linux-toradex.git/security/tomoyo/common.h, branch v3.3.2

Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security

2012-01-11T05:51:23+00:00

* 'for-linus' of git://selinuxproject.org/~jmorris/linux-security: (32 commits)
  ima: fix invalid memory reference
  ima: free duplicate measurement memory
  security: update security_file_mmap() docs
  selinux: Casting (void *) value returned by kmalloc is useless
  apparmor: fix module parameter handling
  Security: tomoyo: add .gitignore file
  tomoyo: add missing rcu_dereference()
  apparmor: add missing rcu_dereference()
  evm: prevent racing during tfm allocation
  evm: key must be set once during initialization
  mpi/mpi-mpow: NULL dereference on allocation failure
  digsig: build dependency fix
  KEYS: Give key types their own lockdep class for key->sem
  TPM: fix transmit_cmd error logic
  TPM: NSC and TIS drivers X86 dependency fix
  TPM: Export wait_for_stat for other vendor specific drivers
  TPM: Use vendor specific function for status probe
  tpm_tis: add delay after aborting command
  tpm_tis: Check return code from getting timeouts/durations
  tpm: Introduce function to poll for result of self test
  ...

Fix up trivial conflict in lib/Makefile due to addition of CONFIG_MPI
and SIGSIG next to CONFIG_DQL addition.

tomoyo_mini_stat: switch to umode_t

2012-01-04T03:55:18+00:00

Signed-off-by: Al Viro

tomoyo: add missing rcu_dereference()

2011-12-12T06:21:40+00:00

Adds a missed rcu_dereference() around real_parent.

Signed-off-by: Kees Cook 
Acked-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Remove tomoyo_policy_memory_lock spinlock.

2011-09-26T00:46:22+00:00

tomoyo_policy_lock mutex already protects it.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Simplify garbage collector.

2011-09-26T00:46:20+00:00

When TOMOYO started using garbage collector at commit 847b173e "TOMOYO: Add
garbage collector.", we waited for close() before kfree(). Thus, elements to be
kfree()d were queued up using tomoyo_gc_list list.

But it turned out that tomoyo_element_linked_by_gc() tends to choke garbage
collector when certain pattern of entries are queued.

Since garbage collector is no longer waiting for close() since commit 2e503bbb
"TOMOYO: Fix lockdep warning.", we can remove tomoyo_gc_list list and
tomoyo_element_linked_by_gc() by doing sequential processing.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Fix make namespacecheck warnings.

2011-09-26T00:46:19+00:00

Commit efe836ab "TOMOYO: Add built-in policy support." introduced
tomoyo_load_builtin_policy() but was by error called from nowhere.

Commit b22b8b9f "TOMOYO: Rename meminfo to stat and show more statistics."
introduced tomoyo_update_stat() but was by error not called from
tomoyo_assign_domain().

Also, mark tomoyo_io_printf() and tomoyo_path_permission() static functions,
as reported by "make namespacecheck".

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow specifying domain transition preference.

2011-09-19T00:09:59+00:00

I got an opinion that it is difficult to use exception policy's domain
transition control directives because they need to match the pathname specified
to "file execute" directives. For example, if "file execute /bin/\*\-ls\-cat"
is given, corresponding domain transition control directive needs to be like
"no_keep_domain /bin/\*\-ls\-cat from any".

If we can specify like below, it will become more convenient.

  file execute /bin/ls keep exec.realpath="/bin/ls" exec.argv[0]="ls"
  file execute /bin/cat keep exec.realpath="/bin/cat" exec.argv[0]="cat"
  file execute /bin/\*\-ls\-cat child
  file execute /usr/sbin/httpd  exec.realpath="/usr/sbin/httpd" exec.argv[0]="/usr/sbin/httpd"

In above examples, "keep" works as if keep_domain is specified, "child" works
as if "no_reset_domain" and "no_initialize_domain" and "no_keep_domain" are
specified, "" causes domain transition to  domain upon
successful execve() operation.

Moreover, we can also allow transition to different domains based on conditions
like below example.

   /usr/sbin/sshd
  file execute /bin/bash  /usr/sbin/sshd //batch-session exec.argc=2 exec.argv[1]="-c"
  file execute /bin/bash  /usr/sbin/sshd //root-session task.uid=0
  file execute /bin/bash  /usr/sbin/sshd //nonroot-session task.uid!=0

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Bump version.

2011-09-14T22:14:21+00:00

Tell userland tools that this is TOMOYO 2.5.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow domain transition without execve().

2011-09-13T22:27:06+00:00

To be able to split permissions for Apache's CGI programs which are executed
without execve(), add special domain transition which is performed by writing
a TOMOYO's domainname to /sys/kernel/security/tomoyo/self_domain interface.

This is an API for TOMOYO-aware userland applications. However, since I expect
TOMOYO and other LSM modules to run in parallel, this patch does not use
/proc/self/attr/ interface in order to avoid conflicts with other LSM modules
when it became possible to run multiple LSM modules in parallel.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow controlling generation of access granted logs for per an entry basis.

2011-09-13T22:27:06+00:00

Add per-entry flag which controls generation of grant logs because Xen and KVM
issues ioctl requests so frequently. For example,

  file ioctl /dev/null 0x5401 grant_log=no

will suppress /sys/kernel/security/tomoyo/audit even if preference says
grant_log=yes .

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris