linux-toradex.git/security/tomoyo/condition.c, branch v3.13.4

userns: Convert tomoyo to use kuid and kgid where appropriate

2012-09-21T10:13:22+00:00

Acked-by: Tetsuo Handa 
Acked-by: Serge Hallyn 
Signed-off-by: Eric W. Biederman

TOMOYO: Simplify garbage collector.

2011-09-26T00:46:20+00:00

When TOMOYO started using garbage collector at commit 847b173e "TOMOYO: Add
garbage collector.", we waited for close() before kfree(). Thus, elements to be
kfree()d were queued up using tomoyo_gc_list list.

But it turned out that tomoyo_element_linked_by_gc() tends to choke garbage
collector when certain pattern of entries are queued.

Since garbage collector is no longer waiting for close() since commit 2e503bbb
"TOMOYO: Fix lockdep warning.", we can remove tomoyo_gc_list list and
tomoyo_element_linked_by_gc() by doing sequential processing.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow specifying domain transition preference.

2011-09-19T00:09:59+00:00

I got an opinion that it is difficult to use exception policy's domain
transition control directives because they need to match the pathname specified
to "file execute" directives. For example, if "file execute /bin/\*\-ls\-cat"
is given, corresponding domain transition control directive needs to be like
"no_keep_domain /bin/\*\-ls\-cat from any".

If we can specify like below, it will become more convenient.

  file execute /bin/ls keep exec.realpath="/bin/ls" exec.argv[0]="ls"
  file execute /bin/cat keep exec.realpath="/bin/cat" exec.argv[0]="cat"
  file execute /bin/\*\-ls\-cat child
  file execute /usr/sbin/httpd  exec.realpath="/usr/sbin/httpd" exec.argv[0]="/usr/sbin/httpd"

In above examples, "keep" works as if keep_domain is specified, "child" works
as if "no_reset_domain" and "no_initialize_domain" and "no_keep_domain" are
specified, "" causes domain transition to  domain upon
successful execve() operation.

Moreover, we can also allow transition to different domains based on conditions
like below example.

   /usr/sbin/sshd
  file execute /bin/bash  /usr/sbin/sshd //batch-session exec.argc=2 exec.argv[1]="-c"
  file execute /bin/bash  /usr/sbin/sshd //root-session task.uid=0
  file execute /bin/bash  /usr/sbin/sshd //nonroot-session task.uid!=0

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow controlling generation of access granted logs for per an entry basis.

2011-09-13T22:27:06+00:00

Add per-entry flag which controls generation of grant logs because Xen and KVM
issues ioctl requests so frequently. For example,

  file ioctl /dev/null 0x5401 grant_log=no

will suppress /sys/kernel/security/tomoyo/audit even if preference says
grant_log=yes .

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow using argv[]/envp[] of execve() as conditions.

2011-07-11T01:05:33+00:00

This patch adds support for permission checks using argv[]/envp[] of execve()
request. Hooks are in the last patch of this pathset.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow using executable's realpath and symlink's target as conditions.

2011-07-11T01:05:33+00:00

This patch adds support for permission checks using executable file's realpath
upon execve() and symlink's target upon symlink(). Hooks are in the last patch
of this pathset.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow using owner/group etc. of file objects as conditions.

2011-07-11T01:05:32+00:00

This patch adds support for permission checks using file object's DAC
attributes (e.g. owner/group) when checking file's pathnames. Hooks for passing
file object's pointers are in the last patch of this pathset.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Allow using UID/GID etc. of current thread as conditions.

2011-07-11T01:05:32+00:00

This patch adds support for permission checks using current thread's UID/GID
etc. in addition to pathnames.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris