diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2008-04-18 21:02:35 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-04-18 21:02:35 -0400 |
commit | 334d094504c2fe1c44211ecb49146ae6bca8c321 (patch) | |
tree | d3c0f68e4b9f8e3d2ccc39e7dfe5de0534a5fad9 /security | |
parent | d1a4be630fb068f251d64b62919f143c49ca8057 (diff) | |
parent | d1643d24c61b725bef399cc1cf2944b4c9c23177 (diff) |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6.26
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6.26: (1090 commits)
[NET]: Fix and allocate less memory for ->priv'less netdevices
[IPV6]: Fix dangling references on error in fib6_add().
[NETLABEL]: Fix NULL deref in netlbl_unlabel_staticlist_gen() if ifindex not found
[PKT_SCHED]: Fix datalen check in tcf_simp_init().
[INET]: Uninline the __inet_inherit_port call.
[INET]: Drop the inet_inherit_port() call.
SCTP: Initialize partial_bytes_acked to 0, when all of the data is acked.
[netdrvr] forcedeth: internal simplifications; changelog removal
phylib: factor out get_phy_id from within get_phy_device
PHY: add BCM5464 support to broadcom PHY driver
cxgb3: Fix __must_check warning with dev_dbg.
tc35815: Statistics cleanup
natsemi: fix MMIO for PPC 44x platforms
[TIPC]: Cleanup of TIPC reference table code
[TIPC]: Optimized initialization of TIPC reference table
[TIPC]: Remove inlining of reference table locking routines
e1000: convert uint16_t style integers to u16
ixgb: convert uint16_t style integers to u16
sb1000.c: make const arrays static
sb1000.c: stop inlining largish static functions
...
Diffstat (limited to 'security')
-rw-r--r-- | security/dummy.c | 14 | ||||
-rw-r--r-- | security/security.c | 21 | ||||
-rw-r--r-- | security/selinux/include/xfrm.h | 13 | ||||
-rw-r--r-- | security/selinux/netif.c | 2 | ||||
-rw-r--r-- | security/selinux/ss/services.c | 2 | ||||
-rw-r--r-- | security/selinux/xfrm.c | 39 | ||||
-rw-r--r-- | security/smack/smack_lsm.c | 2 |
7 files changed, 45 insertions, 48 deletions
diff --git a/security/dummy.c b/security/dummy.c index 78d8f92310a4..480366f9c41d 100644 --- a/security/dummy.c +++ b/security/dummy.c | |||
@@ -876,22 +876,23 @@ static inline void dummy_req_classify_flow(const struct request_sock *req, | |||
876 | #endif /* CONFIG_SECURITY_NETWORK */ | 876 | #endif /* CONFIG_SECURITY_NETWORK */ |
877 | 877 | ||
878 | #ifdef CONFIG_SECURITY_NETWORK_XFRM | 878 | #ifdef CONFIG_SECURITY_NETWORK_XFRM |
879 | static int dummy_xfrm_policy_alloc_security(struct xfrm_policy *xp, | 879 | static int dummy_xfrm_policy_alloc_security(struct xfrm_sec_ctx **ctxp, |
880 | struct xfrm_user_sec_ctx *sec_ctx) | 880 | struct xfrm_user_sec_ctx *sec_ctx) |
881 | { | 881 | { |
882 | return 0; | 882 | return 0; |
883 | } | 883 | } |
884 | 884 | ||
885 | static inline int dummy_xfrm_policy_clone_security(struct xfrm_policy *old, struct xfrm_policy *new) | 885 | static inline int dummy_xfrm_policy_clone_security(struct xfrm_sec_ctx *old_ctx, |
886 | struct xfrm_sec_ctx **new_ctxp) | ||
886 | { | 887 | { |
887 | return 0; | 888 | return 0; |
888 | } | 889 | } |
889 | 890 | ||
890 | static void dummy_xfrm_policy_free_security(struct xfrm_policy *xp) | 891 | static void dummy_xfrm_policy_free_security(struct xfrm_sec_ctx *ctx) |
891 | { | 892 | { |
892 | } | 893 | } |
893 | 894 | ||
894 | static int dummy_xfrm_policy_delete_security(struct xfrm_policy *xp) | 895 | static int dummy_xfrm_policy_delete_security(struct xfrm_sec_ctx *ctx) |
895 | { | 896 | { |
896 | return 0; | 897 | return 0; |
897 | } | 898 | } |
@@ -911,7 +912,8 @@ static int dummy_xfrm_state_delete_security(struct xfrm_state *x) | |||
911 | return 0; | 912 | return 0; |
912 | } | 913 | } |
913 | 914 | ||
914 | static int dummy_xfrm_policy_lookup(struct xfrm_policy *xp, u32 sk_sid, u8 dir) | 915 | static int dummy_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, |
916 | u32 sk_sid, u8 dir) | ||
915 | { | 917 | { |
916 | return 0; | 918 | return 0; |
917 | } | 919 | } |
diff --git a/security/security.c b/security/security.c index 9beecac933b4..54affd0ce6ad 100644 --- a/security/security.c +++ b/security/security.c | |||
@@ -1014,26 +1014,27 @@ void security_inet_conn_established(struct sock *sk, | |||
1014 | 1014 | ||
1015 | #ifdef CONFIG_SECURITY_NETWORK_XFRM | 1015 | #ifdef CONFIG_SECURITY_NETWORK_XFRM |
1016 | 1016 | ||
1017 | int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx) | 1017 | int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx) |
1018 | { | 1018 | { |
1019 | return security_ops->xfrm_policy_alloc_security(xp, sec_ctx); | 1019 | return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx); |
1020 | } | 1020 | } |
1021 | EXPORT_SYMBOL(security_xfrm_policy_alloc); | 1021 | EXPORT_SYMBOL(security_xfrm_policy_alloc); |
1022 | 1022 | ||
1023 | int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new) | 1023 | int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, |
1024 | struct xfrm_sec_ctx **new_ctxp) | ||
1024 | { | 1025 | { |
1025 | return security_ops->xfrm_policy_clone_security(old, new); | 1026 | return security_ops->xfrm_policy_clone_security(old_ctx, new_ctxp); |
1026 | } | 1027 | } |
1027 | 1028 | ||
1028 | void security_xfrm_policy_free(struct xfrm_policy *xp) | 1029 | void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx) |
1029 | { | 1030 | { |
1030 | security_ops->xfrm_policy_free_security(xp); | 1031 | security_ops->xfrm_policy_free_security(ctx); |
1031 | } | 1032 | } |
1032 | EXPORT_SYMBOL(security_xfrm_policy_free); | 1033 | EXPORT_SYMBOL(security_xfrm_policy_free); |
1033 | 1034 | ||
1034 | int security_xfrm_policy_delete(struct xfrm_policy *xp) | 1035 | int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx) |
1035 | { | 1036 | { |
1036 | return security_ops->xfrm_policy_delete_security(xp); | 1037 | return security_ops->xfrm_policy_delete_security(ctx); |
1037 | } | 1038 | } |
1038 | 1039 | ||
1039 | int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx) | 1040 | int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx) |
@@ -1065,9 +1066,9 @@ void security_xfrm_state_free(struct xfrm_state *x) | |||
1065 | security_ops->xfrm_state_free_security(x); | 1066 | security_ops->xfrm_state_free_security(x); |
1066 | } | 1067 | } |
1067 | 1068 | ||
1068 | int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir) | 1069 | int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir) |
1069 | { | 1070 | { |
1070 | return security_ops->xfrm_policy_lookup(xp, fl_secid, dir); | 1071 | return security_ops->xfrm_policy_lookup(ctx, fl_secid, dir); |
1071 | } | 1072 | } |
1072 | 1073 | ||
1073 | int security_xfrm_state_pol_flow_match(struct xfrm_state *x, | 1074 | int security_xfrm_state_pol_flow_match(struct xfrm_state *x, |
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h index 36b0510efa7b..289e24b39e3e 100644 --- a/security/selinux/include/xfrm.h +++ b/security/selinux/include/xfrm.h | |||
@@ -7,16 +7,17 @@ | |||
7 | #ifndef _SELINUX_XFRM_H_ | 7 | #ifndef _SELINUX_XFRM_H_ |
8 | #define _SELINUX_XFRM_H_ | 8 | #define _SELINUX_XFRM_H_ |
9 | 9 | ||
10 | int selinux_xfrm_policy_alloc(struct xfrm_policy *xp, | 10 | int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, |
11 | struct xfrm_user_sec_ctx *sec_ctx); | 11 | struct xfrm_user_sec_ctx *sec_ctx); |
12 | int selinux_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new); | 12 | int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, |
13 | void selinux_xfrm_policy_free(struct xfrm_policy *xp); | 13 | struct xfrm_sec_ctx **new_ctxp); |
14 | int selinux_xfrm_policy_delete(struct xfrm_policy *xp); | 14 | void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx); |
15 | int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx); | ||
15 | int selinux_xfrm_state_alloc(struct xfrm_state *x, | 16 | int selinux_xfrm_state_alloc(struct xfrm_state *x, |
16 | struct xfrm_user_sec_ctx *sec_ctx, u32 secid); | 17 | struct xfrm_user_sec_ctx *sec_ctx, u32 secid); |
17 | void selinux_xfrm_state_free(struct xfrm_state *x); | 18 | void selinux_xfrm_state_free(struct xfrm_state *x); |
18 | int selinux_xfrm_state_delete(struct xfrm_state *x); | 19 | int selinux_xfrm_state_delete(struct xfrm_state *x); |
19 | int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir); | 20 | int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir); |
20 | int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, | 21 | int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, |
21 | struct xfrm_policy *xp, struct flowi *fl); | 22 | struct xfrm_policy *xp, struct flowi *fl); |
22 | 23 | ||
diff --git a/security/selinux/netif.c b/security/selinux/netif.c index 013d3117a86b..9c8a82aa8baf 100644 --- a/security/selinux/netif.c +++ b/security/selinux/netif.c | |||
@@ -281,7 +281,7 @@ static int sel_netif_netdev_notifier_handler(struct notifier_block *this, | |||
281 | { | 281 | { |
282 | struct net_device *dev = ptr; | 282 | struct net_device *dev = ptr; |
283 | 283 | ||
284 | if (dev->nd_net != &init_net) | 284 | if (dev_net(dev) != &init_net) |
285 | return NOTIFY_DONE; | 285 | return NOTIFY_DONE; |
286 | 286 | ||
287 | if (event == NETDEV_DOWN) | 287 | if (event == NETDEV_DOWN) |
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index d75050819b06..33425b1ac8d6 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c | |||
@@ -2674,7 +2674,7 @@ int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr) | |||
2674 | goto netlbl_sid_to_secattr_failure; | 2674 | goto netlbl_sid_to_secattr_failure; |
2675 | secattr->domain = kstrdup(policydb.p_type_val_to_name[ctx->type - 1], | 2675 | secattr->domain = kstrdup(policydb.p_type_val_to_name[ctx->type - 1], |
2676 | GFP_ATOMIC); | 2676 | GFP_ATOMIC); |
2677 | secattr->flags |= NETLBL_SECATTR_DOMAIN; | 2677 | secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY; |
2678 | mls_export_netlbl_lvl(ctx, secattr); | 2678 | mls_export_netlbl_lvl(ctx, secattr); |
2679 | rc = mls_export_netlbl_cat(ctx, secattr); | 2679 | rc = mls_export_netlbl_cat(ctx, secattr); |
2680 | if (rc != 0) | 2680 | if (rc != 0) |
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c index 7e158205d081..874d17c83c61 100644 --- a/security/selinux/xfrm.c +++ b/security/selinux/xfrm.c | |||
@@ -77,20 +77,18 @@ static inline int selinux_authorizable_xfrm(struct xfrm_state *x) | |||
77 | * LSM hook implementation that authorizes that a flow can use | 77 | * LSM hook implementation that authorizes that a flow can use |
78 | * a xfrm policy rule. | 78 | * a xfrm policy rule. |
79 | */ | 79 | */ |
80 | int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir) | 80 | int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir) |
81 | { | 81 | { |
82 | int rc; | 82 | int rc; |
83 | u32 sel_sid; | 83 | u32 sel_sid; |
84 | struct xfrm_sec_ctx *ctx; | ||
85 | 84 | ||
86 | /* Context sid is either set to label or ANY_ASSOC */ | 85 | /* Context sid is either set to label or ANY_ASSOC */ |
87 | if ((ctx = xp->security)) { | 86 | if (ctx) { |
88 | if (!selinux_authorizable_ctx(ctx)) | 87 | if (!selinux_authorizable_ctx(ctx)) |
89 | return -EINVAL; | 88 | return -EINVAL; |
90 | 89 | ||
91 | sel_sid = ctx->ctx_sid; | 90 | sel_sid = ctx->ctx_sid; |
92 | } | 91 | } else |
93 | else | ||
94 | /* | 92 | /* |
95 | * All flows should be treated as polmatch'ing an | 93 | * All flows should be treated as polmatch'ing an |
96 | * otherwise applicable "non-labeled" policy. This | 94 | * otherwise applicable "non-labeled" policy. This |
@@ -103,7 +101,7 @@ int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir) | |||
103 | NULL); | 101 | NULL); |
104 | 102 | ||
105 | if (rc == -EACCES) | 103 | if (rc == -EACCES) |
106 | rc = -ESRCH; | 104 | return -ESRCH; |
107 | 105 | ||
108 | return rc; | 106 | return rc; |
109 | } | 107 | } |
@@ -287,15 +285,14 @@ out2: | |||
287 | * LSM hook implementation that allocs and transfers uctx spec to | 285 | * LSM hook implementation that allocs and transfers uctx spec to |
288 | * xfrm_policy. | 286 | * xfrm_policy. |
289 | */ | 287 | */ |
290 | int selinux_xfrm_policy_alloc(struct xfrm_policy *xp, | 288 | int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, |
291 | struct xfrm_user_sec_ctx *uctx) | 289 | struct xfrm_user_sec_ctx *uctx) |
292 | { | 290 | { |
293 | int err; | 291 | int err; |
294 | 292 | ||
295 | BUG_ON(!xp); | ||
296 | BUG_ON(!uctx); | 293 | BUG_ON(!uctx); |
297 | 294 | ||
298 | err = selinux_xfrm_sec_ctx_alloc(&xp->security, uctx, 0); | 295 | err = selinux_xfrm_sec_ctx_alloc(ctxp, uctx, 0); |
299 | if (err == 0) | 296 | if (err == 0) |
300 | atomic_inc(&selinux_xfrm_refcount); | 297 | atomic_inc(&selinux_xfrm_refcount); |
301 | 298 | ||
@@ -307,32 +304,29 @@ int selinux_xfrm_policy_alloc(struct xfrm_policy *xp, | |||
307 | * LSM hook implementation that copies security data structure from old to | 304 | * LSM hook implementation that copies security data structure from old to |
308 | * new for policy cloning. | 305 | * new for policy cloning. |
309 | */ | 306 | */ |
310 | int selinux_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new) | 307 | int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, |
308 | struct xfrm_sec_ctx **new_ctxp) | ||
311 | { | 309 | { |
312 | struct xfrm_sec_ctx *old_ctx, *new_ctx; | 310 | struct xfrm_sec_ctx *new_ctx; |
313 | |||
314 | old_ctx = old->security; | ||
315 | 311 | ||
316 | if (old_ctx) { | 312 | if (old_ctx) { |
317 | new_ctx = new->security = kmalloc(sizeof(*new_ctx) + | 313 | new_ctx = kmalloc(sizeof(*old_ctx) + old_ctx->ctx_len, |
318 | old_ctx->ctx_len, | 314 | GFP_KERNEL); |
319 | GFP_KERNEL); | ||
320 | |||
321 | if (!new_ctx) | 315 | if (!new_ctx) |
322 | return -ENOMEM; | 316 | return -ENOMEM; |
323 | 317 | ||
324 | memcpy(new_ctx, old_ctx, sizeof(*new_ctx)); | 318 | memcpy(new_ctx, old_ctx, sizeof(*new_ctx)); |
325 | memcpy(new_ctx->ctx_str, old_ctx->ctx_str, new_ctx->ctx_len); | 319 | memcpy(new_ctx->ctx_str, old_ctx->ctx_str, new_ctx->ctx_len); |
320 | *new_ctxp = new_ctx; | ||
326 | } | 321 | } |
327 | return 0; | 322 | return 0; |
328 | } | 323 | } |
329 | 324 | ||
330 | /* | 325 | /* |
331 | * LSM hook implementation that frees xfrm_policy security information. | 326 | * LSM hook implementation that frees xfrm_sec_ctx security information. |
332 | */ | 327 | */ |
333 | void selinux_xfrm_policy_free(struct xfrm_policy *xp) | 328 | void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx) |
334 | { | 329 | { |
335 | struct xfrm_sec_ctx *ctx = xp->security; | ||
336 | if (ctx) | 330 | if (ctx) |
337 | kfree(ctx); | 331 | kfree(ctx); |
338 | } | 332 | } |
@@ -340,10 +334,9 @@ void selinux_xfrm_policy_free(struct xfrm_policy *xp) | |||
340 | /* | 334 | /* |
341 | * LSM hook implementation that authorizes deletion of labeled policies. | 335 | * LSM hook implementation that authorizes deletion of labeled policies. |
342 | */ | 336 | */ |
343 | int selinux_xfrm_policy_delete(struct xfrm_policy *xp) | 337 | int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx) |
344 | { | 338 | { |
345 | struct task_security_struct *tsec = current->security; | 339 | struct task_security_struct *tsec = current->security; |
346 | struct xfrm_sec_ctx *ctx = xp->security; | ||
347 | int rc = 0; | 340 | int rc = 0; |
348 | 341 | ||
349 | if (ctx) { | 342 | if (ctx) { |
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 732ba27923c4..e2d6f7cd9254 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c | |||
@@ -1275,7 +1275,7 @@ static void smack_to_secattr(char *smack, struct netlbl_lsm_secattr *nlsp) | |||
1275 | 1275 | ||
1276 | switch (smack_net_nltype) { | 1276 | switch (smack_net_nltype) { |
1277 | case NETLBL_NLTYPE_CIPSOV4: | 1277 | case NETLBL_NLTYPE_CIPSOV4: |
1278 | nlsp->domain = kstrdup(smack, GFP_ATOMIC); | 1278 | nlsp->domain = smack; |
1279 | nlsp->flags = NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL; | 1279 | nlsp->flags = NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL; |
1280 | 1280 | ||
1281 | rc = smack_to_cipso(smack, &cipso); | 1281 | rc = smack_to_cipso(smack, &cipso); |