linux-toradex.git/security, branch v2.6.33.2

security: fix error return path in ima_inode_alloc

2010-03-15T16:05:50+00:00

commit baac35c4155a8aa826c70acee6553368ca5243a2 upstream.

If radix_tree_preload is failed in ima_inode_alloc, we don't need
radix_tree_preload_end because kernel is alread preempt enabled

Signed-off-by: Xiaotian Feng 
Signed-off-by: Mimi Zohar 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

netlabel: fix export of SELinux categories > 127

2010-03-15T16:05:47+00:00

commit c36f74e67fa12202dbcb4ad92c5ac844f9d36b98 upstream.

This fixes corrupted CIPSO packets when SELinux categories greater than 127
are used.  The bug occured on the second (and later) loops through the
while; the inner for loop through the ebitmap->maps array used the same
index as the NetLabel catmap->bitmap array, even though the NetLabel bitmap
is twice as long as the SELinux bitmap.

Signed-off-by: Joshua Roys 
Acked-by: Paul Moore 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

Take ima_file_free() to proper place.

2010-02-07T08:07:29+00:00

Hooks: Just Say No.

Signed-off-by: Al Viro

ima: rename PATH_CHECK to FILE_CHECK

2010-02-07T08:06:23+00:00

With the movement of the ima hooks functions were renamed from *path* to
*file* since they always deal with struct file.  This patch renames some of
the ima internal flags to make them consistent with the rest of the code.

Signed-off-by: Mimi Zohar 
Signed-off-by: Eric Paris 
Signed-off-by: Al Viro

ima: rename ima_path_check to ima_file_check

2010-02-07T08:06:22+00:00

ima_path_check actually deals with files!  call it ima_file_check instead.

Signed-off-by: Eric Paris 
Acked-by: Mimi Zohar 
Signed-off-by: Al Viro

ima: initialize ima before inodes can be allocated

2010-02-07T08:06:22+00:00

ima wants to create an inode information struct (iint) when inodes are
allocated.  This means that at least the part of ima which does this
allocation (the allocation is filled with information later) should
before any inodes are created.  To accomplish this we split the ima
initialization routine placing the kmem cache allocator inside a
security_initcall() function.  Since this makes use of radix trees we also
need to make sure that is initialized before security_initcall().

Signed-off-by: Eric Paris 
Acked-by: Mimi Zohar 
Signed-off-by: Al Viro

fix ima breakage

2010-02-07T08:06:22+00:00

The "Untangling ima mess, part 2 with counters" patch messed
up the counters.  Based on conversations with Al Viro, this patch
streamlines ima_path_check() by removing the counter maintaince.
The counters are now updated independently, from measuring the file,
in __dentry_open() and alloc_file() by calling ima_counts_get().
ima_path_check() is called from nfsd and do_filp_open().
It also did not measure all files that should have been measured.
Reason: ima_path_check() got bogus value passed as mask.
[AV: mea culpa]
[AV: add missing nfsd bits]

Signed-off-by: Mimi Zohar 
Signed-off-by: Al Viro

get rid of pointless checks after simple_pin_fs()

2010-01-27T03:22:26+00:00

if we'd just got success from it, vfsmount won't be NULL

Signed-off-by: Al Viro

Fix ACC_MODE() for real

2010-01-14T14:05:26+00:00

commit 5300990c0370e804e49d9a59d928c5d53fb73487 had stepped on a rather
nasty mess: definitions of ACC_MODE used to be different.  Fixed the
resulting breakage, converting them to variant that takes O_... value;
all callers have that and it actually simplifies life (see tomoyo part
of changes).

Signed-off-by: Al Viro

SECURITY: selinux, fix update_rlimit_cpu parameter

2010-01-04T10:27:18+00:00

Don't pass current RLIMIT_RTTIME to update_rlimit_cpu() in
selinux_bprm_committing_creds, since update_rlimit_cpu expects
RLIMIT_CPU limit.

Use proper rlim[RLIMIT_CPU].rlim_cur instead to fix that.

Signed-off-by: Jiri Slaby 
Acked-by: James Morris 
Cc: Stephen Smalley 
Cc: Eric Paris 
Cc: David Howells