linux-toradex.git/security/apparmor, branch v3.11-rc5

apparmor: no need to delay vfree()

2013-05-12T11:31:02+00:00

vfree() can be called from interrupt contexts now

Signed-off-by: Al Viro 
Acked-by: John Johansen 
Signed-off-by: James Morris

apparmor: fix fully qualified name parsing

2013-04-28T07:39:37+00:00

currently apparmor name parsing is only correctly handling
::

but
:://

is also a valid form and what is exported to userspace.

Signed-off-by: John Johansen

apparmor: fix setprocattr arg processing for onexec

2013-04-28T07:39:36+00:00

the exec file isn't processing its command arg. It should only set be
responding to a command of exec.

Also cleanup setprocattr some more while we are at it.

Signed-off-by: John Johansen

apparmor: localize getting the security context to a few macros

2013-04-28T07:39:35+00:00

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: fix sparse warnings

2013-04-28T07:39:35+00:00

Fix a couple of warning reported by sparse

Signed-off-by: John Johansen

apparmor: Fix smatch warning in aa_remove_profiles

2013-04-28T07:39:34+00:00

smatch reports
  error: potential NULL dereference 'ns'.

this can not actually occur because it relies on aa_split_fqname setting
both ns_name and name as null but ns_name will actually always have a
value in this case.

so remove the unnecessary if (ns_name) conditional that is resulting
in the false positive further down.

Signed-off-by: John Johansen

apparmor: fix the audit type table

2013-04-28T07:37:41+00:00

The audit type table is missing a comma so that KILLED comes out as
KILLEDAUTO.

Signed-off-by: John Johansen 
Acked-by: Steve Beattie

apparmor: reserve and mask off the top 8 bits of the base field

2013-04-28T07:37:32+00:00

The top 8 bits of the base field have never been used, in fact can't
be used, by the current 'dfa16' format.  However they will be used in the
future as flags, so mask them off when using base as an index value.

Note: the use of the top 8 bits, without masking is trapped by the verify
      checks that base entries are within the size bounds.

Signed-off-by: John Johansen 
Acked-by: Kees Cook

apparmor: move the free_profile fn ahead of aa_alloc_profile

2013-04-28T07:37:24+00:00

Move the free_profile fn ahead of aa_alloc_profile so it can be used
in aa_alloc_profile without a forward declaration.

Signed-off-by: John Johansen 
Acked-by: Kees Cook

apparmor: remove sid from profiles

2013-04-28T07:37:13+00:00

The sid is not going to be a direct property of a profile anymore, instead
it will be directly related to the label, and the profile will pickup
a label back reference.

For null-profiles replace the use of sid with a per namespace unique
id.

Signed-off-by: John Johansen 
Acked-by: Kees Cook