linux-toradex.git/security/Makefile, branch v2.6.32-rc3

SELinux: Convert avc_audit to use lsm_audit.h

2009-08-16T22:37:18+00:00

Convert avc_audit in security/selinux/avc.c to use lsm_audit.h,
for better maintainability.

 - changed selinux to use common_audit_data instead of
    avc_audit_data
 - eliminated code in avc.c and used code from lsm_audit.h instead.

Had to add a LSM_AUDIT_NO_AUDIT to lsm_audit.h so that avc_audit
can call common_lsm_audit and do the pre and post callbacks without
doing the actual dump.  This makes it so that the patched version
behaves the same way as the unpatched version.

Also added a denied field to the selinux_audit_data private space,
once again to make it so that the patched version behaves like the
unpatched.

I've tested and confirmed that AVCs look the same before and after
this patch.

Signed-off-by: Thomas Liu 
Acked-by:  Stephen Smalley 
Signed-off-by: James Morris

Security/SELinux: seperate lsm specific mmap_min_addr

2009-08-05T23:02:23+00:00

Currently SELinux enforcement of controls on the ability to map low memory
is determined by the mmap_min_addr tunable.  This patch causes SELinux to
ignore the tunable and instead use a seperate Kconfig option specific to how
much space the LSM should protect.

The tunable will now only control the need for CAP_SYS_RAWIO and SELinux
permissions will always protect the amount of low memory designated by
CONFIG_LSM_MMAP_MIN_ADDR.

This allows users who need to disable the mmap_min_addr controls (usual reason
being they run WINE as a non-root user) to do so and still have SELinux
controls preventing confined domains (like a web server) from being able to
map some area of low memory.

Signed-off-by: Eric Paris 
Signed-off-by: James Morris

Revert "SELinux: Convert avc_audit to use lsm_audit.h"

2009-07-13T00:39:36+00:00

This reverts commit 8113a8d80f4c6a3dc3724b39b470f3fee9c426b6.

The patch causes a stack overflow on my system during boot.

Signed-off-by: James Morris

SELinux: Convert avc_audit to use lsm_audit.h

2009-07-12T21:54:48+00:00

Convert avc_audit in security/selinux/avc.c to use lsm_audit.h,
for better maintainability and for less code duplication.

 - changed selinux to use common_audit_data instead of
   avc_audit_data
 - eliminated code in avc.c and used code from lsm_audit.h instead.

I have tested to make sure that the avcs look the same before and
after this patch.

Signed-off-by: Thomas Liu 
Acked-by: Eric Paris 
Signed-off-by: James Morris

smack: implement logging V3

2009-04-13T23:00:23+00:00

the following patch, add logging of Smack security decisions.
This is of course very useful to understand what your current smack policy does.
As suggested by Casey, it also now forbids labels with ', " or \

It introduces a '/smack/logging' switch :
0: no logging
1: log denied (default)
2: log accepted
3: log denied&accepted

Signed-off-by: Etienne Basset 
Acked-by: Casey Schaufler 
Acked-by: Eric Paris 
Signed-off-by: James Morris

security: change link order of LSMs so security=tomoyo works

2009-02-12T05:29:04+00:00

LSMs need to be linked before root_plug to ensure the security=
boot parameter works with them.  Do this for Tomoyo.

(root_plug probably needs to be taken out and shot at some point,
too).

Signed-off-by: James Morris

Kconfig and Makefile

2009-02-12T04:19:00+00:00

TOMOYO uses LSM hooks for pathname based access control and securityfs support.

Signed-off-by: Kentaro Takeda 
Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

integrity: IMA as an integrity service provider

2009-02-05T22:05:30+00:00

IMA provides hardware (TPM) based measurement and attestation for
file measurements. As the Trusted Computing (TPM) model requires,
IMA measures all files before they are accessed in any way (on the
integrity_bprm_check, integrity_path_check and integrity_file_mmap
hooks), and commits the measurements to the TPM. Once added to the
TPM, measurements can not be removed.

In addition, IMA maintains a list of these file measurements, which
can be used to validate the aggregate value stored in the TPM.  The
TPM can sign these measurements, and thus the system can prove, to
itself and to a third party, the system's integrity in a way that
cannot be circumvented by malicious or compromised software.

- alloc ima_template_entry before calling ima_store_template()
- log ima_add_boot_aggregate() failure
- removed unused IMA_TEMPLATE_NAME_LEN
- replaced hard coded string length with #define name

Signed-off-by: Mimi Zohar 
Signed-off-by: James Morris

securityfs: do not depend on CONFIG_SECURITY

2008-08-28T00:47:42+00:00

Add a new Kconfig option SECURITYFS which will build securityfs support
but does not require CONFIG_SECURITY.  The only current user of
securityfs does not depend on CONFIG_SECURITY and there is no reason the
full LSM needs to be built to build this fs.

Signed-off-by: Eric Paris 
Signed-off-by: James Morris

security: remove dummy module

2008-07-14T05:03:04+00:00

Remove the dummy module and make the "capability" module the default.

Compile and boot tested.

Signed-off-by: Miklos Szeredi 
Acked-by: Serge Hallyn 
Signed-off-by: James Morris