litmus-rt.git/security, branch 2012.3

KEYS: Fix error handling in construct_key_and_link()

2011-06-22T01:31:45+00:00

Fix error handling in construct_key_and_link().

If construct_alloc_key() returns an error, it shouldn't pass out through
the normal path as the key_serial() called by the kleave() statement
will oops when it gets an error code in the pointer:

  BUG: unable to handle kernel paging request at ffffffffffffff84
  IP: [] request_key_and_link+0x4d7/0x52f
  ..
  Call Trace:
   [] request_key+0x41/0x75
   [] cifs_get_spnego_key+0x206/0x226 [cifs]
   [] CIFS_SessSetup+0x511/0x1234 [cifs]
   [] cifs_setup_session+0x90/0x1ae [cifs]
   [] cifs_get_smb_ses+0x34b/0x40f [cifs]
   [] cifs_mount+0x13f/0x504 [cifs]
   [] cifs_do_mount+0xc4/0x672 [cifs]
   [] mount_fs+0x69/0x155
   [] vfs_kern_mount+0x63/0xa0
   [] do_kern_mount+0x4d/0xdf
   [] do_mount+0x63c/0x69f
   [] sys_mount+0x88/0xc2
   [] system_call_fastpath+0x16/0x1b

Signed-off-by: David Howells 
Acked-by: Jeff Layton 
Signed-off-by: Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6

2011-06-21T03:09:15+00:00

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
  devcgroup_inode_permission: take "is it a device node" checks to inlined wrapper
  fix comment in generic_permission()
  kill obsolete comment for follow_down()
  proc_sys_permission() is OK in RCU mode
  reiserfs_permission() doesn't need to bail out in RCU mode
  proc_fd_permission() is doesn't need to bail out in RCU mode
  nilfs2_permission() doesn't need to bail out in RCU mode
  logfs doesn't need ->permission() at all
  coda_ioctl_permission() is safe in RCU mode
  cifs_permission() doesn't need to bail out in RCU mode
  bad_inode_permission() is safe from RCU mode
  ubifs: dereferencing an ERR_PTR in ubifs_mount()

devcgroup_inode_permission: take "is it a device node" checks to inlined wrapper

2011-06-20T14:46:04+00:00

inode_permission() calls devcgroup_inode_permission() and almost all such
calls are _not_ for device nodes; let's at least keep the common path
straight...

Signed-off-by: Al Viro

KEYS/DNS: Fix ____call_usermodehelper() to not lose the session keyring

2011-06-17T16:40:48+00:00

____call_usermodehelper() now erases any credentials set by the
subprocess_inf::init() function.  The problem is that commit
17f60a7da150 ("capabilites: allow the application of capability limits
to usermode helpers") creates and commits new credentials with
prepare_kernel_cred() after the call to the init() function.  This wipes
all keyrings after umh_keys_init() is called.

The best way to deal with this is to put the init() call just prior to
the commit_creds() call, and pass the cred pointer to init().  That
means that umh_keys_init() and suchlike can modify the credentials
_before_ they are published and potentially in use by the rest of the
system.

This prevents request_key() from working as it is prevented from passing
the session keyring it set up with the authorisation token to
/sbin/request-key, and so the latter can't assume the authority to
instantiate the key.  This causes the in-kernel DNS resolver to fail
with ENOKEY unconditionally.

Signed-off-by: David Howells 
Acked-by: Eric Paris 
Tested-by: Jeff Layton 
Signed-off-by: Linus Torvalds

Merge branch 'for-linus' of git://git.infradead.org/users/eparis/selinux into for-linus

2011-06-14T23:41:48+00:00

SELinux: skip file_name_trans_write() when policy downgraded.

2011-06-14T16:58:51+00:00

When policy version is less than POLICYDB_VERSION_FILENAME_TRANS,
skip file_name_trans_write().

Signed-off-by: Roy.Li 
Signed-off-by: Eric Paris

TOMOYO: Fix oops in tomoyo_mount_acl().

2011-06-14T05:18:42+00:00

In tomoyo_mount_acl() since 2.6.36, kern_path() was called without checking
dev_name != NULL. As a result, an unprivileged user can trigger oops by issuing
mount(NULL, "/", "ext3", 0, NULL) request.
Fix this by checking dev_name != NULL before calling kern_path(dev_name).

Signed-off-by: Tetsuo Handa 
Cc: stable@kernel.org
Signed-off-by: James Morris

AppArmor: Fix sleep in invalid context from task_setrlimit

2011-06-09T01:46:53+00:00

Affected kernels 2.6.36 - 3.0

AppArmor may do a GFP_KERNEL memory allocation with task_lock(tsk->group_leader);
held when called from security_task_setrlimit.  This will only occur when the
task's current policy has been replaced, and the task's creds have not been
updated before entering the LSM security_task_setrlimit() hook.

BUG: sleeping function called from invalid context at mm/slub.c:847
 in_atomic(): 1, irqs_disabled(): 0, pid: 1583, name: cupsd
 2 locks held by cupsd/1583:
  #0:  (tasklist_lock){.+.+.+}, at: [] do_prlimit+0x61/0x189
  #1:  (&(&p->alloc_lock)->rlock){+.+.+.}, at: []
do_prlimit+0x94/0x189
 Pid: 1583, comm: cupsd Not tainted 3.0.0-rc2-git1 #7
 Call Trace:
  [] __might_sleep+0x10d/0x112
  [] slab_pre_alloc_hook.isra.49+0x2d/0x33
  [] kmem_cache_alloc+0x22/0x132
  [] prepare_creds+0x35/0xe4
  [] aa_replace_current_profile+0x35/0xb2
  [] aa_current_profile+0x45/0x4c
  [] apparmor_task_setrlimit+0x19/0x3a
  [] security_task_setrlimit+0x11/0x13
  [] do_prlimit+0xd2/0x189
  [] sys_setrlimit+0x3b/0x48
  [] system_call_fastpath+0x16/0x1b

Signed-off-by: John Johansen 
Reported-by: Miles Lane 
Cc: stable@kernel.org
Signed-off-by: James Morris

selinux: simplify and clean up inode_has_perm()

2011-06-08T22:11:56+00:00

This is a rather hot function that is called with a potentially NULL
"struct common_audit_data" pointer argument.  And in that case it has to
provide and initialize its own dummy common_audit_data structure.

However, all the _common_ cases already pass it a real audit-data
structure, so that uncommon NULL case not only creates a silly run-time
test, more importantly it causes that function to have a big stack frame
for the dummy variable that isn't even used in the common case!

So get rid of that stupid run-time behavior, and make the (few)
functions that currently call with a NULL pointer just call a new helper
function instead (naturally called inode_has_perm_noapd(), since it has
no adp argument).

This makes the run-time test be a static code generation issue instead,
and allows for a much denser stack since none of the common callers need
the dummy structure.  And a denser stack not only means less stack space
usage, it means better cache behavior.  So we have a win-win-win from
this simplification: less code executed, smaller stack footprint, and
better cache behavior.

Signed-off-by: Linus Torvalds

AppArmor: fix oops in apparmor_setprocattr

2011-06-01T03:07:03+00:00

When invalid parameters are passed to apparmor_setprocattr a NULL deref
oops occurs when it tries to record an audit message. This is because
it is passing NULL for the profile parameter for aa_audit. But aa_audit
now requires that the profile passed is not NULL.

Fix this by passing the current profile on the task that is trying to
setprocattr.

Signed-off-by: Kees Cook 
Signed-off-by: John Johansen 
Cc: stable@kernel.org
Signed-off-by: James Morris