Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b6a89584 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 

Pull security subsystem fixes from James Morris.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  fcaps: clear the same personality flags as suid when fcaps are used
  mpi: Avoid using freed pointer in mpi_lshift_limbs()
  Smack: move label list initialization
parents 0db7bd8c d52fc5dd

lib/mpi/mpi-bit.c

+3 −2
Original line number Diff line number Diff line
@@ -177,8 +177,8 @@ int mpi_rshift(MPI x, MPI a, unsigned n) 
 */

int mpi_lshift_limbs(MPI a, unsigned int count)

{

	mpi_ptr_t ap = a->d;

	int n = a->nlimbs;

	const int n = a->nlimbs;

	mpi_ptr_t ap;

	int i;



	if (!count || !n)
@@ -187,6 +187,7 @@ int mpi_lshift_limbs(MPI a, unsigned int count) 
	if (RESIZE_IF_NEEDED(a, n + count) < 0)

		return -ENOMEM;



	ap = a->d;

	for (i = n - 1; i >= 0; i--)

		ap[i + count] = ap[i];

	for (i = 0; i < count; i++)

security/commoncap.c

+5 −0
Original line number Diff line number Diff line
@@ -505,6 +505,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) 
	}

skip:



	/* if we have fs caps, clear dangerous personality flags */

	if (!cap_issubset(new->cap_permitted, old->cap_permitted))

		bprm->per_clear |= PER_CLEAR_ON_SETID;





	/* Don't let someone trace a set[ug]id/setpcap binary with the revised

	 * credentials unless they have the appropriate permit

	 */

security/smack/smack_lsm.c

+33 −11
Original line number Diff line number Diff line
@@ -3640,8 +3640,38 @@ struct security_operations smack_ops = { 
};





static __init void init_smack_know_list(void)

static __init void init_smack_known_list(void)

{

	/*

	 * Initialize CIPSO locks

	 */

	spin_lock_init(&smack_known_huh.smk_cipsolock);

	spin_lock_init(&smack_known_hat.smk_cipsolock);

	spin_lock_init(&smack_known_star.smk_cipsolock);

	spin_lock_init(&smack_known_floor.smk_cipsolock);

	spin_lock_init(&smack_known_invalid.smk_cipsolock);

	spin_lock_init(&smack_known_web.smk_cipsolock);

	/*

	 * Initialize rule list locks

	 */

	mutex_init(&smack_known_huh.smk_rules_lock);

	mutex_init(&smack_known_hat.smk_rules_lock);

	mutex_init(&smack_known_floor.smk_rules_lock);

	mutex_init(&smack_known_star.smk_rules_lock);

	mutex_init(&smack_known_invalid.smk_rules_lock);

	mutex_init(&smack_known_web.smk_rules_lock);

	/*

	 * Initialize rule lists

	 */

	INIT_LIST_HEAD(&smack_known_huh.smk_rules);

	INIT_LIST_HEAD(&smack_known_hat.smk_rules);

	INIT_LIST_HEAD(&smack_known_star.smk_rules);

	INIT_LIST_HEAD(&smack_known_floor.smk_rules);

	INIT_LIST_HEAD(&smack_known_invalid.smk_rules);

	INIT_LIST_HEAD(&smack_known_web.smk_rules);

	/*

	 * Create the known labels list

	 */

	list_add(&smack_known_huh.list, &smack_known_list);

	list_add(&smack_known_hat.list, &smack_known_list);

	list_add(&smack_known_star.list, &smack_known_list);
@@ -3676,16 +3706,8 @@ static __init int smack_init(void) 
	cred = (struct cred *) current->cred;

	cred->security = tsp;



	/* initialize the smack_know_list */

	init_smack_know_list();

	/*

	 * Initialize locks

	 */

	spin_lock_init(&smack_known_huh.smk_cipsolock);

	spin_lock_init(&smack_known_hat.smk_cipsolock);

	spin_lock_init(&smack_known_star.smk_cipsolock);

	spin_lock_init(&smack_known_floor.smk_cipsolock);

	spin_lock_init(&smack_known_invalid.smk_cipsolock);

	/* initialize the smack_known_list */

	init_smack_known_list();



	/*

	 * Register with LSM

security/smack/smackfs.c

+0 −14
Original line number Diff line number Diff line
@@ -1614,20 +1614,6 @@ static int __init init_smk_fs(void) 
	smk_cipso_doi();

	smk_unlbl_ambient(NULL);



	mutex_init(&smack_known_floor.smk_rules_lock);

	mutex_init(&smack_known_hat.smk_rules_lock);

	mutex_init(&smack_known_huh.smk_rules_lock);

	mutex_init(&smack_known_invalid.smk_rules_lock);

	mutex_init(&smack_known_star.smk_rules_lock);

	mutex_init(&smack_known_web.smk_rules_lock);



	INIT_LIST_HEAD(&smack_known_floor.smk_rules);

	INIT_LIST_HEAD(&smack_known_hat.smk_rules);

	INIT_LIST_HEAD(&smack_known_huh.smk_rules);

	INIT_LIST_HEAD(&smack_known_invalid.smk_rules);

	INIT_LIST_HEAD(&smack_known_star.smk_rules);

	INIT_LIST_HEAD(&smack_known_web.smk_rules);



	return err;

}