aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2011-10-12Smack: check permissions from user space (v2)Jarkko Sakkinen1-63/+117
Adds a new file into SmackFS called 'access'. Wanted Smack permission is written into /smack/access. After that result can be read from the opened file. If access applies result contains 1 and otherwise 0. File access is protected from race conditions by using simple_transaction_get()/set() API. Fixes from the previous version: - Removed smack.h changes, refactoring left-over from previous version. - Removed #include <linux/smack.h>, refactoring left-over from previous version. Signed-off-by: Jarkko Sakkinen <[email protected]> Signed-off-by: Casey Schaufler <cschaufler@cschaufler-intel.(none)>
2011-10-12TOMOYO: Fix quota and garbage collector.Tetsuo Handa2-0/+18
Commit 059d84db "TOMOYO: Add socket operation restriction support" and commit 731d37aa "TOMOYO: Allow domain transition without execve()." forgot to update tomoyo_domain_quota_is_ok() and tomoyo_del_acl() which results in incorrect quota counting and memory leak. Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-10-12TOMOYO: Remove redundant tasklist_lock.Tetsuo Handa1-4/+0
rcu_read_lock() is sufficient for calling find_task_by_pid_ns()/find_task_by_vpid(). Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-28TOMOYO: Fix domain transition failure warning.Tetsuo Handa1-1/+2
Commit bd03a3e4 "TOMOYO: Add policy namespace support." introduced policy namespace. But as of /sbin/modprobe is executed from initramfs/initrd, profiles for target domain's namespace is not defined because /sbin/tomoyo-init is not yet called. Reported-by: Jamie Nguyen <[email protected]> Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-27Merge branch 'next-hex2bin' of git://github.com/mzohar/linux-evm into nextJames Morris5-15/+47
2011-09-26TOMOYO: Remove tomoyo_policy_memory_lock spinlock.Tetsuo Handa3-27/+27
tomoyo_policy_lock mutex already protects it. Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-26TOMOYO: Simplify garbage collector.Tetsuo Handa5-319/+186
When TOMOYO started using garbage collector at commit 847b173e "TOMOYO: Add garbage collector.", we waited for close() before kfree(). Thus, elements to be kfree()d were queued up using tomoyo_gc_list list. But it turned out that tomoyo_element_linked_by_gc() tends to choke garbage collector when certain pattern of entries are queued. Since garbage collector is no longer waiting for close() since commit 2e503bbb "TOMOYO: Fix lockdep warning.", we can remove tomoyo_gc_list list and tomoyo_element_linked_by_gc() by doing sequential processing. Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-26TOMOYO: Fix make namespacecheck warnings.Tetsuo Handa5-7/+9
Commit efe836ab "TOMOYO: Add built-in policy support." introduced tomoyo_load_builtin_policy() but was by error called from nowhere. Commit b22b8b9f "TOMOYO: Rename meminfo to stat and show more statistics." introduced tomoyo_update_stat() but was by error not called from tomoyo_assign_domain(). Also, mark tomoyo_io_printf() and tomoyo_path_permission() static functions, as reported by "make namespacecheck". Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-21target: check hex2bin resultMimi Zohar1-3/+9
Now that hex2bin does error checking, on error add debugging error msg. Changelog v1 (update): - fixed definition of 'ret' - hex2bin now returns an int Signed-off-by: Mimi Zohar <[email protected]> Acked-by: Andy Shevchenko <[email protected]>
2011-09-20encrypted-keys: check hex2bin resultMimi Zohar1-3/+11
For each hex2bin call in encrypted keys, check that the ascii hex string is valid. On failure, return -EINVAL. Changelog v1: - hex2bin now returns an int Signed-off-by: Mimi Zohar <[email protected]> Acked-by: Andy Shevchenko <[email protected]>
2011-09-20trusted-keys: check hex2bin resultMimi Zohar1-4/+15
For each hex2bin call in trusted keys, check that the ascii hex string is valid. On failure, return -EINVAL. Changelog v1: - hex2bin now returns an int Signed-off-by: Mimi Zohar <[email protected]> Acked-by: Andy Shevchenko <[email protected]>
2011-09-20lib: add error checking to hex2binMimi Zohar2-5/+12
hex2bin converts a hexadecimal string to its binary representation. The original version of hex2bin did not do any error checking. This patch adds error checking and returns the result. Changelog v1: - removed unpack_hex_byte() - changed return code from boolean to int Changelog: - use the new unpack_hex_byte() - add __must_check compiler option (Andy Shevchenko's suggestion) - change function API to return error checking result (based on Tetsuo Handa's initial patch) Signed-off-by: Mimi Zohar <[email protected]> Acked-by: Andy Shevchenko <[email protected]>
2011-09-19TOMOYO: Allow specifying domain transition preference.Tetsuo Handa5-12/+137
I got an opinion that it is difficult to use exception policy's domain transition control directives because they need to match the pathname specified to "file execute" directives. For example, if "file execute /bin/\*\-ls\-cat" is given, corresponding domain transition control directive needs to be like "no_keep_domain /bin/\*\-ls\-cat from any". If we can specify like below, it will become more convenient. file execute /bin/ls keep exec.realpath="/bin/ls" exec.argv[0]="ls" file execute /bin/cat keep exec.realpath="/bin/cat" exec.argv[0]="cat" file execute /bin/\*\-ls\-cat child file execute /usr/sbin/httpd <apache> exec.realpath="/usr/sbin/httpd" exec.argv[0]="/usr/sbin/httpd" In above examples, "keep" works as if keep_domain is specified, "child" works as if "no_reset_domain" and "no_initialize_domain" and "no_keep_domain" are specified, "<apache>" causes domain transition to <apache> domain upon successful execve() operation. Moreover, we can also allow transition to different domains based on conditions like below example. <kernel> /usr/sbin/sshd file execute /bin/bash <kernel> /usr/sbin/sshd //batch-session exec.argc=2 exec.argv[1]="-c" file execute /bin/bash <kernel> /usr/sbin/sshd //root-session task.uid=0 file execute /bin/bash <kernel> /usr/sbin/sshd //nonroot-session task.uid!=0 Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-15encrypted-keys: IS_ERR need include/err.hStephen Rothwell1-0/+1
Fixes this build error: security/keys/encrypted-keys/masterkey_trusted.c: In function 'request_trusted_key': security/keys/encrypted-keys/masterkey_trusted.c:35:2: error: implicit declaration of function 'IS_ERR' Signed-off-by: Stephen Rothwell <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
2011-09-15Merge branch 'next-evm' of git://github.com/mzohar/linux-evm into nextJames Morris17-84/+169
2011-09-15TOMOYO: Bump version.Tetsuo Handa4-10/+10
Tell userland tools that this is TOMOYO 2.5. Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-14evm: clean verification statusDmitry Kasatkin1-0/+1
When allocating from slab, initialization is done the first time in init_once() and subsequently on free. Because evm_status was not re-initialized on free, evm_verify_hmac() skipped verifications. This patch re-initializes evm_status. Signed-off-by: Dmitry Kasatkin <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
2011-09-14evm: permit mode bits to be updatedMimi Zohar2-17/+14
Before permitting 'security.evm' to be updated, 'security.evm' must exist and be valid. In the case that there are no existing EVM protected xattrs, it is safe for posix acls to update the mode bits. To differentiate between no 'security.evm' xattr and no xattrs used to calculate 'security.evm', this patch defines INTEGRITY_NOXATTR. Signed-off-by: Mimi Zohar <[email protected]>
2011-09-14evm: posix acls modify i_modeMimi Zohar5-5/+59
The posix xattr acls are 'system' prefixed, which normally would not affect security.evm. An interesting side affect of writing posix xattr acls is their modifying of the i_mode, which is included in security.evm. This patch updates security.evm when posix xattr acls are written. Signed-off-by: Mimi Zohar <[email protected]>
2011-09-14evm: limit verifying current security.evm integrityMimi Zohar1-34/+24
evm_protect_xattr unnecessarily validates the current security.evm integrity, before updating non-evm protected extended attributes and other file metadata. This patch limits validating the current security.evm integrity to evm protected metadata. Signed-off-by: Mimi Zohar <[email protected]>
2011-09-14evm: fix security/security_old_init_security return codeMimi Zohar1-2/+2
security_inode_init_security previously returned -EOPNOTSUPP, for S_PRIVATE inodes, and relied on the callers to change it to 0. As the callers do not change the return code anymore, return 0, intead of -EOPNOTSUPP. Signed-off-by: Mimi Zohar <[email protected]>
2011-09-14evm: remove TCG_TPM dependencyMimi Zohar1-2/+1
All tristates selected by EVM(boolean) are forced to be builtin, except in the TCG_TPM(tristate) dependency case. Arnaud Lacombe summarizes the Kconfig bug as, "So it would seem direct dependency state influence the state of reverse dependencies.." For a detailed explanation, refer to Arnaud Lacombe's posting http://lkml.org/lkml/2011/8/23/498. With the "encrypted-keys: remove trusted-keys dependency" patch, EVM can now be built without a dependency on TCG_TPM. The trusted-keys dependency requires trusted-keys to either be builtin or not selected. This dependency will prevent the boolean/tristate mismatch from occuring. Reported-by: Stephen Rothwell <[email protected]>, Randy Dunlap <rdunlap@xenotimenet> Signed-off-by: Mimi Zohar <[email protected]>
2011-09-14encrypted-keys: remove trusted-keys dependencyMimi Zohar5-28/+67
Encrypted keys are decrypted/encrypted using either a trusted-key or, for those systems without a TPM, a user-defined key. This patch removes the trusted-keys and TCG_TPM dependencies. Signed-off-by: Mimi Zohar <[email protected]>
2011-09-14encrypted-keys: create encrypted-keys directoryMimi Zohar6-1/+6
Move all files associated with encrypted keys to keys/encrypted-keys. Signed-off-by: Mimi Zohar <[email protected]>
2011-09-14TOMOYO: Avoid race when retrying "file execute" permission check.Tetsuo Handa1-34/+22
There was a race window that the pathname which is subjected to "file execute" permission check when retrying via supervisor's decision because the pathname was recalculated upon retry. Though, there is an inevitable race window even without supervisor, for we have to calculate the symbolic link's pathname from "struct linux_binprm"->filename rather than from "struct linux_binprm"->file because we cannot back calculate the symbolic link's pathname from the dereferenced pathname. Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-14TOMOYO: Allow domain transition without execve().Tetsuo Handa4-28/+210
To be able to split permissions for Apache's CGI programs which are executed without execve(), add special domain transition which is performed by writing a TOMOYO's domainname to /sys/kernel/security/tomoyo/self_domain interface. This is an API for TOMOYO-aware userland applications. However, since I expect TOMOYO and other LSM modules to run in parallel, this patch does not use /proc/self/attr/ interface in order to avoid conflicts with other LSM modules when it became possible to run multiple LSM modules in parallel. Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-14TOMOYO: Allow controlling generation of access granted logs for per an entry ↵Tetsuo Handa5-1/+38
basis. Add per-entry flag which controls generation of grant logs because Xen and KVM issues ioctl requests so frequently. For example, file ioctl /dev/null 0x5401 grant_log=no will suppress /sys/kernel/security/tomoyo/audit even if preference says grant_log=yes . Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-14TOMOYO: Add socket operation restriction support.Tetsuo Handa10-17/+1215
This patch adds support for permission checks for PF_INET/PF_INET6/PF_UNIX socket's bind()/listen()/connect()/send() operations. Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-14TOMOYO: Add environment variable name restriction support.Tetsuo Handa7-10/+266
This patch adds support for checking environment variable's names. Although TOMOYO already provides ability to check argv[]/envp[] passed to execve() requests, file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="bar" will reject execution of /bin/sh if environment variable LD_LIBRARY_PATH is not defined. To grant execution of /bin/sh if LD_LIBRARY_PATH is not defined, administrators have to specify like file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="/system/lib" file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]=NULL . Since there are many environment variables whereas conditional checks are applied as "&&", it is difficult to cover all combinations. Therefore, this patch supports conditional checks that are applied as "||", by specifying like file execute /bin/sh misc env LD_LIBRARY_PATH exec.envp["LD_LIBRARY_PATH"]="/system/lib" which means "grant execution of /bin/sh if environment variable is not defined or is defined and its value is /system/lib". Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-09security: sparse fix: Move security_fixup_op to security.hJames Morris2-3/+2
Fix sparse warning by moving declaraion to global header. Signed-off-by: James Morris <[email protected]>
2011-09-09selinux: sparse fix: fix several warnings in the security server codeJames Morris5-7/+9
Fix several sparse warnings in the SELinux security server code. Signed-off-by: James Morris <[email protected]>
2011-09-09selinux: sparse fix: include selinux.h in exports.cJames Morris1-0/+1
Fix warning: security/selinux/exports.c:18:6: warning: symbol 'selinux_is_enabled' was not declared. Should it be static? Signed-off-by: James Morris <[email protected]>
2011-09-09selinux: sparse fix: fix warnings in netlink codeJames Morris6-5/+6
Fix sparse warnings in SELinux Netlink code. Signed-off-by: James Morris <[email protected]>
2011-09-09selinux: sparse fix: eliminate warnings for selinuxfsJames Morris3-6/+4
Fixes several sparse warnings for selinuxfs.c Signed-off-by: James Morris <[email protected]>
2011-09-09ima: sparse fix: include linux/ima.h in ima_main.cJames Morris1-0/+1
Fixes sparse warnings: security/integrity/ima/ima_main.c:105:6: warning: symbol 'ima_file_free' was not declared. Should it be static? security/integrity/ima/ima_main.c:167:5: warning: symbol 'ima_file_mmap' was not declared. Should it be static? security/integrity/ima/ima_main.c:192:5: warning: symbol 'ima_bprm_check' was not declared. Should it be static? security/integrity/ima/ima_main.c:211:5: warning: symbol 'ima_file_check' was not declared. Should it be static? Signed-off-by: James Morris <[email protected]>
2011-09-09ima: sparse fix: make ima_open_policy staticJames Morris1-1/+1
Fixes sparse warning: security/integrity/ima/ima_fs.c:290:5: warning: symbol 'ima_open_policy' was not declared. Should it be static? Signed-off-by: James Morris <[email protected]>
2011-09-09apparmor: sparse fix: include procattr.h in procattr.cJames Morris1-0/+1
Fix sparse warnings: security/apparmor/procattr.c:35:5: warning: symbol 'aa_getprocattr' was not declared. Should it be static? security/apparmor/procattr.c:113:5: warning: symbol 'aa_setprocattr_changehat' was not declared. Should it be static? security/apparmor/procattr.c:158:5: warning: symbol 'aa_setprocattr_changeprofile' was not declared. Should it be static? security/apparmor/procattr.c:166:5: warning: symbol 'aa_setprocattr_permipc' was not declared. Should it be static? Signed-off-by: James Morris <[email protected]> Acked-by: John Johansen <[email protected]>
2011-09-09apparmor: sparse fix: rename shadowed variables in policy_unpack.cJames Morris1-6/+6
Fix the following warnings: security/apparmor/policy_unpack.c:384:35: warning: symbol 'size' shadows an earlier one security/apparmor/policy_unpack.c:370:24: originally declared here security/apparmor/policy_unpack.c:443:29: warning: symbol 'tmp' shadows an earlier one security/apparmor/policy_unpack.c:434:21: originally declared here Signed-off-by: James Morris <[email protected]> Acked-by: John Johansen <[email protected]>
2011-09-09apparmor: sparse fix: add apparmor.h to lib.cJames Morris1-0/+1
Fix the following sparse warnings: security/apparmor/lib.c:37:6: warning: symbol 'aa_split_fqname' was not declared. Should it be static? security/apparmor/lib.c:63:6: warning: symbol 'aa_info_message' was not declared. Should it be static? security/apparmor/lib.c:83:6: warning: symbol 'kvmalloc' was not declared. Should it be static? security/apparmor/lib.c:123:6: warning: symbol 'kvfree' was not declared. Should it be static? Signed-off-by: James Morris <[email protected]>
2011-09-09apparmor: sparse fix: include ipc.hJames Morris1-0/+1
Include ipc.h to eliminate sparse warnings. security/apparmor/ipc.c:61:5: warning: symbol 'aa_may_ptrace' was not declared. Should it be static? security/apparmor/ipc.c:83:5: warning: symbol 'aa_ptrace' was not declared. Should it be static Signed-off-by: James Morris <[email protected]> Acked-by: John Johansen <[email protected]>
2011-09-09selinux: sparse fix: declare selinux_disable() in security.hJames Morris2-1/+1
Sparse fix: declare selinux_disable() in security.h Signed-off-by: James Morris <[email protected]>
2011-09-09selinux: sparse fix: move selinux_complete_initJames Morris2-1/+1
Sparse fix: move selinux_complete_init Signed-off-by: James Morris <[email protected]>
2011-09-09selinux: sparse fix: make selinux_secmark_refcount staticJames Morris1-1/+1
Sparse fix: make selinux_secmark_refcount static. Signed-off-by: James Morris <[email protected]>
2011-09-09apparmor: sparse fix: make aa_create_aafs staticJames Morris1-1/+1
Sparse fix: make aa_create_aafs static. Signed-off-by: James Morris <[email protected]> Acked-by: John Johansen <[email protected]>
2011-09-09integrity: sparse fix: move iint_initialized to integrity.hJames Morris2-1/+3
Sparse fix: move iint_initialized to integrity.h Signed-off-by: James Morris <[email protected]>
2011-09-09security: Fix a typo[email protected]1-1/+1
Fix a typo. Signed-off-by: Roy.Li <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-09-09TOMOYO: Fix incorrect enforce mode.Tetsuo Handa1-1/+2
In tomoyo_get_mode() since 2.6.36, CONFIG::file::execute was by error used in place of CONFIG::file if CONFIG::file::execute was set to other than default. As a result, enforcing mode was not applied in a way documentation says. Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-08-24tpm: suppress durations sysfs output if not readStefan Berger1-0/+3
Suppress the output in the 'durations' sysfs entry if they were not read during driver initialization. This is similar to other sysfs entries that return nothing if for some reason sending the commands to the TPM fails. Signed-off-by: Stefan Berger <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-08-23CRED: fix build error due to 'tgcred' undeclaredAxel Lin1-0/+2
This patch adds CONFIG_KEYS guard for tgcred to fix below build error if CONFIG_KEYS is not configured. CC kernel/cred.o kernel/cred.c: In function 'prepare_kernel_cred': kernel/cred.c:657: error: 'tgcred' undeclared (first use in this function) kernel/cred.c:657: error: (Each undeclared identifier is reported only once kernel/cred.c:657: error: for each function it appears in.) make[1]: *** [kernel/cred.o] Error 1 make: *** [kernel] Error 2 Signed-off-by: Axel Lin <[email protected]> Acked-by: David Howells <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-08-23KEYS: Correctly destroy key payloads when their keytype is removedDavid Howells3-208/+258
unregister_key_type() has code to mark a key as dead and make it unavailable in one loop and then destroy all those unavailable key payloads in the next loop. However, the loop to mark keys dead renders the key undetectable to the second loop by changing the key type pointer also. Fix this by the following means: (1) The key code has two garbage collectors: one deletes unreferenced keys and the other alters keyrings to delete links to old dead, revoked and expired keys. They can end up holding each other up as both want to scan the key serial tree under spinlock. Combine these into a single routine. (2) Move the dead key marking, dead link removal and dead key removal into the garbage collector as a three phase process running over the three cycles of the normal garbage collection procedure. This is tracked by the KEY_GC_REAPING_DEAD_1, _2 and _3 state flags. unregister_key_type() then just unlinks the key type from the list, wakes up the garbage collector and waits for the third phase to complete. (3) Downgrade the key types sem in unregister_key_type() once it has deleted the key type from the list so that it doesn't block the keyctl() syscall. (4) Dead keys that cannot be simply removed in the third phase have their payloads destroyed with the key's semaphore write-locked to prevent interference by the keyctl() syscall. There should be no in-kernel users of dead keys of that type by the point of unregistration, though keyctl() may be holding a reference. (5) Only perform timer recalculation in the GC if the timer actually expired. If it didn't, we'll get another cycle when it goes off - and if the key that actually triggered it has been removed, it's not a problem. (6) Only garbage collect link if the timer expired or if we're doing dead key clean up phase 2. (7) As only key_garbage_collector() is permitted to use rb_erase() on the key serial tree, it doesn't need to revalidate its cursor after dropping the spinlock as the node the cursor points to must still exist in the tree. (8) Drop the spinlock in the GC if there is contention on it or if we need to reschedule. After dealing with that, get the spinlock again and resume scanning. This has been tested in the following ways: (1) Run the keyutils testsuite against it. (2) Using the AF_RXRPC and RxKAD modules to test keytype removal: Load the rxrpc_s key type: # insmod /tmp/af-rxrpc.ko # insmod /tmp/rxkad.ko Create a key (http://people.redhat.com/~dhowells/rxrpc/listen.c): # /tmp/listen & [1] 8173 Find the key: # grep rxrpc_s /proc/keys 091086e1 I--Q-- 1 perm 39390000 0 0 rxrpc_s 52:2 Link it to a session keyring, preferably one with a higher serial number: # keyctl link 0x20e36251 @s Kill the process (the key should remain as it's linked to another place): # fg /tmp/listen ^C Remove the key type: rmmod rxkad rmmod af-rxrpc This can be made a more effective test by altering the following part of the patch: if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) { /* Make sure everyone revalidates their keys if we marked a * bunch as being dead and make sure all keyring ex-payloads * are destroyed. */ kdebug("dead sync"); synchronize_rcu(); To call synchronize_rcu() in GC phase 1 instead. That causes that the keyring's old payload content to hang around longer until it's RCU destroyed - which usually happens after GC phase 3 is complete. This allows the destroy_dead_key branch to be tested. Reported-by: Benjamin Coddington <[email protected]> Signed-off-by: David Howells <[email protected]> Signed-off-by: James Morris <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.