linux-toradex.git/security, branch v2.6.16.45

Keys: Fix key serial number collision handling (CVE-2007-0006)

2007-02-21T00:20:05+00:00

Fix the key serial number collision avoidance code in key_alloc_serial().

This didn't use to be so much of a problem as the key serial numbers were
allocated from a simple incremental counter, and it would have to go through
two billion keys before it could possibly encounter a collision.  However, n
that random numbers are used instead, collisions are much more likely.

This is fixed by finding a hole in the rbtree where the next unused serial
number ought to be and using that by going almost back to the top of the
insertion routine and redoing the insertion with the new serial number rathe
than trying to be clever and attempting to work out the insertion point
pointer directly.

This fixes kernel Bugzilla #7727.

Signed-off-by: David Howells 
Signed-off-by: Adrian Bunk

security/seclvl.c: fix time wrap (CVE-2005-4352)

2006-11-17T16:42:43+00:00

initlvl=2 in seclvl gives the guarantee
"Cannot decrement the system time".

But it was possible to set the time to the maximum unixtime value
(19 Jan 2038) resulting in a wrap to the minimum value.

This patch fixes this by disallowing setting the time to any date
after 2030 with initlvl=2.

Signed-off-by: Adrian Bunk

[PATCH] selinux: check for failed kmalloc in security_sid_to_context()

2006-05-20T22:00:31+00:00

Check for NULL kmalloc return value before writing to it.

Signed-off-by: Serge E. Hallyn 
Acked-by: James Morris 
Cc: Stephen Smalley 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] selinux: Fix MLS compatibility off-by-one bug

2006-04-24T16:56:04+00:00

Fix an off-by-one error in the MLS compatibility code that was causing
contexts with a MLS suffix to be rejected, preventing sharing partitions
between FC4 and FC5.  Bug reported in
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188068

Signed-off-by: Stephen Smalley 
Acked-by: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Keys: Fix oops when adding key to non-keyring [CVE-2006-1522]

2006-04-11T04:48:21+00:00

This fixes the problem of an oops occuring when a user attempts to add a
key to a non-keyring key [CVE-2006-1522].

The problem is that __keyring_search_one() doesn't check that the
keyring it's been given is actually a keyring.

I've fixed this problem by:

 (1) declaring that caller of __keyring_search_one() must guarantee that
     the keyring is a keyring; and

 (2) making key_create_or_update() check that the keyring is a keyring,
     and return -ENOTDIR if it isn't.

This can be tested by:

	keyctl add user b b `keyctl add user a a @s`

Signed-off-by: David Howells 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

[PATCH] selinux: tracer SID fix

2006-03-11T17:19:34+00:00

Fix SELinux to not reset the tracer SID when the child is already being
traced, since selinux_ptrace is also called by proc for access checking
outside of the context of a ptrace attach.

Signed-off-by:  Stephen Smalley 
Acked-by: James Morris 
Acked-by: Chris Wright 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] selinux: require AUDIT

2006-02-08T00:12:33+00:00

Make SELinux depend on AUDIT as it requires the basic audit support to log
permission denials at all.  Note that AUDITSYSCALL remains optional for
SELinux, although it can be useful in providing further information upon
denials.

Signed-off-by: Stephen Smalley 
Acked-by: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] selinux: require SECURITY_NETWORK

2006-02-05T19:06:52+00:00

Make SELinux depend on SECURITY_NETWORK (which depends on SECURITY), as it
requires the socket hooks for proper operation even in the local case.

Signed-off-by: Stephen Smalley 
Acked-by: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] Fix keyctl usage of strnlen_user()

2006-02-03T16:32:10+00:00

In the small window between strnlen_user() and copy_from_user() userspace
could alter the terminating `\0' character.

Signed-off-by: Davi Arnaut 
Cc: David Howells 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] selinux: remove security struct magic number fields and tests

2006-02-01T16:53:19+00:00

Remove the SELinux security structure magic number fields and tests, along
with some unnecessary tests for NULL security pointers.  These fields and
tests are leftovers from the early attempts to support SELinux as a
loadable module during LSM development.

Signed-off-by: Stephen Smalley 
Acked-by: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds