08 Mar, 2014
13 commits
-
If keys are not enabled, EVM is not visible in the configuration menu.
It may be difficult to figure out what to do unless you really know.
Other subsystems as NFS, CIFS select keys automatically. This patch does
the same.This patch also removes '(TRUSTED_KEYS=y || TRUSTED_KEYS=n)' dependency,
which is unnecessary. EVM does not depend on trusted keys, but on
encrypted keys. evm.h provides compile time dependency.Signed-off-by: Dmitry Kasatkin
Signed-off-by: Mimi Zohar -
Memory allocation is unnecessary for empty files.
This patch calculates the hash without memory allocation.Signed-off-by: Dmitry Kasatkin
Signed-off-by: Mimi Zohar -
EVM does not use MD5 HMAC. Selection of CRYPTO_MD5 can be safely removed.
Signed-off-by: Dmitry Kasatkin
Signed-off-by: Mimi Zohar -
This is a small refactoring so ima_d_path() returns dentry name
if path reconstruction fails. It simplifies callers actions
and removes code duplication.Signed-off-by: Dmitry Kasatkin
Signed-off-by: Mimi Zohar -
Between checkpatch changes (eg. sizeof) and inconsistencies between
Lindent and checkpatch, unfixed checkpatch errors make it difficult
to see new errors. This patch fixes them. Some lines with over 80 chars
remained unchanged to improve code readability.The "extern" keyword is removed from internal evm.h to make it consistent
with internal ima.h.Signed-off-by: Dmitry Kasatkin
Signed-off-by: Mimi Zohar -
ima_inode_post_setattr() calls ima_must_appraise() to check if the
file needs to be appraised. If it does not then it removes security.ima
xattr. With original policy matching code it might happen that even
file needs to be appraised with FILE_CHECK hook, it might not be
for POST_SETATTR hook. 'security.ima' might be erronously removed.This patch treats POST_SETATTR as special wildcard function and will
cause ima_must_appraise() to be true if any of the hooks rules matches.
security.ima will not be removed if any of the hooks would require
appraisal.Signed-off-by: Dmitry Kasatkin
Signed-off-by: Mimi Zohar -
Convert printks to pr_.
Add pr_fmt.
Remove embedded prefixes.Signed-off-by: Joe Perches
Signed-off-by: Mimi Zohar -
Changes for Trusted/Encrypted keys, EVM, and IMA.
Signed-off-by: Mimi Zohar
-
Before this change, to correctly calculate the template digest for the
'ima' template, the event name field (id: 'n') length was set to the fixed
size of 256 bytes.This patch reduces the length of the event name field to the string
length incremented of one (to make room for the termination character '\0')
and handles the specific case of the digest calculation for the 'ima'
template directly in ima_calc_field_array_hash_tfm().Signed-off-by: Roberto Sassu
Signed-off-by: Mimi Zohar -
With the new template mechanism introduced in IMA since kernel 3.13,
the format of data sent through the binary_runtime_measurements interface
is slightly changed. Now, for a generic measurement, the format of
template data (after the template name) is:template_len | field1_len | field1 | ... | fieldN_len | fieldN
In addition, fields containing a string now include the '\0' termination
character.Instead, the format for the 'ima' template should be:
SHA1 digest | event name length | event name
It must be noted that while in the IMA 3.13 code 'event name length' is
'IMA_EVENT_NAME_LEN_MAX + 1' (256 bytes), so that the template digest
is calculated correctly, and 'event name' contains '\0', in the pre 3.13
code 'event name length' is exactly the string length and 'event name'
does not contain the termination character.The patch restores the behavior of the IMA code pre 3.13 for the 'ima'
template so that legacy userspace tools obtain a consistent behavior
when receiving data from the binary_runtime_measurements interface
regardless of which kernel version is used.Signed-off-by: Roberto Sassu
Cc: # 3.3.13: 3ce1217 ima: define template fields library
Signed-off-by: Mimi Zohar -
When we pass task->comm to audit_log_untrustedstring(), we need to pass it
via get_task_comm() because task->comm can be changed to contain untrusted
string by other threads after audit_log_untrustedstring() confirmed that
task->comm does not contain untrusted string.Signed-off-by: Tetsuo Handa
Signed-off-by: Mimi Zohar -
On a 64-bit system, a hole exists in the 'inode' structure after
i_writecount. This patch moves i_readcount to fill this hole.Reported-by: David Howells
Signed-off-by: Mimi Zohar
Acked-by: David Howells -
A const char pointer allocates memory for a pointer as well as for
a string, This patch replaces a number of the const char pointers
throughout IMA, with a static const char array.Suggested-by: David Howells
Signed-off-by: Mimi Zohar
Acked-by: David Howells
05 Mar, 2014
1 commit
-
Replace "file->f_dentry->d_inode" with the new file_inode() helper
function.Signed-off-by: Libo Chen
Signed-off-by: Mimi Zohar
28 Feb, 2014
1 commit
-
Mark function as static in kernel/seccomp.c because it is not used
outside this file.This eliminates the following warning in kernel/seccomp.c:
kernel/seccomp.c:296:6: warning: no previous prototype for ?seccomp_attach_user_filter? [-Wmissing-prototypes]Signed-off-by: Rashika Kheria
Reviewed-by: Josh Triplett
Acked-by: Kees Cook
Acked-by: Will Drewry
Signed-off-by: James Morris
24 Feb, 2014
1 commit
-
Prefix logging output with "capability: " via pr_fmt.
Convert printks to pr_.
Use pr__once instead of guard flags.
Coalesce formats.Signed-off-by: Joe Perches
Acked-by: Serge E. Hallyn
Signed-off-by: James Morris
17 Feb, 2014
1 commit
-
The Makefiles in security/ uses a non-standard way to
specify sub-directories for building.Fix it up so the normal (and documented) approach is used.
Signed-off-by: Sam Ravnborg
Cc: Michal Marek
Signed-off-by: James Morris
07 Feb, 2014
1 commit
-
Correctly tag the SELinux mailing list as moderated for non-subscribers
and do some shuffling of the SELinux maintainers to try and make things
more clear when the scripts/get_maintainer.pl script is used.# ./scripts/get_maintainer.pl -f security/selinux
Paul Moore (supporter:SELINUX SECURITY...)
Stephen Smalley (supporter:SELINUX SECURITY...)
Eric Paris (supporter:SELINUX SECURITY...)
James Morris (supporter:SECURITY SUBSYSTEM)
selinux@tycho.nsa.gov (moderated list:SELINUX SECURITY...)
linux-security-module@vger.kernel.org (open list:SECURITY SUBSYSTEM)
linux-kernel@vger.kernel.org (open list)Cc: Eric Paris
Acked-by: Stephen Smalley
Signed-off-by: Paul Moore
Signed-off-by: James Morris
06 Feb, 2014
1 commit
-
The usage of strict_strto*() is not preferred, because
strict_strto*() is obsolete. Thus, kstrto*() should be
used.Signed-off-by: Jingoo Han
Signed-off-by: James Morris
08 Jan, 2014
1 commit
07 Jan, 2014
1 commit
-
Hello.
I got below leak with linux-3.10.0-54.0.1.el7.x86_64 .
[ 681.903890] kmemleak: 5538 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
Below is a patch, but I don't know whether we need special handing for undoing
ebitmap_set_bit() call.
----------
>>From fe97527a90fe95e2239dfbaa7558f0ed559c0992 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa
Date: Mon, 6 Jan 2014 16:30:21 +0900
Subject: [PATCH] SELinux: Fix memory leak upon loading policyCommit 2463c26d "SELinux: put name based create rules in a hashtable" did not
check return value from hashtab_insert() in filename_trans_read(). It leaks
memory if hashtab_insert() returns error.unreferenced object 0xffff88005c9160d0 (size 8):
comm "systemd", pid 1, jiffies 4294688674 (age 235.265s)
hex dump (first 8 bytes):
57 0b 00 00 6b 6b 6b a5 W...kkk.
backtrace:
[] kmemleak_alloc+0x4e/0xb0
[] kmem_cache_alloc_trace+0x12e/0x360
[] policydb_read+0xd1d/0xf70
[] security_load_policy+0x6c/0x500
[] sel_write_load+0xac/0x750
[] vfs_write+0xc0/0x1f0
[] SyS_write+0x4c/0xa0
[] system_call_fastpath+0x16/0x1b
[] 0xffffffffffffffffHowever, we should not return EEXIST error to the caller, or the systemd will
show below message and the boot sequence freezes.systemd[1]: Failed to load SELinux policy. Freezing.
Signed-off-by: Tetsuo Handa
Acked-by: Eric Paris
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore
06 Jan, 2014
17 commits
-
Conflicts:
security/selinux/hooks.cResolved using request struct.
Signed-off-by: James Morris
-
so we make it static
CC: Jason Gunthorpe
CC: Peter Huewe
Signed-off-by: Fengguang Wu
Signed-off-by: Peter Huewe -
If CONFIG_PM_SLEEP=n, CONFIG_PNP=y we get this warning:
drivers/char/tpm/tpm_tis.c:706:13: warning: 'tpm_tis_reenable_interrupts' defined but not used [-Wunused-function]
This seems to have been introduced in a2fa3fb0d 'tpm: convert tpm_tis driver
to use dev_pm_ops from legacy pm_ops'Also, unpon reviewing, the #ifdefs around tpm_tis_pm are not right, the first
reference is protected, the second is not. tpm_tis_pm is always defined so we
can drop the #ifdef.Signed-off-by: Jason Gunthorpe
Signed-off-by: Peter Huewe -
This consolidates everything that is only used within tpm-dev.c
into tpm-dev.c and out of the publicly visible struct tpm_chip.The per-file allocation lays the ground work for someday fixing the
strange forced O_EXCL behaviour of the current code.Signed-off-by: Jason Gunthorpe
Reviewed-by: Joel Schopp
Reviewed-by: Ashley Lai
Signed-off-by: Peter Huewe -
This builds on the last commit to use the ops structure in the core
and reduce the size of tpm_vendor_specific.Signed-off-by: Jason Gunthorpe
Reviewed-by: Joel Schopp
Reviewed-by: Ashley Lai
Signed-off-by: Peter Huewe -
This replaces the static initialization of a tpm_vendor_specific
structure in the drivers with the standard Linux idiom of providing
a const structure of function pointers.Signed-off-by: Jason Gunthorpe
Reviewed-by: Joel Schopp
Reviewed-by: Ashley Lai
[phuewe: did apply manually due to commit
191ffc6bde3 tpm/tpm_i2c_atmel: fix coccinelle warnings]
Signed-off-by: Peter Huewe -
The tpm core now sets up and controls all sysfs attributes, instead
of having each driver have a unique take on it.All drivers now now have a uniform set of attributes, and no sysfs
related entry points are exported from the tpm core module.This also uses the new method used to declare sysfs attributes
with DEVICE_ATTR_RO and 'struct attribute *'Signed-off-by: Jason Gunthorpe
[phuewe: had to apply the tpm_i2c_atmel part manually due to commit
191ffc6bde3fc tpm/tpm_i2c_atmel: fix coccinelle warnings]Signed-off-by: Peter Huewe
-
CLASS-sysfs.c is a common idiom for linux subsystems.
This is the first step to pulling all the sysfs support code from
the drivers into tpm-sysfs. This is a plain text copy from tpm-interface
with support changes to make it compile._tpm_pcr_read is made non-static and is called tpm_pcr_read_dev.
Signed-off-by: Jason Gunthorpe
Signed-off-by: Peter Huewe -
CLASS-dev.c is a common idiom for Linux subsystems
This pulls all the code related to the miscdev into tpm-dev.c and makes it
static. The identical file_operation structs in the drivers are purged and the
tpm common code unconditionally creates the miscdev.Signed-off-by: Jason Gunthorpe
Reviewed-by: Joel Schopp
Reviewed-by: Ashley Lai
[phuewe:
tpm_dev_release is now used only in this file, thus the EXPORT_SYMBOL
can be dropped and the function be marked as static.
It has no other in-kernel users]
Signed-off-by: Peter Huewe -
“wait” wait queue is defined but never used in the function, thus
it can be removed.Signed-off-by: Michal Nazarewicz
Acked-by: Jason Gunthorpe
Signed-off-by: Peter Huewe -
- removing stale/inactive maintainers
- removing stale/outdated website
- regrouped maintainersSigned-off-by: Peter Huewe
-
drivers/char/tpm/tpm_i2c_atmel.c:178:8-9: WARNING: return of 0/1 in function 'i2c_atmel_req_canceled' with return type bool
Return statements in functions returning bool should use
true/false instead of 1/0.
Generated by: coccinelle/misc/boolreturn.cocciCC: Jason Gunthorpe
CC: Peter Huewe
Acked-by: Jason Gunthorpe
Signed-off-by: Fengguang Wu
Signed-off-by: Peter Huewe -
smatch complains:
drivers/char/tpm/tpm_ibmvtpm.c:510
ibmvtpm_crq_process() info: ignoring unreachable code.-> The return is not necessary here, remove it
Signed-off-by: Peter Huewe
-
The 'get_burstcount' function can in some circumstances 'return -EBUSY' which
in tpm_stm_i2c_send is stored in an 'u32 burstcnt'
thus converting the signed value into an unsigned value, resulting
in 'burstcnt' being huge.
Changing the type to u32 only does not solve the problem as the signed
value is converted to an unsigned in I2C_WRITE_DATA, resulting in the
same effect.Thus
-> Change type of burstcnt to u32 (the return type of get_burstcount)
-> Add a check for the return value of 'get_burstcount' and propagate a
potential error.This makes also sense in the 'I2C_READ_DATA' case, where the there is no
signed/unsigned conversion.found by coverity
Cc: stable@vger.kernel.org
Signed-off-by: Peter Huewe -
If
status = acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer);
fails for whatever reason and does not return AE_OK
if (strstr(buffer.pointer, context) != NULL) {
does dereference a null pointer.-> Check the return value and return the status to the caller
Found by coverity
Cc: stable@vger.kernel.org
Signed-off-by: Peter Huewe -
Depending on the implementation strcmp might return the difference between
two strings not only -1,0,1 consequently
if (strcmp (a,b) == -1)
might lead to taking the wrong branch-> compare with < 0 instead,
which in any case is more canonical.Cc: stable@vger.kernel.org
Signed-off-by: Peter Huewe
05 Jan, 2014
1 commit
04 Jan, 2014
1 commit
-
Pull battery fixes from Anton Vorontsov:
"Two fixes:- fix build error caused by max17042_battery conversion to the regmap
API.- fix kernel oops when booting with wakeup_source_activate enabled"
* tag 'for-v3.13-fixes' of git://git.infradead.org/battery-2.6:
max17042_battery: Fix build errors caused by missing REGMAP_I2C config
power_supply: Fix Oops from NULL pointer dereference from wakeup_source_activate