Eric Lee / smarc-fsl-linux-kernel

02 May, 2013

1 commit

  • 20b4fb485   Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

    Pull VFS updates from Al Viro,

    Misc cleanups all over the place, mainly wrt /proc interfaces (switch
    create_proc_entry to proc_create(), get rid of the deprecated
    create_proc_read_entry() in favor of using proc_create_data() and
    seq_file etc).

    7kloc removed.

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (204 commits)
    don't bother with deferred freeing of fdtables
    proc: Move non-public stuff from linux/proc_fs.h to fs/proc/internal.h
    proc: Make the PROC_I() and PDE() macros internal to procfs
    proc: Supply a function to remove a proc entry by PDE
    take cgroup_open() and cpuset_open() to fs/proc/base.c
    ppc: Clean up scanlog
    ppc: Clean up rtas_flash driver somewhat
    hostap: proc: Use remove_proc_subtree()
    drm: proc: Use remove_proc_subtree()
    drm: proc: Use minor->index to label things, not PDE->name
    drm: Constify drm_proc_list[]
    zoran: Don't print proc_dir_entry data in debug
    reiserfs: Don't access the proc_dir_entry in r_open(), r_start() r_show()
    proc: Supply an accessor for getting the data from a PDE's parent
    airo: Use remove_proc_subtree()
    rtl8192u: Don't need to save device proc dir PDE
    rtl8187se: Use a dir under /proc/net/r8180/
    proc: Add proc_mkdir_data()
    proc: Move some bits from linux/proc_fs.h to linux/{of.h,signal.h,tty.h}
    proc: Move PDE_NET() to fs/proc/proc_net.c
    ...

    Linus Torvalds
     

30 Apr, 2013

1 commit

18 Mar, 2013

1 commit

23 Feb, 2013

1 commit

12 Oct, 2012

1 commit

09 Oct, 2012

1 commit

  • 2dd8ad81e   mm: use mm->exe_file instead of first VM_EXECUTABLE vma->vm_file ... Browse Code »

    Some security modules and oprofile still uses VM_EXECUTABLE for retrieving
    a task's executable file. After this patch they will use mm->exe_file
    directly. mm->exe_file is protected with mm->mmap_sem, so locking stays
    the same.

    Signed-off-by: Konstantin Khlebnikov
    Acked-by: Chris Metcalf [arch/tile]
    Acked-by: Tetsuo Handa [tomoyo]
    Cc: Alexander Viro
    Cc: Carsten Otte
    Cc: Cyrill Gorcunov
    Cc: Eric Paris
    Cc: H. Peter Anvin
    Cc: Hugh Dickins
    Cc: Ingo Molnar
    Acked-by: James Morris
    Cc: Jason Baron
    Cc: Kentaro Takeda
    Cc: Matt Helsley
    Cc: Nick Piggin
    Cc: Oleg Nesterov
    Cc: Peter Zijlstra
    Cc: Robert Richter
    Cc: Suresh Siddha
    Cc: Venkatesh Pallipadi
    Acked-by: Linus Torvalds
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Konstantin Khlebnikov
     

21 Sep, 2012

2 commits

22 May, 2012

1 commit

15 May, 2012

1 commit

10 Apr, 2012

1 commit

24 Mar, 2012

1 commit

  • 70834d307   usermodehelper: use UMH_WAIT_PROC consistently ... Browse Code »

    A few call_usermodehelper() callers use the hardcoded constant instead of
    the proper UMH_WAIT_PROC, fix them.

    Reported-by: Tetsuo Handa
    Signed-off-by: Oleg Nesterov
    Cc: Lars Ellenberg
    Cc: Greg Kroah-Hartman
    Cc: Michal Januszewski
    Cc: Florian Tobias Schandinat
    Cc: Kentaro Takeda
    Cc: Tetsuo Handa
    Cc: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Oleg Nesterov
     

22 Mar, 2012

1 commit

  • 3556485f1   Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security ... Browse Code »

    Pull security subsystem updates for 3.4 from James Morris:
    "The main addition here is the new Yama security module from Kees Cook,
    which was discussed at the Linux Security Summit last year. Its
    purpose is to collect miscellaneous DAC security enhancements in one
    place. This also marks a departure in policy for LSM modules, which
    were previously limited to being standalone access control systems.
    Chromium OS is using Yama, and I believe there are plans for Ubuntu,
    at least.

    This patchset also includes maintenance updates for AppArmor, TOMOYO
    and others."

    Fix trivial conflict in due to the jumo_label->static_key
    rename.

    * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (38 commits)
    AppArmor: Fix location of const qualifier on generated string tables
    TOMOYO: Return error if fails to delete a domain
    AppArmor: add const qualifiers to string arrays
    AppArmor: Add ability to load extended policy
    TOMOYO: Return appropriate value to poll().
    AppArmor: Move path failure information into aa_get_name and rename
    AppArmor: Update dfa matching routines.
    AppArmor: Minor cleanup of d_namespace_path to consolidate error handling
    AppArmor: Retrieve the dentry_path for error reporting when path lookup fails
    AppArmor: Add const qualifiers to generated string tables
    AppArmor: Fix oops in policy unpack auditing
    AppArmor: Fix error returned when a path lookup is disconnected
    KEYS: testing wrong bit for KEY_FLAG_REVOKED
    TOMOYO: Fix mount flags checking order.
    security: fix ima kconfig warning
    AppArmor: Fix the error case for chroot relative path name lookup
    AppArmor: fix mapping of META_READ to audit and quiet flags
    AppArmor: Fix underflow in xindex calculation
    AppArmor: Fix dropping of allowed operations that are force audited
    AppArmor: Add mising end of structure test to caps unpacking
    ...

    Linus Torvalds
     

20 Mar, 2012

2 commits

  • c58e0377d   tomoyo: remove the second argument of k[un]map_atomic() ... Browse Code »

    Acked-by: Tetsuo Handa
    Signed-off-by: Cong Wang

    Cong Wang
     
  • 7d7473dbd   TOMOYO: Return error if fails to delete a domain ... Browse Code »

    Call sequence:
    tomoyo_write_domain() --> tomoyo_delete_domain()

    In 'tomoyo_delete_domain', return -EINTR if locking attempt is
    interrupted by signal.

    At present it returns success to its caller 'tomoyo_write_domain()'
    even though domain is not deleted. 'tomoyo_write_domain()' assumes
    domain is deleted and returns success to its caller. This is wrong behaviour.

    'tomoyo_write_domain' should return error from tomoyo_delete_domain() to its
    caller.

    Signed-off-by: Santosh Nayak
    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

15 Mar, 2012

1 commit

  • 6041e8346   TOMOYO: Return appropriate value to poll(). ... Browse Code »

    "struct file_operations"->poll() expects "unsigned int" return value.
    All files in /sys/kernel/security/tomoyo/ directory other than
    /sys/kernel/security/tomoyo/query and /sys/kernel/security/tomoyo/audit should
    return POLLIN | POLLRDNORM | POLLOUT | POLLWRNORM rather than -ENOSYS.
    Also, /sys/kernel/security/tomoyo/query and /sys/kernel/security/tomoyo/audit
    should return POLLOUT | POLLWRNORM rather than 0 when there is no data to read.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

01 Mar, 2012

1 commit

  • df91e4947   TOMOYO: Fix mount flags checking order. ... Browse Code »
    1

    Userspace can pass in arbitrary combinations of MS_* flags to mount().

    If both MS_BIND and one of MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE are
    passed, device name which should be checked for MS_BIND was not checked because
    MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE had higher priority than MS_BIND.

    If both one of MS_BIND/MS_MOVE and MS_REMOUNT are passed, device name which
    should not be checked for MS_REMOUNT was checked because MS_BIND/MS_MOVE had
    higher priority than MS_REMOUNT.

    Fix these bugs by changing priority to MS_REMOUNT -> MS_BIND ->
    MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE -> MS_MOVE as with do_mount() does.

    Also, unconditionally return -EINVAL if more than one of
    MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE is passed so that TOMOYO will not
    generate inaccurate audit logs, for commit 7a2e8a8f "VFS: Sanity check mount
    flags passed to change_mnt_propagation()" clarified that these flags must be
    exclusively passed.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

18 Jan, 2012

1 commit

  • 25add8cf9   TOMOYO: Accept \000 as a valid character. ... Browse Code »

    TOMOYO 2.5 in Linux 3.2 and later handles Unix domain socket's address.
    Thus, tomoyo_correct_word2() needs to accept \000 as a valid character, or
    TOMOYO 2.5 cannot handle Unix domain's abstract socket address.

    Reported-by: Steven Allen
    Signed-off-by: Tetsuo Handa
    CC: stable@vger.kernel.org [3.2+]
    Signed-off-by: James Morris

    Tetsuo Handa
     

11 Jan, 2012

1 commit

  • e7691a1ce   Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security ... Browse Code »

    * 'for-linus' of git://selinuxproject.org/~jmorris/linux-security: (32 commits)
    ima: fix invalid memory reference
    ima: free duplicate measurement memory
    security: update security_file_mmap() docs
    selinux: Casting (void *) value returned by kmalloc is useless
    apparmor: fix module parameter handling
    Security: tomoyo: add .gitignore file
    tomoyo: add missing rcu_dereference()
    apparmor: add missing rcu_dereference()
    evm: prevent racing during tfm allocation
    evm: key must be set once during initialization
    mpi/mpi-mpow: NULL dereference on allocation failure
    digsig: build dependency fix
    KEYS: Give key types their own lockdep class for key->sem
    TPM: fix transmit_cmd error logic
    TPM: NSC and TIS drivers X86 dependency fix
    TPM: Export wait_for_stat for other vendor specific drivers
    TPM: Use vendor specific function for status probe
    tpm_tis: add delay after aborting command
    tpm_tis: Check return code from getting timeouts/durations
    tpm: Introduce function to poll for result of self test
    ...

    Fix up trivial conflict in lib/Makefile due to addition of CONFIG_MPI
    and SIGSIG next to CONFIG_DQL addition.

    Linus Torvalds
     

09 Jan, 2012

1 commit

07 Jan, 2012

2 commits

04 Jan, 2012

7 commits

12 Dec, 2011

2 commits

09 Dec, 2011

1 commit

  • 1418a3e5a   TOMOYO: Fix pathname handling of disconnected paths. ... Browse Code »

    Current tomoyo_realpath_from_path() implementation returns strange pathname
    when calculating pathname of a file which belongs to lazy unmounted tree.
    Use local pathname rather than strange absolute pathname in that case.

    Also, this patch fixes a regression by commit 02125a82 "fix apparmor
    dereferencing potentially freed dentry, sanitize __d_path() API".

    Signed-off-by: Tetsuo Handa
    Acked-by: Al Viro
    Cc: stable@vger.kernel.org
    Signed-off-by: Linus Torvalds

    Tetsuo Handa
     

07 Dec, 2011

1 commit

  • 02125a826   fix apparmor dereferencing potentially freed dentry, sanitize __d_path() API ... Browse Code »
    1

    __d_path() API is asking for trouble and in case of apparmor d_namespace_path()
    getting just that. The root cause is that when __d_path() misses the root
    it had been told to look for, it stores the location of the most remote ancestor
    in *root. Without grabbing references. Sure, at the moment of call it had
    been pinned down by what we have in *path. And if we raced with umount -l, we
    could have very well stopped at vfsmount/dentry that got freed as soon as
    prepend_path() dropped vfsmount_lock.

    It is safe to compare these pointers with pre-existing (and known to be still
    alive) vfsmount and dentry, as long as all we are asking is "is it the same
    address?". Dereferencing is not safe and apparmor ended up stepping into
    that. d_namespace_path() really wants to examine the place where we stopped,
    even if it's not connected to our namespace. As the result, it looked
    at ->d_sb->s_magic of a dentry that might've been already freed by that point.
    All other callers had been careful enough to avoid that, but it's really
    a bad interface - it invites that kind of trouble.

    The fix is fairly straightforward, even though it's bigger than I'd like:
    * prepend_path() root argument becomes const.
    * __d_path() is never called with NULL/NULL root. It was a kludge
    to start with. Instead, we have an explicit function - d_absolute_root().
    Same as __d_path(), except that it doesn't get root passed and stops where
    it stops. apparmor and tomoyo are using it.
    * __d_path() returns NULL on path outside of root. The main
    caller is show_mountinfo() and that's precisely what we pass root for - to
    skip those outside chroot jail. Those who don't want that can (and do)
    use d_path().
    * __d_path() root argument becomes const. Everyone agrees, I hope.
    * apparmor does *NOT* try to use __d_path() or any of its variants
    when it sees that path->mnt is an internal vfsmount. In that case it's
    definitely not mounted anywhere and dentry_path() is exactly what we want
    there. Handling of sysctl()-triggered weirdness is moved to that place.
    * if apparmor is asked to do pathname relative to chroot jail
    and __d_path() tells it we it's not in that jail, the sucker just calls
    d_absolute_path() instead. That's the other remaining caller of __d_path(),
    BTW.
    * seq_path_root() does _NOT_ return -ENAMETOOLONG (it's stupid anyway -
    the normal seq_file logics will take care of growing the buffer and redoing
    the call of ->show() just fine). However, if it gets path not reachable
    from root, it returns SEQ_SKIP. The only caller adjusted (i.e. stopped
    ignoring the return value as it used to do).

    Reviewed-by: John Johansen
    ACKed-by: John Johansen
    Signed-off-by: Al Viro
    Cc: stable@vger.kernel.org

    Al Viro
     

03 Nov, 2011

1 commit

29 Oct, 2011

1 commit

  • 59df3166e   TOMOYO: Fix interactive judgment functionality. ... Browse Code »

    Commit 17fcfbd9 "TOMOYO: Add interactive enforcing mode." introduced ability
    to query access decision using userspace programs. It was using global PID for
    reaching policy configuration of the process. However, use of PID returns stale
    policy configuration when the process's subjective credentials and objective
    credentials differ. Fix this problem by allowing reaching policy configuration
    via query id.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

25 Oct, 2011

1 commit

  • 36b8d186e   Merge branch 'next' of git://selinuxproject.org/~jmorris/linux-security ... Browse Code »

    * 'next' of git://selinuxproject.org/~jmorris/linux-security: (95 commits)
    TOMOYO: Fix incomplete read after seek.
    Smack: allow to access /smack/access as normal user
    TOMOYO: Fix unused kernel config option.
    Smack: fix: invalid length set for the result of /smack/access
    Smack: compilation fix
    Smack: fix for /smack/access output, use string instead of byte
    Smack: domain transition protections (v3)
    Smack: Provide information for UDS getsockopt(SO_PEERCRED)
    Smack: Clean up comments
    Smack: Repair processing of fcntl
    Smack: Rule list lookup performance
    Smack: check permissions from user space (v2)
    TOMOYO: Fix quota and garbage collector.
    TOMOYO: Remove redundant tasklist_lock.
    TOMOYO: Fix domain transition failure warning.
    TOMOYO: Remove tomoyo_policy_memory_lock spinlock.
    TOMOYO: Simplify garbage collector.
    TOMOYO: Fix make namespacecheck warnings.
    target: check hex2bin result
    encrypted-keys: check hex2bin result
    ...

    Linus Torvalds
     

23 Oct, 2011

1 commit

  • e0b057b40   TOMOYO: Fix incomplete read after seek. ... Browse Code »

    Commit f23571e8 "TOMOYO: Copy directly to userspace buffer." introduced
    tomoyo_flush() that flushes data to be read as soon as possible.
    tomoyo_select_domain() (which is called by write()) enqueues data which meant
    to be read by next read(), but previous read()'s read buffer's size was not
    cleared. As a result, since 2.6.36, sequence like

    char *cp = "select global-pid=1\n";
    read(fd, buf1, sizeof(buf1));
    write(fd, cp, strlen(cp));
    read(fd, buf2, sizeof(buf2));

    causes enqueued data to be flushed to buf1 rather than buf2.
    Fix this bug by clearing read buffer's size upon write() request.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

19 Oct, 2011

1 commit

12 Oct, 2011

2 commits