linux-toradex.git/security/selinux, branch v3.16

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2014-06-12T21:27:40+00:00

Pull networking updates from David Miller:

 1) Seccomp BPF filters can now be JIT'd, from Alexei Starovoitov.

 2) Multiqueue support in xen-netback and xen-netfront, from Andrew J
    Benniston.

 3) Allow tweaking of aggregation settings in cdc_ncm driver, from Bjørn
    Mork.

 4) BPF now has a "random" opcode, from Chema Gonzalez.

 5) Add more BPF documentation and improve test framework, from Daniel
    Borkmann.

 6) Support TCP fastopen over ipv6, from Daniel Lee.

 7) Add software TSO helper functions and use them to support software
    TSO in mvneta and mv643xx_eth drivers.  From Ezequiel Garcia.

 8) Support software TSO in fec driver too, from Nimrod Andy.

 9) Add Broadcom SYSTEMPORT driver, from Florian Fainelli.

10) Handle broadcasts more gracefully over macvlan when there are large
    numbers of interfaces configured, from Herbert Xu.

11) Allow more control over fwmark used for non-socket based responses,
    from Lorenzo Colitti.

12) Do TCP congestion window limiting based upon measurements, from Neal
    Cardwell.

13) Support busy polling in SCTP, from Neal Horman.

14) Allow RSS key to be configured via ethtool, from Venkata Duvvuru.

15) Bridge promisc mode handling improvements from Vlad Yasevich.

16) Don't use inetpeer entries to implement ID generation any more, it
    performs poorly, from Eric Dumazet.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1522 commits)
  rtnetlink: fix userspace API breakage for iproute2 < v3.9.0
  tcp: fixing TLP's FIN recovery
  net: fec: Add software TSO support
  net: fec: Add Scatter/gather support
  net: fec: Increase buffer descriptor entry number
  net: fec: Factorize feature setting
  net: fec: Enable IP header hardware checksum
  net: fec: Factorize the .xmit transmit function
  bridge: fix compile error when compiling without IPv6 support
  bridge: fix smatch warning / potential null pointer dereference
  via-rhine: fix full-duplex with autoneg disable
  bnx2x: Enlarge the dorq threshold for VFs
  bnx2x: Check for UNDI in uncommon branch
  bnx2x: Fix 1G-baseT link
  bnx2x: Fix link for KR with swapped polarity lane
  sctp: Fix sk_ack_backlog wrap-around problem
  net/core: Add VF link state control policy
  net/fsl: xgmac_mdio is dependent on OF_MDIO
  net/fsl: Make xgmac_mdio read error message useful
  net_sched: drr: warn when qdisc is not work conserving
  ...

Merge branch 'serge-next-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux-security

2014-06-10T17:05:36+00:00

Pull security layer updates from Serge Hallyn:
 "This is a merge of James Morris' security-next tree from 3.14 to
  yesterday's master, plus four patches from Paul Moore which are in
  linux-next, plus one patch from Mimi"

* 'serge-next-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux-security:
  ima: audit log files opened with O_DIRECT flag
  selinux: conditionally reschedule in hashtab_insert while loading selinux policy
  selinux: conditionally reschedule in mls_convert_context while loading selinux policy
  selinux: reject setexeccon() on MNT_NOSUID applications with -EACCES
  selinux:  Report permissive mode in avc: denied messages.
  Warning in scanf string typing
  Smack: Label cgroup files for systemd
  Smack: Verify read access on file open - v3
  security: Convert use of typedef ctl_table to struct ctl_table
  Smack: bidirectional UDS connect check
  Smack: Correctly remove SMACK64TRANSMUTE attribute
  SMACK: Fix handling value==NULL in post setxattr
  bugfix patch for SMACK
  Smack: adds smackfs/ptrace interface
  Smack: unify all ptrace accesses in the smack
  Smack: fix the subject/object order in smack_ptrace_traceme()
  Minor improvement of 'smack_sb_kern_mount'
  smack: fix key permission verification
  KEYS: Move the flags representing required permission to linux/key.h

selinux: conditionally reschedule in hashtab_insert while loading selinux policy

2014-06-03T19:21:50+00:00

After silencing the sleeping warning in mls_convert_context() I started
seeing similar traces from hashtab_insert. Do a cond_resched there too.

Signed-off-by: Dave Jones 
Acked-by: Stephen Smalley 
Signed-off-by: Paul Moore

selinux: conditionally reschedule in mls_convert_context while loading selinux policy

2014-06-03T19:21:49+00:00

On a slow machine (with debugging enabled), upgrading selinux policy may take
a considerable amount of time. Long enough that the softlockup detector
gets triggered.

The backtrace looks like this..

 > BUG: soft lockup - CPU#2 stuck for 23s! [load_policy:19045]
 > Call Trace:
 >  [] symcmp+0xf/0x20
 >  [] hashtab_search+0x47/0x80
 >  [] mls_convert_context+0xdc/0x1c0
 >  [] convert_context+0x378/0x460
 >  [] ? security_context_to_sid_core+0x240/0x240
 >  [] sidtab_map+0x45/0x80
 >  [] security_load_policy+0x3ff/0x580
 >  [] ? sched_clock_cpu+0xa8/0x100
 >  [] ? sched_clock_local+0x1d/0x80
 >  [] ? sched_clock_cpu+0xa8/0x100
 >  [] ? __change_page_attr_set_clr+0x82a/0xa50
 >  [] ? sched_clock_local+0x1d/0x80
 >  [] ? sched_clock_cpu+0xa8/0x100
 >  [] ? __change_page_attr_set_clr+0x82a/0xa50
 >  [] ? sched_clock_cpu+0xa8/0x100
 >  [] ? retint_restore_args+0xe/0xe
 >  [] ? trace_hardirqs_on_caller+0xfd/0x1c0
 >  [] ? trace_hardirqs_on_thunk+0x3a/0x3f
 >  [] ? rcu_irq_exit+0x68/0xb0
 >  [] ? retint_restore_args+0xe/0xe
 >  [] sel_write_load+0xa7/0x770
 >  [] ? vfs_write+0x1c3/0x200
 >  [] ? security_file_permission+0x1e/0xa0
 >  [] vfs_write+0xbb/0x200
 >  [] ? fget_light+0x397/0x4b0
 >  [] SyS_write+0x47/0xa0
 >  [] tracesys+0xdd/0xe2

Stephen Smalley suggested:

 > Maybe put a cond_resched() within the ebitmap_for_each_positive_bit()
 > loop in mls_convert_context()?

That seems to do the trick. Tested by downgrading and re-upgrading selinux-policy-targeted.

Signed-off-by: Dave Jones 
Acked-by: Stephen Smalley 
Signed-off-by: Paul Moore

selinux: reject setexeccon() on MNT_NOSUID applications with -EACCES

2014-06-03T19:21:48+00:00

We presently prevent processes from using setexecon() to set the
security label of exec()'d processes when NO_NEW_PRIVS is enabled by
returning an error; however, we silently ignore setexeccon() when
exec()'ing from a nosuid mounted filesystem.  This patch makes things
a bit more consistent by returning an error in the setexeccon()/nosuid
case.

Signed-off-by: Paul Moore 
Acked-by: Andy Lutomirski 
Acked-by: Stephen Smalley

selinux: Report permissive mode in avc: denied messages.

2014-06-03T19:21:48+00:00

We cannot presently tell from an avc: denied message whether access was in
fact denied or was allowed due to global or per-domain permissive mode.
Add a permissive= field to the avc message to reflect this information.

Signed-off-by: Stephen Smalley 
Acked-by: Eric Paris 
Signed-off-by: Paul Moore

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2014-05-12T17:19:14+00:00

Conflicts:
	drivers/net/ethernet/altera/altera_sgdma.c
	net/netlink/af_netlink.c
	net/sched/cls_api.c
	net/sched/sch_api.c

The netlink conflict dealt with moving to netlink_capable() and
netlink_ns_capable() in the 'net' tree vs. supporting 'tc' operations
in non-init namespaces.  These were simple transformations from
netlink_capable to netlink_ns_capable.

The Altera driver conflict was simply code removal overlapping some
void pointer cast cleanups in net-next.

Signed-off-by: David S. Miller

audit: add netlink audit protocol bind to check capabilities on multicast join

2014-04-23T01:42:27+00:00

Register a netlink per-protocol bind fuction for audit to check userspace
process capabilities before allowing a multicast group connection.

Signed-off-by: Richard Guy Briggs 
Signed-off-by: David S. Miller

locks: rename file-private locks to "open file description locks"

2014-04-22T12:23:58+00:00

File-private locks have been merged into Linux for v3.15, and *now*
people are commenting that the name and macro definitions for the new
file-private locks suck.

...and I can't even disagree. The names and command macros do suck.

We're going to have to live with these for a long time, so it's
important that we be happy with the names before we're stuck with them.
The consensus on the lists so far is that they should be rechristened as
"open file description locks".

The name isn't a big deal for the kernel, but the command macros are not
visually distinct enough from the traditional POSIX lock macros. The
glibc and documentation folks are recommending that we change them to
look like F_OFD_{GETLK|SETLK|SETLKW}. That lessens the chance that a
programmer will typo one of the commands wrong, and also makes it easier
to spot this difference when reading code.

This patch makes the following changes that I think are necessary before
v3.15 ships:

1) rename the command macros to their new names. These end up in the uapi
   headers and so are part of the external-facing API. It turns out that
   glibc doesn't actually use the fcntl.h uapi header, but it's hard to
   be sure that something else won't. Changing it now is safest.

2) make the the /proc/locks output display these as type "OFDLCK"

Cc: Michael Kerrisk 
Cc: Christoph Hellwig 
Cc: Carlos O'Donell 
Cc: Stefan Metzmacher 
Cc: Andy Lutomirski 
Cc: Frank Filz 
Cc: Theodore Ts'o 
Signed-off-by: Jeff Layton

Merge tag 'keys-20140314' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into next

2014-04-14T01:42:49+00:00