aboutsummaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2014-03-25 20:29:20 -0400
committerDavid S. Miller <davem@davemloft.net>2014-03-25 20:29:20 -0400
commit04f58c88542b6b351efb4eea01134eb672e22e6e (patch)
tree47bb617212f8c8951f35730e324bdc43487a01ca /security
parent0fc31966035d7a540c011b6c967ce8eae1db121b (diff)
parent632b06aa2842b12c6d6a510ec080fb6ebdb38ea5 (diff)
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Conflicts: Documentation/devicetree/bindings/net/micrel-ks8851.txt net/core/netpoll.c The net/core/netpoll.c conflict is a bug fix in 'net' happening to code which is completely removed in 'net-next'. In micrel-ks8851.txt we simply have overlapping changes. Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'security')
-rw-r--r--security/capability.c3
-rw-r--r--security/security.c6
-rw-r--r--security/selinux/hooks.c13
-rw-r--r--security/selinux/include/security.h2
-rw-r--r--security/selinux/include/xfrm.h3
-rw-r--r--security/selinux/selinuxfs.c28
-rw-r--r--security/selinux/ss/services.c6
-rw-r--r--security/selinux/xfrm.c14
8 files changed, 46 insertions, 29 deletions
diff --git a/security/capability.c b/security/capability.c
index 8b4f24ae4338..21e2b9cae685 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -757,7 +757,8 @@ static void cap_skb_owned_by(struct sk_buff *skb, struct sock *sk)
757 757
758#ifdef CONFIG_SECURITY_NETWORK_XFRM 758#ifdef CONFIG_SECURITY_NETWORK_XFRM
759static int cap_xfrm_policy_alloc_security(struct xfrm_sec_ctx **ctxp, 759static int cap_xfrm_policy_alloc_security(struct xfrm_sec_ctx **ctxp,
760 struct xfrm_user_sec_ctx *sec_ctx) 760 struct xfrm_user_sec_ctx *sec_ctx,
761 gfp_t gfp)
761{ 762{
762 return 0; 763 return 0;
763} 764}
diff --git a/security/security.c b/security/security.c
index 15b6928592ef..919cad93ac82 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1317,9 +1317,11 @@ void security_skb_owned_by(struct sk_buff *skb, struct sock *sk)
1317 1317
1318#ifdef CONFIG_SECURITY_NETWORK_XFRM 1318#ifdef CONFIG_SECURITY_NETWORK_XFRM
1319 1319
1320int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx) 1320int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1321 struct xfrm_user_sec_ctx *sec_ctx,
1322 gfp_t gfp)
1321{ 1323{
1322 return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx); 1324 return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx, gfp);
1323} 1325}
1324EXPORT_SYMBOL(security_xfrm_policy_alloc); 1326EXPORT_SYMBOL(security_xfrm_policy_alloc);
1325 1327
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4b34847208cc..b332e2cc0954 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -668,7 +668,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
668 if (flags[i] == SBLABEL_MNT) 668 if (flags[i] == SBLABEL_MNT)
669 continue; 669 continue;
670 rc = security_context_to_sid(mount_options[i], 670 rc = security_context_to_sid(mount_options[i],
671 strlen(mount_options[i]), &sid); 671 strlen(mount_options[i]), &sid, GFP_KERNEL);
672 if (rc) { 672 if (rc) {
673 printk(KERN_WARNING "SELinux: security_context_to_sid" 673 printk(KERN_WARNING "SELinux: security_context_to_sid"
674 "(%s) failed for (dev %s, type %s) errno=%d\n", 674 "(%s) failed for (dev %s, type %s) errno=%d\n",
@@ -2489,7 +2489,8 @@ static int selinux_sb_remount(struct super_block *sb, void *data)
2489 if (flags[i] == SBLABEL_MNT) 2489 if (flags[i] == SBLABEL_MNT)
2490 continue; 2490 continue;
2491 len = strlen(mount_options[i]); 2491 len = strlen(mount_options[i]);
2492 rc = security_context_to_sid(mount_options[i], len, &sid); 2492 rc = security_context_to_sid(mount_options[i], len, &sid,
2493 GFP_KERNEL);
2493 if (rc) { 2494 if (rc) {
2494 printk(KERN_WARNING "SELinux: security_context_to_sid" 2495 printk(KERN_WARNING "SELinux: security_context_to_sid"
2495 "(%s) failed for (dev %s, type %s) errno=%d\n", 2496 "(%s) failed for (dev %s, type %s) errno=%d\n",
@@ -2893,7 +2894,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2893 if (rc) 2894 if (rc)
2894 return rc; 2895 return rc;
2895 2896
2896 rc = security_context_to_sid(value, size, &newsid); 2897 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
2897 if (rc == -EINVAL) { 2898 if (rc == -EINVAL) {
2898 if (!capable(CAP_MAC_ADMIN)) { 2899 if (!capable(CAP_MAC_ADMIN)) {
2899 struct audit_buffer *ab; 2900 struct audit_buffer *ab;
@@ -3050,7 +3051,7 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3050 if (!value || !size) 3051 if (!value || !size)
3051 return -EACCES; 3052 return -EACCES;
3052 3053
3053 rc = security_context_to_sid((void *)value, size, &newsid); 3054 rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3054 if (rc) 3055 if (rc)
3055 return rc; 3056 return rc;
3056 3057
@@ -5529,7 +5530,7 @@ static int selinux_setprocattr(struct task_struct *p,
5529 str[size-1] = 0; 5530 str[size-1] = 0;
5530 size--; 5531 size--;
5531 } 5532 }
5532 error = security_context_to_sid(value, size, &sid); 5533 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5533 if (error == -EINVAL && !strcmp(name, "fscreate")) { 5534 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5534 if (!capable(CAP_MAC_ADMIN)) { 5535 if (!capable(CAP_MAC_ADMIN)) {
5535 struct audit_buffer *ab; 5536 struct audit_buffer *ab;
@@ -5638,7 +5639,7 @@ static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5638 5639
5639static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 5640static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5640{ 5641{
5641 return security_context_to_sid(secdata, seclen, secid); 5642 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5642} 5643}
5643 5644
5644static void selinux_release_secctx(char *secdata, u32 seclen) 5645static void selinux_release_secctx(char *secdata, u32 seclen)
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 8ed8daf7f1ee..ce7852cf526b 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -134,7 +134,7 @@ int security_sid_to_context(u32 sid, char **scontext,
134int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len); 134int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len);
135 135
136int security_context_to_sid(const char *scontext, u32 scontext_len, 136int security_context_to_sid(const char *scontext, u32 scontext_len,
137 u32 *out_sid); 137 u32 *out_sid, gfp_t gfp);
138 138
139int security_context_to_sid_default(const char *scontext, u32 scontext_len, 139int security_context_to_sid_default(const char *scontext, u32 scontext_len,
140 u32 *out_sid, u32 def_sid, gfp_t gfp_flags); 140 u32 *out_sid, u32 def_sid, gfp_t gfp_flags);
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index dfe3fda7e5f7..1450f85b946d 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -10,7 +10,8 @@
10#include <net/flow.h> 10#include <net/flow.h>
11 11
12int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, 12int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
13 struct xfrm_user_sec_ctx *uctx); 13 struct xfrm_user_sec_ctx *uctx,
14 gfp_t gfp);
14int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, 15int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
15 struct xfrm_sec_ctx **new_ctxp); 16 struct xfrm_sec_ctx **new_ctxp);
16void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx); 17void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 5122affe06a8..d60c0ee66387 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -576,7 +576,7 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
576 if (length) 576 if (length)
577 goto out; 577 goto out;
578 578
579 length = security_context_to_sid(buf, size, &sid); 579 length = security_context_to_sid(buf, size, &sid, GFP_KERNEL);
580 if (length) 580 if (length)
581 goto out; 581 goto out;
582 582
@@ -731,11 +731,13 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
731 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) 731 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
732 goto out; 732 goto out;
733 733
734 length = security_context_to_sid(scon, strlen(scon) + 1, &ssid); 734 length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
735 GFP_KERNEL);
735 if (length) 736 if (length)
736 goto out; 737 goto out;
737 738
738 length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid); 739 length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
740 GFP_KERNEL);
739 if (length) 741 if (length)
740 goto out; 742 goto out;
741 743
@@ -817,11 +819,13 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
817 objname = namebuf; 819 objname = namebuf;
818 } 820 }
819 821
820 length = security_context_to_sid(scon, strlen(scon) + 1, &ssid); 822 length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
823 GFP_KERNEL);
821 if (length) 824 if (length)
822 goto out; 825 goto out;
823 826
824 length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid); 827 length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
828 GFP_KERNEL);
825 if (length) 829 if (length)
826 goto out; 830 goto out;
827 831
@@ -878,11 +882,13 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
878 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) 882 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
879 goto out; 883 goto out;
880 884
881 length = security_context_to_sid(scon, strlen(scon) + 1, &ssid); 885 length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
886 GFP_KERNEL);
882 if (length) 887 if (length)
883 goto out; 888 goto out;
884 889
885 length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid); 890 length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
891 GFP_KERNEL);
886 if (length) 892 if (length)
887 goto out; 893 goto out;
888 894
@@ -934,7 +940,7 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
934 if (sscanf(buf, "%s %s", con, user) != 2) 940 if (sscanf(buf, "%s %s", con, user) != 2)
935 goto out; 941 goto out;
936 942
937 length = security_context_to_sid(con, strlen(con) + 1, &sid); 943 length = security_context_to_sid(con, strlen(con) + 1, &sid, GFP_KERNEL);
938 if (length) 944 if (length)
939 goto out; 945 goto out;
940 946
@@ -994,11 +1000,13 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
994 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) 1000 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
995 goto out; 1001 goto out;
996 1002
997 length = security_context_to_sid(scon, strlen(scon) + 1, &ssid); 1003 length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
1004 GFP_KERNEL);
998 if (length) 1005 if (length)
999 goto out; 1006 goto out;
1000 1007
1001 length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid); 1008 length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
1009 GFP_KERNEL);
1002 if (length) 1010 if (length)
1003 goto out; 1011 goto out;
1004 1012
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 5d0144ee8ed6..4bca49414a40 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1289,16 +1289,18 @@ out:
1289 * @scontext: security context 1289 * @scontext: security context
1290 * @scontext_len: length in bytes 1290 * @scontext_len: length in bytes
1291 * @sid: security identifier, SID 1291 * @sid: security identifier, SID
1292 * @gfp: context for the allocation
1292 * 1293 *
1293 * Obtains a SID associated with the security context that 1294 * Obtains a SID associated with the security context that
1294 * has the string representation specified by @scontext. 1295 * has the string representation specified by @scontext.
1295 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1296 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
1296 * memory is available, or 0 on success. 1297 * memory is available, or 0 on success.
1297 */ 1298 */
1298int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid) 1299int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid,
1300 gfp_t gfp)
1299{ 1301{
1300 return security_context_to_sid_core(scontext, scontext_len, 1302 return security_context_to_sid_core(scontext, scontext_len,
1301 sid, SECSID_NULL, GFP_KERNEL, 0); 1303 sid, SECSID_NULL, gfp, 0);
1302} 1304}
1303 1305
1304/** 1306/**
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 0462cb3ff0a7..98b042630a9e 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -78,7 +78,8 @@ static inline int selinux_authorizable_xfrm(struct xfrm_state *x)
78 * xfrm_user_sec_ctx context. 78 * xfrm_user_sec_ctx context.
79 */ 79 */
80static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp, 80static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
81 struct xfrm_user_sec_ctx *uctx) 81 struct xfrm_user_sec_ctx *uctx,
82 gfp_t gfp)
82{ 83{
83 int rc; 84 int rc;
84 const struct task_security_struct *tsec = current_security(); 85 const struct task_security_struct *tsec = current_security();
@@ -94,7 +95,7 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
94 if (str_len >= PAGE_SIZE) 95 if (str_len >= PAGE_SIZE)
95 return -ENOMEM; 96 return -ENOMEM;
96 97
97 ctx = kmalloc(sizeof(*ctx) + str_len + 1, GFP_KERNEL); 98 ctx = kmalloc(sizeof(*ctx) + str_len + 1, gfp);
98 if (!ctx) 99 if (!ctx)
99 return -ENOMEM; 100 return -ENOMEM;
100 101
@@ -103,7 +104,7 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
103 ctx->ctx_len = str_len; 104 ctx->ctx_len = str_len;
104 memcpy(ctx->ctx_str, &uctx[1], str_len); 105 memcpy(ctx->ctx_str, &uctx[1], str_len);
105 ctx->ctx_str[str_len] = '\0'; 106 ctx->ctx_str[str_len] = '\0';
106 rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid); 107 rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid, gfp);
107 if (rc) 108 if (rc)
108 goto err; 109 goto err;
109 110
@@ -282,9 +283,10 @@ int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
282 * LSM hook implementation that allocs and transfers uctx spec to xfrm_policy. 283 * LSM hook implementation that allocs and transfers uctx spec to xfrm_policy.
283 */ 284 */
284int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, 285int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
285 struct xfrm_user_sec_ctx *uctx) 286 struct xfrm_user_sec_ctx *uctx,
287 gfp_t gfp)
286{ 288{
287 return selinux_xfrm_alloc_user(ctxp, uctx); 289 return selinux_xfrm_alloc_user(ctxp, uctx, gfp);
288} 290}
289 291
290/* 292/*
@@ -332,7 +334,7 @@ int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
332int selinux_xfrm_state_alloc(struct xfrm_state *x, 334int selinux_xfrm_state_alloc(struct xfrm_state *x,
333 struct xfrm_user_sec_ctx *uctx) 335 struct xfrm_user_sec_ctx *uctx)
334{ 336{
335 return selinux_xfrm_alloc_user(&x->security, uctx); 337 return selinux_xfrm_alloc_user(&x->security, uctx, GFP_KERNEL);
336} 338}
337 339
338/* 340/*