Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b7b57551 authored by James Morris's avatar James Morris
Browse files

Merge branch 'master' of git://git.infradead.org/users/eparis/selinux into for-linus 



Conflicts:
	lib/flex_array.c
	security/selinux/avc.c
	security/selinux/hooks.c
	security/selinux/ss/policydb.c
	security/smack/smack_lsm.c

Manually resolve conflicts.

Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parents 434d42cf 7a627e3b

MAINTAINERS

+2 −1
Original line number Diff line number Diff line
@@ -5592,10 +5592,11 @@ M: James Morris <jmorris@namei.org> 
M:	Eric Paris <eparis@parisplace.org>

L:	selinux@tycho.nsa.gov (subscribers-only, general discussion)

W:	http://selinuxproject.org

T:	git git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6.git

T:	git git://git.infradead.org/users/eparis/selinux.git

S:	Supported

F:	include/linux/selinux*

F:	security/selinux/

F:	scripts/selinux/



APPARMOR SECURITY MODULE

M:	John Johansen <john.johansen@canonical.com>

include/linux/lsm_audit.h

+6 −5
Original line number Diff line number Diff line
@@ -27,7 +27,7 @@ 
/* Auxiliary data to use in generating the audit record. */

struct common_audit_data {

	char type;

#define LSM_AUDIT_DATA_FS	1

#define LSM_AUDIT_DATA_PATH	1

#define LSM_AUDIT_DATA_NET	2

#define LSM_AUDIT_DATA_CAP	3

#define LSM_AUDIT_DATA_IPC	4
@@ -35,12 +35,13 @@ struct common_audit_data { 
#define LSM_AUDIT_DATA_KEY	6

#define LSM_AUDIT_DATA_NONE	7

#define LSM_AUDIT_DATA_KMOD	8

#define LSM_AUDIT_DATA_INODE	9

#define LSM_AUDIT_DATA_DENTRY	10

	struct task_struct *tsk;

	union 	{

		struct {

		struct path path;

		struct dentry *dentry;

		struct inode *inode;

		} fs;

		struct {

			int netif;

			struct sock *sk;

lib/flex_array.c

+20 −6
Original line number Diff line number Diff line
@@ -88,7 +88,10 @@ struct flex_array *flex_array_alloc(int element_size, unsigned int total, 
					gfp_t flags)

{

	struct flex_array *ret;

	int max_size = FLEX_ARRAY_NR_BASE_PTRS *

	int max_size = 0;



	if (element_size)

		max_size = FLEX_ARRAY_NR_BASE_PTRS *

			   FLEX_ARRAY_ELEMENTS_PER_PART(element_size);



	/* max_size will end up 0 if element_size > PAGE_SIZE */
@@ -183,15 +186,18 @@ __fa_get_part(struct flex_array *fa, int part_nr, gfp_t flags) 
int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,

			gfp_t flags)

{

	int part_nr = fa_element_to_part_nr(fa, element_nr);

	int part_nr;

	struct flex_array_part *part;

	void *dst;



	if (element_nr >= fa->total_nr_elements)

		return -ENOSPC;

	if (!fa->element_size)

		return 0;

	if (elements_fit_in_base(fa))

		part = (struct flex_array_part *)&fa->parts[0];

	else {

		part_nr = fa_element_to_part_nr(fa, element_nr);

		part = __fa_get_part(fa, part_nr, flags);

		if (!part)

			return -ENOMEM;
@@ -211,15 +217,18 @@ EXPORT_SYMBOL(flex_array_put); 
 */

int flex_array_clear(struct flex_array *fa, unsigned int element_nr)

{

	int part_nr = fa_element_to_part_nr(fa, element_nr);

	int part_nr;

	struct flex_array_part *part;

	void *dst;



	if (element_nr >= fa->total_nr_elements)

		return -ENOSPC;

	if (!fa->element_size)

		return 0;

	if (elements_fit_in_base(fa))

		part = (struct flex_array_part *)&fa->parts[0];

	else {

		part_nr = fa_element_to_part_nr(fa, element_nr);

		part = fa->parts[part_nr];

		if (!part)

			return -EINVAL;
@@ -264,6 +273,8 @@ int flex_array_prealloc(struct flex_array *fa, unsigned int start, 


	if (end >= fa->total_nr_elements)

		return -ENOSPC;

	if (!fa->element_size)

		return 0;

	if (elements_fit_in_base(fa))

		return 0;

	start_part = fa_element_to_part_nr(fa, start);
@@ -291,14 +302,17 @@ EXPORT_SYMBOL(flex_array_prealloc); 
 */

void *flex_array_get(struct flex_array *fa, unsigned int element_nr)

{

	int part_nr = fa_element_to_part_nr(fa, element_nr);

	int part_nr;

	struct flex_array_part *part;



	if (!fa->element_size)

		return NULL;

	if (element_nr >= fa->total_nr_elements)

		return NULL;

	if (elements_fit_in_base(fa))

		part = (struct flex_array_part *)&fa->parts[0];

	else {

		part_nr = fa_element_to_part_nr(fa, element_nr);

		part = fa->parts[part_nr];

		if (!part)

			return NULL;
@@ -353,7 +367,7 @@ int flex_array_shrink(struct flex_array *fa) 
	int part_nr;

	int ret = 0;



	if (!fa->total_nr_elements)

	if (!fa->total_nr_elements || !fa->element_size)

		return 0;

	if (elements_fit_in_base(fa))

		return ret;

security/lsm_audit.c

+36 −23
Original line number Diff line number Diff line
@@ -210,7 +210,6 @@ static inline void print_ipv4_addr(struct audit_buffer *ab, __be32 addr, 
static void dump_common_audit_data(struct audit_buffer *ab,

				   struct common_audit_data *a)

{

	struct inode *inode = NULL;

	struct task_struct *tsk = current;



	if (a->tsk)
@@ -229,20 +228,36 @@ static void dump_common_audit_data(struct audit_buffer *ab, 
	case LSM_AUDIT_DATA_CAP:

		audit_log_format(ab, " capability=%d ", a->u.cap);

		break;

	case LSM_AUDIT_DATA_FS:

		if (a->u.fs.path.dentry) {

			struct dentry *dentry = a->u.fs.path.dentry;

			if (a->u.fs.path.mnt) {

				audit_log_d_path(ab, "path=", &a->u.fs.path);

			} else {

	case LSM_AUDIT_DATA_PATH: {

		struct inode *inode;



		audit_log_d_path(ab, "path=", &a->u.path);



		inode = a->u.path.dentry->d_inode;

		if (inode)

			audit_log_format(ab, " dev=%s ino=%lu",

					inode->i_sb->s_id,

					inode->i_ino);

		break;

	}

	case LSM_AUDIT_DATA_DENTRY: {

		struct inode *inode;



		audit_log_format(ab, " name=");

				audit_log_untrustedstring(ab,

						 dentry->d_name.name);

		audit_log_untrustedstring(ab, a->u.dentry->d_name.name);



		inode = a->u.dentry->d_inode;

		if (inode)

			audit_log_format(ab, " dev=%s ino=%lu",

					inode->i_sb->s_id,

					inode->i_ino);

		break;

	}

			inode = dentry->d_inode;

		} else if (a->u.fs.inode) {

	case LSM_AUDIT_DATA_INODE: {

		struct dentry *dentry;

			inode = a->u.fs.inode;

		struct inode *inode;



		inode = a->u.inode;

		dentry = d_find_alias(inode);

		if (dentry) {

			audit_log_format(ab, " name=");
@@ -250,12 +265,10 @@ static void dump_common_audit_data(struct audit_buffer *ab, 
					 dentry->d_name.name);

			dput(dentry);

		}

		}

		if (inode)

			audit_log_format(ab, " dev=%s ino=%lu",

					inode->i_sb->s_id,

		audit_log_format(ab, " dev=%s ino=%lu", inode->i_sb->s_id,

				 inode->i_ino);

		break;

	}

	case LSM_AUDIT_DATA_TASK:

		tsk = a->u.tsk;

		if (tsk && tsk->pid) {

security/selinux/avc.c

+1 −1
Original line number Diff line number Diff line
@@ -526,7 +526,7 @@ int avc_audit(u32 ssid, u32 tsid, 
	 * during retry. However this is logically just as if the operation

	 * happened a little later.

	 */

	if ((a->type == LSM_AUDIT_DATA_FS) &&

	if ((a->type == LSM_AUDIT_DATA_INODE) &&

	    (flags & IPERM_FLAG_RCU))

		return -ECHILD;