linux/security, branch v2.6.24-rc4

file capabilities: don't prevent signaling setuid root programs

2007-11-29T17:24:53Z

An unprivileged process must be able to kill a setuid root program started by the same user. This is legacy behavior needed for instance for xinit to kill X when the window manager exits. When an unprivileged user runs a setuid root program in !SECURE_NOROOT mode, fP, fI, and fE are set full on, so pP' and pE' are full on. Then cap_task_kill() prevents the user from signaling the setuid root task. This is a change in behavior compared to when !CONFIG_SECURITY_FILE_CAPABILITIES. This patch introduces a special check into cap_task_kill() just to check whether a non-root user is signaling a setuid root program started by the same user. If so, then signal is allowed. Signed-off-by: Serge E. Hallyn Cc: Andrew Morgan Cc: Stephen Smalley Cc: Chris Wright Cc: James Morris Cc: Casey Schaufler Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

file capabilities: allow sigcont within session

2007-11-15T02:45:44Z

Fix http://bugzilla.kernel.org/show_bug.cgi?id=9247 Allow sigcont to be sent to a process with greater capabilities if it is in the same session. Otherwise, a shell from which I've started a root shell and done 'suspend' can't be restarted by the parent shell. Also don't do file-capabilities signaling checks when uids for the processes don't match, since the standard check_kill_permission will have done those checks. [akpm@linux-foundation.org: coding-style cleanups] Signed-off-by: Serge E. Hallyn Acked-by: Andrew Morgan Cc: Chris Wright Tested-by: "Theodore Ts'o" Cc: Stephen Smalley Cc: "Rafael J. Wysocki" Cc: Chris Wright Cc: James Morris Cc: Stephen Smalley Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

SELinux: add more validity checks on policy load

2007-11-07T21:56:23Z

Add more validity checks at policy load time to reject malformed policies and prevent subsequent out-of-range indexing when in permissive mode. Resolves the NULL pointer dereference reported in https://bugzilla.redhat.com/show_bug.cgi?id=357541. Signed-off-by: Stephen Smalley Signed-off-by: James Morris

SELinux: fix bug in new ebitmap code.

2007-11-07T21:55:10Z

The "e_iter = e_iter->next;" statement in the inner for loop is primally bug. It should be moved to outside of the for loop. Signed-off-by: KaiGai Kohei Acked-by: Stephen Smalley Signed-off-by: James Morris

SELinux: suppress a warning for 64k pages.

2007-11-07T21:55:04Z

On PowerPC allmodconfig build we get this: security/selinux/xfrm.c:214: warning: comparison is always false due to limited range of data type Signed-off-by: Stephen Rothwell Signed-off-by: James Morris

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6

2007-10-23T15:59:46Z

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6: SELinux: always check SIGCHLD in selinux_task_wait

SELinux: always check SIGCHLD in selinux_task_wait

2007-10-22T22:47:48Z

When checking if we can wait on a child we were looking at p->exit_signal and trying to make the decision based on if the signal would eventually be allowed. One big flaw is that p->exit_signal is -1 for NPTL threads and so aignal_to_av was not actually checking SIGCHLD which is what would have been sent. Even is exit_signal was set to something strange it wouldn't change the fact that the child was there and needed to be waited on. This patch just assumes wait is based on SIGCHLD. Specific permission checks are made when the child actually attempts to send a signal. This resolves the problem of things like using GDB on confined domains such as in RH BZ 232371. The confined domain did not have permission to send a generic signal (exit_signal == -1) back to the unconfined GDB. With this patch the GDB wait works and since the actual signal sent is allowed everything functions as it should. Signed-off-by: Eric Paris Signed-off-by: James Morris

capabilities: clean up file capability reading

2007-10-22T15:13:18Z

Simplify the vfs_cap_data structure. Also fix get_file_caps which was declaring __le32 v1caps[XATTR_CAPS_SZ] on the stack, but XATTR_CAPS_SZ is already * sizeof(__le32). [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Serge E. Hallyn Cc: Andrew Morgan Cc: Chris Wright Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

pid namespaces: define is_global_init() and is_container_init()

2007-10-19T18:53:37Z

is_init() is an ambiguous name for the pid==1 check. Split it into is_global_init() and is_container_init(). A cgroup init has it's tsk->pid == 1. A global init also has it's tsk->pid == 1 and it's active pid namespace is the init_pid_ns. But rather than check the active pid namespace, compare the task structure with 'init_pid_ns.child_reaper', which is initialized during boot to the /sbin/init process and never changes. Changelog: 2.6.22-rc4-mm2-pidns1: - Use 'init_pid_ns.child_reaper' to determine if a given task is the global init (/sbin/init) process. This would improve performance and remove dependence on the task_pid(). 2.6.21-mm2-pidns2: - [Sukadev Bhattiprolu] Changed is_container_init() calls in {powerpc, ppc,avr32}/traps.c for the _exception() call to is_global_init(). This way, we kill only the cgroup if the cgroup's init has a bug rather than force a kernel panic. [akpm@linux-foundation.org: fix comment] [sukadev@us.ibm.com: Use is_global_init() in arch/m32r/mm/fault.c] [bunk@stusta.de: kernel/pid.c: remove unused exports] [sukadev@us.ibm.com: Fix capability.c to work with threaded init] Signed-off-by: Serge E. Hallyn Signed-off-by: Sukadev Bhattiprolu Acked-by: Pavel Emelianov Cc: Eric W. Biederman Cc: Cedric Le Goater Cc: Dave Hansen Cc: Herbert Poetzel Cc: Kirill Korotaev Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

sparse pointer use of zero as null

2007-10-18T21:37:31Z

Get rid of sparse related warnings from places that use integer as NULL pointer. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Stephen Hemminger Cc: Andi Kleen Cc: Jeff Garzik Cc: Matt Mackall Cc: Ian Kent Cc: Arnd Bergmann Cc: Davide Libenzi Cc: Stephen Smalley Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds