BMC/Intel-BMC/linux.git/security, branch v2.6.26-rc9

devcgroup: fix odd behaviour when writing 'a' to devices.allow

2008-07-04T17:40:10+00:00

# cat /devcg/devices.list a *:* rwm # echo a > devices.allow # cat /devcg/devices.list a *:* rwm a 0:0 rwm This is odd and maybe confusing. With this patch, writing 'a' to devices.allow will add 'a *:* rwm' to the whitelist. Also a few fixes and updates to the document. Signed-off-by: Li Zefan Cc: Pavel Emelyanov Cc: Serge E. Hallyn Cc: Paul Menage Cc: Balbir Singh Cc: James Morris Cc: Chris Wright Cc: Stephen Smalley Cc: KAMEZAWA Hiroyuki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

security: filesystem capabilities: fix CAP_SETPCAP handling

2008-07-04T17:40:08+00:00

The filesystem capability support meaning for CAP_SETPCAP is less powerful than the non-filesystem capability support. As such, when filesystem capabilities are configured, we should not permit CAP_SETPCAP to 'enhance' the current process through strace manipulation of a child process. Signed-off-by: Andrew G. Morgan Acked-by: Serge Hallyn Cc: David Howells Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

capabilities: add (back) dummy support for KEEPCAPS

2008-06-13T01:05:40+00:00

The dummy module is used by folk that run security conscious code(!?). A feature of such code (for example, dhclient) is that it tries to operate with minimum privilege (dropping unneeded capabilities). While the dummy module doesn't restrict code execution based on capability state, the user code expects the kernel to appear to support it. This patch adds back faked support for the PR_SET_KEEPCAPS etc., calls - making the kernel behave as before 2.6.26. For details see: http://bugzilla.kernel.org/show_bug.cgi?id=10748 Signed-off-by: Andrew G. Morgan Acked-by: Serge Hallyn Cc: James Morris Cc: Stephen Smalley Cc: Chris Wright Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

keys: remove unused key_alloc_sem

2008-06-06T18:29:11+00:00

This semaphore doesn't appear to be used, so remove it. Signed-off-by: Daniel Walker Cc: David Howells Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

devscgroup: make white list more compact in some cases

2008-06-06T18:29:11+00:00

Consider you added a 'c foo:bar r' permission to some cgroup and then (a bit later) 'c'foo:bar w' for it. After this you'll see the c foo:bar r c foo:bar w lines in a devices.list file. Another example - consider you added 10 'c foo:bar r' permissions to some cgroup (e.g. by mistake). After this you'll see 10 c foo:bar r lines in a list file. This is weird. This situation also has one more annoying consequence. Having many items in a white list makes permissions checking slower, sine it has to walk a longer list. The proposal is to merge permissions for items, that correspond to the same device. Signed-off-by: Pavel Emelyanov Acked-by: Serge Hallyn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

devscgroup: relax task to dev_cgroup conversion

2008-06-06T18:29:11+00:00

Two functions, that need to get a device_cgroup from a task (they are devcgroup_inode_permission and devcgroup_inode_mknod) make it in a strange way: They get a css_set from task, then a subsys_state from css_set, then a cgroup from the state and then a subsys_state again from the cgroup. Besides, the devices_subsys_id is read from memory, whilst there's a enum-ed constant for it. Optimize this part a bit: 1. Get the subsys_stats form the task and be done - no 2 extra dereferences, 2. Use the device_subsys_id constant, not the value from memory (i.e. one less dereference). Found while preparing 2.6.26 OpenVZ port. Signed-off-by: Pavel Emelyanov Acked-by: Serge Hallyn Acked-by: Paul Menage Cc: Balbir Singh Cc: James Morris Cc: Chris Wright Cc: Stephen Smalley Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

devcgroup: make a helper to convert cgroup_subsys_state to devs_cgroup

2008-06-06T18:29:11+00:00

This is just picking the container_of out of cgroup_to_devcgroup into a separate function. This new css_to_devcgroup will be used in the 2nd patch. Signed-off-by: Pavel Emelyanov Acked-by: Serge Hallyn Cc: Paul Menage Cc: Balbir Singh Cc: James Morris Cc: Chris Wright Cc: Stephen Smalley Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Smack: fuse mount hang fix

2008-06-04T15:50:43+00:00

The d_instantiate hook for Smack can hang on the root inode of a filesystem if the file system code has not really done all the set-up. Fuse is known to encounter this problem. This change detects an attempt to instantiate a root inode and addresses it early in the processing, before any attempt is made to do something that might hang. Signed-off-by: Casey Schaufler Tested-by: Luiz Fernando N. Capitulino Signed-off-by: Linus Torvalds

[PATCH] split linux/file.h

2008-05-01T17:08:16+00:00

Initial splitoff of the low-level stuff; taken to fdtable.h Signed-off-by: Al Viro

signals: cleanup security_task_kill() usage/implementation

2008-04-30T15:29:34+00:00

Every implementation of ->task_kill() does nothing when the signal comes from the kernel. This is correct, but means that check_kill_permission() should call security_task_kill() only for SI_FROMUSER() case, and we can remove the same check from ->task_kill() implementations. (sadly, check_kill_permission() is the last user of signal->session/__session but we can't s/task_session_nr/task_session/ here). NOTE: Eric W. Biederman pointed out cap_task_kill() should die, and I think he is very right. Signed-off-by: Oleg Nesterov Cc: "Eric W. Biederman" Cc: Serge Hallyn Cc: Roland McGrath Cc: Casey Schaufler Cc: David Quigley Cc: Eric Paris Cc: Harald Welte Cc: Pavel Emelyanov Cc: Stephen Smalley Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds