linux/security, branch v2.6.27.25

SELinux: BUG in SELinux compat_net code

2009-06-12T03:01:28Z

This patch is not applicable to Linus's tree as the code in question has been removed for 2.6.30. I'm sending in case any of the stable maintainers would like to push to their branches (which I think anything pre 2.6.30 would like to do). Ubuntu users were experiencing a kernel panic when they enabled SELinux due to an old bug in our handling of the compatibility mode network controls, introduced Jan 1 2008 effad8df44261031a882e1a895415f7186a5098e Most distros have not used the compat_net code since the new code was introduced and so noone has hit this problem before. Ubuntu is the only distro I know that enabled that legacy cruft by default. But, I was ask to look at it and found that the above patch changed a call to avc_has_perm from if(send_perm) to if(!send_perm) in selinux_ip_postroute_iptables_compat(). The result is that users who turn on SELinux and have compat_net set can (and oftern will) BUG() in avc_has_perm_noaudit since they are requesting 0 permissions. This patch corrects that accidental bug introduction. Signed-off-by: Eric Paris Signed-off-by: Greg Kroah-Hartman

unreached code in selinux_ip_postroute_iptables_compat() (CVE-2009-1184)

2009-05-02T17:25:09Z

Not upstream in 2.6.30, as the function was removed there, making this a non-issue. Node and port send checks can skip in the compat_net=1 case. This bug was introduced in commit effad8d. Signed-off-by: Eugene Teo Reported-by: Dan Carpenter Acked-by: James Morris Acked-by: Paul Moore Signed-off-by: Greg Kroah-Hartman

security/smack: fix oops when setting a size 0 SMACK64 xattr

2009-05-02T17:23:55Z

upstream commit: 4303154e86597885bc3cbc178a48ccbc8213875f this patch fix an oops in smack when setting a size 0 SMACK64 xattr eg attr -S -s SMACK64 -V '' somefile This oops because smk_import_entry treats a 0 length as SMK_MAXLEN Signed-off-by: Etienne Basset Reviewed-by: James Morris Acked-by: Casey Schaufler Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

selinux: Fix the NetLabel glue code for setsockopt()

2009-03-17T00:52:57Z

commit 09c50b4a52c01a1f450b8eec819089e228655bfb upstream. At some point we (okay, I) managed to break the ability for users to use the setsockopt() syscall to set IPv4 options when NetLabel was not active on the socket in question. The problem was noticed by someone trying to use the "-R" (record route) option of ping: # ping -R 10.0.0.1 ping: record route: No message of desired type The solution is relatively simple, we catch the unlabeled socket case and clear the error code, allowing the operation to succeed. Please note that we still deny users the ability to override IPv4 options on socket's which have NetLabel labeling active; this is done to ensure the labeling remains intact. Signed-off-by: Paul Moore Signed-off-by: James Morris Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman

selinux: Fix a panic in selinux_netlbl_inode_permission()

2009-03-17T00:52:57Z

commit d7f59dc4642ce2fc7b79fcd4ec02ffce7f21eb02 upstream. Rick McNeal from LSI identified a panic in selinux_netlbl_inode_permission() caused by a certain sequence of SUNRPC operations. The problem appears to be due to the lack of NULL pointer checking in the function; this patch adds the pointer checks so the function will exit safely in the cases where the socket is not completely initialized. Signed-off-by: Paul Moore Signed-off-by: James Morris Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman

security: introduce missing kfree

2009-01-25T00:36:24Z

commit 0d54ee1c7850a954026deec4cd4885f331da35cc upstream. Plug this leak. Acked-by: David Howells Cc: James Morris Signed-off-by: Vegard Nossum Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

System call wrappers part 28

2009-01-18T18:35:39Z

commit 938bb9f5e840eddbf54e4f62f6c5ba9b3ae12c9d upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman

System call wrappers part 27

2009-01-18T18:35:39Z

commit 1e7bfb2134dfec37ce04fb3a4ca89299e892d10c upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman

devices cgroup: allow mkfifo

2009-01-18T18:35:26Z

commit 0b82ac37b889ec881b645860da3775118effb3ca upstream. The devcgroup_inode_permission() hook in the devices whitelist cgroup has always bypassed access checks on fifos. But the mknod hook did not. The devices whitelist is only about block and char devices, and fifos can't even be added to the whitelist, so fifos can't be created at all except by tasks which have 'a' in their whitelist (meaning they have access to all devices). Fix the behavior by bypassing access checks to mkfifo. Signed-off-by: Serge E. Hallyn Cc: Li Zefan Cc: Pavel Emelyanov Cc: Paul Menage Cc: Lai Jiangshan Cc: KOSAKI Motohiro Cc: James Morris Reported-by: Daniel Lezcano Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

KEYS: Make request key instantiate the per-user keyrings

2008-11-13T17:56:04Z

commit 1f8f5cf6e4f038552a3e47b66085452c08556d71 upstream Make request_key() instantiate the per-user keyrings so that it doesn't oops if it needs to get hold of the user session keyring because there isn't a session keyring in place. Signed-off-by: David Howells Tested-by: Steve French Tested-by: Rutger Nijlunsing Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman