summaryrefslogtreecommitdiffstats
path: root/security
Commit message (Collapse)AuthorAgeFilesLines
* apparmor: update query interface to support label queriesJohn Johansen2017-06-101-7/+39
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: switch getprocattr to using label_print fns()John Johansen2017-06-103-37/+27
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: switch from profiles to using labels on contextsJohn Johansen2017-06-1020-529/+686
| | | | | | | | Begin the actual switch to using domain labels by storing them on the context and converting the label to a singular profile where possible. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add the base fns() for domain labelsJohn Johansen2017-06-102-0/+2561
| | | | | | | | Begin moving apparmor to using broader domain labels, that will allow run time computation of domain type splitting via "stacking" of profiles into a domain label vec. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: revalidate files during execJohn Johansen2017-06-104-0/+81
| | | | | | | | | Instead of running file revalidation lazily when read/write are called copy selinux and revalidate the file table on exec. This avoids extra mediation overhead in read/write and also prevents file handles being passed through to a grand child unchecked. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: cleanup rename XXX_file_context() to XXX_file_ctx()John Johansen2017-06-102-11/+16
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: convert aa_change_XXX bool parameters to flagsJohn Johansen2017-06-105-32/+29
| | | | | | | Instead of passing multiple booleans consolidate on a single flags field. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: cleanup remove unused and not fully implemented profile renameJohn Johansen2017-06-101-37/+2
| | | | | | | Remove the partially implemented code, until this can be properly implemented. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: refactor updating profiles to the newest parentJohn Johansen2017-06-101-4/+31
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: share profile name on replacementJohn Johansen2017-06-103-9/+72
| | | | | | The profile names are the same, leverage this. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: convert to profile block critical sectionsJohn Johansen2017-06-108-56/+162
| | | | | | | | | | There are still a few places where profile replacement fails to update and a stale profile is used for mediation. Fix this by moving to accessing the current label through a critical section that will always ensure mediation is using the current label regardless of whether the tasks cred has been updated or not. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: move bprm_committing_creds/committed_creds to lsm.cJohn Johansen2017-06-103-32/+30
| | | | | | | | There is no reason to have the small stubs that don't use domain private functions in domain.c, instead move them to lsm.c and make them static. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: fix display of ns nameJohn Johansen2017-06-101-1/+1
| | | | | | The ns name being displayed should go through an ns view lookup. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: fix apparmor_query dataJohn Johansen2017-06-101-2/+6
| | | | | | | The data being queried isn't always the current profile and a lookup relative to the current profile should be done. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: fix policy load/remove semanticsJohn Johansen2017-06-102-15/+13
| | | | | | | | | The namespace being passed into the replace/remove profiles fns() is not the view, but the namespace specified by the inode from the file hook (if present) or the loading tasks ns, if accessing the top level virtualized load/replace file interface. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add namespace lookup fns()John Johansen2017-06-103-4/+73
| | | | | | | | | | | Currently lookups are restricted to a single ns component in the path. However when namespaces are allowed to have separate views, and scopes this will not be sufficient, as it will be possible to have a multiple component ns path in scope. Add some ns lookup fns() to allow this and use them. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: cleanup __find_child()John Johansen2017-06-101-8/+8
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: provide information about path buffer size at bootJohn Johansen2017-06-101-2/+9
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add profile permission query abilityJohn Johansen2017-06-101-1/+102
| | | | | | | | Allow userspace to query a profile about permissions, through the transaction interface that is already used to allow userspace to query about key,value data. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: switch from file_perms to aa_permsJohn Johansen2017-06-105-48/+29
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add gerneric permissions struct and support fnsJohn Johansen2017-06-104-17/+153
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add fn to test if profile supports a given mediation classJohn Johansen2017-06-101-0/+10
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: speed up transactional queriesJohn Johansen2017-06-101-11/+114
| | | | | | | | | | | | | | | | | | | The simple_transaction interface is slow. It requires 4 syscalls (open, write, read, close) per query and shares a single lock for each queries. So replace its use with a compatible in multi_transaction interface. It allows for a faster 2 syscall pattern per query. After an initial open, an arbitrary number of writes and reads can be issued. Each write will reset the query with new data that can be read. Reads do not clear the data, and can be issued multiple times, and used with seek, until a new write is performed which will reset the data available and the seek position. Note: this keeps the single lock design, if needed moving to a per file lock will have to come later. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add label data availability to the feature setJohn Johansen2017-06-101-0/+10
| | | | | | | | | | | | gsettings mediation needs to be able to determine if apparmor supports label data queries. A label data query can be done to test for support but its failure is indistinguishable from other failures, making it an unreliable indicator. Fix by making support of label data queries available as a flag in the apparmorfs features dir tree. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add mkdir/rmdir interface to manage policy namespacesJohn Johansen2017-06-101-1/+94
| | | | | | | | | | | When setting up namespaces for containers its easier for them to use an fs interface to create the namespace for the containers policy. Allow mkdir/rmdir under the policy/namespaces/ dir to be used to create and remove namespaces. BugLink: http://bugs.launchpad.net/bugs/1611078 Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add policy revision file interfaceJohn Johansen2017-06-104-1/+116
| | | | | | | | | | | | | | Add a policy revision file to find the current revision of a ns's policy. There is a revision file per ns, as well as a virtualized global revision file in the base apparmor fs directory. The global revision file when opened will provide the revision of the opening task namespace. The revision file can be waited on via select/poll to detect apparmor policy changes from the last read revision of the opened file. This means that the revision file must be read after the select/poll other wise update data will remain ready for reading. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: provide finer control over policy managementJohn Johansen2017-06-103-23/+35
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rework perm mapping to a slightly broader setJohn Johansen2017-06-095-53/+133
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: move permissions into their own file to be more easily sharedJohn Johansen2017-06-084-19/+43
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: convert from securityfs to apparmorfs for policy ns filesJohn Johansen2017-06-081-26/+37
| | | | | | | | | | | Virtualize the apparmor policy/ directory so that the current namespace affects what part of policy is seen. To do this convert to using apparmorfs for policy namespace files and setup a magic symlink in the securityfs apparmor dir to access those files. Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
* apparmor: allow specifying an already created dir to create ns entries inJohn Johansen2017-06-083-7/+8
| | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
* apparmor: rename apparmor file fns and data to indicate useJohn Johansen2017-06-089-127/+172
| | | | | | | | | | | | | prefixes are used for fns/data that are not static to apparmorfs.c with the prefixes being aafs - special magic apparmorfs for policy namespace data aa_sfs - for fns/data that go into securityfs aa_fs - for fns/data that may be used in the either of aafs or securityfs Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
* apparmor: add custom apparmorfs that will be used by policy namespace filesJohn Johansen2017-06-081-17/+336
| | | | | | | | | | | | | AppArmor policy needs to be able to be resolved based on the policy namespace a task is confined by. Add a base apparmorfs filesystem that (like nsfs) will exist as a kern mount and be accessed via jump_link through a securityfs file. Setup the base apparmorfs fns and data, but don't use it yet. Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
* apparmor: use macro template to simplify namespace seq_filesJohn Johansen2017-06-081-29/+24
| | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
* apparmor: use macro template to simplify profile seq_filesJohn Johansen2017-06-081-61/+36
| | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
* apparmor: move to per loaddata files, instead of replicating in profilesJohn Johansen2017-06-087-69/+409
| | | | | | | | | | The loaddata sets cover more than just a single profile and should be tracked at the ns level. Move the load data files under the namespace and reference the files from the profiles via a symlink. Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
* securityfs: add the ability to support symlinksJohn Johansen2017-06-081-21/+123
| | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Kees Cook <keescook@chromium.org>
* apparmor: Move path lookup to using preallocated buffersJohn Johansen2017-06-084-86/+53
| | | | | | | | Dynamically allocating buffers is problematic and is an extra layer that is a potntial point of failure and can slow down mediation. Change path lookup to use the preallocated per cpu buffers. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: allow profiles to provide info to disconnected pathsJohn Johansen2017-06-086-17/+34
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: make internal lib fn skipn_spaces available to the rest of apparmorJohn Johansen2017-06-082-1/+2
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: move file context into file.hJohn Johansen2017-06-082-32/+32
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* security/apparmor: Use POSIX-compatible "printf '%s'"Thomas Schneider2017-06-081-2/+2
| | | | | | | | When using a strictly POSIX-compliant shell, "-n #define ..." gets written into the file. Use "printf '%s'" to avoid this. Signed-off-by: Thomas Schneider <qsx@qsx.re> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: Fix error cod in __aa_fs_profile_mkdir()Dan Carpenter2017-06-081-2/+4
| | | | | | | | | | We can either return PTR_ERR(NULL) or a PTR_ERR(a valid pointer) here. Returning NULL is probably not good, but since this happens at boot then we are probably already toasted if we were to hit this bug in real life. In other words, it seems like a very low severity bug to me. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmorfs: Use seq_putc() in two functionsMarkus Elfring2017-06-081-2/+2
| | | | | | | | | | Two single characters (line breaks) should be put into a sequence. Thus use the corresponding function "seq_putc". This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmorfs: Combine two function calls into one in aa_fs_seq_raw_abi_show()Markus Elfring2017-06-081-4/+3
| | | | | | | | A bit of data was put into a sequence by two separate function calls. Print the same data by a single function call instead. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: John Johansen <john.johansen@canonical.com>
* Sync to mainline for security submaintainers to work againstJames Morris2017-05-2215-106/+63
|\
| * Merge branch 'work.misc' of ↵Linus Torvalds2017-05-093-4/+4
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc vfs updates from Al Viro: "Assorted bits and pieces from various people. No common topic in this pile, sorry" * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs/affs: add rename exchange fs/affs: add rename2 to prepare multiple methods Make stat/lstat/fstatat pass AT_NO_AUTOMOUNT to vfs_statx() fs: don't set *REFERENCED on single use objects fs: compat: Remove warning from COMPATIBLE_IOCTL remove pointless extern of atime_need_update_rcu() fs: completely ignore unknown open flags fs: add a VALID_OPEN_FLAGS fs: remove _submit_bh() fs: constify tree_descr arrays passed to simple_fill_super() fs: drop duplicate header percpu-rwsem.h fs/affs: bugfix: Write files greater than page size on OFS fs/affs: bugfix: enable writes on OFS disks fs/affs: remove node generation check fs/affs: import amigaffs.h fs/affs: bugfix: make symbolic links work again
| | * fs: constify tree_descr arrays passed to simple_fill_super()Eric Biggers2017-04-263-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | simple_fill_super() is passed an array of tree_descr structures which describe the files to create in the filesystem's root directory. Since these arrays are never modified intentionally, they should be 'const' so that they are placed in .rodata and benefit from memory protection. This patch updates the function signature and all users, and also constifies tree_descr.name. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| * | apparmorfs: replace CURRENT_TIME with current_time()Deepa Dinamani2017-05-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CURRENT_TIME macro is not y2038 safe on 32 bit systems. The patch replaces all the uses of CURRENT_TIME by current_time(). This is also in preparation for the patch that transitions vfs timestamps to use 64 bit time and hence make them y2038 safe. current_time() is also planned to be transitioned to y2038 safe behavior along with this change. CURRENT_TIME macro will be deleted before merging the aforementioned change. Link: http://lkml.kernel.org/r/1491613030-11599-11-git-send-email-deepa.kernel@gmail.com Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com> Acked-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| * | treewide: use kv[mz]alloc* rather than opencoded variantsMichal Hocko2017-05-081-16/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are many code paths opencoding kvmalloc. Let's use the helper instead. The main difference to kvmalloc is that those users are usually not considering all the aspects of the memory allocator. E.g. allocation requests <= 32kB (with 4kB pages) are basically never failing and invoke OOM killer to satisfy the allocation. This sounds too disruptive for something that has a reasonable fallback - the vmalloc. On the other hand those requests might fallback to vmalloc even when the memory allocator would succeed after several more reclaim/compaction attempts previously. There is no guarantee something like that happens though. This patch converts many of those places to kv[mz]alloc* helpers because they are more conservative. Link: http://lkml.kernel.org/r/20170306103327.2766-2-mhocko@kernel.org Signed-off-by: Michal Hocko <mhocko@suse.com> Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> # Xen bits Acked-by: Kees Cook <keescook@chromium.org> Acked-by: Vlastimil Babka <vbabka@suse.cz> Acked-by: Andreas Dilger <andreas.dilger@intel.com> # Lustre Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> # KVM/s390 Acked-by: Dan Williams <dan.j.williams@intel.com> # nvdim Acked-by: David Sterba <dsterba@suse.com> # btrfs Acked-by: Ilya Dryomov <idryomov@gmail.com> # Ceph Acked-by: Tariq Toukan <tariqt@mellanox.com> # mlx4 Acked-by: Leon Romanovsky <leonro@mellanox.com> # mlx5 Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Herbert Xu <herbert@gondor.apana.org.au> Cc: Anton Vorontsov <anton@enomsg.org> Cc: Colin Cross <ccross@android.com> Cc: Tony Luck <tony.luck@intel.com> Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net> Cc: Ben Skeggs <bskeggs@redhat.com> Cc: Kent Overstreet <kent.overstreet@gmail.com> Cc: Santosh Raspatur <santosh@chelsio.com> Cc: Hariprasad S <hariprasad@chelsio.com> Cc: Yishai Hadas <yishaih@mellanox.com> Cc: Oleg Drokin <oleg.drokin@intel.com> Cc: "Yan, Zheng" <zyan@redhat.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: David Miller <davem@davemloft.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 02:07:26 +0000