1. 13 Feb, 2012 2 commits
  2. 09 Feb, 2012 1 commit
  3. 06 Jan, 2012 1 commit
  4. 05 Jan, 2012 5 commits
    • Eric Paris's avatar
      security: remove the security_netlink_recv hook as it is equivalent to capable() · fd778461
      Eric Paris authored
      Once upon a time netlink was not sync and we had to get the effective
      capabilities from the skb that was being received.  Today we instead get
      the capabilities from the current task.  This has rendered the entire
      purpose of the hook moot as it is now functionally equivalent to the
      capable() call.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      fd778461
    • Eric Paris's avatar
      capabilities: remove all _real_ interfaces · 2920a840
      Eric Paris authored
      The name security_real_capable and security_real_capable_noaudit just don't
      make much sense to me.  Convert them to use security_capable and
      security_capable_noaudit.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      Acked-by: default avatarSerge E. Hallyn <serge.hallyn@canonical.com>
      2920a840
    • Eric Paris's avatar
      capabilities: introduce security_capable_noaudit · c7eba4a9
      Eric Paris authored
      Exactly like security_capable except don't audit any denials.  This is for
      places where the kernel may make decisions about what to do if a task has a
      given capability, but which failing that capability is not a sign of a
      security policy violation.  An example is checking if a task has
      CAP_SYS_ADMIN to lower it's likelyhood of being killed by the oom killer.
      This check is not a security violation if it is denied.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      Acked-by: default avatarSerge E. Hallyn <serge.hallyn@canonical.com>
      c7eba4a9
    • Eric Paris's avatar
      capabilities: reverse arguments to security_capable · b7e724d3
      Eric Paris authored
      security_capable takes ns, cred, cap.  But the LSM capable() hook takes
      cred, ns, cap.  The capability helper functions also take cred, ns, cap.
      Rather than flip argument order just to flip it back, leave them alone.
      Heck, this should be a little faster since argument will be in the right
      place!
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      b7e724d3
    • Eric Paris's avatar
      capabilities: remove the task from capable LSM hook entirely · 6a9de491
      Eric Paris authored
      The capabilities framework is based around credentials, not necessarily the
      current task.  Yet we still passed the current task down into LSMs from the
      security_capable() LSM hook as if it was a meaningful portion of the security
      decision.  This patch removes the 'generic' passing of current and instead
      forces individual LSMs to use current explicitly if they think it is
      appropriate.  In our case those LSMs are SELinux and AppArmor.
      
      I believe the AppArmor use of current is incorrect, but that is wholely
      unrelated to this patch.  This patch does not change what AppArmor does, it
      just makes it clear in the AppArmor code that it is doing it.
      
      The SELinux code still uses current in it's audit message, which may also be
      wrong and needs further investigation.  Again this is NOT a change, it may
      have always been wrong, this patch just makes it clear what is happening.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      6a9de491
  5. 03 Jan, 2012 7 commits
  6. 18 Oct, 2011 1 commit
  7. 14 Sep, 2011 1 commit
  8. 09 Sep, 2011 1 commit
  9. 19 Jul, 2011 2 commits
  10. 18 Jul, 2011 5 commits
  11. 25 Apr, 2011 1 commit
    • Andi Kleen's avatar
      SECURITY: Move exec_permission RCU checks into security modules · 1c990429
      Andi Kleen authored
      Right now all RCU walks fall back to reference walk when CONFIG_SECURITY
      is enabled, even though just the standard capability module is active.
      This is because security_inode_exec_permission unconditionally fails
      RCU walks.
      
      Move this decision to the low level security module. This requires
      passing the RCU flags down the security hook. This way at least
      the capability module and a few easy cases in selinux/smack work
      with RCU walks with CONFIG_SECURITY=y
      Signed-off-by: default avatarAndi Kleen <ak@linux.intel.com>
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      1c990429
  12. 22 Apr, 2011 1 commit
  13. 23 Mar, 2011 1 commit
    • Serge E. Hallyn's avatar
      userns: security: make capabilities relative to the user namespace · 3486740a
      Serge E. Hallyn authored
      - Introduce ns_capable to test for a capability in a non-default
        user namespace.
      - Teach cap_capable to handle capabilities in a non-default
        user namespace.
      
      The motivation is to get to the unprivileged creation of new
      namespaces.  It looks like this gets us 90% of the way there, with
      only potential uid confusion issues left.
      
      I still need to handle getting all caps after creation but otherwise I
      think I have a good starter patch that achieves all of your goals.
      
      Changelog:
      	11/05/2010: [serge] add apparmor
      	12/14/2010: [serge] fix capabilities to created user namespaces
      	Without this, if user serge creates a user_ns, he won't have
      	capabilities to the user_ns he created.  THis is because we
      	were first checking whether his effective caps had the caps
      	he needed and returning -EPERM if not, and THEN checking whether
      	he was the creator.  Reverse those checks.
      	12/16/2010: [serge] security_real_capable needs ns argument in !security case
      	01/11/2011: [serge] add task_ns_capable helper
      	01/11/2011: [serge] add nsown_capable() helper per Bastian Blank suggestion
      	02/16/2011: [serge] fix a logic bug: the root user is always creator of
      		    init_user_ns, but should not always have capabilities to
      		    it!  Fix the check in cap_capable().
      	02/21/2011: Add the required user_ns parameter to security_capable,
      		    fixing a compile failure.
      	02/23/2011: Convert some macros to functions as per akpm comments.  Some
      		    couldn't be converted because we can't easily forward-declare
      		    them (they are inline if !SECURITY, extern if SECURITY).  Add
      		    a current_user_ns function so we can use it in capability.h
      		    without #including cred.h.  Move all forward declarations
      		    together to the top of the #ifdef __KERNEL__ section, and use
      		    kernel-doc format.
      	02/23/2011: Per dhowells, clean up comment in cap_capable().
      	02/23/2011: Per akpm, remove unreachable 'return -EPERM' in cap_capable.
      
      (Original written and signed off by Eric;  latest, modified version
      acked by him)
      
      [akpm@linux-foundation.org: fix build]
      [akpm@linux-foundation.org: export current_user_ns() for ecryptfs]
      [serge.hallyn@canonical.com: remove unneeded extra argument in selinux's task_has_capability]
      Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
      Signed-off-by: default avatarSerge E. Hallyn <serge.hallyn@canonical.com>
      Acked-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Acked-by: default avatarDaniel Lezcano <daniel.lezcano@free.fr>
      Acked-by: default avatarDavid Howells <dhowells@redhat.com>
      Cc: James Morris <jmorris@namei.org>
      Signed-off-by: default avatarSerge E. Hallyn <serge.hallyn@canonical.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      3486740a
  14. 12 Mar, 2011 1 commit
  15. 03 Mar, 2011 1 commit
    • Eric Paris's avatar
      LSM: Pass -o remount options to the LSM · ff36fe2c
      Eric Paris authored
      The VFS mount code passes the mount options to the LSM.  The LSM will remove
      options it understands from the data and the VFS will then pass the remaining
      options onto the underlying filesystem.  This is how options like the
      SELinux context= work.  The problem comes in that -o remount never calls
      into LSM code.  So if you include an LSM specific option it will get passed
      to the filesystem and will cause the remount to fail.  An example of where
      this is a problem is the 'seclabel' option.  The SELinux LSM hook will
      print this word in /proc/mounts if the filesystem is being labeled using
      xattrs.  If you pass this word on mount it will be silently stripped and
      ignored.  But if you pass this word on remount the LSM never gets called
      and it will be passed to the FS.  The FS doesn't know what seclabel means
      and thus should fail the mount.  For example an ext3 fs mounted over loop
      
      # mount -o loop /tmp/fs /mnt/tmp
      # cat /proc/mounts | grep /mnt/tmp
      /dev/loop0 /mnt/tmp ext3 rw,seclabel,relatime,errors=continue,barrier=0,data=ordered 0 0
      # mount -o remount /mnt/tmp
      mount: /mnt/tmp not mounted already, or bad option
      # dmesg
      EXT3-fs (loop0): error: unrecognized mount option "seclabel" or missing value
      
      This patch passes the remount mount options to an new LSM hook.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      Reviewed-by: default avatarJames Morris <jmorris@namei.org>
      ff36fe2c
  16. 22 Feb, 2011 1 commit
  17. 10 Feb, 2011 1 commit
  18. 02 Feb, 2011 1 commit
  19. 01 Feb, 2011 2 commits
    • Lucian Adrian Grijincu's avatar
      security: remove unused security_sysctl hook · 4916ca40
      Lucian Adrian Grijincu authored
      The only user for this hook was selinux. sysctl routes every call
      through /proc/sys/. Selinux and other security modules use the file
      system checks for sysctl too, so no need for this hook any more.
      Signed-off-by: default avatarLucian Adrian Grijincu <lucian.grijincu@gmail.com>
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      4916ca40
    • Eric Paris's avatar
      fs/vfs/security: pass last path component to LSM on inode creation · 2a7dba39
      Eric Paris authored
      SELinux would like to implement a new labeling behavior of newly created
      inodes.  We currently label new inodes based on the parent and the creating
      process.  This new behavior would also take into account the name of the
      new object when deciding the new label.  This is not the (supposed) full path,
      just the last component of the path.
      
      This is very useful because creating /etc/shadow is different than creating
      /etc/passwd but the kernel hooks are unable to differentiate these
      operations.  We currently require that userspace realize it is doing some
      difficult operation like that and than userspace jumps through SELinux hoops
      to get things set up correctly.  This patch does not implement new
      behavior, that is obviously contained in a seperate SELinux patch, but it
      does pass the needed name down to the correct LSM hook.  If no such name
      exists it is fine to pass NULL.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      2a7dba39
  20. 23 Jan, 2011 1 commit
  21. 06 Jan, 2011 1 commit
    • Nick Piggin's avatar
      fs: rcu-walk for path lookup · 31e6b01f
      Nick Piggin authored
      Perform common cases of path lookups without any stores or locking in the
      ancestor dentry elements. This is called rcu-walk, as opposed to the current
      algorithm which is a refcount based walk, or ref-walk.
      
      This results in far fewer atomic operations on every path element,
      significantly improving path lookup performance. It also avoids cacheline
      bouncing on common dentries, significantly improving scalability.
      
      The overall design is like this:
      * LOOKUP_RCU is set in nd->flags, which distinguishes rcu-walk from ref-walk.
      * Take the RCU lock for the entire path walk, starting with the acquiring
        of the starting path (eg. root/cwd/fd-path). So now dentry refcounts are
        not required for dentry persistence.
      * synchronize_rcu is called when unregistering a filesystem, so we can
        access d_ops and i_ops during rcu-walk.
      * Similarly take the vfsmount lock for the entire path walk. So now mnt
        refcounts are not required for persistence. Also we are free to perform mount
        lookups, and to assume dentry mount points and mount roots are stable up and
        down the path.
      * Have a per-dentry seqlock to protect the dentry name, parent, and inode,
        so we can load this tuple atomically, and also check whether any of its
        members have changed.
      * Dentry lookups (based on parent, candidate string tuple) recheck the parent
        sequence after the child is found in case anything changed in the parent
        during the path walk.
      * inode is also RCU protected so we can load d_inode and use the inode for
        limited things.
      * i_mode, i_uid, i_gid can be tested for exec permissions during path walk.
      * i_op can be loaded.
      
      When we reach the destination dentry, we lock it, recheck lookup sequence,
      and increment its refcount and mountpoint refcount. RCU and vfsmount locks
      are dropped. This is termed "dropping rcu-walk". If the dentry refcount does
      not match, we can not drop rcu-walk gracefully at the current point in the
      lokup, so instead return -ECHILD (for want of a better errno). This signals the
      path walking code to re-do the entire lookup with a ref-walk.
      
      Aside from the final dentry, there are other situations that may be encounted
      where we cannot continue rcu-walk. In that case, we drop rcu-walk (ie. take
      a reference on the last good dentry) and continue with a ref-walk. Again, if
      we can drop rcu-walk gracefully, we return -ECHILD and do the whole lookup
      using ref-walk. But it is very important that we can continue with ref-walk
      for most cases, particularly to avoid the overhead of double lookups, and to
      gain the scalability advantages on common path elements (like cwd and root).
      
      The cases where rcu-walk cannot continue are:
      * NULL dentry (ie. any uncached path element)
      * parent with d_inode->i_op->permission or ACLs
      * dentries with d_revalidate
      * Following links
      
      In future patches, permission checks and d_revalidate become rcu-walk aware. It
      may be possible eventually to make following links rcu-walk aware.
      
      Uncached path elements will always require dropping to ref-walk mode, at the
      very least because i_mutex needs to be grabbed, and objects allocated.
      Signed-off-by: default avatarNick Piggin <npiggin@kernel.dk>
      31e6b01f
  22. 05 Jan, 2011 1 commit
  23. 15 Nov, 2010 1 commit