linux-toradex.git/security/apparmor/domain.c, branch v4.1.10

sched: move no_new_privs into new atomic flags

2014-07-18T19:13:38+00:00

Since seccomp transitions between threads requires updates to the
no_new_privs flag to be atomic, the flag must be part of an atomic flag
set. This moves the nnp flag into a separate task field, and introduces
accessors.

Signed-off-by: Kees Cook 
Reviewed-by: Oleg Nesterov 
Reviewed-by: Andy Lutomirski

apparmor: remove the "task" arg from may_change_ptraced_domain()

2013-10-30T04:34:18+00:00

Unless task == current ptrace_parent(task) is not safe even under
rcu_read_lock() and most of the current users are not right.

So may_change_ptraced_domain(task) looks wrong as well. However it
is always called with task == current so the code is actually fine.
Remove this argument to make this fact clear.

Note: perhaps we should simply kill ptrace_parent(), it buys almost
nothing. And it is obviously racy, perhaps this should be fixed.

Signed-off-by: Oleg Nesterov 
Signed-off-by: John Johansen

apparmor: fix capability to not use the current task, during reporting

2013-10-30T04:33:37+00:00

Mediation is based off of the cred but auditing includes the current
task which may not be related to the actual request.

Signed-off-by: John Johansen

apparmor: allow setting any profile into the unconfined state

2013-08-14T18:42:07+00:00

Allow emulating the default profile behavior from boot, by allowing
loading of a profile in the unconfined state into a new NS.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: update how unconfined is handled

2013-08-14T18:42:06+00:00

ns->unconfined is being used read side without locking, nor rcu but is
being updated when a namespace is removed. This works for the root ns
which is never removed but has a race window and can cause failures when
children namespaces are removed.

Also ns and ns->unconfined have a circular refcounting dependency that
is problematic and must be broken. Currently this is done incorrectly
when the namespace is destroyed.

Fix this by forward referencing unconfined via the replacedby infrastructure
instead of directly updating the ns->unconfined pointer.

Remove the circular refcount dependency by making the ns and its unconfined
profile share the same refcount.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: change how profile replacement update is done

2013-08-14T18:42:06+00:00

remove the use of replaced by chaining and move to profile invalidation
and lookup to handle task replacement.

Replacement chaining can result in large chains of profiles being pinned
in memory when one profile in the chain is use. With implicit labeling
this will be even more of a problem, so move to a direct lookup method.

Signed-off-by: John Johansen

apparmor: convert profile lists to RCU based locking

2013-08-14T18:42:06+00:00

Signed-off-by: John Johansen

apparmor: localize getting the security context to a few macros

2013-04-28T07:39:35+00:00

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: use common fn to clear task_context for domain transitions

2013-04-28T07:36:20+00:00

Signed-off-by: John Johansen 
Acked-by: Steve Beattie

apparmor: add utility function to get an arbitrary tasks profile.

2013-04-28T07:35:53+00:00

Signed-off-by: John Johansen 
Acked-by: Steve Beattie