Eric Lee / smarc-fsl-linux-kernel

11 Jan, 2012

1 commit

  • e7691a1ce   Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security ... Browse Code »

    * 'for-linus' of git://selinuxproject.org/~jmorris/linux-security: (32 commits)
    ima: fix invalid memory reference
    ima: free duplicate measurement memory
    security: update security_file_mmap() docs
    selinux: Casting (void *) value returned by kmalloc is useless
    apparmor: fix module parameter handling
    Security: tomoyo: add .gitignore file
    tomoyo: add missing rcu_dereference()
    apparmor: add missing rcu_dereference()
    evm: prevent racing during tfm allocation
    evm: key must be set once during initialization
    mpi/mpi-mpow: NULL dereference on allocation failure
    digsig: build dependency fix
    KEYS: Give key types their own lockdep class for key->sem
    TPM: fix transmit_cmd error logic
    TPM: NSC and TIS drivers X86 dependency fix
    TPM: Export wait_for_stat for other vendor specific drivers
    TPM: Use vendor specific function for status probe
    tpm_tis: add delay after aborting command
    tpm_tis: Check return code from getting timeouts/durations
    tpm: Introduce function to poll for result of self test
    ...

    Fix up trivial conflict in lib/Makefile due to addition of CONFIG_MPI
    and SIGSIG next to CONFIG_DQL addition.

    Linus Torvalds
     

09 Jan, 2012

1 commit

07 Jan, 2012

2 commits

04 Jan, 2012

7 commits

12 Dec, 2011

2 commits

09 Dec, 2011

1 commit

  • 1418a3e5a   TOMOYO: Fix pathname handling of disconnected paths. ... Browse Code »

    Current tomoyo_realpath_from_path() implementation returns strange pathname
    when calculating pathname of a file which belongs to lazy unmounted tree.
    Use local pathname rather than strange absolute pathname in that case.

    Also, this patch fixes a regression by commit 02125a82 "fix apparmor
    dereferencing potentially freed dentry, sanitize __d_path() API".

    Signed-off-by: Tetsuo Handa
    Acked-by: Al Viro
    Cc: stable@vger.kernel.org
    Signed-off-by: Linus Torvalds

    Tetsuo Handa
     

07 Dec, 2011

1 commit

  • 02125a826   fix apparmor dereferencing potentially freed dentry, sanitize __d_path() API ... Browse Code »
    1

    __d_path() API is asking for trouble and in case of apparmor d_namespace_path()
    getting just that. The root cause is that when __d_path() misses the root
    it had been told to look for, it stores the location of the most remote ancestor
    in *root. Without grabbing references. Sure, at the moment of call it had
    been pinned down by what we have in *path. And if we raced with umount -l, we
    could have very well stopped at vfsmount/dentry that got freed as soon as
    prepend_path() dropped vfsmount_lock.

    It is safe to compare these pointers with pre-existing (and known to be still
    alive) vfsmount and dentry, as long as all we are asking is "is it the same
    address?". Dereferencing is not safe and apparmor ended up stepping into
    that. d_namespace_path() really wants to examine the place where we stopped,
    even if it's not connected to our namespace. As the result, it looked
    at ->d_sb->s_magic of a dentry that might've been already freed by that point.
    All other callers had been careful enough to avoid that, but it's really
    a bad interface - it invites that kind of trouble.

    The fix is fairly straightforward, even though it's bigger than I'd like:
    * prepend_path() root argument becomes const.
    * __d_path() is never called with NULL/NULL root. It was a kludge
    to start with. Instead, we have an explicit function - d_absolute_root().
    Same as __d_path(), except that it doesn't get root passed and stops where
    it stops. apparmor and tomoyo are using it.
    * __d_path() returns NULL on path outside of root. The main
    caller is show_mountinfo() and that's precisely what we pass root for - to
    skip those outside chroot jail. Those who don't want that can (and do)
    use d_path().
    * __d_path() root argument becomes const. Everyone agrees, I hope.
    * apparmor does *NOT* try to use __d_path() or any of its variants
    when it sees that path->mnt is an internal vfsmount. In that case it's
    definitely not mounted anywhere and dentry_path() is exactly what we want
    there. Handling of sysctl()-triggered weirdness is moved to that place.
    * if apparmor is asked to do pathname relative to chroot jail
    and __d_path() tells it we it's not in that jail, the sucker just calls
    d_absolute_path() instead. That's the other remaining caller of __d_path(),
    BTW.
    * seq_path_root() does _NOT_ return -ENAMETOOLONG (it's stupid anyway -
    the normal seq_file logics will take care of growing the buffer and redoing
    the call of ->show() just fine). However, if it gets path not reachable
    from root, it returns SEQ_SKIP. The only caller adjusted (i.e. stopped
    ignoring the return value as it used to do).

    Reviewed-by: John Johansen
    ACKed-by: John Johansen
    Signed-off-by: Al Viro
    Cc: stable@vger.kernel.org

    Al Viro
     

03 Nov, 2011

1 commit

29 Oct, 2011

1 commit

  • 59df3166e   TOMOYO: Fix interactive judgment functionality. ... Browse Code »

    Commit 17fcfbd9 "TOMOYO: Add interactive enforcing mode." introduced ability
    to query access decision using userspace programs. It was using global PID for
    reaching policy configuration of the process. However, use of PID returns stale
    policy configuration when the process's subjective credentials and objective
    credentials differ. Fix this problem by allowing reaching policy configuration
    via query id.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

25 Oct, 2011

1 commit

  • 36b8d186e   Merge branch 'next' of git://selinuxproject.org/~jmorris/linux-security ... Browse Code »

    * 'next' of git://selinuxproject.org/~jmorris/linux-security: (95 commits)
    TOMOYO: Fix incomplete read after seek.
    Smack: allow to access /smack/access as normal user
    TOMOYO: Fix unused kernel config option.
    Smack: fix: invalid length set for the result of /smack/access
    Smack: compilation fix
    Smack: fix for /smack/access output, use string instead of byte
    Smack: domain transition protections (v3)
    Smack: Provide information for UDS getsockopt(SO_PEERCRED)
    Smack: Clean up comments
    Smack: Repair processing of fcntl
    Smack: Rule list lookup performance
    Smack: check permissions from user space (v2)
    TOMOYO: Fix quota and garbage collector.
    TOMOYO: Remove redundant tasklist_lock.
    TOMOYO: Fix domain transition failure warning.
    TOMOYO: Remove tomoyo_policy_memory_lock spinlock.
    TOMOYO: Simplify garbage collector.
    TOMOYO: Fix make namespacecheck warnings.
    target: check hex2bin result
    encrypted-keys: check hex2bin result
    ...

    Linus Torvalds
     

23 Oct, 2011

1 commit

  • e0b057b40   TOMOYO: Fix incomplete read after seek. ... Browse Code »

    Commit f23571e8 "TOMOYO: Copy directly to userspace buffer." introduced
    tomoyo_flush() that flushes data to be read as soon as possible.
    tomoyo_select_domain() (which is called by write()) enqueues data which meant
    to be read by next read(), but previous read()'s read buffer's size was not
    cleared. As a result, since 2.6.36, sequence like

    char *cp = "select global-pid=1\n";
    read(fd, buf1, sizeof(buf1));
    write(fd, cp, strlen(cp));
    read(fd, buf2, sizeof(buf2));

    causes enqueued data to be flushed to buf1 rather than buf2.
    Fix this bug by clearing read buffer's size upon write() request.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

19 Oct, 2011

1 commit

12 Oct, 2011

2 commits

28 Sep, 2011

1 commit

  • e00fb3f7a   TOMOYO: Fix domain transition failure warning. ... Browse Code »

    Commit bd03a3e4 "TOMOYO: Add policy namespace support." introduced policy
    namespace. But as of /sbin/modprobe is executed from initramfs/initrd, profiles
    for target domain's namespace is not defined because /sbin/tomoyo-init is not
    yet called.

    Reported-by: Jamie Nguyen
    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

26 Sep, 2011

3 commits

  • a427fd14d   TOMOYO: Remove tomoyo_policy_memory_lock spinlock. ... Browse Code »

    tomoyo_policy_lock mutex already protects it.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     
  • f9732ea14   TOMOYO: Simplify garbage collector. ... Browse Code »

    When TOMOYO started using garbage collector at commit 847b173e "TOMOYO: Add
    garbage collector.", we waited for close() before kfree(). Thus, elements to be
    kfree()d were queued up using tomoyo_gc_list list.

    But it turned out that tomoyo_element_linked_by_gc() tends to choke garbage
    collector when certain pattern of entries are queued.

    Since garbage collector is no longer waiting for close() since commit 2e503bbb
    "TOMOYO: Fix lockdep warning.", we can remove tomoyo_gc_list list and
    tomoyo_element_linked_by_gc() by doing sequential processing.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     
  • 778c4a4d6   TOMOYO: Fix make namespacecheck warnings. ... Browse Code »

    Commit efe836ab "TOMOYO: Add built-in policy support." introduced
    tomoyo_load_builtin_policy() but was by error called from nowhere.

    Commit b22b8b9f "TOMOYO: Rename meminfo to stat and show more statistics."
    introduced tomoyo_update_stat() but was by error not called from
    tomoyo_assign_domain().

    Also, mark tomoyo_io_printf() and tomoyo_path_permission() static functions,
    as reported by "make namespacecheck".

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

19 Sep, 2011

1 commit

  • 6bce98edc   TOMOYO: Allow specifying domain transition preference. ... Browse Code »

    I got an opinion that it is difficult to use exception policy's domain
    transition control directives because they need to match the pathname specified
    to "file execute" directives. For example, if "file execute /bin/\*\-ls\-cat"
    is given, corresponding domain transition control directive needs to be like
    "no_keep_domain /bin/\*\-ls\-cat from any".

    If we can specify like below, it will become more convenient.

    file execute /bin/ls keep exec.realpath="/bin/ls" exec.argv[0]="ls"
    file execute /bin/cat keep exec.realpath="/bin/cat" exec.argv[0]="cat"
    file execute /bin/\*\-ls\-cat child
    file execute /usr/sbin/httpd exec.realpath="/usr/sbin/httpd" exec.argv[0]="/usr/sbin/httpd"

    In above examples, "keep" works as if keep_domain is specified, "child" works
    as if "no_reset_domain" and "no_initialize_domain" and "no_keep_domain" are
    specified, "" causes domain transition to domain upon
    successful execve() operation.

    Moreover, we can also allow transition to different domains based on conditions
    like below example.

    /usr/sbin/sshd
    file execute /bin/bash /usr/sbin/sshd //batch-session exec.argc=2 exec.argv[1]="-c"
    file execute /bin/bash /usr/sbin/sshd //root-session task.uid=0
    file execute /bin/bash /usr/sbin/sshd //nonroot-session task.uid!=0

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

15 Sep, 2011

1 commit

14 Sep, 2011

5 commits

  • a8f764096   TOMOYO: Avoid race when retrying "file execute" permission check. ... Browse Code »

    There was a race window that the pathname which is subjected to "file execute"
    permission check when retrying via supervisor's decision because the pathname
    was recalculated upon retry. Though, there is an inevitable race window even
    without supervisor, for we have to calculate the symbolic link's pathname from
    "struct linux_binprm"->filename rather than from "struct linux_binprm"->file
    because we cannot back calculate the symbolic link's pathname from the
    dereferenced pathname.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     
  • 731d37aa7   TOMOYO: Allow domain transition without execve(). ... Browse Code »

    To be able to split permissions for Apache's CGI programs which are executed
    without execve(), add special domain transition which is performed by writing
    a TOMOYO's domainname to /sys/kernel/security/tomoyo/self_domain interface.

    This is an API for TOMOYO-aware userland applications. However, since I expect
    TOMOYO and other LSM modules to run in parallel, this patch does not use
    /proc/self/attr/ interface in order to avoid conflicts with other LSM modules
    when it became possible to run multiple LSM modules in parallel.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     
  • 1f067a682   TOMOYO: Allow controlling generation of access granted logs for per an entry basis. ... Browse Code »

    Add per-entry flag which controls generation of grant logs because Xen and KVM
    issues ioctl requests so frequently. For example,

    file ioctl /dev/null 0x5401 grant_log=no

    will suppress /sys/kernel/security/tomoyo/audit even if preference says
    grant_log=yes .

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     
  • 059d84dbb   TOMOYO: Add socket operation restriction support. ... Browse Code »

    This patch adds support for permission checks for PF_INET/PF_INET6/PF_UNIX
    socket's bind()/listen()/connect()/send() operations.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     
  • d58e0da85   TOMOYO: Add environment variable name restriction support. ... Browse Code »

    This patch adds support for checking environment variable's names.
    Although TOMOYO already provides ability to check argv[]/envp[] passed to
    execve() requests,

    file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="bar"

    will reject execution of /bin/sh if environment variable LD_LIBRARY_PATH is not
    defined. To grant execution of /bin/sh if LD_LIBRARY_PATH is not defined,
    administrators have to specify like

    file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="/system/lib"
    file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]=NULL

    . Since there are many environment variables whereas conditional checks are
    applied as "&&", it is difficult to cover all combinations. Therefore, this
    patch supports conditional checks that are applied as "||", by specifying like

    file execute /bin/sh
    misc env LD_LIBRARY_PATH exec.envp["LD_LIBRARY_PATH"]="/system/lib"

    which means "grant execution of /bin/sh if environment variable is not defined
    or is defined and its value is /system/lib".

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

10 Sep, 2011

1 commit

  • 852584157   TOMOYO: Fix incorrect enforce mode. ... Browse Code »

    In tomoyo_get_mode() since 2.6.36, CONFIG::file::execute was by error used in
    place of CONFIG::file if CONFIG::file::execute was set to other than default.
    As a result, enforcing mode was not applied in a way documentation says.

    Signed-off-by: Tetsuo Handa
    Signed-off-by: James Morris

    Tetsuo Handa
     

17 Aug, 2011

1 commit

  • 09f464bf0   tomoyo: remove tomoyo_gc_thread()->daemonize() ... Browse Code »

    daemonize() is only needed when a user-space task does kernel_thread().

    tomoyo_gc_thread() is kthread_create()'ed and thus it doesn't need
    the soon-to-be-deprecated daemonize().

    Signed-off-by: Oleg Nesterov
    Acked-by: Tejun Heo
    Acked-by: Matt Fleming
    Signed-off-by: James Morris

    Oleg Nesterov
     

08 Aug, 2011

1 commit

14 Jul, 2011

1 commit

11 Jul, 2011

3 commits