linux-toradex.git/security, branch v2.6.29

smack: fixes for unlabeled host support

2009-03-04T21:36:34+00:00

The following patch (against 2.6.29rc5) fixes a few issues in the
smack/netlabel "unlabeled host support" functionnality that was added in
2.6.29rc.  It should go in before -final.

1) smack_host_label disregard a "0.0.0.0/0 @" rule (or other label),
preventing 'tagged' tasks to access Internet (many systems drop packets with
IP options)

2) netmasks were not handled correctly, they were stored in a way _not
equivalent_ to conversion to be32 (it was equivalent for /0, /8, /16, /24,
/32 masks but not other masks)

3) smack_netlbladdr prefixes (IP/mask) were not consistent (mask&IP was not
done), so there could have been different list entries for the same IP
prefix; if those entries had different labels, well ...

4) they were not sorted

1) 2) 3) are bugs, 4) is a more cosmetic issue.
The patch :

-creates a new helper smk_netlbladdr_insert to insert a smk_netlbladdr,
-sorted by netmask length

-use the new sorted nature of  smack_netlbladdrs list to simplify
 smack_host_label : the first match _will_ be the more specific

-corrects endianness issues in smk_write_netlbladdr &  netlbladdr_seq_show

Signed-off-by: 
Acked-by: Casey Schaufler 
Reviewed-by: Paul Moore 
Signed-off-by: James Morris

selinux: Fix a panic in selinux_netlbl_inode_permission()

2009-03-01T22:30:04+00:00

Rick McNeal from LSI identified a panic in selinux_netlbl_inode_permission()
caused by a certain sequence of SUNRPC operations.  The problem appears to be
due to the lack of NULL pointer checking in the function; this patch adds the
pointer checks so the function will exit safely in the cases where the socket
is not completely initialized.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

selinux: Fix the NetLabel glue code for setsockopt()

2009-02-22T23:05:55+00:00

At some point we (okay, I) managed to break the ability for users to use the
setsockopt() syscall to set IPv4 options when NetLabel was not active on the
socket in question.  The problem was noticed by someone trying to use the
"-R" (record route) option of ping:

 # ping -R 10.0.0.1
 ping: record route: No message of desired type

The solution is relatively simple, we catch the unlabeled socket case and
clear the error code, allowing the operation to succeed.  Please note that we
still deny users the ability to override IPv4 options on socket's which have
NetLabel labeling active; this is done to ensure the labeling remains intact.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

smackfs load append mode fix

2009-01-28T04:13:32+00:00

Given just how hard it is to find the code that uses MAY_APPEND
it's probably not a big surprise that this went unnoticed for so
long. The Smack rules loading code is incorrectly setting the
MAY_READ bit when MAY_APPEND is requested.

Signed-off-by: Casey Schaufler 
Reviewed-by: James Morris 
Signed-off-by: Linus Torvalds

security: introduce missing kfree

2009-01-17T22:24:46+00:00

Plug this leak.

Acked-by: David Howells 
Cc: James Morris 
Cc: 
Signed-off-by: Vegard Nossum 
Signed-off-by: Linus Torvalds

[CVE-2009-0029] System call wrappers part 28

2009-01-14T13:15:30+00:00

Signed-off-by: Heiko Carstens

[CVE-2009-0029] System call wrappers part 27

2009-01-14T13:15:29+00:00

Signed-off-by: Heiko Carstens

remove lots of double-semicolons

2009-01-08T16:31:14+00:00

Cc: Ingo Molnar 
Cc: Thomas Gleixner 
Acked-by: Theodore Ts'o 
Acked-by: Mark Fasheh 
Acked-by: David S. Miller 
Cc: James Morris 
Acked-by: Casey Schaufler 
Acked-by: Takashi Iwai 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devices cgroup: allow mkfifo

2009-01-08T16:31:03+00:00

The devcgroup_inode_permission() hook in the devices whitelist cgroup has
always bypassed access checks on fifos.  But the mknod hook did not.  The
devices whitelist is only about block and char devices, and fifos can't
even be added to the whitelist, so fifos can't be created at all except by
tasks which have 'a' in their whitelist (meaning they have access to all
devices).

Fix the behavior by bypassing access checks to mkfifo.

Signed-off-by: Serge E. Hallyn 
Cc: Li Zefan 
Cc: Pavel Emelyanov 
Cc: Paul Menage 
Cc: Lai Jiangshan 
Cc: KOSAKI Motohiro 
Cc: James Morris 
Reported-by: Daniel Lezcano 
Cc: 		[2.6.27.x]
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: use list_for_each_entry_rcu()

2009-01-08T16:31:03+00:00

We should use list_for_each_entry_rcu in RCU read site.

Signed-off-by: Lai Jiangshan 
Cc: Paul Menage 
Cc: KAMEZAWA Hiroyuki 
Cc: Pavel Emelyanov 
Cc: Balbir Singh 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds