linux-toradex.git/security/selinux, branch v3.0.86

selinux: use GFP_ATOMIC under spin_lock

2013-03-20T19:58:52+00:00

commit 4502403dcf8f5c76abd4dbab8726c8e4ecb5cd34 upstream.

The call tree here is:

sk_clone_lock()              <- takes bh_lock_sock(newsk);
xfrm_sk_clone_policy()
__xfrm_sk_clone_policy()
clone_policy()               <- uses GFP_ATOMIC for allocations
security_xfrm_policy_clone()
security_ops->xfrm_policy_clone_security()
selinux_xfrm_policy_clone()

Signed-off-by: Dan Carpenter 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

selinux: fix sel_netnode_insert() suspicious rcu dereference

2012-11-26T19:34:56+00:00

commit 88a693b5c1287be4da937699cb82068ce9db0135 upstream.

===============================
[ INFO: suspicious RCU usage. ]
3.5.0-rc1+ #63 Not tainted
-------------------------------
security/selinux/netnode.c:178 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 0
1 lock held by trinity-child1/8750:
 #0:  (sel_netnode_lock){+.....}, at: [] sel_netnode_sid+0x16a/0x3e0

stack backtrace:
Pid: 8750, comm: trinity-child1 Not tainted 3.5.0-rc1+ #63
Call Trace:
 [] lockdep_rcu_suspicious+0xfd/0x130
 [] sel_netnode_sid+0x3b1/0x3e0
 [] ? sel_netnode_find+0x1a0/0x1a0
 [] selinux_socket_bind+0xf6/0x2c0
 [] ? trace_hardirqs_off+0xd/0x10
 [] ? lock_release_holdtime.part.9+0x15/0x1a0
 [] ? lock_hrtimer_base+0x31/0x60
 [] security_socket_bind+0x16/0x20
 [] sys_bind+0x7a/0x100
 [] ? sysret_check+0x22/0x5d
 [] ? trace_hardirqs_on_caller+0x10d/0x1a0
 [] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [] system_call_fastpath+0x16/0x1b

This patch below does what Paul McKenney suggested in the previous thread.

Signed-off-by: Dave Jones 
Reviewed-by: Paul E. McKenney 
Acked-by: Paul Moore 
Cc: Eric Paris 
Signed-off-by: Andrew Morton 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

SELinux: if sel_make_bools errors don't leave inconsistent state

2012-06-01T07:12:54+00:00

commit 154c50ca4eb9ae472f50b6a481213e21ead4457d upstream.

We reset the bool names and values array to NULL, but do not reset the
number of entries in these arrays to 0.  If we error out and then get back
into this function we will walk these NULL pointers based on the belief
that they are non-zero length.

Signed-off-by: Eric Paris 
Signed-off-by: Greg Kroah-Hartman

SELinux: Fix RCU deref check warning in sel_netport_insert()

2012-01-06T22:13:52+00:00

commit 50345f1ea9cda4618d9c26e590a97ecd4bc7ac75 upstream.

Fix the following bug in sel_netport_insert() where rcu_dereference() should
be rcu_dereference_protected() as sel_netport_lock is held.

===================================================
[ INFO: suspicious rcu_dereference_check() usage. ]
---------------------------------------------------
security/selinux/netport.c:127 invoked rcu_dereference_check() without protection!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 0
1 lock held by ossec-rootcheck/3323:
 #0:  (sel_netport_lock){+.....}, at: [] sel_netport_sid+0xbb/0x226

stack backtrace:
Pid: 3323, comm: ossec-rootcheck Not tainted 3.1.0-rc8-fsdevel+ #1095
Call Trace:
 [] lockdep_rcu_dereference+0xa7/0xb0
 [] sel_netport_sid+0x1b7/0x226
 [] ? sel_netport_avc_callback+0xbc/0xbc
 [] selinux_socket_bind+0x115/0x230
 [] ? might_fault+0x4e/0x9e
 [] ? might_fault+0x97/0x9e
 [] security_socket_bind+0x11/0x13
 [] sys_bind+0x56/0x95
 [] ? sysret_check+0x27/0x62
 [] ? trace_hardirqs_on_caller+0x11e/0x155
 [] ? audit_syscall_entry+0x17b/0x1ae
 [] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [] system_call_fastpath+0x16/0x1b

Signed-off-by: David Howells 
Acked-by: Paul Moore 
Acked-by: Eric Dumazet 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'for-linus' of git://git.infradead.org/users/eparis/selinux into for-linus

2011-06-14T23:41:48+00:00

SELinux: skip file_name_trans_write() when policy downgraded.

2011-06-14T16:58:51+00:00

When policy version is less than POLICYDB_VERSION_FILENAME_TRANS,
skip file_name_trans_write().

Signed-off-by: Roy.Li 
Signed-off-by: Eric Paris

selinux: simplify and clean up inode_has_perm()

2011-06-08T22:11:56+00:00

This is a rather hot function that is called with a potentially NULL
"struct common_audit_data" pointer argument.  And in that case it has to
provide and initialize its own dummy common_audit_data structure.

However, all the _common_ cases already pass it a real audit-data
structure, so that uncommon NULL case not only creates a silly run-time
test, more importantly it causes that function to have a big stack frame
for the dummy variable that isn't even used in the common case!

So get rid of that stupid run-time behavior, and make the (few)
functions that currently call with a NULL pointer just call a new helper
function instead (naturally called inode_has_perm_noapd(), since it has
no adp argument).

This makes the run-time test be a static code generation issue instead,
and allows for a much denser stack since none of the common callers need
the dummy structure.  And a denser stack not only means less stack space
usage, it means better cache behavior.  So we have a win-win-win from
this simplification: less code executed, smaller stack footprint, and
better cache behavior.

Signed-off-by: Linus Torvalds

selinux: don't pass in NULL avd to avc_has_perm_noaudit

2011-05-27T01:13:57+00:00

Right now security_get_user_sids() will pass in a NULL avd pointer to
avc_has_perm_noaudit(), which then forces that function to have a dummy
entry for that case and just generally test it.

Don't do it.  The normal callers all pass a real avd pointer, and this
helper function is incredibly hot.  So don't make avc_has_perm_noaudit()
do conditional stuff that isn't needed for the common case.

This also avoids some duplicated stack space.

Signed-off-by: Linus Torvalds

selinux: fix case of names with whitespace/multibytes on /selinux/create

2011-05-26T21:20:53+00:00

I submit the patch again, according to patch submission convension.

This patch enables to accept percent-encoded object names as forth
argument of /selinux/create interface to avoid possible bugs when we
give an object name including whitespace or multibutes.

E.g) if and when a userspace object manager tries to create a new object
 named as "resolve.conf but fake", it shall give this name as the forth
 argument of the /selinux/create. But sscanf() logic in kernel space
 fetches only the part earlier than the first whitespace.
 In this case, selinux may unexpectedly answer a default security context
 configured to "resolve.conf", but it is bug.

Although I could not test this patch on named TYPE_TRANSITION rules
actually, But debug printk() message seems to me the logic works
correctly.
I assume the libselinux provides an interface to apply this logic
transparently, so nothing shall not be changed from the viewpoint of
application.

Signed-off-by: KaiGai Kohei 
Signed-off-by: Eric Paris

Merge commit 'v2.6.39' into 20110526

2011-05-26T21:20:14+00:00

Conflicts:
	lib/flex_array.c
	security/selinux/avc.c
	security/selinux/hooks.c
	security/selinux/ss/policydb.c
	security/smack/smack_lsm.c