linux/security, branch v2.6.29.5

keys: Handle there being no fallback destination keyring for request_key()

2009-06-15T16:40:17Z

commit 34574dd10b6d0697b86703388d6d6af9cbf4bb48 upstream. When request_key() is called, without there being any standard process keyrings on which to fall back if a destination keyring is not specified, an oops is liable to occur when construct_alloc_key() calls down_write() on dest_keyring's semaphore. Due to function inlining this may be seen as an oops in down_write() as called from request_key_and_link(). This situation crops up during boot, where request_key() is called from within the kernel (such as in CIFS mounts) where nobody is actually logged in, and so PAM has not had a chance to create a session keyring and user keyrings to act as the fallback. To fix this, make construct_alloc_key() not attempt to cache a key if there is no fallback key if no destination keyring is given specifically. Signed-off-by: David Howells Tested-by: Jeff Layton Signed-off-by: Linus Torvalds Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman

SELinux: BUG in SELinux compat_net code

2009-06-15T16:40:10Z

This patch is not applicable to Linus's tree as the code in question has been removed for 2.6.30. I'm sending in case any of the stable maintainers would like to push to their branches (which I think anything pre 2.6.30 would like to do). Ubuntu users were experiencing a kernel panic when they enabled SELinux due to an old bug in our handling of the compatibility mode network controls, introduced Jan 1 2008 effad8df44261031a882e1a895415f7186a5098e Most distros have not used the compat_net code since the new code was introduced and so noone has hit this problem before. Ubuntu is the only distro I know that enabled that legacy cruft by default. But, I was ask to look at it and found that the above patch changed a call to avc_has_perm from if(send_perm) to if(!send_perm) in selinux_ip_postroute_iptables_compat(). The result is that users who turn on SELinux and have compat_net set can (and oftern will) BUG() in avc_has_perm_noaudit since they are requesting 0 permissions. This patch corrects that accidental bug introduction. Signed-off-by: Eric Paris Signed-off-by: Greg Kroah-Hartman

smack: Set the proper NetLabel security attributes for connection requests

2009-05-18T23:34:54Z

[NOTE: based on 07feee8f812f7327a46186f7604df312c8c81962] This patch ensures the correct labeling of new network connection requests using Smack and NetLabel. Signed-off-by: Paul Moore Signed-off-by: Greg Kroah-Hartman

selinux: Remove dead code labeled networking code

2009-05-18T23:34:53Z

[NOTE: based on 389fb800ac8be2832efedd19978a2b8ced37eb61] Remove code that is no longer needed by NetLabel and/or SELinux. Signed-off-by: Paul Moore Signed-off-by: Greg Kroah-Hartman

selinux: Set the proper NetLabel security attributes for connection requests

2009-05-18T23:34:52Z

[NOTE: based on 389fb800ac8be2832efedd19978a2b8ced37eb61] This patch ensures the correct labeling of incoming connection requests responses via NetLabel by enabling the recent changes to NetLabel and the SELinux/Netlabel glue code. Signed-off-by: Paul Moore Signed-off-by: Greg Kroah-Hartman

selinux: Add new NetLabel glue code to handle labeling of connection requests

2009-05-18T23:34:51Z

[NOTE: based on 389fb800ac8be2832efedd19978a2b8ced37eb61] This patch provides the missing functions to properly handle the labeling of responses to incoming connection requests within SELinux. Signed-off-by: Paul Moore Signed-off-by: Greg Kroah-Hartman

unreached code in selinux_ip_postroute_iptables_compat() (CVE-2009-1184)

2009-05-08T22:45:02Z

Not upstream in 2.6.30, as the function was removed there, making this a non-issue. Node and port send checks can skip in the compat_net=1 case. This bug was introduced in commit effad8d. Signed-off-by: Eugene Teo Reported-by: Dan Carpenter Acked-by: James Morris Acked-by: Paul Moore Signed-off-by: Greg Kroah-Hartman

cap_prctl: don't set error to 0 at 'no_change'

2009-04-27T17:36:59Z

upstream commit: 5bf37ec3e0f5eb79f23e024a7fbc8f3557c087f0 One-liner: capsh --print is broken without this patch. In certain cases, cap_prctl returns error > 0 for success. However, the 'no_change' label was always setting error to 0. As a result, for example, 'prctl(CAP_BSET_READ, N)' would always return 0. It should return 1 if a process has N in its bounding set (as by default it does). I'm keeping the no_change label even though it's now functionally the same as 'error'. Signed-off-by: Serge Hallyn Acked-by: David Howells Signed-off-by: James Morris Signed-off-by: Chris Wright

security/smack: fix oops when setting a size 0 SMACK64 xattr

2009-04-27T17:36:51Z

upstream commit: 4303154e86597885bc3cbc178a48ccbc8213875f this patch fix an oops in smack when setting a size 0 SMACK64 xattr eg attr -S -s SMACK64 -V '' somefile This oops because smk_import_entry treats a 0 length as SMK_MAXLEN Signed-off-by: Etienne Basset Reviewed-by: James Morris Acked-by: Casey Schaufler Signed-off-by: Chris Wright

smack: fixes for unlabeled host support

2009-03-04T21:36:34Z

The following patch (against 2.6.29rc5) fixes a few issues in the smack/netlabel "unlabeled host support" functionnality that was added in 2.6.29rc. It should go in before -final. 1) smack_host_label disregard a "0.0.0.0/0 @" rule (or other label), preventing 'tagged' tasks to access Internet (many systems drop packets with IP options) 2) netmasks were not handled correctly, they were stored in a way _not equivalent_ to conversion to be32 (it was equivalent for /0, /8, /16, /24, /32 masks but not other masks) 3) smack_netlbladdr prefixes (IP/mask) were not consistent (mask&IP was not done), so there could have been different list entries for the same IP prefix; if those entries had different labels, well ... 4) they were not sorted 1) 2) 3) are bugs, 4) is a more cosmetic issue. The patch : -creates a new helper smk_netlbladdr_insert to insert a smk_netlbladdr, -sorted by netmask length -use the new sorted nature of smack_netlbladdrs list to simplify smack_host_label : the first match _will_ be the more specific -corrects endianness issues in smk_write_netlbladdr & netlbladdr_seq_show Signed-off-by: Acked-by: Casey Schaufler Reviewed-by: Paul Moore Signed-off-by: James Morris