linux-toradex.git/security/commoncap.c, branch v2.6.35-rc5

security: whitespace coding style fixes

2010-04-23T00:10:23+00:00

Whitespace coding style fixes.

Signed-off-by: Justin P. Mattock 
Signed-off-by: James Morris

Security: Fix the comment of cap_file_mmap()

2010-04-19T22:47:11+00:00

In the comment of cap_file_mmap(), replace mmap_min_addr to be dac_mmap_min_addr.

Signed-off-by: Zhitong Wang 
Acked-by: Eric Paris 
Signed-off-by: James Morris

syslog: clean up needless comment

2010-02-05T06:48:51+00:00

Drop my typoed comment as it is both unhelpful and redundant.

Signed-off-by: Kees Cook 
Acked-by: Serge Hallyn 
Signed-off-by: James Morris

syslog: use defined constants instead of raw numbers

2010-02-04T03:20:41+00:00

Right now the syslog "type" action are just raw numbers which makes
the source difficult to follow.  This patch replaces the raw numbers
with defined constants for some level of sanity.

Signed-off-by: Kees Cook 
Acked-by: John Johansen 
Acked-by: Serge Hallyn 
Signed-off-by: James Morris

syslog: distinguish between /proc/kmsg and syscalls

2010-02-04T03:20:12+00:00

This allows the LSM to distinguish between syslog functions originating
from /proc/kmsg access and direct syscalls.  By default, the commoncaps
will now no longer require CAP_SYS_ADMIN to read an opened /proc/kmsg
file descriptor.  For example the kernel syslog reader can now drop
privileges after opening /proc/kmsg, instead of staying privileged with
CAP_SYS_ADMIN.  MAC systems that implement security_syslog have unchanged
behavior.

Signed-off-by: Kees Cook 
Acked-by: Serge Hallyn 
Acked-by: John Johansen 
Signed-off-by: James Morris

remove CONFIG_SECURITY_FILE_CAPABILITIES compile option

2009-11-24T04:06:47+00:00

As far as I know, all distros currently ship kernels with default
CONFIG_SECURITY_FILE_CAPABILITIES=y.  Since having the option on
leaves a 'no_file_caps' option to boot without file capabilities,
the main reason to keep the option is that turning it off saves
you (on my s390x partition) 5k.  In particular, vmlinux sizes
came to:

without patch fscaps=n:		 	53598392
without patch fscaps=y:		 	53603406
with this patch applied:		53603342

with the security-next tree.

Against this we must weigh the fact that there is no simple way for
userspace to figure out whether file capabilities are supported,
while things like per-process securebits, capability bounding
sets, and adding bits to pI if CAP_SETPCAP is in pE are not supported
with SECURITY_FILE_CAPABILITIES=n, leaving a bit of a problem for
applications wanting to know whether they can use them and/or why
something failed.

It also adds another subtly different set of semantics which we must
maintain at the risk of severe security regressions.

So this patch removes the SECURITY_FILE_CAPABILITIES compile
option.  It drops the kernel size by about 50k over the stock
SECURITY_FILE_CAPABILITIES=y kernel, by removing the
cap_limit_ptraced_target() function.

Changelog:
	Nov 20: remove cap_limit_ptraced_target() as it's logic
		was ifndef'ed.

Signed-off-by: Serge E. Hallyn 
Acked-by: Andrew G. Morgan" 
Signed-off-by: James Morris

security: remove root_plug

2009-10-20T05:26:16+00:00

    Remove the root_plug example LSM code.  It's unmaintained and
    increasingly broken in various ways.

    Made at the 2009 Kernel Summit in Tokyo!

    Acked-by: Greg Kroah-Hartman 
    Signed-off-by: James Morris

Security/SELinux: seperate lsm specific mmap_min_addr

2009-08-05T23:02:23+00:00

Currently SELinux enforcement of controls on the ability to map low memory
is determined by the mmap_min_addr tunable.  This patch causes SELinux to
ignore the tunable and instead use a seperate Kconfig option specific to how
much space the LSM should protect.

The tunable will now only control the need for CAP_SYS_RAWIO and SELinux
permissions will always protect the amount of low memory designated by
CONFIG_LSM_MMAP_MIN_ADDR.

This allows users who need to disable the mmap_min_addr controls (usual reason
being they run WINE as a non-root user) to do so and still have SELinux
controls preventing confined domains (like a web server) from being able to
map some area of low memory.

Signed-off-by: Eric Paris 
Signed-off-by: James Morris

Capabilities: move cap_file_mmap to commoncap.c

2009-08-05T23:02:17+00:00

Currently we duplicate the mmap_min_addr test in cap_file_mmap and in
security_file_mmap if !CONFIG_SECURITY.  This patch moves cap_file_mmap
into commoncap.c and then calls that function directly from
security_file_mmap ifndef CONFIG_SECURITY like all of the other capability
checks are done.

Signed-off-by: Eric Paris 
Acked-by: Serge Hallyn 
Signed-off-by: James Morris

security: rename ptrace_may_access => ptrace_access_check

2009-06-24T14:18:05+00:00

The ->ptrace_may_access() methods are named confusingly - the real
ptrace_may_access() returns a bool, while these security checks have
a retval convention.

Rename it to ptrace_access_check, to reduce the confusion factor.

[ Impact: cleanup, no code changed ]

Signed-off-by: Ingo Molnar 
Signed-off-by: James Morris