1. 13 Sep, 2011 2 commits
    • Tetsuo Handa's avatar
      TOMOYO: Add socket operation restriction support. · 059d84db
      Tetsuo Handa authored
      
      
      This patch adds support for permission checks for PF_INET/PF_INET6/PF_UNIX
      socket's bind()/listen()/connect()/send() operations.
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      059d84db
    • Tetsuo Handa's avatar
      TOMOYO: Add environment variable name restriction support. · d58e0da8
      Tetsuo Handa authored
      
      
      This patch adds support for checking environment variable's names.
      Although TOMOYO already provides ability to check argv[]/envp[] passed to
      execve() requests,
      
        file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="bar"
      
      will reject execution of /bin/sh if environment variable LD_LIBRARY_PATH is not
      defined. To grant execution of /bin/sh if LD_LIBRARY_PATH is not defined,
      administrators have to specify like
      
        file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="/system/lib"
        file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]=NULL
      
      . Since there are many environment variables whereas conditional checks are
      applied as "&&", it is difficult to cover all combinations. Therefore, this
      patch supports conditional checks that are applied as "||", by specifying like
      
        file execute /bin/sh
        misc env LD_LIBRARY_PATH exec.envp["LD_LIBRARY_PATH"]="/system/lib"
      
      which means "grant execution of /bin/sh if environment variable is not defined
      or is defined and its value is /system/lib".
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      d58e0da8
  2. 16 Aug, 2011 1 commit
  3. 14 Jul, 2011 1 commit
  4. 11 Jul, 2011 3 commits
  5. 28 Jun, 2011 5 commits
    • Tetsuo Handa's avatar
      TOMOYO: Fix lockdep warning. · 2e503bbb
      Tetsuo Handa authored
      
      
      Currently TOMOYO holds SRCU lock upon open() and releases it upon close()
      because list elements stored in the "struct tomoyo_io_buffer" instances are
      accessed until close() is called. However, such SRCU usage causes lockdep to
      complain about leaving the kernel with SRCU lock held.
      
      This patch solves the warning by holding/releasing SRCU upon each
      read()/write(). This patch is doing something similar to calling kfree()
      without calling synchronize_srcu(), by selectively deferring kfree() by keeping
      track of the "struct tomoyo_io_buffer" instances.
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      2e503bbb
    • Tetsuo Handa's avatar
      TOMOYO: Add policy namespace support. · bd03a3e4
      Tetsuo Handa authored
      
      
      Mauras Olivier reported that it is difficult to use TOMOYO in LXC environments,
      for TOMOYO cannot distinguish between environments outside the container and
      environments inside the container since LXC environments are created using
      pivot_root(). To address this problem, this patch introduces policy namespace.
      
      Each policy namespace has its own set of domain policy, exception policy and
      profiles, which are all independent of other namespaces. This independency
      allows users to develop policy without worrying interference among namespaces.
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      bd03a3e4
    • Tetsuo Handa's avatar
      TOMOYO: Add ACL group support. · 32997144
      Tetsuo Handa authored
      
      
      ACL group allows administrator to globally grant not only "file read"
      permission but also other permissions.
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      32997144
    • Tetsuo Handa's avatar
      TOMOYO: Cleanup part 3. · 0df7e8b8
      Tetsuo Handa authored
      
      
      Use common structure for ACL with "struct list_head" + "atomic_t".
      Use array/struct where possible.
      Remove is_group from "struct tomoyo_name_union"/"struct tomoyo_number_union".
      Pass "struct file"->private_data rather than "struct file".
      Update some of comments.
      Bring tomoyo_same_acl_head() from common.h to domain.c .
      Bring tomoyo_invalid()/tomoyo_valid() from common.h to util.c .
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      0df7e8b8
    • Tetsuo Handa's avatar
      TOMOYO: Cleanup part 1. · 7c75964f
      Tetsuo Handa authored
      
      
      In order to synchronize with TOMOYO 1.8's syntax,
      
      (1) Remove special handling for allow_read/write permission.
      (2) Replace deny_rewrite/allow_rewrite permission with allow_append permission.
      (3) Remove file_pattern keyword.
      (4) Remove allow_read permission from exception policy.
      (5) Allow creating domains in enforcing mode without calling supervisor.
      (6) Add permission check for opening directory for reading.
      (7) Add permission check for stat() operation.
      (8) Make "cat < /sys/kernel/security/tomoyo/self_domain" behave as if
          "cat /sys/kernel/security/tomoyo/self_domain".
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      7c75964f
  6. 02 Aug, 2010 15 commits
  7. 16 May, 2010 1 commit
  8. 06 May, 2010 1 commit
  9. 30 Mar, 2010 1 commit
    • Tejun Heo's avatar
      include cleanup: Update gfp.h and slab.h includes to prepare for breaking... · 5a0e3ad6
      Tejun Heo authored
      include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
      
      percpu.h is included by sched.h and module.h and thus ends up being
      included when building most .c files.  percpu.h includes slab.h which
      in turn includes gfp.h making everything defined by the two files
      universally available and complicating inclusion dependencies.
      
      percpu.h -> slab.h dependency is about to be removed.  Prepare for
      this change by updating users of gfp and slab facilities include those
      headers directly instead of assuming availability.  As this conversion
      needs to touch large number of source files, the following script is
      used as the basis of conversion.
      
        http://userweb.kernel.org/~tj/misc/slabh-sweep.py
      
      
      
      The script does the followings.
      
      * Scan files for gfp and slab usages and update includes such that
        only the necessary includes are there.  ie. if only gfp is used,
        gfp.h, if slab is used, slab.h.
      
      * When the script inserts a new include, it looks at the include
        blocks and try to put the new include such that its order conforms
        to its surrounding.  It's put in the include block which contains
        core kernel includes, in the same order that the rest are ordered -
        alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
        doesn't seem to be any matching order.
      
      * If the script can't find a place to put a new include (mostly
        because the file doesn't have fitting include block), it prints out
        an error message indicating which .h file needs to be added to the
        file.
      
      The conversion was done in the following steps.
      
      1. The initial automatic conversion of all .c files updated slightly
         over 4000 files, deleting around 700 includes and adding ~480 gfp.h
         and ~3000 slab.h inclusions.  The script emitted errors for ~400
         files.
      
      2. Each error was manually checked.  Some didn't need the inclusion,
         some needed manual addition while adding it to implementation .h or
         embedding .c file was more appropriate for others.  This step added
         inclusions to around 150 files.
      
      3. The script was run again and the output was compared to the edits
         from #2 to make sure no file was left behind.
      
      4. Several build tests were done and a couple of problems were fixed.
         e.g. lib/decompress_*.c used malloc/free() wrappers around slab
         APIs requiring slab.h to be added manually.
      
      5. The script was run on all .h files but without automatically
         editing them as sprinkling gfp.h and slab.h inclusions around .h
         files could easily lead to inclusion dependency hell.  Most gfp.h
         inclusion directives were ignored as stuff from gfp.h was usually
         wildly available and often used in preprocessor macros.  Each
         slab.h inclusion directive was examined and added manually as
         necessary.
      
      6. percpu.h was updated not to include slab.h.
      
      7. Build test were done on the following configurations and failures
         were fixed.  CONFIG_GCOV_KERNEL was turned off for all tests (as my
         distributed build env didn't work with gcov compiles) and a few
         more options had to be turned off depending on archs to make things
         build (like ipr on powerpc/64 which failed due to missing writeq).
      
         * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
         * powerpc and powerpc64 SMP allmodconfig
         * sparc and sparc64 SMP allmodconfig
         * ia64 SMP allmodconfig
         * s390 SMP allmodconfig
         * alpha SMP allmodconfig
         * um on x86_64 SMP allmodconfig
      
      8. percpu.h modifications were reverted so that it could be applied as
         a separate patch and serve as bisection point.
      
      Given the fact that I had only a couple of failures from tests on step
      6, I'm fairly confident about the coverage of this conversion patch.
      If there is a breakage, it's likely to be something in one of the arch
      headers which should be easily discoverable easily on most builds of
      the specific arch.
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Guess-its-ok-by: default avatarChristoph Lameter <cl@linux-foundation.org>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
      5a0e3ad6
  10. 16 Feb, 2010 1 commit
  11. 14 Feb, 2010 1 commit