linux-toradex.git/security, branch v2.6.19-rc1

Still more typo fixes

2006-10-03T20:36:44+00:00

Signed-off-by: Adrian Bunk

more misc typo fixes

2006-10-03T20:34:14+00:00

Signed-off-by: Adrian Bunk

[PATCH] r/o bind mount prepwork: inc_nlink() helper

2006-10-01T07:39:30+00:00

This is mostly included for parity with dec_nlink(), where we will have some
more hooks.  This one should stay pretty darn straightforward for now.

Signed-off-by: Dave Hansen 
Acked-by: Christoph Hellwig 
Cc: Al Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] MLSXFRM: fix mis-labelling of child sockets

2006-09-29T22:58:21+00:00

Accepted connections of types other than AF_INET, AF_INET6, AF_UNIX won't
have an appropriate label derived from the peer, so don't use it.

Signed-off-by: David Woodhouse 
Acked-by: Stephen Smalley 
Acked-by: James Morris 
Acked-by: Paul Moore 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] pidspace: is_init()

2006-09-29T16:18:12+00:00

This is an updated version of Eric Biederman's is_init() patch.
(http://lkml.org/lkml/2006/2/6/280).  It applies cleanly to 2.6.18-rc3 and
replaces a few more instances of ->pid == 1 with is_init().

Further, is_init() checks pid and thus removes dependency on Eric's other
patches for now.

Eric's original description:

	There are a lot of places in the kernel where we test for init
	because we give it special properties.  Most  significantly init
	must not die.  This results in code all over the kernel test
	->pid == 1.

	Introduce is_init to capture this case.

	With multiple pid spaces for all of the cases affected we are
	looking for only the first process on the system, not some other
	process that has pid == 1.

Signed-off-by: Eric W. Biederman 
Signed-off-by: Sukadev Bhattiprolu 
Cc: Dave Hansen 
Cc: Serge Hallyn 
Cc: Cedric Le Goater 
Cc: 
Acked-by: Paul Mackerras 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] LSM: remove BSD secure level security module

2006-09-29T16:18:10+00:00

This code has suffered from broken core design and lack of developer
attention.  Broken security modules are too dangerous to leave around.  It
is time to remove this one.

Signed-off-by: Chris Wright 
Acked-by: Michael Halcrow 
Acked-by: Serge Hallyn 
Cc: Davi Arnaut 
Acked-by: Greg Kroah-Hartman 
Acked-by: James Morris 
Acked-by: Alan Cox 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] SELinux: support mls categories for context mounts

2006-09-29T16:18:03+00:00

Allows commas to be embedded into context mount options (i.e.  "-o
context=some_selinux_context_t"), to better support multiple categories,
which are separated by commas and confuse mount.

For example, with the current code:

  mount -t iso9660 /dev/cdrom /media/cdrom -o \
  ro,context=system_u:object_r:iso9660_t:s0:c1,c3,c4,exec

The context option that will be interpreted by SELinux is
context=system_u:object_r:iso9660_t:s0:c1

instead of
context=system_u:object_r:iso9660_t:s0:c1,c3,c4

The options that will be passed on to the file system will be
ro,c3,c4,exec.

The proposed solution is to allow/require the SELinux context option
specified to mount to use quotes when the context contains a comma.

This patch modifies the option parsing in parse_opts(), contained in
mount.c, to take options after finding a comma only if it hasn't seen a
quote or if the quotes are matched.  It also introduces a new function that
will strip the quotes from the context option prior to translation.  The
quotes are replaced after the translation is completed to insure that in
the event the raw context contains commas the kernel will be able to
interpret the correct context.

Signed-off-by: Cory Olmo 
Signed-off-by: James Morris 
Acked-by: Stephen Smalley 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] inode-diet: Eliminate i_blksize from the inode structure

2006-09-27T15:26:18+00:00

This eliminates the i_blksize field from struct inode.  Filesystems that want
to provide a per-inode st_blksize can do so by providing their own getattr
routine instead of using the generic_fillattr() function.

Note that some filesystems were providing pretty much random (and incorrect)
values for i_blksize.

[bunk@stusta.de: cleanup]
[akpm@osdl.org: generic_fillattr() fix]
Signed-off-by: "Theodore Ts'o" 
Signed-off-by: Adrian Bunk 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] inode_diet: Replace inode.u.generic_ip with inode.i_private

2006-09-27T15:26:17+00:00

The following patches reduce the size of the VFS inode structure by 28 bytes
on a UP x86.  (It would be more on an x86_64 system).  This is a 10% reduction
in the inode size on a UP kernel that is configured in a production mode
(i.e., with no spinlock or other debugging functions enabled; if you want to
save memory taken up by in-core inodes, the first thing you should do is
disable the debugging options; they are responsible for a huge amount of bloat
in the VFS inode structure).

This patch:

The filesystem or device-specific pointer in the inode is inside a union,
which is pretty pointless given that all 30+ users of this field have been
using the void pointer.  Get rid of the union and rename it to i_private, with
a comment to explain who is allowed to use the void pointer.  This is just a
cleanup, but it allows us to reuse the union 'u' for something something where
the union will actually be used.

[judith@osdl.org: powerpc build fix]
Signed-off-by: "Theodore Ts'o" 
Signed-off-by: Judith Lebzelter 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] selinux: fix tty locking

2006-09-26T15:48:53+00:00

Take tty_mutex when accessing ->signal->tty in selinux code.  Noted by Alan
Cox.  Longer term, we are looking at refactoring the code to provide better
encapsulation of the tty layer, but this is a simple fix that addresses the
immediate bug.

Signed-off-by: Stephen Smalley 
Acked-by: Alan Cox 
Acked-by: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds