linux/security, branch mybooklive

gpl-source-mybooklive-02.32.05-044.zip

2014-08-13T23:40:43Z

gpl-source-mybooklive-020202.zip

2014-08-13T23:11:53Z

gpl-source-mybooklive-020035.zip

2014-08-13T23:04:11Z

gpl-source-mybooklive-010002-update.zip

2014-08-13T21:14:13Z

sysctl: require CAP_SYS_RAWIO to set mmap_min_addr

2010-04-01T22:58:16Z

commit 0e1a6ef2dea88101b056b6d9984f3325c5efced3 upstream. Currently the mmap_min_addr value can only be bypassed during mmap when the task has CAP_SYS_RAWIO. However, the mmap_min_addr sysctl value itself can be adjusted to 0 if euid == 0, allowing a bypass without CAP_SYS_RAWIO. This patch adds a check for the capability before allowing mmap_min_addr to be changed. Signed-off-by: Kees Cook Acked-by: Serge Hallyn Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman

netlabel: fix export of SELinux categories > 127

2010-03-15T15:49:34Z

commit c36f74e67fa12202dbcb4ad92c5ac844f9d36b98 upstream. This fixes corrupted CIPSO packets when SELinux categories greater than 127 are used. The bug occured on the second (and later) loops through the while; the inner for loop through the ebitmap->maps array used the same index as the NetLabel catmap->bitmap array, even though the NetLabel bitmap is twice as long as the SELinux bitmap. Signed-off-by: Joshua Roys Acked-by: Paul Moore Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman

SECURITY: selinux, fix update_rlimit_cpu parameter

2010-02-09T12:50:53Z

commit 17740d89785aeb4143770923d67c293849414710 upstream. Don't pass current RLIMIT_RTTIME to update_rlimit_cpu() in selinux_bprm_committing_creds, since update_rlimit_cpu expects RLIMIT_CPU limit. Use proper rlim[RLIMIT_CPU].rlim_cur instead to fix that. Signed-off-by: Jiri Slaby Acked-by: James Morris Cc: Stephen Smalley Cc: Eric Paris Cc: David Howells Signed-off-by: Greg Kroah-Hartman

Keys: KEYCTL_SESSION_TO_PARENT needs TIF_NOTIFY_RESUME architecture support

2010-01-06T23:04:46Z

commit a00ae4d21b2fa9379914f270ffffd8d3bec55430 upstream. As of commit ee18d64c1f632043a02e6f5ba5e045bb26a5465f ("KEYS: Add a keyctl to install a process's session keyring on its parent [try #6]"), CONFIG_KEYS=y fails to build on architectures that haven't implemented TIF_NOTIFY_RESUME yet: security/keys/keyctl.c: In function 'keyctl_session_to_parent': security/keys/keyctl.c:1312: error: 'TIF_NOTIFY_RESUME' undeclared (first use in this function) security/keys/keyctl.c:1312: error: (Each undeclared identifier is reported only once security/keys/keyctl.c:1312: error: for each function it appears in.) Make KEYCTL_SESSION_TO_PARENT depend on TIF_NOTIFY_RESUME until m68k, and xtensa have implemented it. Signed-off-by: Geert Uytterhoeven Signed-off-by: James Morris Acked-by: Mike Frysinger Signed-off-by: Greg Kroah-Hartman

NOMMU: Optimise away the {dac_,}mmap_min_addr tests

2010-01-06T23:04:30Z

commit 6e1415467614e854fee660ff6648bd10fa976e95 upstream. In NOMMU mode clamp dac_mmap_min_addr to zero to cause the tests on it to be skipped by the compiler. We do this as the minimum mmap address doesn't make any sense in NOMMU mode. mmap_min_addr and round_hint_to_min() can be discarded entirely in NOMMU mode. Signed-off-by: David Howells Acked-by: Eric Paris Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman

ima: replace GFP_KERNEL with GFP_NOFS

2009-11-18T21:42:01Z

While running fsstress tests on the NFSv4 mounted ext3 and ext4 filesystem, the following call trace was generated on the nfs server machine. Replace GFP_KERNEL with GFP_NOFS in ima_iint_insert() to avoid a potential deadlock. ================================= [ INFO: inconsistent lock state ] 2.6.31-31.el6.x86_64 #1 --------------------------------- inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-W} usage. kswapd2/75 [HC0[0]:SC0[0]:HE1:SE1] takes: (jbd2_handle){+.+.?.}, at: [] jbd2_journal_start+0xfe/0x13f {RECLAIM_FS-ON-W} state was registered at: [] mark_held_locks+0x65/0x99 [] lockdep_trace_alloc+0xbd/0xf5 [] kmem_cache_alloc+0x40/0x185 [] ima_iint_insert+0x3d/0xf1 [] ima_inode_alloc+0x25/0x44 [] inode_init_always+0xec/0x271 [] alloc_inode+0x51/0xa1 [] new_inode+0x2e/0x94 [] ext4_new_inode+0xb8/0xdc9 [] ext4_create+0xcf/0x175 [] vfs_create+0x82/0xb8 [] do_filp_open+0x32c/0x9ee [] do_sys_open+0x6c/0x12c [] sys_open+0x2e/0x44 [] system_call_fastpath+0x16/0x1b [] 0xffffffffffffffff irq event stamp: 90371 hardirqs last enabled at (90371): [] kmem_cache_alloc+0xf0/0x185 hardirqs last disabled at (90370): [] kmem_cache_alloc+0x89/0x185 softirqs last enabled at (89492): [] __do_softirq+0x1bf/0x1eb softirqs last disabled at (89477): [] call_softirq+0x1c/0x30 other info that might help us debug this: 2 locks held by kswapd2/75: #0: (shrinker_rwsem){++++..}, at: [] shrink_slab+0x44/0x177 #1: (&type->s_umount_key#25){++++..}, at: [] Reported-by: Muni P. Beerakam Reported-by: Amit K. Arora Cc: stable@kernel.org Signed-off-by: Mimi Zohar Signed-off-by: James Morris