linux-toradex.git/security/security.c, branch v3.2-rc5

Merge branch 'next' of git://selinuxproject.org/~jmorris/linux-security

2011-10-25T07:45:31+00:00

* 'next' of git://selinuxproject.org/~jmorris/linux-security: (95 commits)
  TOMOYO: Fix incomplete read after seek.
  Smack: allow to access /smack/access as normal user
  TOMOYO: Fix unused kernel config option.
  Smack: fix: invalid length set for the result of /smack/access
  Smack: compilation fix
  Smack: fix for /smack/access output, use string instead of byte
  Smack: domain transition protections (v3)
  Smack: Provide information for UDS getsockopt(SO_PEERCRED)
  Smack: Clean up comments
  Smack: Repair processing of fcntl
  Smack: Rule list lookup performance
  Smack: check permissions from user space (v2)
  TOMOYO: Fix quota and garbage collector.
  TOMOYO: Remove redundant tasklist_lock.
  TOMOYO: Fix domain transition failure warning.
  TOMOYO: Remove tomoyo_policy_memory_lock spinlock.
  TOMOYO: Simplify garbage collector.
  TOMOYO: Fix make namespacecheck warnings.
  target: check hex2bin result
  encrypted-keys: check hex2bin result
  ...

bluetooth: Properly clone LSM attributes to newly created child connections

2011-10-19T03:36:43+00:00

The Bluetooth stack has internal connection handlers for all of the various
Bluetooth protocols, and unfortunately, they are currently lacking the LSM
hooks found in the core network stack's connection handlers.  I say
unfortunately, because this can cause problems for users who have have an
LSM enabled and are using certain Bluetooth devices.  See one problem
report below:

 * http://bugzilla.redhat.com/show_bug.cgi?id=741703

In order to keep things simple at this point in time, this patch fixes the
problem by cloning the parent socket's LSM attributes to the newly created
child socket.  If we decide we need a more elaborate LSM marking mechanism
for Bluetooth (I somewhat doubt this) we can always revisit this decision
in the future.

Reported-by: James M. Cape 
Signed-off-by: Paul Moore 
Acked-by: James Morris 
Signed-off-by: David S. Miller

evm: fix security/security_old_init_security return code

2011-09-14T19:24:50+00:00

security_inode_init_security previously returned -EOPNOTSUPP, for S_PRIVATE
inodes, and relied on the callers to change it to 0.  As the callers do not
change the return code anymore, return 0, intead of -EOPNOTSUPP.

Signed-off-by: Mimi Zohar

security: sparse fix: Move security_fixup_op to security.h

2011-09-09T23:56:33+00:00

Fix sparse warning by moving declaraion to global header.

Signed-off-by: James Morris

Merge branch 'next-evm' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/ima-2.6 into next

2011-08-09T00:31:03+00:00

Conflicts:
	fs/attr.c

Resolve conflict manually.

Signed-off-by: James Morris

->permission() sanitizing: don't pass flags to exec_permission()

2011-07-20T05:43:29+00:00

pass mask instead; kill security_inode_exec_permission() since we can use
security_inode_permission() instead.

Signed-off-by: Al Viro

->permission() sanitizing: don't pass flags to ->inode_permission()

2011-07-20T05:43:26+00:00

pass that via mask instead.

Signed-off-by: Al Viro

evm: add evm_inode_setattr to prevent updating an invalid security.evm

2011-07-18T16:29:50+00:00

Permit changing of security.evm only when valid, unless in fixmode.

Reported-by: Roberto Sassu 
Signed-off-by: Mimi Zohar

evm: call evm_inode_init_security from security_inode_init_security

2011-07-18T16:29:45+00:00

Changelog v7:
- moved the initialization call to security_inode_init_security,
  renaming evm_inode_post_init_security to evm_inode_init_security
- increase size of xattr array for EVM xattr

Signed-off-by: Mimi Zohar

security: imbed evm calls in security hooks

2011-07-18T16:29:42+00:00

Imbed the evm calls evm_inode_setxattr(), evm_inode_post_setxattr(),
evm_inode_removexattr() in the security hooks.  evm_inode_setxattr()
protects security.evm xattr.  evm_inode_post_setxattr() and
evm_inode_removexattr() updates the hmac associated with an inode.

(Assumes an LSM module protects the setting/removing of xattr.)

Changelog:
  - Don't define evm_verifyxattr(), unless CONFIG_INTEGRITY is enabled.
  - xattr_name is a 'const', value is 'void *'

Signed-off-by: Mimi Zohar 
Acked-by: Serge Hallyn