kernel/linux.git/security/selinux/include/avc.h, branch linux-4.4.y

Merge branch 'next' of git://git.infradead.org/users/pcmoore/selinux into next

2015-08-15T03:29:57+00:00

selinux: extended permissions for ioctls

2015-07-13T17:31:58+00:00

Add extended permissions logic to selinux. Extended permissions provides additional permissions in 256 bit increments. Extend the generic ioctl permission check to use the extended permissions for per-command filtering. Source/target/class sets including the ioctl permission may additionally include a set of commands. Example: allowxperm : ioctl unpriv_app_socket_cmds auditallowxperm : ioctl priv_gpu_cmds Where unpriv_app_socket_cmds and priv_gpu_cmds are macros representing commonly granted sets of ioctl commands. When ioctl commands are omitted only the permissions are checked. This feature is intended to provide finer granularity for the ioctl permission that may be too imprecise. For example, the same driver may use ioctls to provide important and benign functionality such as driver version or socket type as well as dangerous capabilities such as debugging features, read/write/execute to physical memory or access to sensitive data. Per-command filtering provides a mechanism to reduce the attack surface of the kernel, and limit applications to the subset of commands required. The format of the policy binary has been modified to include ioctl commands, and the policy version number has been incremented to POLICYDB_VERSION_XPERMS_IOCTL=30 to account for the format change. The extended permissions logic is deliberately generic to allow components to be reused e.g. netlink filters Signed-off-by: Jeff Vander Stoep Acked-by: Nick Kralevich Signed-off-by: Paul Moore

security/selinux: pass 'flags' arg to avc_audit() and avc_has_perm_flags()

2015-05-11T12:13:11+00:00

This allows MAY_NOT_BLOCK to be passed, in RCU-walk mode, through the new avc_has_perm_flags() to avc_audit() and thence the slow_avc_audit. Signed-off-by: NeilBrown Signed-off-by: Al Viro

selinux: Report permissive mode in avc: denied messages.

2014-06-03T19:21:48+00:00

We cannot presently tell from an avc: denied message whether access was in fact denied or was allowed due to global or per-domain permissive mode. Add a permissive= field to the avc message to reflect this information. Signed-off-by: Stephen Smalley Acked-by: Eric Paris Signed-off-by: Paul Moore

selinux: remove 'flags' parameter from avc_audit()

2013-10-04T21:13:25+00:00

Now avc_audit() has no more users with that parameter. Remove it. Signed-off-by: Linus Torvalds

selinux: avc_has_perm_flags has no more users

2013-10-04T21:13:14+00:00

.. so get rid of it. The only indirect users were all the avc_has_perm() callers which just expanded to have a zero flags argument. Signed-off-by: Linus Torvalds

SELinux: avc: remove the useless fields in avc_add_callback

2012-04-09T16:23:44+00:00

avc_add_callback now just used for registering reset functions in initcalls, and the callback functions just did reset operations. So, reducing the arguments to only one event is enough now. Signed-off-by: Wanlong Gao Signed-off-by: Eric Paris

SELinux: unify the selinux_audit_data and selinux_late_audit_data

2012-04-09T16:23:06+00:00

We no longer need the distinction. We only need data after we decide to do an audit. So turn the "late" audit data into just "data" and remove what we currently have as "data". Signed-off-by: Eric Paris

SELinux: remove auditdeny from selinux_audit_data

2012-04-09T16:23:05+00:00

It's just takin' up space. Signed-off-by: Eric Paris

SELinux: delay initialization of audit data in selinux_inode_permission

2012-04-09T16:22:59+00:00

We pay a rather large overhead initializing the common_audit_data. Since we only need this information if we actually emit an audit message there is little need to set it up in the hot path. This patch splits the functionality of avc_has_perm() into avc_has_perm_noaudit(), avc_audit_required() and slow_avc_audit(). But we take care of setting up to audit between required() and the actual audit call. Thus saving measurable time in a hot path. Signed-off-by: Stephen Smalley Signed-off-by: Eric Paris