linux/security/apparmor, branch v3.6

split ->file_mmap() into ->mmap_addr()/->mmap_file()

2012-05-31T17:11:54Z

... i.e. file-dependent and address-dependent checks. Signed-off-by: Al Viro

split cap_mmap_addr() out of cap_file_mmap()

2012-05-31T17:10:54Z

... switch callers. Signed-off-by: Al Viro

Merge branch 'master' of git://git.infradead.org/users/eparis/selinux into next

2012-05-22T01:21:06Z

Per pull request, for 3.5.

apparmor: fix long path failure due to disconnected path

2012-05-18T18:09:52Z

BugLink: http://bugs.launchpad.net/bugs/955892 All failures from __d_path where being treated as disconnected paths, however __d_path can also fail when the generated pathname is too long. The initial ENAMETOOLONG error was being lost, and ENAMETOOLONG was only returned if the subsequent dentry_path call resulted in that error. Other wise if the path was split across a mount point such that the dentry_path fit within the buffer when the __d_path did not the failure was treated as a disconnected path. Signed-off-by: John Johansen

apparmor: fix profile lookup for unconfined

2012-05-18T18:09:28Z

BugLink: http://bugs.launchpad.net/bugs/978038 also affects apparmor portion of BugLink: http://bugs.launchpad.net/bugs/987371 The unconfined profile is not stored in the regular profile list, but change_profile and exec transitions may want access to it when setting up specialized transitions like switch to the unconfined profile of a new policy namespace. Signed-off-by: John Johansen

Fix execve behavior apparmor for PR_{GET,SET}_NO_NEW_PRIVS

2012-04-14T01:13:18Z

Add support for AppArmor to explicitly fail requested domain transitions if NO_NEW_PRIVS is set and the task is not unconfined. Transitions from unconfined are still allowed because this always results in a reduction of privileges. Acked-by: Eric Paris Signed-off-by: Will Drewry Signed-off-by: John Johansen Signed-off-by: Andy Lutomirski v18: new acked-by, new description Signed-off-by: James Morris

Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs

2012-04-14T01:13:18Z

With this change, calling prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) disables privilege granting operations at execve-time. For example, a process will not be able to execute a setuid binary to change their uid or gid if this bit is set. The same is true for file capabilities. Additionally, LSM_UNSAFE_NO_NEW_PRIVS is defined to ensure that LSMs respect the requested behavior. To determine if the NO_NEW_PRIVS bit is set, a task may call prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0); It returns 1 if set and 0 if it is not set. If any of the arguments are non-zero, it will return -1 and set errno to -EINVAL. (PR_SET_NO_NEW_PRIVS behaves similarly.) This functionality is desired for the proposed seccomp filter patch series. By using PR_SET_NO_NEW_PRIVS, it allows a task to modify the system call behavior for itself and its child tasks without being able to impact the behavior of a more privileged task. Another potential use is making certain privileged operations unprivileged. For example, chroot may be considered "safe" if it cannot affect privileged tasks. Note, this patch causes execve to fail when PR_SET_NO_NEW_PRIVS is set and AppArmor is in use. It is fixed in a subsequent patch. Signed-off-by: Andy Lutomirski Signed-off-by: Will Drewry Acked-by: Eric Paris Acked-by: Kees Cook v18: updated change desc v17: using new define values as per 3.4 Signed-off-by: James Morris

LSM: do not initialize common_audit_data to 0

2012-04-09T16:23:04Z

It isn't needed. If you don't set the type of the data associated with that type it is a pretty obvious programming bug. So why waste the cycles? Signed-off-by: Eric Paris

apparmor: move task from common_audit_data to apparmor_audit_data

2012-04-09T16:23:02Z

apparmor is the only LSM that uses the common_audit_data tsk field. Instead of making all LSMs pay for the stack space move the aa usage into the apparmor_audit_data. Signed-off-by: Eric Paris

LSM: remove the COMMON_AUDIT_DATA_INIT type expansion

2012-04-09T16:23:01Z

Just open code it so grep on the source code works better. Signed-off-by: Eric Paris