linux-toradex.git/security/selinux, branch v3.2.51

selinux: use GFP_ATOMIC under spin_lock

2013-03-27T02:41:03+00:00

commit 4502403dcf8f5c76abd4dbab8726c8e4ecb5cd34 upstream.

The call tree here is:

sk_clone_lock()              <- takes bh_lock_sock(newsk);
xfrm_sk_clone_policy()
__xfrm_sk_clone_policy()
clone_policy()               <- uses GFP_ATOMIC for allocations
security_xfrm_policy_clone()
security_ops->xfrm_policy_clone_security()
selinux_xfrm_policy_clone()

Signed-off-by: Dan Carpenter 
Signed-off-by: James Morris 
Signed-off-by: Ben Hutchings

selinux: fix sel_netnode_insert() suspicious rcu dereference

2012-12-06T11:20:32+00:00

commit 88a693b5c1287be4da937699cb82068ce9db0135 upstream.

===============================
[ INFO: suspicious RCU usage. ]
3.5.0-rc1+ #63 Not tainted
-------------------------------
security/selinux/netnode.c:178 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 0
1 lock held by trinity-child1/8750:
 #0:  (sel_netnode_lock){+.....}, at: [] sel_netnode_sid+0x16a/0x3e0

stack backtrace:
Pid: 8750, comm: trinity-child1 Not tainted 3.5.0-rc1+ #63
Call Trace:
 [] lockdep_rcu_suspicious+0xfd/0x130
 [] sel_netnode_sid+0x3b1/0x3e0
 [] ? sel_netnode_find+0x1a0/0x1a0
 [] selinux_socket_bind+0xf6/0x2c0
 [] ? trace_hardirqs_off+0xd/0x10
 [] ? lock_release_holdtime.part.9+0x15/0x1a0
 [] ? lock_hrtimer_base+0x31/0x60
 [] security_socket_bind+0x16/0x20
 [] sys_bind+0x7a/0x100
 [] ? sysret_check+0x22/0x5d
 [] ? trace_hardirqs_on_caller+0x10d/0x1a0
 [] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [] system_call_fastpath+0x16/0x1b

This patch below does what Paul McKenney suggested in the previous thread.

Signed-off-by: Dave Jones 
Reviewed-by: Paul E. McKenney 
Acked-by: Paul Moore 
Cc: Eric Paris 
Signed-off-by: Andrew Morton 
Signed-off-by: James Morris 
Signed-off-by: Ben Hutchings

SELinux: if sel_make_bools errors don't leave inconsistent state

2012-05-30T23:43:21+00:00

commit 154c50ca4eb9ae472f50b6a481213e21ead4457d upstream.

We reset the bool names and values array to NULL, but do not reset the
number of entries in these arrays to 0.  If we error out and then get back
into this function we will walk these NULL pointers based on the belief
that they are non-zero length.

Signed-off-by: Eric Paris 
Signed-off-by: Ben Hutchings

SELinux: Fix RCU deref check warning in sel_netport_insert()

2011-12-21T00:28:56+00:00

Fix the following bug in sel_netport_insert() where rcu_dereference() should
be rcu_dereference_protected() as sel_netport_lock is held.

===================================================
[ INFO: suspicious rcu_dereference_check() usage. ]
---------------------------------------------------
security/selinux/netport.c:127 invoked rcu_dereference_check() without protection!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 0
1 lock held by ossec-rootcheck/3323:
 #0:  (sel_netport_lock){+.....}, at: [] sel_netport_sid+0xbb/0x226

stack backtrace:
Pid: 3323, comm: ossec-rootcheck Not tainted 3.1.0-rc8-fsdevel+ #1095
Call Trace:
 [] lockdep_rcu_dereference+0xa7/0xb0
 [] sel_netport_sid+0x1b7/0x226
 [] ? sel_netport_avc_callback+0xbc/0xbc
 [] selinux_socket_bind+0x115/0x230
 [] ? might_fault+0x4e/0x9e
 [] ? might_fault+0x97/0x9e
 [] security_socket_bind+0x11/0x13
 [] sys_bind+0x56/0x95
 [] ? sysret_check+0x27/0x62
 [] ? trace_hardirqs_on_caller+0x11e/0x155
 [] ? audit_syscall_entry+0x17b/0x1ae
 [] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [] system_call_fastpath+0x16/0x1b

Signed-off-by: David Howells 
Acked-by: Paul Moore 
Acked-by: Eric Dumazet 
Cc: stable@kernel.org
Signed-off-by: James Morris

selinux: Add export.h to files using EXPORT_SYMBOL/THIS_MODULE

2011-10-31T23:31:32+00:00

The pervasive, but implicit presence of  meant
that things like this file would happily compile as-is.  But
with the desire to phase out the module.h being included everywhere,
point this file at export.h which will give it THIS_MODULE and
the EXPORT_SYMBOL variants.

Signed-off-by: Paul Gortmaker

selinux: sparse fix: fix several warnings in the security server code

2011-09-09T23:56:32+00:00

Fix several sparse warnings in the SELinux security server code.

Signed-off-by: James Morris

selinux: sparse fix: include selinux.h in exports.c

2011-09-09T23:56:32+00:00

Fix warning:
security/selinux/exports.c:18:6: warning: symbol 'selinux_is_enabled' was not declared. Should it be static?

Signed-off-by: James Morris

selinux: sparse fix: fix warnings in netlink code

2011-09-09T23:56:31+00:00

Fix sparse warnings in SELinux Netlink code.

Signed-off-by: James Morris

selinux: sparse fix: eliminate warnings for selinuxfs

2011-09-09T23:56:30+00:00

Fixes several sparse warnings for selinuxfs.c

Signed-off-by: James Morris

selinux: sparse fix: declare selinux_disable() in security.h

2011-09-09T23:56:26+00:00

Sparse fix: declare selinux_disable() in security.h

Signed-off-by: James Morris