect()'d. This should alleviate the per-packet NetLabel
    labeling for all connected sockets (yes, it even works for connected DGRAM
    sockets).

    Signed-off-by: Paul Moore
    Reviewed-by: James Morris

    Paul Moore
     
  • 948bf85c1   netlabel: Add functionality to set the security attributes of a packet ... Browse Code »

    This patch builds upon the new NetLabel address selector functionality by
    providing the NetLabel KAPI and CIPSO engine support needed to enable the
    new packet-based labeling. The only new addition to the NetLabel KAPI at
    this point is shown below:

    * int netlbl_skbuff_setattr(skb, family, secattr)

    ... and is designed to be called from a Netfilter hook after the packet's
    IP header has been populated such as in the FORWARD or LOCAL_OUT hooks.

    This patch also provides the necessary SELinux hooks to support this new
    functionality. Smack support is not currently included due to uncertainty
    regarding the permissions needed to expand the Smack network access controls.

    Signed-off-by: Paul Moore
    Reviewed-by: James Morris

    Paul Moore
     
  • 63c416887   netlabel: Add network address selectors to the NetLabel/LSM domain mapping ... Browse Code »

    This patch extends the NetLabel traffic labeling capabilities to individual
    packets based not only on the LSM domain but the by the destination address
    as well. The changes here only affect the core NetLabel infrastructre,
    changes to the NetLabel KAPI and individial protocol engines are also
    required but are split out into a different patch to ease review.

    Signed-off-by: Paul Moore
    Reviewed-by: James Morris

    Paul Moore
     
  • 61e106821   netlabel: Add a generic way to create ordered linked lists of network addrs ... Browse Code »

    Create an ordered IP address linked list mechanism similar to the core
    kernel's linked list construct. The idea behind this list functionality
    is to create an extensibile linked list ordered by IP address mask to
    ease the matching of network addresses. The linked list is ordered with
    larger address masks at the front of the list and shorter address masks
    at the end to facilitate overriding network entries with individual host
    or subnet entries.

    Signed-off-by: Paul Moore
    Reviewed-by: James Morris

    Paul Moore
     
  • b1edeb102   netlabel: Replace protocol/NetLabel linking with refrerence counts ... Browse Code »

    NetLabel has always had a list of backpointers in the CIPSO DOI definition
    structure which pointed to the NetLabel LSM domain mapping structures which
    referenced the CIPSO DOI struct. The rationale for this was that when an
    administrator removed a CIPSO DOI from the system all of the associated
    NetLabel LSM domain mappings should be removed as well; a list of
    backpointers made this a simple operation.

    Unfortunately, while the backpointers did make the removal easier they were
    a bit of a mess from an implementation point of view which was making
    further development difficult. Since the removal of a CIPSO DOI is a
    realtively rare event it seems to make sense to remove this backpointer
    list as the optimization was hurting us more then it was helping. However,
    we still need to be able to track when a CIPSO DOI definition is being used
    so replace the backpointer list with a reference count. In order to
    preserve the current functionality of removing the associated LSM domain
    mappings when a CIPSO DOI is removed we walk the LSM domain mapping table,
    removing the relevant entries.

    Signed-off-by: Paul Moore
    Reviewed-by: James Morris

    Paul Moore
     
  • dfaebe982   selinux: Fix missing calls to netlbl_skbuff_err() ... Browse Code »

    At some point I think I messed up and dropped the calls to netlbl_skbuff_err()
    which are necessary for CIPSO to send error notifications to remote systems.
    This patch re-introduces the error handling calls into the SELinux code.

    Signed-off-by: Paul Moore
    Acked-by: James Morris

    Paul Moore
     
  • 948a72438   netlabel: Remove unneeded in-kernel API functions ... Browse Code »

    After some discussions with the Smack folks, well just Casey, I now have a
    better idea of what Smack wants out of NetLabel in the future so I think it
    is now safe to do some API "pruning". If another LSM comes along that
    needs this functionality we can always add it back in, but I don't see any
    LSMs on the horizon which might make use of these functions.

    Thanks to Rami Rosen who suggested removing netlbl_cfg_cipsov4_del() back
    in February 2008.

    Signed-off-by: Paul Moore
    Reviewed-by: James Morris

    Paul Moore
     
  • 561967010   netlabel: Fix some sparse warnings ... Browse Code »

    Fix a few sparse warnings. One dealt with a RCU lock being held on error,
    another dealt with an improper type caused by a signed/unsigned mixup while
    the rest appeared to be caused by using rcu_dereference() in a
    list_for_each_entry_rcu() call. The latter probably isn't a big deal, but
    I derive a certain pleasure from knowing that the net/netlabel is nice and
    clean.

    Thanks to James Morris for pointing out the issues and demonstrating how
    to run sparse.

    Signed-off-by: Paul Moore

    Paul Moore
     

20 Jul, 2008

1 commit

18 Jul, 2008

1 commit

16 Jul, 2008

1 commit

15 Jul, 2008

1 commit

  • 83aa2e964   netlabel: return msg overflow error from netlbl_cipsov4_list faster ... Browse Code »

    Currently, we are trying to place the information from the kernel to
    1, 2, 3 and 4 pages sequentially. These pages are allocated via slab.
    Though, from the slab point of view steps 3 and 4 are equivalent on
    most architectures. So, lets skip 3 pages attempt.

    By the way, should we switch from .doit to .dumpit interface here?
    The amount of data seems quite big for me.

    Signed-off-by: Denis V. Lunev
    Acked-by: Paul Moore
    Signed-off-by: David S. Miller

    Denis V. Lunev
     

11 Jul, 2008

2 commits

28 Jun, 2008

1 commit

  • 59d88c00c   netlabel: Fix a problem when dumping the default IPv6 static labels ... Browse Code »

    There is a missing "!" in a conditional statement which is causing entries to
    be skipped when dumping the default IPv6 static label entries. This can be
    demonstrated by running the following:

    # netlabelctl unlbl add default address:::1 \
    label:system_u:object_r:unlabeled_t:s0
    # netlabelctl -p unlbl list

    ... you will notice that the entry for the IPv6 localhost address is not
    displayed but does exist (works correctly, causes collisions when attempting
    to add duplicate entries, etc.).

    Signed-off-by: Paul Moore
    Signed-off-by: David S. Miller

    Paul Moore
     

19 May, 2008

1 commit

  • 82524746c   rcu: split list.h and move rcu-protected lists into rculist.h ... Browse Code »

    Move rcu-protected lists from list.h into a new header file rculist.h.

    This is done because list are a very used primitive structure all over the
    kernel and it's currently impossible to include other header files in this
    list.h without creating some circular dependencies.

    For example, list.h implements rcu-protected list and uses rcu_dereference()
    without including rcupdate.h. It actually compiles because users of
    rcu_dereference() are macros. Others RCU functions could be used too but
    aren't probably because of this.

    Therefore this patch creates rculist.h which includes rcupdates without to
    many changes/troubles.

    Signed-off-by: Franck Bui-Huu
    Acked-by: Paul E. McKenney
    Acked-by: Josh Triplett
    Signed-off-by: Andrew Morton
    Signed-off-by: Ingo Molnar

    Franck Bui-Huu
     

28 Apr, 2008

1 commit

  • 2532386f4   Audit: collect sessionid in netlink messages ... Browse Code »

    Previously I added sessionid output to all audit messages where it was
    available but we still didn't know the sessionid of the sender of
    netlink messages. This patch adds that information to netlink messages
    so we can audit who sent netlink messages.

    Signed-off-by: Eric Paris
    Signed-off-by: Al Viro

    Eric Paris
     

18 Apr, 2008

1 commit

  • 794eb6bf2   [NETLABEL]: Fix NULL deref in netlbl_unlabel_staticlist_gen() if ifindex not found ... Browse Code »

    dev_get_by_index() may return NULL if nothing is found. In
    net/netlabel/netlabel_unlabeled.c::netlbl_unlabel_staticlist_gen() the
    function is called, but the return value is never checked. If it returns
    NULL then we'll deref a NULL pointer on the very next line.
    I checked the callers, and I don't think this can actually happen today,
    but code changes over time and in the future it might happen and it does
    no harm to be defensive and check for the failure, so that if/when it
    happens we'll fail gracefully instead of crashing.

    Signed-off-by: Jesper Juhl
    Acked-by: Paul Moore
    Signed-off-by: David S. Miller

    Jesper Juhl
     

26 Mar, 2008

1 commit

18 Feb, 2008

2 commits

13 Feb, 2008

1 commit