{"push_id":1998388558,"size":9,"distinct_size":9,"ref":"refs/heads/lineage-15.0","head":"9f5d7dd306328d10050479ff7b4f94e7bd1cfe06","before":"6461ae79e519d5f2c4d431c9eb8decb580ff47d8","commits":[{"sha":"f79ae30f4d8516204a0ca21c9a9eb74dabae1bc7","author":{"name":"Eric W. Biederman","email":"e4ccc9f9b54eebd6cb8fc7643b8083f628b68ff2@xmission.com"},"message":"userns: Add kuid_t and kgid_t and associated infrastructure in uidgid.h\n\nStart distinguishing between internal kernel uids and gids and\nvalues that userspace can use.  This is done by introducing two\nnew types: kuid_t and kgid_t.  These types and their associated\nfunctions are infrastructure are declared in the new header\nuidgid.h.\n\nUltimately there will be a different implementation of the mapping\nfunctions for use with user namespaces.  But to keep it simple\nwe introduce the mapping functions first to separate the meat\nfrom the mechanical code conversions.\n\nExport overflowuid and overflowgid so we can use from_kuid_munged\nand from_kgid_munged in modular code.\n\nChange-Id: Id934f981c91aa9c656e045d4f45f958c7fc2f1b0\nAcked-by: Serge Hallyn <serge.hallyn@canonical.com>\nSigned-off-by: Eric W. Biederman <ebiederm@xmission.com>","distinct":true,"url":"https://api.github.com/repos/fusion3-common/android_kernel_sony_apq8064/commits/f79ae30f4d8516204a0ca21c9a9eb74dabae1bc7"},{"sha":"16adfa00b8d3ce956beca801780dcd34d0de6617","author":{"name":"Eric W. Biederman","email":"e4ccc9f9b54eebd6cb8fc7643b8083f628b68ff2@xmission.com"},"message":"userns: make each net (net_ns) belong to a user_ns\n\nThe user namespace which creates a new network namespace owns that\nnamespace and all resources created in it.  This way we can target\ncapability checks for privileged operations against network resources to\nthe user_ns which created the network namespace in which the resource\nlives.  Privilege to the user namespace which owns the network\nnamespace, or any parent user namespace thereof, provides the same\nprivilege to the network resource.\n\nThis patch is reworked from a version originally by\nSerge E. Hallyn <serge.hallyn@canonical.com>\n\nChange-Id: Ifa426537c47cce669099cc96e80b17e1d814457b\nAcked-by: Serge Hallyn <serge.hallyn@canonical.com>\nSigned-off-by: Eric W. Biederman <ebiederm@xmission.com>","distinct":true,"url":"https://api.github.com/repos/fusion3-common/android_kernel_sony_apq8064/commits/16adfa00b8d3ce956beca801780dcd34d0de6617"},{"sha":"4b43987f4839f461a3820bcd45842f3748d556c4","author":{"name":"Lorenzo Colitti","email":"bb03c7a1072f7993eaae5ac54ef7bc06e4588478@google.com"},"message":"net: core: add UID to flows, rules, and routes\n\n- Define a new FIB rule attributes, FRA_UID_RANGE, to describe a\n  range of UIDs.\n- Define a RTA_UID attribute for per-UID route lookups and dumps.\n- Support passing these attributes to and from userspace via\n  rtnetlink. The value INVALID_UID indicates no UID was\n  specified.\n- Add a UID field to the flow structures.\n\n[Backport of net-next 622ec2c9d52405973c9f1ca5116eb1c393adfc7d]\n\nBug: 16355602\nChange-Id: Iea98e6fedd0fd4435a1f4efa3deb3629505619ab\nSigned-off-by: Lorenzo Colitti <lorenzo@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/fusion3-common/android_kernel_sony_apq8064/commits/4b43987f4839f461a3820bcd45842f3748d556c4"},{"sha":"df28cc6d3b81e2f3df485786f7b8c007c8c0e289","author":{"name":"Andy Lutomirski","email":"3cb7d5a8804519b67b2d7945dee31e85c91c02f9@kernel.org"},"message":"UPSTREAM: capabilities: ambient capabilities\n\nCredit where credit is due: this idea comes from Christoph Lameter with\na lot of valuable input from Serge Hallyn.  This patch is heavily based\non Christoph's patch.\n\n===== The status quo =====\n\nOn Linux, there are a number of capabilities defined by the kernel.  To\nperform various privileged tasks, processes can wield capabilities that\nthey hold.\n\nEach task has four capability masks: effective (pE), permitted (pP),\ninheritable (pI), and a bounding set (X).  When the kernel checks for a\ncapability, it checks pE.  The other capability masks serve to modify\nwhat capabilities can be in pE.\n\nAny task can remove capabilities from pE, pP, or pI at any time.  If a\ntask has a capability in pP, it can add that capability to pE and/or pI.\nIf a task has CAP_SETPCAP, then it can add any capability to pI, and it\ncan remove capabilities from X.\n\nTasks are not the only things that can have capabilities; files can also\nhave capabilities.  A file can have no capabilty information at all [1].\nIf a file has capability information, then it has a permitted mask (fP)\nand an inheritable mask (fI) as well as a single effective bit (fE) [2].\nFile capabilities modify the capabilities of tasks that execve(2) them.\n\nA task that successfully calls execve has its capabilities modified for\nthe file ultimately being excecuted (i.e.  the binary itself if that\nbinary is ELF or for the interpreter if the binary is a script.) [3] In\nthe capability evolution rules, for each mask Z, pZ represents the old\nvalue and pZ' represents the new value.  The rules are:\n\n  pP' = (X & fP) | (pI & fI)\n  pI' = pI\n  pE' = (fE ? pP' : 0)\n  X is unchanged\n\nFor setuid binaries, fP, fI, and fE are modified by a moderately\ncomplicated set of rules that emulate POSIX behavior.  Similarly, if\neuid == 0 or ruid == 0, then fP, fI, and fE are modified differently\n(primary, fP and fI usually end up being the full set).  For nonroot\nusers executing binaries with neither setuid nor file caps, fI and fP\nare empty and fE is false.\n\nAs an extra complication, if you execute a process as nonroot and fE is\nset, then the \"secure exec\" rules are in effect: AT_SECURE gets set,\nLD_PRELOAD doesn't work, etc.\n\nThis is rather messy.  We've learned that making any changes is\ndangerous, though: if a new kernel version allows an unprivileged\nprogram to change its security state in a way that persists cross\nexecution of a setuid program or a program with file caps, this\npersistent state is surprisingly likely to allow setuid or file-capped\nprograms to be exploited for privilege escalation.\n\n===== The problem =====\n\nCapability inheritance is basically useless.\n\nIf you aren't root and you execute an ordinary binary, fI is zero, so\nyour capabilities have no effect whatsoever on pP'.  This means that you\ncan't usefully execute a helper process or a shell command with elevated\ncapabilities if you aren't root.\n\nOn current kernels, you can sort of work around this by setting fI to\nthe full set for most or all non-setuid executable files.  This causes\npP' = pI for nonroot, and inheritance works.  No one does this because\nit's a PITA and it isn't even supported on most filesystems.\n\nIf you try this, you'll discover that every nonroot program ends up with\nsecure exec rules, breaking many things.\n\nThis is a problem that has bitten many people who have tried to use\ncapabilities for anything useful.\n\n===== The proposed change =====\n\nThis patch adds a fifth capability mask called the ambient mask (pA).\npA does what most people expect pI to do.\n\npA obeys the invariant that no bit can ever be set in pA if it is not\nset in both pP and pI.  Dropping a bit from pP or pI drops that bit from\npA.  This ensures that existing programs that try to drop capabilities\nstill do so, with a complication.  Because capability inheritance is so\nbroken, setting KEEPCAPS, using setresuid to switch to nonroot uids, and\nthen calling execve effectively drops capabilities.  Therefore,\nsetresuid from root to nonroot conditionally clears pA unless\nSECBIT_NO_SETUID_FIXUP is set.  Processes that don't like this can\nre-add bits to pA afterwards.\n\nThe capability evolution rules are changed:\n\n  pA' = (file caps or setuid or setgid ? 0 : pA)\n  pP' = (X & fP) | (pI & fI) | pA'\n  pI' = pI\n  pE' = (fE ? pP' : pA')\n  X is unchanged\n\nIf you are nonroot but you have a capability, you can add it to pA.  If\nyou do so, your children get that capability in pA, pP, and pE.  For\nexample, you can set pA = CAP_NET_BIND_SERVICE, and your children can\nautomatically bind low-numbered ports.  Hallelujah!\n\nUnprivileged users can create user namespaces, map themselves to a\nnonzero uid, and create both privileged (relative to their namespace)\nand unprivileged process trees.  This is currently more or less\nimpossible.  Hallelujah!\n\nYou cannot use pA to try to subvert a setuid, setgid, or file-capped\nprogram: if you execute any such program, pA gets cleared and the\nresulting evolution rules are unchanged by this patch.\n\nUsers with nonzero pA are unlikely to unintentionally leak that\ncapability.  If they run programs that try to drop privileges, dropping\nprivileges will still work.\n\nIt's worth noting that the degree of paranoia in this patch could\npossibly be reduced without causing serious problems.  Specifically, if\nwe allowed pA to persist across executing non-pA-aware setuid binaries\nand across setresuid, then, naively, the only capabilities that could\nleak as a result would be the capabilities in pA, and any attacker\n*already* has those capabilities.  This would make me nervous, though --\nsetuid binaries that tried to privilege-separate might fail to do so,\nand putting CAP_DAC_READ_SEARCH or CAP_DAC_OVERRIDE into pA could have\nunexpected side effects.  (Whether these unexpected side effects would\nbe exploitable is an open question.) I've therefore taken the more\nparanoid route.  We can revisit this later.\n\nAn alternative would be to require PR_SET_NO_NEW_PRIVS before setting\nambient capabilities.  I think that this would be annoying and would\nmake granting otherwise unprivileged users minor ambient capabilities\n(CAP_NET_BIND_SERVICE or CAP_NET_RAW for example) much less useful than\nit is with this patch.\n\n===== Footnotes =====\n\n[1] Files that are missing the \"security.capability\" xattr or that have\nunrecognized values for that xattr end up with has_cap set to false.\nThe code that does that appears to be complicated for no good reason.\n\n[2] The libcap capability mask parsers and formatters are dangerously\nmisleading and the documentation is flat-out wrong.  fE is *not* a mask;\nit's a single bit.  This has probably confused every single person who\nhas tried to use file capabilities.\n\n[3] Linux very confusingly processes both the script and the interpreter\nif applicable, for reasons that elude me.  The results from thinking\nabout a script's file capabilities and/or setuid bits are mostly\ndiscarded.\n\nPreliminary userspace code is here, but it needs updating:\nhttps://git.kernel.org/cgit/linux/kernel/git/luto/util-linux-playground.git/commit/?h=cap_ambient&id=7f5afbd175d2\n\nHere is a test program that can be used to verify the functionality\n(from Christoph):\n\n/*\n * Test program for the ambient capabilities. This program spawns a shell\n * that allows running processes with a defined set of capabilities.\n *\n * (C) 2015 Christoph Lameter <cl@linux.com>\n * Released under: GPL v3 or later.\n *\n *\n * Compile using:\n *\n *\tgcc -o ambient_test ambient_test.o -lcap-ng\n *\n * This program must have the following capabilities to run properly:\n * Permissions for CAP_NET_RAW, CAP_NET_ADMIN, CAP_SYS_NICE\n *\n * A command to equip the binary with the right caps is:\n *\n *\tsetcap cap_net_raw,cap_net_admin,cap_sys_nice+p ambient_test\n *\n *\n * To get a shell with additional caps that can be inherited by other processes:\n *\n *\t./ambient_test /bin/bash\n *\n *\n * Verifying that it works:\n *\n * From the bash spawed by ambient_test run\n *\n *\tcat /proc/$$/status\n *\n * and have a look at the capabilities.\n */\n\n/*\n * Definitions from the kernel header files. These are going to be removed\n * when the /usr/include files have these defined.\n */\n\nstatic void set_ambient_cap(int cap)\n{\n\tint rc;\n\n\tcapng_get_caps_process();\n\trc = capng_update(CAPNG_ADD, CAPNG_INHERITABLE, cap);\n\tif (rc) {\n\t\tprintf(\"Cannot add inheritable cap\\n\");\n\t\texit(2);\n\t}\n\tcapng_apply(CAPNG_SELECT_CAPS);\n\n\t/* Note the two 0s at the end. Kernel checks for these */\n\tif (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0)) {\n\t\tperror(\"Cannot set cap\");\n\t\texit(1);\n\t}\n}\n\nint main(int argc, char **argv)\n{\n\tint rc;\n\n\tset_ambient_cap(CAP_NET_RAW);\n\tset_ambient_cap(CAP_NET_ADMIN);\n\tset_ambient_cap(CAP_SYS_NICE);\n\n\tprintf(\"Ambient_test forking shell\\n\");\n\tif (execv(argv[1], argv + 1))\n\t\tperror(\"Cannot exec\");\n\n\treturn 0;\n}\n\nSigned-off-by: Christoph Lameter <cl@linux.com> # Original author\nSigned-off-by: Andy Lutomirski <luto@kernel.org>\nAcked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>\nAcked-by: Kees Cook <keescook@chromium.org>\nCc: Jonathan Corbet <corbet@lwn.net>\nCc: Aaron Jones <aaronmdjones@gmail.com>\nCc: Ted Ts'o <tytso@mit.edu>\nCc: Andrew G. Morgan <morgan@kernel.org>\nCc: Mimi Zohar <zohar@linux.vnet.ibm.com>\nCc: Austin S Hemmelgarn <ahferroin7@gmail.com>\nCc: Markku Savela <msa@moth.iki.fi>\nCc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>\nCc: Michael Kerrisk <mtk.manpages@gmail.com>\nCc: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n(cherry picked from commit 58319057b7847667f0c9585b9de0e8932b0fdb08)\n\nBug: 31038224\nChange-Id: I88bc5caa782dc6be23dc7e839ff8e11b9a903f8c\nSigned-off-by: Jorge Lucangeli Obes <jorgelo@google.com>","distinct":true,"url":"https://api.github.com/repos/fusion3-common/android_kernel_sony_apq8064/commits/df28cc6d3b81e2f3df485786f7b8c007c8c0e289"},{"sha":"a8d8d4e220693d7c62f73e0b9f741d793c8cd361","author":{"name":"Vladimir Kondratiev","email":"f0199ef09ee6aadd6bd637ef5eb98cb8bd399f36@qca.qualcomm.com"},"message":"BACKPORT: {nl,cfg}80211: support high bitrates\n\nUntil now, a u16 value was used to represent bitrate value.\nWith VHT bitrates this becomes too small.\n\nIntroduce a new 32-bit bitrate attribute. nl80211 will report\nboth the new and the old attribute, unless the bitrate doesn't\nfit into the old u16 attribute in which case only the new one\nwill be reported.\n\nUser space tools encouraged to prefer the 32-bit attribute, if\navailable (since it won't be available on older kernels.)\n\nSigned-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>\n[reword commit message and comments a bit]\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\n\n[AdrianDC] Includes if () improvements from commit\n           \"nl80211/cfg80211: add VHT MCS support\"\n           by Johannes Berg, Fri, 9 Nov 2012\n\nChange-Id: Ib5823475ba368954e51ac4129b400a58fd74e28d\nSigned-off-by: Adrian DC <radian.dc@gmail.com>","distinct":true,"url":"https://api.github.com/repos/fusion3-common/android_kernel_sony_apq8064/commits/a8d8d4e220693d7c62f73e0b9f741d793c8cd361"},{"sha":"1115f4cb69b8bcb1455a10d9b7e8fe513afe2e2d","author":{"name":"Tetsuo Handa","email":"badf33aa2d274d0572a6b5c85bfcebfa56176677@I-love.SAKURA.ne.jp"},"message":"BACKPORT: commoncap: don't alloc the credential unless needed in cap_task_prctl\n\nIn function cap_task_prctl(), we would allocate a credential\nunconditionally and then check if we support the requested function.\nIf not we would release this credential with abort_creds() by using\nRCU method. But on some archs such as powerpc, the sys_prctl is heavily\nused to get/set the floating point exception mode. So the unnecessary\nallocating/releasing of credential not only introduce runtime overhead\nbut also do cause OOM due to the RCU implementation.\n\nThis patch removes abort_creds() from cap_task_prctl() by calling\nprepare_creds() only when we need to modify it.\n\nReported-by: Kevin Hao <haokexin@gmail.com>\nSigned-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nReviewed-by: Paul Moore <paul@paul-moore.com>\nAcked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>\nReviewed-by: Kees Cook <keescook@chromium.org>\nSigned-off-by: James Morris <james.l.morris@oracle.com>\n(cherry picked from commit 6d6f3328422a3bc56b0d8dd026a5de845d2abfa7)\n\nBug: 35074030\nTest: Builds.\nChange-Id: Ic7b0d01f4c23328b134084a5585599883aed6345\nSigned-off-by: Jorge Lucangeli Obes <jorgelo@google.com>","distinct":true,"url":"https://api.github.com/repos/fusion3-common/android_kernel_sony_apq8064/commits/1115f4cb69b8bcb1455a10d9b7e8fe513afe2e2d"},{"sha":"cad8145fa3f0fdbc84a5dfc5da4a40f45645a7f9","author":{"name":"Mark Salyzyn","email":"4814ffc71be21311f04ef34122c19152acc840c4@google.com"},"message":"android: base-cfg: Add CONFIG_IP_MULTICAST\n\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nBug: 19173869\nChange-Id: I882b4b8f44b62b668bb03dae0858739868bd953a","distinct":true,"url":"https://api.github.com/repos/fusion3-common/android_kernel_sony_apq8064/commits/cad8145fa3f0fdbc84a5dfc5da4a40f45645a7f9"},{"sha":"1021f408b3630d2a3226f9eb4b01d658456d869c","author":{"name":"Rom Lemarchand","email":"b5a3988bc5b5ee62e2ced080fc85864eeac72be4@android.com"},"message":"android: base-cfg: enable CONFIG_QUOTA\n\nBug: 28032718\nChange-Id: I7cb6b641f72085e69b90dca11d2ea68adcd02390","distinct":true,"url":"https://api.github.com/repos/fusion3-common/android_kernel_sony_apq8064/commits/1021f408b3630d2a3226f9eb4b01d658456d869c"},{"sha":"9f5d7dd306328d10050479ff7b4f94e7bd1cfe06","author":{"name":"Yongqin Liu","email":"169077ffaa9c16812ce359e5af706ce78405214e@linaro.org"},"message":"ANDROID: base-cfg: enable SECCOMP config\n\nEnable seccomp config\n\nCONFIG_SECCOMP=y\n\nOtherwise we will get mediacode error like this on Android N:\n\nE /system/bin/mediaextractor: libminijail: prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER): Invalid argument\n\nChange-Id: I2477b6a2cfdded5c0ebf6ffbb6150b0e5fe2ba12\nSigned-off-by: Yongqin Liu <yongqin.liu@linaro.org>\nSigned-off-by: Amit Pundir <amit.pundir@linaro.org>","distinct":true,"url":"https://api.github.com/repos/fusion3-common/android_kernel_sony_apq8064/commits/9f5d7dd306328d10050479ff7b4f94e7bd1cfe06"}]}
{"actor":{"display_login":"CyberWalkMaN"}}