linux-toradex.git/security/tomoyo/audit.c, branch v3.2.49

TOMOYO: Allow controlling generation of access granted logs for per an entry basis.

2011-09-13T22:27:06+00:00

Add per-entry flag which controls generation of grant logs because Xen and KVM
issues ioctl requests so frequently. For example,

  file ioctl /dev/null 0x5401 grant_log=no

will suppress /sys/kernel/security/tomoyo/audit even if preference says
grant_log=yes .

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Update kernel-doc.

2011-07-14T07:50:03+00:00

Update comments for scripts/kernel-doc and fix some of errors reported by
scripts/checkpatch.pl .

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow using argv[]/envp[] of execve() as conditions.

2011-07-11T01:05:33+00:00

This patch adds support for permission checks using argv[]/envp[] of execve()
request. Hooks are in the last patch of this pathset.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow using executable's realpath and symlink's target as conditions.

2011-07-11T01:05:33+00:00

This patch adds support for permission checks using executable file's realpath
upon execve() and symlink's target upon symlink(). Hooks are in the last patch
of this pathset.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow using owner/group etc. of file objects as conditions.

2011-07-11T01:05:32+00:00

This patch adds support for permission checks using file object's DAC
attributes (e.g. owner/group) when checking file's pathnames. Hooks for passing
file object's pointers are in the last patch of this pathset.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow using UID/GID etc. of current thread as conditions.

2011-07-11T01:05:32+00:00

This patch adds support for permission checks using current thread's UID/GID
etc. in addition to pathnames.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Fix wrong domainname in tomoyo_init_log().

2011-06-30T23:25:47+00:00

Commit eadd99cc "TOMOYO: Add auditing interface." by error replaced
"struct tomoyo_request_info"->domain with tomoyo_domain().

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Rename meminfo to stat and show more statistics.

2011-06-28T23:31:22+00:00

Show statistics such as last policy update time and last policy violation time
in addition to memory usage.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Cleanup part 4.

2011-06-28T23:31:21+00:00

Gather string constants to one file in order to make the object size smaller.
Use unsigned type where appropriate.
read()/write() returns ssize_t.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Add policy namespace support.

2011-06-28T23:31:21+00:00

Mauras Olivier reported that it is difficult to use TOMOYO in LXC environments,
for TOMOYO cannot distinguish between environments outside the container and
environments inside the container since LXC environments are created using
pivot_root(). To address this problem, this patch introduces policy namespace.

Each policy namespace has its own set of domain policy, exception policy and
profiles, which are all independent of other namespaces. This independency
allows users to develop policy without worrying interference among namespaces.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris