Eric Lee / smarc-fsl-linux-kernel

01 Jan, 2009

1 commit

  • 277d342fc   selinux: Deprecate and schedule the removal of the the compat_net functionality ... Browse Code »

    This patch is the first step towards removing the old "compat_net" code from
    the kernel. Secmark, the "compat_net" replacement was first introduced in
    2.6.18 (September 2006) and the major Linux distributions with SELinux support
    have transitioned to Secmark so it is time to start deprecating the "compat_net"
    mechanism. Testing a patched version of 2.6.28-rc6 with the initial release of
    Fedora Core 5 did not show any problems when running in enforcing mode.

    This patch adds an entry to the feature-removal-schedule.txt file and removes
    the SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT configuration option, forcing
    Secmark on by default although it can still be disabled at runtime. The patch
    also makes the Secmark permission checks "dynamic" in the sense that they are
    only executed when Secmark is configured; this should help prevent problems
    with older distributions that have not yet migrated to Secmark.

    Signed-off-by: Paul Moore
    Acked-by: James Morris

    Paul Moore
     

11 Sep, 2008

1 commit

18 Apr, 2008

1 commit

  • 64dbf0747   selinux: introduce permissive types ... Browse Code »

    Introduce the concept of a permissive type. A new ebitmap is introduced to
    the policy database which indicates if a given type has the permissive bit
    set or not. This bit is tested for the scontext of any denial. The bit is
    meaningless on types which only appear as the target of a decision and never
    the source. A domain running with a permissive type will be allowed to
    perform any action similarly to when the system is globally set permissive.

    Signed-off-by: Eric Paris
    Acked-by: Stephen Smalley
    Signed-off-by: James Morris

    Eric Paris
     

30 Jan, 2008

1 commit

09 May, 2007

1 commit

04 Oct, 2006

2 commits

26 Sep, 2006

2 commits

  • f3f877142   [PATCH] selinux: add support for range transitions on object classes ... Browse Code »

    Introduces support for policy version 21. This version of the binary
    kernel policy allows for defining range transitions on security classes
    other than the process security class. As always, backwards compatibility
    for older formats is retained. The security class is read in as specified
    when using the new format, while the "process" security class is assumed
    when using an older policy format.

    Signed-off-by: Darrel Goeddel
    Signed-off-by: Stephen Smalley
    Acked-by: James Morris
    Acked-by: Eric Paris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Darrel Goeddel
     
  • 016b9bdb8   [PATCH] selinux: enable configuration of max policy version ... Browse Code »

    Enable configuration of SELinux maximum supported policy version to support
    legacy userland (init) that does not gracefully handle kernels that support
    newer policy versions two or more beyond the installed policy, as in FC3
    and FC4.

    [bunk@stusta.de: improve Kconfig help text]
    Signed-off-by: Stephen Smalley
    Acked-by: James Morris
    Acked-by: Eric Paris
    Signed-off-by: Adrian Bunk
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     

18 Jun, 2006

1 commit

  • 4e5ab4cb8   [SECMARK]: Add new packet controls to SELinux ... Browse Code »

    Add new per-packet access controls to SELinux, replacing the old
    packet controls.

    Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
    then security policy for the packets is enforced with these controls.

    To allow for a smooth transition to the new controls, the old code is
    still present, but not active by default. To restore previous
    behavior, the old controls may be activated at runtime by writing a
    '1' to /selinux/compat_net, and also via the kernel boot parameter
    selinux_compat_net. Switching between the network control models
    requires the security load_policy permission. The old controls will
    probably eventually be removed and any continued use is discouraged.

    With this patch, the new secmark controls for SElinux are disabled by
    default, so existing behavior is entirely preserved, and the user is
    not affected at all.

    It also provides a config option to enable the secmark controls by
    default (which can always be overridden at boot and runtime). It is
    also noted in the kconfig help that the user will need updated
    userspace if enabling secmark controls for SELinux and that they'll
    probably need the SECMARK and CONNMARK targets, and conntrack protocol
    helpers, although such decisions are beyond the scope of kernel
    configuration.

    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: David S. Miller

    James Morris
     

08 Feb, 2006

1 commit

  • 99f6d61bd   [PATCH] selinux: require AUDIT ... Browse Code »

    Make SELinux depend on AUDIT as it requires the basic audit support to log
    permission denials at all. Note that AUDITSYSCALL remains optional for
    SELinux, although it can be useful in providing further information upon
    denials.

    Signed-off-by: Stephen Smalley
    Acked-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Smalley
     

06 Feb, 2006

1 commit

17 Apr, 2005

1 commit

  • 1da177e4c   Linux-2.6.12-rc2 ... Browse Code »

    Initial git repository build. I'm not bothering with the full history,
    even though we have it. We can create a separate "historical" git
    archive of that later if we want to, and in the meantime it's about
    3.2GB when imported into git - space that would just make the early
    git days unnecessarily complicated, when we don't have a lot of good
    infrastructure for it.

    Let it rip!

    Linus Torvalds