{"push_id":1717453467,"size":124,"distinct_size":3,"ref":"refs/heads/master-basepatches","head":"42a25390190ad74d124fc34bc29df36f437190bf","before":"216e8b2395b1292eb4f1da6999bfc92c0c6445ef","commits":[{"sha":"791ec491c372f49cea3ea7a7143454a9023ac9d4","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"prlimit,security,selinux: add a security hook for prlimit\n\nWhen SELinux was first added to the kernel, a process could only get\nand set its own resource limits via getrlimit(2) and setrlimit(2), so no\nMAC checks were required for those operations, and thus no security hooks\nwere defined for them. Later, SELinux introduced a hook for setlimit(2)\nwith a check if the hard limit was being changed in order to be able to\nrely on the hard limit value as a safe reset point upon context\ntransitions.\n\nLater on, when prlimit(2) was added to the kernel with the ability to get\nor set resource limits (hard or soft) of another process, LSM/SELinux was\nnot updated other than to pass the target process to the setrlimit hook.\nThis resulted in incomplete control over both getting and setting the\nresource limits of another process.\n\nAdd a new security_task_prlimit() hook to the check_prlimit_permission()\nfunction to provide complete mediation.  The hook is only called when\nacting on another task, and only if the existing DAC/capability checks\nwould allow access.  Pass flags down to the hook to indicate whether the\nprlimit(2) call will read, write, or both read and write the resource\nlimits of the target process.\n\nThe existing security_task_setrlimit() hook is left alone; it continues\nto serve a purpose in supporting the ability to make decisions based on\nthe old and/or new resource limit values when setting limits.  This\nis consistent with the DAC/capability logic, where\ncheck_prlimit_permission() performs generic DAC/capability checks for\nacting on another task, while do_prlimit() performs a capability check\nbased on a comparison of the old and new resource limits.  Fix the\ninline documentation for the hook to match the code.\n\nImplement the new hook for SELinux.  For setting resource limits, we\nreuse the existing setrlimit permission.  Note that this does overload\nthe setrlimit permission to mean the ability to set the resource limit\n(soft or hard) of another process or the ability to change one's own\nhard limit.  For getting resource limits, a new getrlimit permission\nis defined.  This was not originally defined since getrlimit(2) could\nonly be used to obtain a process' own limits.\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>\nSigned-off-by: James Morris <james.l.morris@oracle.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/791ec491c372f49cea3ea7a7143454a9023ac9d4"},{"sha":"84e6885e9e6a818d1ca1eabb9b720b357ab07a8b","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"selinux: fix kernel BUG on prlimit(..., NULL, NULL)\n\ncommit 79bcf325e6b32b3c (\"prlimit,security,selinux: add a security hook\nfor prlimit\") introduced a security hook for prlimit() and implemented it\nfor SELinux.  However, if prlimit() is called with NULL arguments for both\nthe new limit and the old limit, then the hook is called with 0 for the\nread/write flags, since the prlimit() will neither read nor write the\nprocess' limits.  This would in turn lead to calling avc_has_perm() with 0\nfor the requested permissions, which triggers a BUG_ON() in\navc_has_perm_noaudit() since the kernel should never be invoking\navc_has_perm() with no permissions.  Fix this in the SELinux hook by\nreturning immediately if the flags are 0.  Arguably prlimit64() itself\nought to return immediately if both old_rlim and new_rlim are NULL since\nit is effectively a no-op in that case.\n\nReported by the lkp-robot based on trinity testing.\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>\nAcked-by: Paul Moore <paul@paul-moore.com>\nSigned-off-by: James Morris <james.l.morris@oracle.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/84e6885e9e6a818d1ca1eabb9b720b357ab07a8b"},{"sha":"dd0859dccbe291cf8179a96390f5c0e45cb9af1d","author":{"name":"James Morris","email":"af85dc1d025febf85c9c800f825ef7acc0fe79b5@namei.org"},"message":"security: introduce CONFIG_SECURITY_WRITABLE_HOOKS\n\nSubsequent patches will add RO hardening to LSM hooks, however, SELinux\nstill needs to be able to perform runtime disablement after init to handle\narchitectures where init-time disablement via boot parameters is not feasible.\n\nIntroduce a new kernel configuration parameter CONFIG_SECURITY_WRITABLE_HOOKS,\nand a helper macro __lsm_ro_after_init, to handle this case.\n\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nAcked-by: Stephen Smalley <sds@tycho.nsa.gov>\nAcked-by: Casey Schaufler <casey@schaufler-ca.com>\nAcked-by: Kees Cook <keescook@chromium.org>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/dd0859dccbe291cf8179a96390f5c0e45cb9af1d"},{"sha":"ca97d939db114c8d1619e10a3b82af8615372dae","author":{"name":"James Morris","email":"af85dc1d025febf85c9c800f825ef7acc0fe79b5@namei.org"},"message":"security: mark LSM hooks as __ro_after_init\n\nMark all of the registration hooks as __ro_after_init (via the\n__lsm_ro_after_init macro).\n\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nAcked-by:  Stephen Smalley <sds@tycho.nsa.gov>\nAcked-by: Kees Cook <keescook@chromium.org>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/ca97d939db114c8d1619e10a3b82af8615372dae"},{"sha":"579fc0dc09111c1f8b94742a0ed5a0bb8fdddbb9","author":{"name":"James Morris","email":"af85dc1d025febf85c9c800f825ef7acc0fe79b5@namei.org"},"message":"selinux: constify nlmsg permission tables\n\nConstify nlmsg permission tables, which are initialized once\nand then do not change.\n\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/579fc0dc09111c1f8b94742a0ed5a0bb8fdddbb9"},{"sha":"bad4417b692ede5cf31105b329cea1544875b526","author":{"name":"James Morris","email":"af85dc1d025febf85c9c800f825ef7acc0fe79b5@namei.org"},"message":"integrity: mark default IMA rules as __ro_after_init\n\nThe default IMA rules are loaded during init and then do not\nchange, so mark them as __ro_after_init.\n\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/bad4417b692ede5cf31105b329cea1544875b526"},{"sha":"1ac202e978e18f045006d75bd549612620c6ec3a","author":{"name":"Daniel Glöckner","email":"f1fc52a380c6cf9b589f356b9309d5396f6754f6@emlix.com"},"message":"ima: accept previously set IMA_NEW_FILE\n\nModifying the attributes of a file makes ima_inode_post_setattr reset\nthe IMA cache flags. So if the file, which has just been created,\nis opened a second time before the first file descriptor is closed,\nverification fails since the security.ima xattr has not been written\nyet. We therefore have to look at the IMA_NEW_FILE even if the file\nalready existed.\n\nWith this patch there should no longer be an error when cat tries to\nopen testfile:\n\n$ rm -f testfile\n$ ( echo test >&3 ; touch testfile ; cat testfile ) 3>testfile\n\nA file being new is no reason to accept that it is missing a digital\nsignature demanded by the policy.\n\nSigned-off-by: Daniel Glöckner <dg@emlix.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/1ac202e978e18f045006d75bd549612620c6ec3a"},{"sha":"c017c71ce09f4c7a5378fccbec6a3d7e96b0c5c2","author":{"name":"Nicolas Iooss","email":"d3457e454cf019ca2de7f483c3d6bc52529b443c@m4x.org"},"message":"selinux: include sys/socket.h in host programs to have PF_MAX\n\nCompiling with clang and -Wundef makes the compiler report a usage of\nundefined PF_MAX macro in security/selinux/include/classmap.h:\n\n    In file included from scripts/selinux/mdp/mdp.c:48:\n    security/selinux/include/classmap.h:37:31: warning: no previous\n    extern declaration for non-static variable 'secclass_map'\n    [-Wmissing-variable-declarations]\n    struct security_class_mapping secclass_map[] = {\n                                  ^\n    security/selinux/include/classmap.h:235:5: error: 'PF_MAX' is not\n    defined, evaluates to 0 [-Werror,-Wundef]\n    #if PF_MAX > 43\n        ^\n    In file included from scripts/selinux/genheaders/genheaders.c:17:\n    security/selinux/include/classmap.h:37:31: warning: no previous\n    extern declaration for non-static variable 'secclass_map'\n    [-Wmissing-variable-declarations]\n    struct security_class_mapping secclass_map[] = {\n                                  ^\n    security/selinux/include/classmap.h:235:5: error: 'PF_MAX' is not\n    defined, evaluates to 0 [-Werror,-Wundef]\n    #if PF_MAX > 43\n        ^\n\nPF_MAX is defined in include/linux/socket.h but not in\ninclude/uapi/linux/socket.h. Therefore host programs have to rely on the\ndefinition from libc's /usr/include/bits/socket.h, included by\n<sys/socket.h>.\n\nFix the issue by using sys/socket.h in mdp and genheaders. When\nclassmap.h is included by security/selinux/avc.c, it uses the kernel\ndefinition of PF_MAX, which makes the test consistent.\n\nSigned-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/c017c71ce09f4c7a5378fccbec6a3d7e96b0c5c2"},{"sha":"e2f586bd83177d22072b275edd4b8b872daba924","author":{"name":"Alexander Potapenko","email":"8a652d6e37d449a8e8c8989569d8839dd1bfdb29@google.com"},"message":"selinux: check for address length in selinux_socket_bind()\n\nKMSAN (KernelMemorySanitizer, a new error detection tool) reports use of\nuninitialized memory in selinux_socket_bind():\n\n==================================================================\nBUG: KMSAN: use of unitialized memory\ninter: 0\nCPU: 3 PID: 1074 Comm: packet2 Tainted: G    B           4.8.0-rc6+ #1916\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n 0000000000000000 ffff8800882ffb08 ffffffff825759c8 ffff8800882ffa48\n ffffffff818bf551 ffffffff85bab870 0000000000000092 ffffffff85bab550\n 0000000000000000 0000000000000092 00000000bb0009bb 0000000000000002\nCall Trace:\n [<     inline     >] __dump_stack lib/dump_stack.c:15\n [<ffffffff825759c8>] dump_stack+0x238/0x290 lib/dump_stack.c:51\n [<ffffffff818bdee6>] kmsan_report+0x276/0x2e0 mm/kmsan/kmsan.c:1008\n [<ffffffff818bf0fb>] __msan_warning+0x5b/0xb0 mm/kmsan/kmsan_instr.c:424\n [<ffffffff822dae71>] selinux_socket_bind+0xf41/0x1080 security/selinux/hooks.c:4288\n [<ffffffff8229357c>] security_socket_bind+0x1ec/0x240 security/security.c:1240\n [<ffffffff84265d98>] SYSC_bind+0x358/0x5f0 net/socket.c:1366\n [<ffffffff84265a22>] SyS_bind+0x82/0xa0 net/socket.c:1356\n [<ffffffff81005678>] do_syscall_64+0x58/0x70 arch/x86/entry/common.c:292\n [<ffffffff8518217c>] entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.o:?\nchained origin: 00000000ba6009bb\n [<ffffffff810bb7a7>] save_stack_trace+0x27/0x50 arch/x86/kernel/stacktrace.c:67\n [<     inline     >] kmsan_save_stack_with_flags mm/kmsan/kmsan.c:322\n [<     inline     >] kmsan_save_stack mm/kmsan/kmsan.c:337\n [<ffffffff818bd2b8>] kmsan_internal_chain_origin+0x118/0x1e0 mm/kmsan/kmsan.c:530\n [<ffffffff818bf033>] __msan_set_alloca_origin4+0xc3/0x130 mm/kmsan/kmsan_instr.c:380\n [<ffffffff84265b69>] SYSC_bind+0x129/0x5f0 net/socket.c:1356\n [<ffffffff84265a22>] SyS_bind+0x82/0xa0 net/socket.c:1356\n [<ffffffff81005678>] do_syscall_64+0x58/0x70 arch/x86/entry/common.c:292\n [<ffffffff8518217c>] return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.o:?\norigin description: ----address@SYSC_bind (origin=00000000b8c00900)\n==================================================================\n\n(the line numbers are relative to 4.8-rc6, but the bug persists upstream)\n\n, when I run the following program as root:\n\n=======================================================\n  #include <string.h>\n  #include <sys/socket.h>\n  #include <netinet/in.h>\n\n  int main(int argc, char *argv[]) {\n    struct sockaddr addr;\n    int size = 0;\n    if (argc > 1) {\n      size = atoi(argv[1]);\n    }\n    memset(&addr, 0, sizeof(addr));\n    int fd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);\n    bind(fd, &addr, size);\n    return 0;\n  }\n=======================================================\n\n(for different values of |size| other error reports are printed).\n\nThis happens because bind() unconditionally copies |size| bytes of\n|addr| to the kernel, leaving the rest uninitialized. Then\nsecurity_socket_bind() reads the IP address bytes, including the\nuninitialized ones, to determine the port, or e.g. pass them further to\nsel_netnode_find(), which uses them to calculate a hash.\n\nSigned-off-by: Alexander Potapenko <glider@google.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\n[PM: fixed some whitespace damage]\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/e2f586bd83177d22072b275edd4b8b872daba924"},{"sha":"3dd0c8d06511c7c61c62305fcf431ca28884d263","author":{"name":"Mikhail Kurinnoi","email":"d5569d0692c52791dc8d34bf67bd1c8fa36a9d5c@viewizard.com"},"message":"ima: provide \">\" and \"<\" operators for fowner/uid/euid rules.\n\nFor now we have only \"=\" operator for fowner/uid/euid rules. This\npatch provide two more operators - \">\" and \"<\" in order to make\nfowner/uid/euid rules more flexible.\n\nExamples of usage.\n\n Appraise all files owned by special and system users (SYS_UID_MAX 999):\n    appraise fowner<1000\n Don't appraise files owned by normal users (UID_MIN 1000):\n    dont_appraise fowner>999\n Appraise all files owned by users with UID 1000-1010:\n    dont_appraise fowner>1010\n    appraise fowner>999\n\nChangelog v3:\n- Removed code duplication in ima_parse_rule().\n- Fix ima_policy_show() - (Mimi)\n\nChangelog v2:\n- Fixed default policy rules.\n\nSigned-off-by: Mikhail Kurinnoi <viewizard@viewizard.com>\nSigned-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>\n\n security/integrity/ima/ima_policy.c | 115 +++++++++++++++++++++++++++---------\n 1 file changed, 87 insertions(+), 28 deletions(-)","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/3dd0c8d06511c7c61c62305fcf431ca28884d263"},{"sha":"f6076f704aa29679fdba114b0f60e71e0884840a","author":{"name":"Markus Elfring","email":"2916b57751e3b8379170cb86139f7bb868e8eca1@users.sourceforge.net"},"message":"selinux: Use kmalloc_array() in cond_init_bool_indexes()\n\n* A multiplication for the size determination of a memory allocation\n  indicated that an array data structure should be processed.\n  Thus use the corresponding function \"kmalloc_array\".\n\n  This issue was detected by using the Coccinelle software.\n\n* Replace the specification of a data type by a pointer dereference\n  to make the corresponding size determination a bit safer according to\n  the Linux coding style convention.\n\nSigned-off-by: Markus Elfring <elfring@users.sourceforge.net>\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/f6076f704aa29679fdba114b0f60e71e0884840a"},{"sha":"e34cfef901badc0e17c2b296a535e7412ef038f3","author":{"name":"Markus Elfring","email":"2916b57751e3b8379170cb86139f7bb868e8eca1@users.sourceforge.net"},"message":"selinux: Delete an unnecessary return statement in cond_compute_av()\n\nThe script \"checkpatch.pl\" pointed information out like the following.\n\nWARNING: void function return statements are not generally useful\n\nThus remove such a statement in the affected function.\n\nSigned-off-by: Markus Elfring <elfring@users.sourceforge.net>\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/e34cfef901badc0e17c2b296a535e7412ef038f3"},{"sha":"fb13a312daa11005b0230695a1d6a0b4e2b27069","author":{"name":"Markus Elfring","email":"2916b57751e3b8379170cb86139f7bb868e8eca1@users.sourceforge.net"},"message":"selinux: Improve size determinations in four functions\n\nReplace the specification of data structures by pointer dereferences\nas the parameter for the operator \"sizeof\" to make the corresponding size\ndetermination a bit safer.\n\nSigned-off-by: Markus Elfring <elfring@users.sourceforge.net>\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/fb13a312daa11005b0230695a1d6a0b4e2b27069"},{"sha":"2f00e680fe25d8d2758879b772d54cb46a78b59d","author":{"name":"Markus Elfring","email":"2916b57751e3b8379170cb86139f7bb868e8eca1@users.sourceforge.net"},"message":"selinux: Use kmalloc_array() in hashtab_create()\n\nA multiplication for the size determination of a memory allocation\nindicated that an array data structure should be processed.\nThus use the corresponding function \"kmalloc_array\".\n\nThis issue was detected by using the Coccinelle software.\n\nSigned-off-by: Markus Elfring <elfring@users.sourceforge.net>\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/2f00e680fe25d8d2758879b772d54cb46a78b59d"},{"sha":"cb8d21e3640f18444c597bddaec156637eacecf8","author":{"name":"Markus Elfring","email":"2916b57751e3b8379170cb86139f7bb868e8eca1@users.sourceforge.net"},"message":"selinux: Adjust four checks for null pointers\n\nThe script \"checkpatch.pl\" pointed information out like the following.\n\nComparison to NULL could be written !…\n\nThus fix affected source code places.\n\nSigned-off-by: Markus Elfring <elfring@users.sourceforge.net>\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/cb8d21e3640f18444c597bddaec156637eacecf8"},{"sha":"ad10a10567e243425d7be35a3d950709371fa048","author":{"name":"Markus Elfring","email":"2916b57751e3b8379170cb86139f7bb868e8eca1@users.sourceforge.net"},"message":"selinux: Use kcalloc() in policydb_index()\n\nMultiplications for the size determination of memory allocations\nindicated that array data structures should be processed.\nThus use the corresponding function \"kcalloc\".\n\nThis issue was detected by using the Coccinelle software.\n\nSigned-off-by: Markus Elfring <elfring@users.sourceforge.net>\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/ad10a10567e243425d7be35a3d950709371fa048"},{"sha":"b4e4686f65a3092f63ed01c887d9f56714d29f4a","author":{"name":"Markus Elfring","email":"2916b57751e3b8379170cb86139f7bb868e8eca1@users.sourceforge.net"},"message":"selinux: Delete an unnecessary return statement in policydb_destroy()\n\nThe script \"checkpatch.pl\" pointed information out like the following.\n\nWARNING: void function return statements are not generally useful\n\nThus remove such a statement in the affected function.\n\nSigned-off-by: Markus Elfring <elfring@users.sourceforge.net>\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/b4e4686f65a3092f63ed01c887d9f56714d29f4a"},{"sha":"3a0aa56518432a1a598ac3e48a93f2e99c66a393","author":{"name":"Markus Elfring","email":"2916b57751e3b8379170cb86139f7bb868e8eca1@users.sourceforge.net"},"message":"selinux: Return directly after a failed next_entry() in genfs_read()\n\nReturn directly after a call of the function \"next_entry\" failed\nat the beginning.\n\nSigned-off-by: Markus Elfring <elfring@users.sourceforge.net>\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/3a0aa56518432a1a598ac3e48a93f2e99c66a393"},{"sha":"315e01ada8047cba0520ecca050ad8f5237abb41","author":{"name":"Markus Elfring","email":"2916b57751e3b8379170cb86139f7bb868e8eca1@users.sourceforge.net"},"message":"selinux: One function call less in genfs_read() after null pointer detection\n\nCall the function \"kfree\" at the end only after it was determined\nthat the local variable \"newgenfs\" contained a non-null pointer.\n\nSigned-off-by: Markus Elfring <elfring@users.sourceforge.net>\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/315e01ada8047cba0520ecca050ad8f5237abb41"},{"sha":"02fcef27cc908e22ddb68d30ad1b7fd9ac3a1c24","author":{"name":"Markus Elfring","email":"2916b57751e3b8379170cb86139f7bb868e8eca1@users.sourceforge.net"},"message":"selinux: Delete an unnecessary variable assignment in filename_trans_read()\n\nThe local variable \"ft\" was set to a null pointer despite of an\nimmediate reassignment.\nThus remove this statement from the beginning of a loop.\n\nSigned-off-by: Markus Elfring <elfring@users.sourceforge.net>\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":false,"url":"https://api.github.com/repos/herrnst/dddvb-linux-kernel/commits/02fcef27cc908e22ddb68d30ad1b7fd9ac3a1c24"}]}
{"actor":{"display_login":"herrnst"}}