linux-toradex.git/security, branch v2.6.25.20

file caps: always start with clear bprm->caps_*

2008-11-10T18:50:06+00:00

commit 3318a386e4ca68c76e0294363d29bdc46fcad670 upstream

While Linux doesn't honor setuid on scripts.  However, it mistakenly
behaves differently for file capabilities.

This patch fixes that behavior by making sure that get_file_caps()
begins with empty bprm->caps_*.  That way when a script is loaded,
its bprm->caps_* may be filled when binfmt_misc calls prepare_binprm(),
but they will be cleared again when binfmt_elf calls prepare_binprm()
next to read the interpreter's file capabilities.

Signed-off-by: Serge Hallyn 
Acked-by: David Howells 
Acked-by: Andrew G. Morgan 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Smack: fuse mount hang fix

2008-06-09T18:27:04+00:00

upstream commit: e97dcb0eadbb821eccd549d4987b653cf61e2374

The d_instantiate hook for Smack can hang on the root inode of a
filesystem if the file system code has not really done all the set-up.
Fuse is known to encounter this problem.

This change detects an attempt to instantiate a root inode and addresses
it early in the processing, before any attempt is made to do something
that might hang.

Signed-off-by: Casey Schaufler 
Tested-by: Luiz Fernando N. Capitulino 
Signed-off-by: Linus Torvalds 
Signed-off-by: Chris Wright

SELinux: no BUG_ON(!ss_initialized) in selinux_clone_mnt_opts

2008-05-01T21:44:35+00:00

commit 0f5e64200f20fc8f5b759c4010082f577ab0af3f upstream

The Fedora installer actually makes multiple NFS mounts before it loads
selinux policy.  The code in selinux_clone_mnt_opts() assumed that the
init process would always be loading policy before NFS was up and
running.  It might be possible to hit this in a diskless environment as
well, I'm not sure.  There is no need to BUG_ON() in this situation
since we can safely continue given the circumstances.

Signed-off-by: Eric Paris 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

SELinux: don't BUG if fs reuses a superblock

2008-04-09T22:51:01+00:00

I (wrongly) assumed that nfs_xdev_get_sb() would not ever share a superblock
and so cloning mount options would always be correct.  Turns out that isn't
the case and we could fall over a BUG_ON() that wasn't a BUG at all.  Since
there is little we can do to reconcile different mount options this patch
just leaves the sb alone and the first set of options wins.

Signed-off-by: Eric Paris 
Acked-by: Stephen Smalley 
Acked-by: Trond Myklebust 
Signed-off-by: James Morris

SELinux: more GFP_NOFS fixups to prevent selinux from re-entering the fs code

2008-04-07T22:30:14+00:00

More cases where SELinux must not re-enter the fs code. Called from the
d_instantiate security hook.

Signed-off-by: Stephen Smalley 
Signed-off-by: James Morris

selinux: prevent rentry into the FS

2008-04-03T22:35:05+00:00

BUG fix.  Keep us from re-entering the fs when we aren't supposed to.

See discussion at
http://marc.info/?t=120716967100004&r=1&w=2

Signed-off-by: Josef Bacik 
Acked-by: Stephen Smalley 
Signed-off-by: James Morris

selinux: handle files opened with flags 3 by checking ioctl permission

2008-04-02T05:05:52+00:00

Handle files opened with flags 3 by checking ioctl permission.

Default to returning FILE__IOCTL from file_to_av() if the f_mode has neither
FMODE_READ nor FMODE_WRITE, and thus check ioctl permission on exec or
transfer, thereby validating such descriptors early as with normal r/w
descriptors and catching leaks of them prior to attempted usage.

Signed-off-by:  Stephen Smalley 
Acked-by: Eric Paris 
Signed-off-by: James Morris

smackfs: remove redundant lock, fix open(,O_RDWR)

2008-03-25T02:22:19+00:00

Older smackfs was parsing MAC rules by characters, thus a need of locking
write sessions on open() was needed.  This lock is no longer useful now since
each rule is handled by a single write() call.

This is also a bugfix since seq_open() was not called if an open() O_RDWR flag
was given, leading to a seq_read() without an initialized seq_file, thus an
Oops.

Signed-off-by: Ahmed S. Darwish 
Reported-by: Jonathan Corbet 
Acked-by: Casey Schaufler 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

file capabilities: remove cap_task_kill()

2008-03-20T16:46:36+00:00

The original justification for cap_task_kill() was as follows:

	check_kill_permission() does appropriate uid equivalence checks.
	However with file capabilities it becomes possible for an
	unprivileged user to execute a file with file capabilities
	resulting in a more privileged task with the same uid.

However now that cap_task_kill() always returns 0 (permission
granted) when p->uid==current->uid, the whole hook is worthless,
and only likely to create more subtle problems in the corner cases
where it might still be called but return -EPERM.  Those cases
are basically when uids are different but euid/suid is equivalent
as per the check in check_kill_permission().

One example of a still-broken application is 'at' for non-root users.

This patch removes cap_task_kill().

Signed-off-by: Serge Hallyn 
Acked-by: Andrew G. Morgan 
Earlier-version-tested-by: Luiz Fernando N. Capitulino 
Acked-by: Casey Schaufler 
Signed-off-by: Linus Torvalds

smack: do not dereference NULL ipc object

2008-03-20T01:53:36+00:00

In the SYSV ipc msgctl(),semctl(),shmctl() family, if the user passed *_INFO
as the desired operation, no specific object is meant to be controlled and
only system-wide information is returned.  This leads to a NULL IPC object in
the LSM hooks if the _INFO flag is given.

Avoid dereferencing this NULL pointer in Smack ipc *ctl() methods.

Signed-off-by: Ahmed S. Darwish 
Acked-by: Casey Schaufler 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds