aboutsummaryrefslogtreecommitdiffstats
path: root/security
Commit message (Collapse)AuthorAgeFilesLines
* selinux/nlmsg: add XFRM_MSG_NEWSPDINFONicolas Dichtel2016-03-111-0/+1
| | | | | | | | | | | | commit 2b7834d3e1b828429faa5dc41a480919e52d3f31 upstream (net-next). This new command is missing. Change-Id: If511000c19aa9af7220ff775d88ace9834b35dcb Fixes: 880a6fab8f6b ("xfrm: configure policy hash table thresholds by netlink") Reported-by: Christophe Gouault <christophe.gouault@6wind.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* selinux: fix inode security list corruptionStephen Smalley2016-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 923190d32de4428afbea5e5773be86bea60a9925 upstream. sb_finish_set_opts() can race with inode_free_security() when initializing inode security structures for inodes created prior to initial policy load or by the filesystem during ->mount(). This appears to have always been a possible race, but commit 3dc91d4 ("SELinux: Fix possible NULL pointer dereference in selinux_inode_permission()") made it more evident by immediately reusing the unioned list/rcu element of the inode security structure for call_rcu() upon an inode_free_security(). But the underlying issue was already present before that commit as a possible use-after-free of isec. Shivnandan Kumar reported the list corruption and proposed a patch to split the list and rcu elements out of the union as separate fields of the inode_security_struct so that setting the rcu element would not affect the list element. However, this would merely hide the issue and not truly fix the code. This patch instead moves up the deletion of the list entry prior to dropping the sbsec->isec_lock initially. Then, if the inode is dropped subsequently, there will be no further references to the isec. Change-Id: Iac9264851e98933deabedaa9c4ead434669a07a8 Reported-by: Shivnandan Kumar <shivnandan.k@samsung.com> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* pstore: selinux: add security in-core xattr support for pstore and debugfsMark Salyzyn2016-03-111-9/+5
| | | | | | | | | | | | | - add "pstore" and "debugfs" to list of in-core exceptions - change fstype checks to boolean equation - change from strncmp to strcmp for checking (Cherry Pick from commit 2294d499b7969df3838becf5e58bf16b0e3c86c8) Signed-off-by: Mark Salyzyn <salyzyn@google.com> Bug: 18917345 Bug: 18935184 Change-Id: Ib648f30ce4b5d6c96f11465836d6fee89bec1c72
* LSM: shrink sizeof LSM specific portion of common_audit_dataEric Paris2016-03-1115-100/+241
| | | | | | | | | | | | | | | Linus found that the gigantic size of the common audit data caused a big perf hit on something as simple as running stat() in a loop. This patch requires LSMs to declare the LSM specific portion separately rather than doing it in a union. Thus each LSM can be responsible for shrinking their portion and don't have to pay a penalty just because other LSMs have a bigger space requirement. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Conflicts: security/selinux/avc.c
* Revert "selinux: fix merge conflicts"Ziyan2016-03-112-2/+4
| | | | This reverts commit ed376663c228d53902ee78a89b1d3549565f4825.
* AppArmor: Fix oops in policy unpack auditingJohn Johansen2016-03-111-2/+3
| | | | | | | | | | | | Post unpacking of policy a verification pass is made on x transition indexes. When this fails a call to audit_iface is made resulting in an oops, because audit_iface is expecting a valid buffer position but since the failure comes from post unpack verification there is none. Make the position argument optional so that audit_iface can be called from post unpack verification. Signed-off-by: John Johansen <john.johansen@canonical.com>
* security: remove the security_netlink_recv hook as it is equivalent to capable()Eric Paris2016-03-114-34/+0
| | | | | | | | | | Once upon a time netlink was not sync and we had to get the effective capabilities from the skb that was being received. Today we instead get the capabilities from the current task. This has rendered the entire purpose of the hook moot as it is now functionally equivalent to the capable() call. Signed-off-by: Eric Paris <eparis@redhat.com>
* capabilities: remove the task from capable LSM hook entirelyEric Paris2016-03-114-30/+24
| | | | | | | | | | | | | | | | | | | The capabilities framework is based around credentials, not necessarily the current task. Yet we still passed the current task down into LSMs from the security_capable() LSM hook as if it was a meaningful portion of the security decision. This patch removes the 'generic' passing of current and instead forces individual LSMs to use current explicitly if they think it is appropriate. In our case those LSMs are SELinux and AppArmor. I believe the AppArmor use of current is incorrect, but that is wholely unrelated to this patch. This patch does not change what AppArmor does, it just makes it clear in the AppArmor code that it is doing it. The SELinux code still uses current in it's audit message, which may also be wrong and needs further investigation. Again this is NOT a change, it may have always been wrong, this patch just makes it clear what is happening. Signed-off-by: Eric Paris <eparis@redhat.com>
* selinux: fix merge conflictsZiyan2016-01-172-4/+2
|
* selinux: Report permissive mode in avc: denied messages.Stephen Smalley2016-01-171-2/+7
| | | | | | | | | | | | | We cannot presently tell from an avc: denied message whether access was in fact denied or was allowed due to global or per-domain permissive mode. Add a permissive= field to the avc message to reflect this information. Change-Id: I23adf43e417687f1da7354d392d37f5fabbd805e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Dan Trifan <jimsth@gmail.com> Conflicts: security/selinux/avc.c
* SELinux: per-command whitelisting of ioctlsJeff Vander Stoep2016-01-1711-64/+812
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | note that this patch depends on a prior patch that is already in android-3.4 but has not apparently found its way into the msm 3.4 branches (but is included in exynos and tegra), https://android-review.googlesource.com/#/c/92962/ Extend the generic ioctl permission check with support for per-command filtering. Source/target/class sets including the ioctl permission may additionally include a set of commands. Example: allow <source> <target>:<class> { 0x8910-0x8926 0x892A-0x8935 } auditallow <source> <target>:<class> 0x892A When ioctl commands are omitted only the permissions are checked. This feature is intended to provide finer granularity for the ioctl permission which may be too imprecise in some circumstances. For example, the same driver may use ioctls to provide important and benign functionality such as driver version or socket type as well as dangerous capabilities such as debugging features, read/write/execute to physical memory or access to sensitive data. Per-command filtering provides a mechanism to reduce the attack surface of the kernel, and limit applications to the subset of commands required. The format of the policy binary has been modified to include ioctl commands, and the policy version number has been incremented to POLICYDB_VERSION_IOCTL_OPERATIONS=30 to account for the format change. Bug: 18087110 Change-Id: Ibf0e36728f6f3f0d5af56ccdeddee40800af689d Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
* security: lsm_audit: add ioctl specific auditingJeff Vander Stoep2016-01-171-0/+15
| | | | | | | | | Add information about ioctl calls to the LSM audit data. Log the file path and command number. Bug: 18087110 Change-Id: Idbbd106db6226683cb30022d9e8f6f3b8fab7f84 Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
* SELinux: Update policy version to support constraints infoRichard Haines2016-01-174-10/+101
| | | | | | | | | | | | Update the policy version (POLICYDB_VERSION_CONSTRAINT_NAMES) to allow holding of policy source info for constraints. Upstream commit a660bec1d84ad19a39e380af129e207b3b8f609e Signed-off-by: Richard Haines <richard_c_haines@btinternet.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <pmoore@redhat.com> Change-Id: If419c7bfdea2f7006c9a62ea595f0cbfe5c78871
* SELinux: add default_type statementsEric Paris2016-01-174-6/+33
| | | | | | | | | | | Because Fedora shipped userspace based on my development tree we now have policy version 27 in the wild defining only default user, role, and range. Thus to add default_type we need a policy.28. Upstream commit eed7795d0a2c9b2e934afc088e903fa2c17b7958 Signed-off-by: Eric Paris <eparis@redhat.com> Change-Id: Icb3324af7f740249977a4559c2c5692c7fcc22a2
* SELinux: allow default source/target selectors for user/role/rangeEric Paris2016-01-176-8/+109
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When new objects are created we have great and flexible rules to determine the type of the new object. We aren't quite as flexible or mature when it comes to determining the user, role, and range. This patch adds a new ability to specify the place a new objects user, role, and range should come from. For users and roles it can come from either the source or the target of the operation. aka for files the user can either come from the source (the running process and todays default) or it can come from the target (aka the parent directory of the new file) examples always are done with directory context: system_u:object_r:mnt_t:s0-s0:c0.c512 process context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [no rule] unconfined_u:object_r:mnt_t:s0 test_none [default user source] unconfined_u:object_r:mnt_t:s0 test_user_source [default user target] system_u:object_r:mnt_t:s0 test_user_target [default role source] unconfined_u:unconfined_r:mnt_t:s0 test_role_source [default role target] unconfined_u:object_r:mnt_t:s0 test_role_target [default range source low] unconfined_u:object_r:mnt_t:s0 test_range_source_low [default range source high] unconfined_u:object_r:mnt_t:s0:c0.c1023 test_range_source_high [default range source low-high] unconfined_u:object_r:mnt_t:s0-s0:c0.c1023 test_range_source_low-high [default range target low] unconfined_u:object_r:mnt_t:s0 test_range_target_low [default range target high] unconfined_u:object_r:mnt_t:s0:c0.c512 test_range_target_high [default range target low-high] unconfined_u:object_r:mnt_t:s0-s0:c0.c512 test_range_target_low-high upstream commit aa893269de6277b44be88e25dcd5331c934c29c4 Change-Id: Ic8f33d05793bf742c70c68ea79e33c7f40ffbd53 Signed-off-by: Eric Paris <eparis@redhat.com>
* SELinux: remove avd from slow_avc_audit()Eric Paris2016-01-171-2/+2
| | | | | | | | We don't use the argument, so remove it. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Dan Trifan <jimsth@gmail.com>
* selinux: inline avc_audit() and avc_has_perm_noaudit() into callerLinus Torvalds2016-01-171-2/+2
| | | | | | | | | | | | | | | | | Now that all the slow-path code is gone from these functions, we can inline them into the main caller - avc_has_perm_flags(). Now the compiler can see that 'avc' is allocated on the stack for this case, which helps register pressure a bit. It also actually shrinks the total stack frame, because the stack frame that avc_has_perm_flags() always needed (for that 'avc' allocation) is now sufficient for the inlined functions too. Inlining isn't bad - but mindless inlining of cold code (see the previous commit) is. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Dan Trifan <jimsth@gmail.com>
* selinux: don't inline slow-path code into avc_has_perm_noaudit()Linus Torvalds2016-01-171-14/+38
| | | | | | | | | | | | | | | | | | | | | | | The selinux AVC paths remain some of the hottest (and deepest) codepaths at filename lookup time, and we make it worse by having the slow path cases take up I$ and stack space even when they don't trigger. Gcc tends to always want to inline functions that are just called once - never mind that this might make for slower and worse code in the caller. So this tries to improve on it a bit by making the slow-path cases explicitly separate functions that are marked noinline, causing gcc to at least no longer allocate stack space for them unless they are actually called. It also seems to help register allocation a tiny bit, since gcc now doesn't take the slow case code into account. Uninlining the slow path may also allow us to inline the remaining hot path into the one caller that actually matters: avc_has_perm_flags(). I'll have to look at that separately, but both avc_audit() and avc_has_perm_noaudit() are now small and lean enough that inlining them may make sense. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Dan Trifan <jimsth@gmail.com>
* security: optimize avc_audit() common pathLinus Torvalds2016-01-171-29/+41
| | | | | | | | | | | | | | | | | | | | | | | | | avc_audit() did a lot of jumping around and had a big stack frame, all for the uncommon case. Split up the uncommon case (which we really can't make go fast anyway) into its own slow function, and mark the conditional branches appropriately for the common likely case. This causes avc_audit() to no longer show up as one of the hottest functions on the branch profiles (the new "perf -b" thing), and makes the cycle profiles look really nice and dense too. The whole audit path is still annoyingly very much one of the biggest costs of name lookup, so these things are worth optimizing for. I wish we could just tell people to turn it off, but realistically we do need it: we just need to make sure that the overhead of the necessary evil is as low as possible. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Dan Trifan <jimsth@gmail.com> Conflicts: security/selinux/avc.c
* cgroup: introduce cgroup_taskset and use it in subsys->can_attach(), ↵Tejun Heo2016-01-081-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | cancel_attach() and attach() Currently, there's no way to pass multiple tasks to cgroup_subsys methods necessitating the need for separate per-process and per-task methods. This patch introduces cgroup_taskset which can be used to pass multiple tasks and their associated cgroups to cgroup_subsys methods. Three methods - can_attach(), cancel_attach() and attach() - are converted to use cgroup_taskset. This unifies passed parameters so that all methods have access to all information. Conversions in this patchset are identical and don't introduce any behavior change. -v2: documentation updated as per Paul Menage's suggestion. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Reviewed-by: Frederic Weisbecker <fweisbec@gmail.com> Acked-by: Paul Menage <paul@paulmenage.org> Acked-by: Li Zefan <lizf@cn.fujitsu.com> Cc: Balbir Singh <bsingharora@gmail.com> Cc: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: James Morris <jmorris@namei.org>
* Enable setting security contexts on rootfs inodes.Stephen Smalley2014-11-261-0/+7
| | | | | | | | | | | | | | | | rootfs (ramfs) can support setting of security contexts by userspace due to the vfs fallback behavior of calling the security module to set the in-core inode state for security.* attributes when the filesystem does not provide an xattr handler. No xattr handler required as the inodes are pinned in memory and have no backing store. This is useful in allowing early userspace to label individual files within a rootfs while still providing a policy-defined default via genfs. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* SELinux: Fix possible NULL pointer dereference in selinux_inode_permission()Steven Rostedt2014-11-202-3/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While running stress tests on adding and deleting ftrace instances I hit this bug: BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 IP: selinux_inode_permission+0x85/0x160 PGD 63681067 PUD 7ddbe067 PMD 0 Oops: 0000 [#1] PREEMPT CPU: 0 PID: 5634 Comm: ftrace-test-mki Not tainted 3.13.0-rc4-test-00033-gd2a6dde-dirty #20 Hardware name: /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006 task: ffff880078375800 ti: ffff88007ddb0000 task.ti: ffff88007ddb0000 RIP: 0010:[<ffffffff812d8bc5>] [<ffffffff812d8bc5>] selinux_inode_permission+0x85/0x160 RSP: 0018:ffff88007ddb1c48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000800000 RCX: ffff88006dd43840 RDX: 0000000000000001 RSI: 0000000000000081 RDI: ffff88006ee46000 RBP: ffff88007ddb1c88 R08: 0000000000000000 R09: ffff88007ddb1c54 R10: 6e6576652f6f6f66 R11: 0000000000000003 R12: 0000000000000000 R13: 0000000000000081 R14: ffff88006ee46000 R15: 0000000000000000 FS: 00007f217b5b6700(0000) GS:ffffffff81e21000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033^M CR2: 0000000000000020 CR3: 000000006a0fe000 CR4: 00000000000007f0 Call Trace: security_inode_permission+0x1c/0x30 __inode_permission+0x41/0xa0 inode_permission+0x18/0x50 link_path_walk+0x66/0x920 path_openat+0xa6/0x6c0 do_filp_open+0x43/0xa0 do_sys_open+0x146/0x240 SyS_open+0x1e/0x20 system_call_fastpath+0x16/0x1b Code: 84 a1 00 00 00 81 e3 00 20 00 00 89 d8 83 c8 02 40 f6 c6 04 0f 45 d8 40 f6 c6 08 74 71 80 cf 02 49 8b 46 38 4c 8d 4d cc 45 31 c0 <0f> b7 50 20 8b 70 1c 48 8b 41 70 89 d9 8b 78 04 e8 36 cf ff ff RIP selinux_inode_permission+0x85/0x160 CR2: 0000000000000020 Investigating, I found that the inode->i_security was NULL, and the dereference of it caused the oops. in selinux_inode_permission(): isec = inode->i_security; rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd); Note, the crash came from stressing the deletion and reading of debugfs files. I was not able to recreate this via normal files. But I'm not sure they are safe. It may just be that the race window is much harder to hit. What seems to have happened (and what I have traced), is the file is being opened at the same time the file or directory is being deleted. As the dentry and inode locks are not held during the path walk, nor is the inodes ref counts being incremented, there is nothing saving these structures from being discarded except for an rcu_read_lock(). The rcu_read_lock() protects against freeing of the inode, but it does not protect freeing of the inode_security_struct. Now if the freeing of the i_security happens with a call_rcu(), and the i_security field of the inode is not changed (it gets freed as the inode gets freed) then there will be no issue here. (Linus Torvalds suggested not setting the field to NULL such that we do not need to check if it is NULL in the permission check). Note, this is a hack, but it fixes the problem at hand. A real fix is to restructure the destroy_inode() to call all the destructor handlers from the RCU callback. But that is a major job to do, and requires a lot of work. For now, we just band-aid this bug with this fix (it works), and work on a more maintainable solution in the future. Link: http://lkml.kernel.org/r/20140109101932.0508dec7@gandalf.local.home Link: http://lkml.kernel.org/r/20140109182756.17abaaa8@gandalf.local.home Cc: stable@vger.kernel.org Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* SMC: Fix compiler warningsBryan Buckley2014-10-031-1/+1
| | | | | | | | security/smc/tf_device.c:174: missing braces around initializer security/smc/tf_device.c:174: (near initialization for 'g_tf_dev.kobj') Change-Id: Ia8b3b9420ab3b860900d1db9fe0ed925b96fc200 Signed-off-by: Bryan Buckley <bryan.buckley@ti.com>
* smc: remove duplicate flagsZiyann2014-10-031-3/+0
|
* Enable the ARM security extension when compiling some filesJason Simmons2014-10-011-0/+3
| | | | | | Change-Id: I5704b5b0edc55b66d4917352198d921f246ad404 Signed-off-by: Jason Simmons <jsimmons@google.com> Signed-off-by: Ruslan Bilovol <ruslan.bilovol@ti.com>
* SMC: Update UUID to match generic, common secure playback driverBryan Buckley2014-10-011-8/+8
| | | | | | | Remove WVDRM prepends as this UUID is now generic. Change-Id: I8b890d3f8227523635a394c9b02d409d597def8c Signed-off-by: Bryan Buckley <bryan.buckley@ti.com>
* SMC: Unlock aes_hwa_ctx lock in case of bad dma_map_sgBryan Buckley2014-10-012-2/+5
| | | | | | | | | | | This release of the SMC package fixes PL310 accesses (See MSDK273 from MSHIELD) In case of bad dma_map_sg, we silently fail. Be sure to call spin_unlock_irqrestore before silently failing. Change-Id: Ib6015c0710e56eae2bce341f263d62142f12ba3e Signed-off-by: Bryan Buckley <bryan.buckley@ti.com>
* SMC: Update to AG01.06p4 releaseTrusted Logic2014-10-018-33/+72
| | | | | | | | | | | | | | | | | | | With this SMC driver version present in MSHIELD-DK 1.7.10 and using corresponding PPA/PA, the crypto driver now uses DMA beyond a certain data size threshold. It fixes some statbility issues observed since introduction of DMA in MSHIELD-DK release 1.7.2 * start using GFP_ATOMIC instead of GFP_KERNEL in aes_sync_operate() and tf_digest_hw_perform_dma() * tf_clock_timer_start() now called in tf_clock_timer_cbis() * fixed potential memory leak in aes_sync_operate Change-Id: Ifcb4653b0cad7dc2e5cf61bd58631c56d7738dd7 Signed-off-by: Trusted Logic <smc_support@trusted-logic.com> Signed-off-by: Bryan Buckley <bryan.buckley@ti.com> Signed-off-by: Srinivas Pulukuru <srinivas.pulukuru@ti.com>
* OMAP: SMC: Fix compile error if CONFIG_ION is not enabledGrygorii Strashko2014-10-011-0/+2
| | | | | Change-Id: I541f0281916c008e0bf7dfe0069eaf700de37d42 Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
* SMC: Fix regression where AES1 clock would never be disabledTrusted Logic2014-10-011-0/+2
| | | | | | Change-Id: I3b620a573b2eee85c76036bcdab9f851ce9c7513 Signed-off-by: Trusted Logic <smc_support@trusted-logic.com> Signed-off-by: Jeremie Corbier <jeremie.corbier@trusted-logic.com>
* SMC: Fix PA load error 0xffff3020Trusted Logic2014-10-017-24/+39
| | | | | | | | | | | | | | Fix "Error while loading the PA [0xffff3020]" Improve synchronous public crypto. WARNING: using this patch with an older PA binary (before MSHIELD v1.7.5) will result in a PA load error. This patch is coupled with changes in the secure PA (cache flush/invalidiation) Change-Id: I3c3b7c41917b1146d6cb6f29ee33848eb9c3c0dc Signed-off-by: Trusted Logic <smc_support@trusted-logic.com> Signed-off-by: Bryan Buckley <bryan.buckley@ti.com>
* SMC: Update to AG01.06 production releaseTrusted Logic2014-10-016-29/+204
| | | | | | | | | | | | | | | | | | | Last SMC update was to AG01.06 engineering release (see s_version.h) this is the official patch to production AG01.06. This update notably brings support for: * OMAP4 HW RNG - see new menuconfig option * GP devices are okay to be built with this SMC based on testing (even though it is not functional for GP devices, the SMC driver will no longer keep the device from entering suspend) Change-Id: I974693ca73a038e2b547917e1a9556299a9bab11 Signed-off-by: Trusted Logic <smc_support@trusted-logic.com> Signed-off-by: Jeremie Corbier <jeremie.corbier@trusted-logic.com> Signed-off-by: Bryan Buckley <bryan.buckley@ti.com> Conflicts: security/smc/Makefile
* OMAP: SMC: Fix-up some whitespaceBryan Buckley2014-10-019-13/+10
| | | | | Change-Id: Iead40d07843a876892f17f109619a593e3b53a58 Signed-off-by: Bryan Buckley <bryan.buckley@ti.com>
* OMAP4: SMC: remove group id check within SMC driverBryan Buckley2014-10-011-9/+0
| | | | | | | | | | | | Previously the driver will only allow the SMC daemon to start by the kernel or a gid of 0. We remove this gid check and rely on the linux device node access permissions. Change-Id: Iaf2747c6f58a722f7668f9a5ad3ea7177c1233bf Signed-off-by: Bryan Buckley <bryan.buckley@ti.com> Conflicts: security/smc/tf_conn.c
* OMAP: SMC: Update to AG01.06 releaseTrusted Logic2014-10-0127-1394/+2899
| | | | | | | | | | | | | | | | | | | | | | | This update should only be used with PPA 1.6.4 and higher. There are many important, coupled fixes in PPA 1.6.3+, including ROM code critical section management. * GP devices should still be built without SMC * SMC driver now supports starting the SMC daemon within a member group system. By default this is set to 1026 DRMRPC * FIPS certification capable (requires more patches to kernel though) * fixed ext4 filesystem corruptions on HW encrypted partitions * fixed wrong handle returned by C_OpenSession (crypto API) when opening a secondary session from a service * fixed SHandleClose silently fails on cryptoki key handles * fixed two instances of the tf_daemon could connect to the SMC PA * fixed Potential memory leak in case of error when tf_daemon is connecting to secure Change-Id: I1b792c88fb4615fae60643d49989ac9fa542bf9b Signed-off-by: Trusted Logic <smc_support@trusted-logic.com> Signed-off-by: Jeremie Corbier <jeremie.corbier@trusted-logic.com> Signed-off-by: Bryan Buckley <bryan.buckley@ti.com>
* Revert "OMAP4: SMC: remove group id check within SMC driver"Ziyann2014-10-011-0/+7
| | | | This reverts commit ac5b3e5e80118f26c56d73b277f9c63c916f9a48.
* OMAP4: SMC: Fix two compiler warnings in security/smc/tf_comm.cBryan Buckley2014-10-011-1/+4
| | | | | | | | | | | | | | | | security/smc/tf_comm.c: In function 'tf_fill_descriptor_table': security/smc/tf_comm.c:835: warning: ISO C90 forbids mixed declarations and code security/smc/tf_comm.c:918: warning: 'error' may be used uninitialized in this function security/smc/tf_comm.c:645: note: 'error' was declared here Moved declaration of "struct page *page" to beginning of functional block. Ensure 'error' gets set correctly and never reports a false negative. Change-Id: Icbb10298eb5da9b455ede587195a0a7a16feef13 Signed-off-by: Bryan Buckley <bryan.buckley@ti.com>
* Merge branch 'android-omap-3.0' into android-omap-tuna-3.0Todd Poynor2013-04-294-0/+109
|\
| * Merge branch 'android-3.0' into android-omap-3.0Todd Poynor2013-04-294-0/+109
| |\
| | * Add permission checking for binder IPC.Stephen Smalley2013-04-294-0/+109
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not apply permission checks to private files. Fix security_binder_transfer_binder hook. Drop the owning task argument to security_binder_transfer_binder since ref->node->proc can be NULL (dead owner?). Revise the SELinux checking to apply a single transfer check between the source and destination tasks. Owning task is no longer relevant. Drop the receive permission definition as it is no longer used. This makes the transfer permission similar to the call permission; it is only useful if you want to allow a binder IPC between two tasks (call permission) but deny passing of binder references between them (transfer permission). Change-Id: I51e7a9a6662e826073b35e4f70a57f9ec73e472e Signed-off-by: William Roberts <w.roberts@sta.samsung.com>
* | | Merge branch 'android-omap-3.0' into android-omap-tuna-3.0Todd Poynor2013-04-054-6/+6
|\ \ \ | |/ /
| * | Merge branch 'android-3.0' into android-omap-3.0Todd Poynor2013-04-054-6/+6
| |\ \ | | |/
| | * Merge tag 'v3.0.72' into android-3.0Todd Poynor2013-04-054-6/+6
| | |\ | | | | | | | | | | | | This is the 3.0.72 stable release
| | | * Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and ↵Mathieu Desnoyers2013-03-281-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | security keys commit 8aec0f5d4137532de14e6554fd5dd201ff3a3c49 upstream. Looking at mm/process_vm_access.c:process_vm_rw() and comparing it to compat_process_vm_rw() shows that the compatibility code requires an explicit "access_ok()" check before calling compat_rw_copy_check_uvector(). The same difference seems to appear when we compare fs/read_write.c:do_readv_writev() to fs/compat.c:compat_do_readv_writev(). This subtle difference between the compat and non-compat requirements should probably be debated, as it seems to be error-prone. In fact, there are two others sites that use this function in the Linux kernel, and they both seem to get it wrong: Now shifting our attention to fs/aio.c, we see that aio_setup_iocb() also ends up calling compat_rw_copy_check_uvector() through aio_setup_vectored_rw(). Unfortunately, the access_ok() check appears to be missing. Same situation for security/keys/compat.c:compat_keyctl_instantiate_key_iov(). I propose that we add the access_ok() check directly into compat_rw_copy_check_uvector(), so callers don't have to worry about it, and it therefore makes the compat call code similar to its non-compat counterpart. Place the access_ok() check in the same location where copy_from_user() can trigger a -EFAULT error in the non-compat code, so the ABI behaviors are alike on both compat and non-compat. While we are here, fix compat_do_readv_writev() so it checks for compat_rw_copy_check_uvector() negative return values. And also, fix a memory leak in compat_keyctl_instantiate_key_iov() error handling. Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Acked-by: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * key: Fix resource leakAlan Cox2013-03-281-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit a84a921978b7d56e0e4b87ffaca6367429b4d8ff upstream. On an error iov may still have been reallocated and need freeing Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * selinux: use GFP_ATOMIC under spin_lockDan Carpenter2013-03-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 4502403dcf8f5c76abd4dbab8726c8e4ecb5cd34 upstream. The call tree here is: sk_clone_lock() <- takes bh_lock_sock(newsk); xfrm_sk_clone_policy() __xfrm_sk_clone_policy() clone_policy() <- uses GFP_ATOMIC for allocations security_xfrm_policy_clone() security_ops->xfrm_policy_clone_security() selinux_xfrm_policy_clone() Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * keys: fix race with concurrent install_user_keyrings()David Howells2013-03-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 0da9dfdd2cd9889201bc6f6f43580c99165cd087 upstream. This fixes CVE-2013-1792. There is a race in install_user_keyrings() that can cause a NULL pointer dereference when called concurrently for the same user if the uid and uid-session keyrings are not yet created. It might be possible for an unprivileged user to trigger this by calling keyctl() from userspace in parallel immediately after logging in. Assume that we have two threads both executing lookup_user_key(), both looking for KEY_SPEC_USER_SESSION_KEYRING. THREAD A THREAD B =============================== =============================== ==>call install_user_keyrings(); if (!cred->user->session_keyring) ==>call install_user_keyrings() ... user->uid_keyring = uid_keyring; if (user->uid_keyring) return 0; <== key = cred->user->session_keyring [== NULL] user->session_keyring = session_keyring; atomic_inc(&key->usage); [oops] At the point thread A dereferences cred->user->session_keyring, thread B hasn't updated user->session_keyring yet, but thread A assumes it is populated because install_user_keyrings() returned ok. The race window is really small but can be exploited if, for example, thread B is interrupted or preempted after initializing uid_keyring, but before doing setting session_keyring. This couldn't be reproduced on a stock kernel. However, after placing systemtap probe on 'user->session_keyring = session_keyring;' that introduced some delay, the kernel could be crashed reliably. Fix this by checking both pointers before deciding whether to return. Alternatively, the test could be done away with entirely as it is checked inside the mutex - but since the mutex is global, that may not be the best way. Signed-off-by: David Howells <dhowells@redhat.com> Reported-by: Mateusz Guzik <mguzik@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | Merge branch 'android-omap-3.0' into android-omap-tuna-3.0Todd Poynor2013-01-162-1/+3
|\ \ \ \ | |/ / /
| * | | Merge branch 'android-3.0' into android-omap-3.0Todd Poynor2013-01-162-1/+3
| |\ \ \ | | |/ / | | | | | | | | | | | | | | | | | | | | Fixup incompatible code in opp.c: omap_init_opp_table() Change-Id: Iac7d60b814a539285d00e0a3dbb6e3f0060cb683 Signed-off-by: Todd Poynor <toddpoynor@google.com>
| | * | Merge commit 'v3.0.58' into android-3.0Todd Poynor2013-01-151-1/+2
| | |\ \ | | | |/ | | | | | | | | Change-Id: I05959ed26f71cf9197df59291e8e13f254b2115c
generated by cgit v1.1 at 2025-01-25 19:14:10 +0000