linux-toradex.git/security/smack, branch v3.3.5

vfs: prefer ->dentry->d_sb to ->mnt->mnt_sb

2012-01-07T04:16:53+00:00

Signed-off-by: Al Viro

Smack: smackfs cipso seq read repair

2011-11-11T19:07:21+00:00

Commit 272cd7a8c67dd40a31ecff76a503bbb84707f757 introduced
a change to the way rule lists are handled and reported in
the smackfs filesystem. One of the issues addressed had to
do with the termination of read requests on /smack/load.
This change introduced a error in /smack/cipso, which shares
some of the same list processing code.

This patch updates all the file access list handling in
smackfs to use the code introduced for /smack/load.

Signed-off-by: Casey Schaufler

Smack: allow to access /smack/access as normal user

2011-10-20T23:07:31+00:00

Allow query access as a normal user removing the need
for CAP_MAC_ADMIN. Give RW access to /smack/access
for UGO. Do not import smack labels in access check.

Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Casey Schaufler

Smack: fix: invalid length set for the result of /smack/access

2011-10-18T16:02:57+00:00

Forgot to update simple_transaction_set() to take terminator
character into account.

Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Casey Schaufler

Smack: compilation fix

2011-10-14T15:56:49+00:00

On some build configurations PER_CLEAR_ON_SETID symbol was not
found when compiling smack_lsm.c. This patch fixes the issue by
explicitly doing #include .

Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Casey Schaufler

Smack: fix for /smack/access output, use string instead of byte

2011-10-12T21:30:07+00:00

Small fix for the output of access SmackFS file. Use string
is instead of byte. Makes it easier to extend API if it is
needed.

Signed-off-by: Jarkko Sakkinen

Smack: domain transition protections (v3)

2011-10-12T21:28:15+00:00

Protections for domain transition:

- BPRM unsafe flags
- Secureexec
- Clear unsafe personality bits.
- Clear parent death signal

Signed-off-by: Jarkko Sakkinen

Smack: Provide information for UDS getsockopt(SO_PEERCRED)

2011-10-12T21:27:05+00:00

This patch is targeted for the smack-next tree.

This patch takes advantage of the recent changes for performance
and points the packet labels on UDS connect at the output label of
the far side. This makes getsockopt(...SO_PEERCRED...) function
properly. Without this change the getsockopt does not provide any
information.

Signed-off-by: Casey Schaufler

Smack: Clean up comments

2011-10-12T21:26:07+00:00

There are a number of comments in the Smack code that
are either malformed or include code. This patch cleans
them up.

Signed-off-by: Casey Schaufler

Smack: Repair processing of fcntl

2011-10-12T21:24:28+00:00

Al Viro pointed out that the processing of fcntl done
by Smack appeared poorly designed. He was right. There
are three things that required change. Most obviously,
the list of commands that really imply writing is limited
to those involving file locking and signal handling.
The initialization if the file security blob was
incomplete, requiring use of a heretofore unused LSM hook.
Finally, the audit information coming from a helper
masked the identity of the LSM hook. This patch corrects
all three of these defects.

This is targeted for the smack-next tree pending comments.

Signed-off-by: Casey Schaufler