aboutsummaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2010-04-23mmap_min_addr check CAP_SYS_RAWIO only for writeKees Cook1-1/+1
Redirecting directly to lsm, here's the patch discussed on lkml: http://lkml.org/lkml/2010/4/22/219 The mmap_min_addr value is useful information for an admin to see without being root ("is my system vulnerable to kernel NULL pointer attacks?") and its setting is trivially easy for an attacker to determine by calling mmap() in PAGE_SIZE increments starting at 0, so trying to keep it private has no value. Only require CAP_SYS_RAWIO if changing the value, not reading it. Comment from Serge : Me, I like to write my passwords with light blue pen on dark blue paper, pasted on my window - if you're going to get my password, you're gonna get a headache. Signed-off-by: Kees Cook <[email protected]> Acked-by: Serge Hallyn <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-23IMA: include the word IMA in printk messagesEric Paris3-5/+5
As an example IMA emits a warning when it can't find a TPM chip: "No TPM chip found, activating TPM-bypass!" This patch prefaces that message with IMA so we know what subsystem is bypassing the TPM. Do this for all pr_info and pr_err messages. Signed-off-by: Eric Paris <[email protected]> Acked-by: Mimi Zohar <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-22security: testing the wrong variable in create_by_name()Dan Carpenter1-2/+2
There is a typo here. We should be testing "*dentry" instead of "dentry". If "*dentry" is an ERR_PTR, it gets dereferenced in either mkdir() or create() which would cause an OOPs. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-21IMA: drop the word integrity in the audit messageEric Paris1-1/+1
integrity_audit_msg() uses "integrity:" in the audit message. This violates the (loosely defined) audit system requirements that everything be a key=value pair and it doesn't provide additional information. This can be obviously gleaned from the message type. Just drop it. Signed-off-by: Eric Paris <[email protected]> Acked-by: Mimi Zohar <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-21IMA: use audit_log_untrusted_string rather than %sEric Paris1-13/+20
Convert all of the places IMA calls audit_log_format with %s into audit_log_untrusted_string(). This is going to cause them all to get quoted, but it should make audit log injection harder. Signed-off-by: Eric Paris <[email protected]> Acked-by: Mimi Zohar <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-21IMA: handle comments in policyEric Paris1-7/+14
IMA policy load parser will reject any policies with a comment. This patch will allow the parser to just ignore lines which start with a #. This is not very robust. # can ONLY be used at the very beginning of a line. Inline comments are not allowed. Signed-off-by: Eric Paris Acked-by: Mimi Zohar <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-21IMA: handle whitespace betterEric Paris1-3/+3
IMA parser will fail if whitespace is used in any way other than a single space. Using a tab or even using 2 spaces in a row will result in a policy being rejected. This patch makes the kernel ignore whitespace a bit better. Signed-off-by: Eric Paris <[email protected]> Acked-by: Mimi Zohar <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-21IMA: reject policies with unknown entriesEric Paris1-0/+1
Currently the ima policy load code will print what it doesn't understand but really I think it should reject any policy it doesn't understand. This patch makes it so! Signed-off-by: Eric Paris <[email protected]> Acked-by: Mimi Zohar <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-21IMA: set entry->action to UNKNOWN rather than hard codingEric Paris1-1/+1
ima_parse_rule currently sets entry->action = -1 and then later tests if (entry->action == UNKNOWN). It is true that UNKNOWN == -1 but actually setting it to UNKNOWN makes a lot more sense in case things change in the future. Signed-off-by: Eric Paris <[email protected]> Acked-by: Mimi Zohar <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-21IMA: do not allow the same rule to specify the same thing twiceEric Paris1-1/+33
IMA will accept rules which specify things twice and will only pay attention to the last one. We should reject such rules. Signed-off-by: Eric Paris <[email protected]> Acked-by: Mimi Zohar <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-21ima: handle multiple rules per writeEric Paris3-26/+32
Currently IMA will only accept one rule per write(). This patch allows IMA to accept writes which contain multiple rules but only processes one rule per write. \n is used as the delimiter between rules. IMA will return a short write indicating that it only accepted up to the first \n. This allows simple userspace utilities like cat to be used to load an IMA policy instead of needing a special userspace utility that understood 'one write per rule' Signed-off-by: Eric Paris <[email protected]> Acked-by: Mimi Zohar <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-21SELinux: return error codes on policy load failureEric Paris1-15/+22
policy load failure always return EINVAL even if the failure was for some other reason (usually ENOMEM). This patch passes error codes back up the stack where they will make their way to userspace. This might help in debugging future problems with policy load. Signed-off-by: Eric Paris <[email protected]> Acked-by: Stephen Smalley <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-20Security: Fix the comment of cap_file_mmap()[email protected]1-1/+1
In the comment of cap_file_mmap(), replace mmap_min_addr to be dac_mmap_min_addr. Signed-off-by: Zhitong Wang <[email protected]> Acked-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-15SELinux: Reduce max avtab size to avoid page allocation failuresStephen Smalley1-1/+1
Reduce MAX_AVTAB_HASH_BITS so that the avtab allocation is an order 2 allocation rather than an order 4 allocation on x86_64. This addresses reports of page allocation failures: http://marc.info/?l=selinux&m=126757230625867&w=2 https://bugzilla.redhat.com/show_bug.cgi?id=570433 Reported-by: Russell Coker <[email protected]> Signed-off-by: Stephen D. Smalley <[email protected]> Acked-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove dead hook acctEric Paris2-11/+0
Unused hook. Remove. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove dead hook key_session_to_parentEric Paris3-22/+0
Unused hook. Remove. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove dead hook task_setgroupsEric Paris2-11/+0
Unused hook. Remove. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove dead hook task_setgidEric Paris2-11/+0
Unused hook. Remove. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove dead hook task_setuidEric Paris2-11/+0
Unused hook. Remove. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove dead hook cred_commitEric Paris2-10/+0
Unused hook. Remove. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove dead hook inode_deleteEric Paris2-12/+0
Unused hook. Remove. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove dead hook sb_post_pivotrootEric Paris2-10/+0
Unused hook. Remove. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove dead hook sb_post_addmountEric Paris2-10/+0
Unused hook. Remove. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove dead hook sb_post_remountEric Paris2-11/+0
Unused hook. Remove. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove dead hook sb_umount_busyEric Paris2-10/+0
Unused hook. Remove. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove dead hook sb_umount_closeEric Paris2-10/+0
Unused hook. Remove. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-12security: remove sb_check_sb hooksEric Paris2-11/+0
Unused hook. Remove it. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-09Security: Fix coding style in security/[email protected]4-31/+31
Fix coding style in security/ Signed-off-by: Zhitong Wang <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-08SMACK: remove dead cred_commit hookEric Paris1-10/+0
This is an unused hook in SMACK so remove it. Signed-off-by: Eric Paris <[email protected]> Acked-by: Casey Schaufler <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-08selinux: always call sk_security_struct sksecEric Paris3-36/+36
trying to grep everything that messes with a sk_security_struct isn't easy since we don't always call it sksec. Just rename everything sksec. Signed-off-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-03-31Merge branch 'master' into nextJames Morris4-23/+9
2010-03-30include cleanup: Update gfp.h and slab.h includes to prepare for breaking ↵Tejun Heo28-3/+25
implicit slab.h inclusion from percpu.h percpu.h is included by sched.h and module.h and thus ends up being included when building most .c files. percpu.h includes slab.h which in turn includes gfp.h making everything defined by the two files universally available and complicating inclusion dependencies. percpu.h -> slab.h dependency is about to be removed. Prepare for this change by updating users of gfp and slab facilities include those headers directly instead of assuming availability. As this conversion needs to touch large number of source files, the following script is used as the basis of conversion. http://userweb.kernel.org/~tj/misc/slabh-sweep.py The script does the followings. * Scan files for gfp and slab usages and update includes such that only the necessary includes are there. ie. if only gfp is used, gfp.h, if slab is used, slab.h. * When the script inserts a new include, it looks at the include blocks and try to put the new include such that its order conforms to its surrounding. It's put in the include block which contains core kernel includes, in the same order that the rest are ordered - alphabetical, Christmas tree, rev-Xmas-tree or at the end if there doesn't seem to be any matching order. * If the script can't find a place to put a new include (mostly because the file doesn't have fitting include block), it prints out an error message indicating which .h file needs to be added to the file. The conversion was done in the following steps. 1. The initial automatic conversion of all .c files updated slightly over 4000 files, deleting around 700 includes and adding ~480 gfp.h and ~3000 slab.h inclusions. The script emitted errors for ~400 files. 2. Each error was manually checked. Some didn't need the inclusion, some needed manual addition while adding it to implementation .h or embedding .c file was more appropriate for others. This step added inclusions to around 150 files. 3. The script was run again and the output was compared to the edits from #2 to make sure no file was left behind. 4. Several build tests were done and a couple of problems were fixed. e.g. lib/decompress_*.c used malloc/free() wrappers around slab APIs requiring slab.h to be added manually. 5. The script was run on all .h files but without automatically editing them as sprinkling gfp.h and slab.h inclusions around .h files could easily lead to inclusion dependency hell. Most gfp.h inclusion directives were ignored as stuff from gfp.h was usually wildly available and often used in preprocessor macros. Each slab.h inclusion directive was examined and added manually as necessary. 6. percpu.h was updated not to include slab.h. 7. Build test were done on the following configurations and failures were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my distributed build env didn't work with gcov compiles) and a few more options had to be turned off depending on archs to make things build (like ipr on powerpc/64 which failed due to missing writeq). * x86 and x86_64 UP and SMP allmodconfig and a custom test config. * powerpc and powerpc64 SMP allmodconfig * sparc and sparc64 SMP allmodconfig * ia64 SMP allmodconfig * s390 SMP allmodconfig * alpha SMP allmodconfig * um on x86_64 SMP allmodconfig 8. percpu.h modifications were reverted so that it could be applied as a separate patch and serve as bisection point. Given the fact that I had only a couple of failures from tests on step 6, I'm fairly confident about the coverage of this conversion patch. If there is a breakage, it's likely to be something in one of the arch headers which should be easily discoverable easily on most builds of the specific arch. Signed-off-by: Tejun Heo <[email protected]> Guess-its-ok-by: Christoph Lameter <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Lee Schermerhorn <[email protected]>
2010-03-16SELinux: Reduce max avtab size to avoid page allocation failuresStephen Smalley1-1/+1
Reduce MAX_AVTAB_HASH_BITS so that the avtab allocation is an order 2 allocation rather than an order 4 allocation on x86_64. This addresses reports of page allocation failures: http://marc.info/?l=selinux&m=126757230625867&w=2 https://bugzilla.redhat.com/show_bug.cgi?id=570433 Reported-by: Russell Coker <[email protected]> Signed-off-by: Stephen D. Smalley <[email protected]> Acked-by: Eric Paris <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-03-15tomoyo: fix potential use after freeDan Carpenter1-0/+1
The original code returns a freed pointer. This function is expected to return NULL on errors. Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-03-10security/ima: replace gcc specific __FUNCTION__ with __func__H Hartley Sweeten2-4/+4
As noted by checkpatch.pl, __func__ should be used instead of gcc specific __FUNCTION__. Signed-off-by: H Hartley Sweeten <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-03-10Security: key: keyring: fix some code style issuesChihau Chau1-4/+3
This fixes to include <linux/uaccess.h> instead <asm/uaccess.h> and some code style issues like to put a else sentence below close brace '}' and to replace a tab instead of some space characters. Signed-off-by: Chihau Chau <[email protected]> Acked-by: David Howells <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-03-09Merge branch 'next-queue' into nextJames Morris9-18/+9
2010-03-08Merge branch 'for-next' into for-linusJiri Kosina1-3/+3
Conflicts: Documentation/filesystems/proc.txt arch/arm/mach-u300/include/mach/debug-macro.S drivers/net/qlge/qlge_ethtool.c drivers/net/qlge/qlge_main.c drivers/net/typhoon.c
2010-03-08selinux: const strings in tablesStephen Hemminger3-3/+3
Several places strings tables are used that should be declared const. Signed-off-by: Stephen Hemminger <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-03-05Security: Fix some coding styles in security/keys/keyring.c[email protected]1-4/+2
Fix some coding styles in security/keys/keyring.c Signed-off-by: Zhitong Wang <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-03-04Merge branch 'for-linus' of ↵Linus Torvalds2-20/+5
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: (52 commits) init: Open /dev/console from rootfs mqueue: fix typo "failues" -> "failures" mqueue: only set error codes if they are really necessary mqueue: simplify do_open() error handling mqueue: apply mathematics distributivity on mq_bytes calculation mqueue: remove unneeded info->messages initialization mqueue: fix mq_open() file descriptor leak on user-space processes fix race in d_splice_alias() set S_DEAD on unlink() and non-directory rename() victims vfs: add NOFOLLOW flag to umount(2) get rid of ->mnt_parent in tomoyo/realpath hppfs can use existing proc_mnt, no need for do_kern_mount() in there Mirror MS_KERNMOUNT in ->mnt_flags get rid of useless vfsmount_lock use in put_mnt_ns() Take vfsmount_lock to fs/internal.h get rid of insanity with namespace roots in tomoyo take check for new events in namespace (guts of mounts_poll()) to namespace.c Don't mess with generic_permission() under ->d_lock in hpfs sanitize const/signedness for udf nilfs: sanitize const/signedness in dealing with ->d_name.name ... Fix up fairly trivial (famous last words...) conflicts in drivers/infiniband/core/uverbs_main.c and security/tomoyo/realpath.c
2010-03-04Selinux: Remove unused headers skbuff.h in selinux/nlmsgtab.c[email protected]1-1/+0
skbuff.h is already included by netlink.h, so remove it. Signed-off-by: Zhitong Wang <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-03-03get rid of ->mnt_parent in tomoyo/realpathAl Viro1-1/+1
Signed-off-by: Al Viro <[email protected]>
2010-03-03get rid of insanity with namespace roots in tomoyoAl Viro1-19/+4
passing *any* namespace root to __d_path() as root is equivalent to just passing it {NULL, NULL}; no need to bother with finding the root of our namespace in there. Signed-off-by: Al Viro <[email protected]>
2010-03-03fix mnt_mountpoint abuse in smackAl Viro1-1/+1
(mnt,mnt_mountpoint) pair is conceptually wrong; if you want to use it for generating pathname and for nothing else *and* if you know that vfsmount tree is unchanging, you can get away with that, but the right solution for that is (mnt,mnt_root). Signed-off-by: Al Viro <[email protected]>
2010-03-03Selinux: Remove unused headers slab.h in selinux/ss/symtab.c[email protected]1-1/+0
slab.h is unused in symtab.c, so remove it. Signed-off-by: Zhitong Wang <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-03-03Selinux: Remove unused headers list.h in selinux/netlink.c[email protected]1-1/+0
list.h is unused in netlink.c, so remove it. Signed-off-by: Zhitong Wang <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-03-03TOMOYO: Remove unused variables.Tetsuo Handa1-7/+3
Variable "atmark" is currently unused. Signed-off-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-03-03Security: Add __init to register_security to disable load a security module ↵[email protected]1-1/+1
on runtime LSM framework doesn't allow to load a security module on runtime, it must be loaded on boot time. but in security/security.c: int register_security(struct security_operations *ops) { ... if (security_ops != &default_security_ops) return -EAGAIN; ... } if security_ops == &default_security_ops, it can access to register a security module. If selinux is enabled, other security modules can't register, but if selinux is disabled on boot time, the security_ops was set to default_security_ops, LSM allows other kernel modules to use register_security() to register a not trust security module. For example: disable selinux on boot time(selinux=0). #include <linux/kernel.h> #include <linux/module.h> #include <linux/init.h> #include <linux/version.h> #include <linux/string.h> #include <linux/list.h> #include <linux/security.h> MODULE_LICENSE("GPL"); MODULE_AUTHOR("wzt"); extern int register_security(struct security_operations *ops); int (*new_register_security)(struct security_operations *ops); int rootkit_bprm_check_security(struct linux_binprm *bprm) { return 0; } struct security_operations rootkit_ops = { .bprm_check_security = rootkit_bprm_check_security, }; static int rootkit_init(void) { printk("Load LSM rootkit module.\n"); /* cat /proc/kallsyms | grep register_security */ new_register_security = 0xc0756689; if (new_register_security(&rootkit_ops)) { printk("Can't register rootkit module.\n"); return 0; } printk("Register rootkit module ok.\n"); return 0; } static void rootkit_exit(void) { printk("Unload LSM rootkit module.\n"); } module_init(rootkit_init); module_exit(rootkit_exit); Signed-off-by: Zhitong Wang <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-03-01Merge branch 'next' into for-linusJames Morris25-1665/+1937
Powered by cgit, Gruvboxed by Blaster4385.