linux-toradex.git/security/tomoyo/mount.c, branch v3.0.98

TOMOYO: Fix mount flags checking order.

2012-04-13T15:14:08+00:00

commit df91e49477a9be15921cb2854e1d12a3bdb5e425 upstream.

Userspace can pass in arbitrary combinations of MS_* flags to mount().

If both MS_BIND and one of MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE are
passed, device name which should be checked for MS_BIND was not checked because
MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE had higher priority than MS_BIND.

If both one of MS_BIND/MS_MOVE and MS_REMOUNT are passed, device name which
should not be checked for MS_REMOUNT was checked because MS_BIND/MS_MOVE had
higher priority than MS_REMOUNT.

Fix these bugs by changing priority to MS_REMOUNT -> MS_BIND ->
MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE -> MS_MOVE as with do_mount() does.

Also, unconditionally return -EINVAL if more than one of
MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE is passed so that TOMOYO will not
generate inaccurate audit logs, for commit 7a2e8a8f "VFS: Sanity check mount
flags passed to change_mnt_propagation()" clarified that these flags must be
exclusively passed.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris 
Signed-off-by: Jonathan Nieder 
Signed-off-by: Greg Kroah-Hartman

TOMOYO: Fix oops in tomoyo_mount_acl().

2011-06-14T05:18:42+00:00

In tomoyo_mount_acl() since 2.6.36, kern_path() was called without checking
dev_name != NULL. As a result, an unprivileged user can trigger oops by issuing
mount(NULL, "/", "ext3", 0, NULL) request.
Fix this by checking dev_name != NULL before calling kern_path(dev_name).

Signed-off-by: Tetsuo Handa 
Cc: stable@kernel.org
Signed-off-by: James Morris

TOMOYO: Fix refcount leak in tomoyo_mount_acl().

2011-04-20T00:16:21+00:00

In tomoyo_mount_acl() since 2.6.36, reference to device file (e.g. /dev/sda1)
was leaking.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Use pathname specified by policy rather than execve()

2010-08-02T05:38:38+00:00

Commit c9e69318 "TOMOYO: Allow wildcard for execute permission." changed execute
permission and domainname to accept wildcards. But tomoyo_find_next_domain()
was using pathname passed to execve() rather than pathname specified by the
execute permission. As a result, processes were not able to transit to domains
which contain wildcards in their domainnames.

This patch passes pathname specified by the execute permission back to
tomoyo_find_next_domain() so that processes can transit to domains which
contain wildcards in their domainnames.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Rename symbols.

2010-08-02T05:34:54+00:00

Use shorter name in order to make it easier to fit 80 columns limit.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Loosen parameter check for mount operation.

2010-08-02T05:34:34+00:00

If invalid combination of mount flags are given, it will be rejected later.
Thus, no need for TOMOYO to reject invalid combination of mount flags.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Rename symbols.

2010-08-02T05:34:33+00:00

Use shorter name in order to make it easier to fix 80 columns limit.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Use callback for permission check.

2010-08-02T05:34:32+00:00

We can use callback function since parameters are passed via
"const struct tomoyo_request_info".

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Pass parameters via structure.

2010-08-02T05:34:32+00:00

To make it possible to use callback function, pass parameters via
"struct tomoyo_request_info".

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Use callback for updating entries.

2010-08-02T05:34:28+00:00

Use common "struct list_head" + "bool" + "u8" structure and
use common code for elements using that structure.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris