Skip to content

cloud-kernel
cloud-kernel

openanolis / cloud-kernel
1 年多 前同步成功

通知 160
Star 36
Fork 7
cloud-kernel
cloud-kernel
切换分支/标签
  1. 26 4月, 2007 6 次提交
  3. 27 2月, 2007 1 次提交
  5. 27 1月, 2007 1 次提交
  7. 24 1月, 2007 1 次提交
  9. 09 1月, 2007 2 次提交
  11. 03 1月, 2007 1 次提交
  13. 03 12月, 2006 4 次提交
    • P
      NetLabel: convert to an extensibile/sparse category bitmap · 02752760
      由 Paul Moore 提交于 
      The original NetLabel category bitmap was a straight char bitmap which worked
fine for the initial release as it only supported 240 bits due to limitations
in the CIPSO restricted bitmap tag (tag type 0x01).  This patch converts that
straight char bitmap into an extensibile/sparse bitmap in order to lay the
foundation for other CIPSO tag types and protocols.

This patch also has a nice side effect in that all of the security attributes
passed by NetLabel into the LSM are now in a format which is in the host's
native byte/bit ordering which makes the LSM specific code much simpler; look
at the changes in security/selinux/ss/ebitmap.c as an example.
Signed-off-by: NPaul Moore <paul.moore@hp.com>
Signed-off-by: NJames Morris <jmorris@namei.org>
      02752760
    • P
      SELinux: peer secid consolidation for external network labeling · 3de4bab5
      由 Paul Moore 提交于 
      Now that labeled IPsec makes use of the peer_sid field in the
sk_security_struct we can remove a lot of the special cases between labeled
IPsec and NetLabel.  In addition, create a new function,
security_skb_extlbl_sid(), which we can use in several places to get the
security context of the packet's external label which allows us to further
simplify the code in a few places.
Signed-off-by: NPaul Moore <paul.moore@hp.com>
Signed-off-by: NJames Morris <jmorris@namei.org>
      3de4bab5
    • P
      NetLabel: SELinux cleanups · 9f2ad665
      由 Paul Moore 提交于 
      This patch does a lot of cleanup in the SELinux NetLabel support code.  A
summary of the changes include:

* Use RCU locking for the NetLabel state variable in the skk_security_struct
  instead of using the inode_security_struct mutex.
* Remove unnecessary parameters in selinux_netlbl_socket_post_create().
* Rename selinux_netlbl_sk_clone_security() to
  selinux_netlbl_sk_security_clone() to better fit the other NetLabel
  sk_security functions.
* Improvements to selinux_netlbl_inode_permission() to help reduce the cost of
  the common case.
Signed-off-by: NPaul Moore <paul.moore@hp.com>
Signed-off-by: NJames Morris <jmorris@namei.org>
      9f2ad665
    • P
      NetLabel: make netlbl_lsm_secattr struct easier/quicker to understand · 701a90ba
      由 Paul Moore 提交于 
      The existing netlbl_lsm_secattr struct required the LSM to check all of the
fields to determine if any security attributes were present resulting in a lot
of work in the common case of no attributes.  This patch adds a 'flags' field
which is used to indicate which attributes are present in the structure; this
should allow the LSM to do a quick comparison to determine if the structure
holds any security attributes.

Example:

 if (netlbl_lsm_secattr->flags)
	/* security attributes present */
 else
	/* NO security attributes present */
Signed-off-by: NPaul Moore <paul.moore@hp.com>
Signed-off-by: NJames Morris <jmorris@namei.org>
      701a90ba
  15. 29 11月, 2006 2 次提交
    • C
      SELinux: validate kernel object classes and permissions · b94c7e67
      由 Chad Sellers 提交于 
      This is a new object class and permission validation scheme that validates
against the defined kernel headers. This scheme allows extra classes
and permissions that do not conflict with the kernel definitions to be
added to the policy. This validation is now done for all policy loads,
not just subsequent loads after the first policy load.

The implementation walks the three structrures containing the defined
object class and permission values and ensures their values are the
same in the policy being loaded. This includes verifying the object
classes themselves, the permissions they contain, and the permissions
they inherit from commons. Classes or permissions that are present in the
kernel but missing from the policy cause a warning (printed to KERN_INFO)
to be printed, but do not stop the policy from loading, emulating current
behavior. Any other inconsistencies cause the load to fail.
Signed-off-by: NChad Sellers <csellers@tresys.com>
Acked-by: NStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: NJames Morris <jmorris@namei.org>
      b94c7e67
    • C
      SELinux: remove current object class and permission validation mechanism · 5a64d443
      由 Chad Sellers 提交于 
      Removes the current SELinux object class and permission validation code,
as the current code makes it impossible to change or remove object classes
and permissions on a running system. Additionally, the current code does
not actually validate that the classes and permissions are correct, but
instead merely validates that they do not change between policy reloads.
Signed-off-by: NChad Sellers <csellers@tresys.com>
Acked-by: NStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: NJames Morris <jmorris@namei.org>
      5a64d443
  17. 31 10月, 2006 1 次提交
    • P
      [NetLabel]: protect the CIPSOv4 socket option from setsockopt() · f8687afe
      由 Paul Moore 提交于 
      This patch makes two changes to protect applications from either removing or
tampering with the CIPSOv4 IP option on a socket.  The first is the requirement
that applications have the CAP_NET_RAW capability to set an IPOPT_CIPSO option
on a socket; this prevents untrusted applications from setting their own
CIPSOv4 security attributes on the packets they send.  The second change is to
SELinux and it prevents applications from setting any IPv4 options when there
is an IPOPT_CIPSO option already present on the socket; this prevents
applications from removing CIPSOv4 security attributes from the packets they
send.
Signed-off-by: NPaul Moore <paul.moore@hp.com>
Signed-off-by: NJames Morris <jmorris@namei.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f8687afe
  19. 16 10月, 2006 1 次提交
  21. 12 10月, 2006 2 次提交
  23. 26 9月, 2006 4 次提交
  25. 23 9月, 2006 6 次提交
  27. 01 8月, 2006 1 次提交
  29. 01 7月, 2006 2 次提交
  31. 20 6月, 2006 1 次提交
  33. 16 5月, 2006 1 次提交
  35. 01 5月, 2006 1 次提交
    • D
      [PATCH] support for context based audit filtering · 376bd9cb
      由 Darrel Goeddel 提交于 
      The following patch provides selinux interfaces that will allow the audit
system to perform filtering based on the process context (user, role, type,
sensitivity, and clearance).  These interfaces will allow the selinux
module to perform efficient matches based on lower level selinux constructs,
rather than relying on context retrievals and string comparisons within
the audit module.  It also allows for dominance checks on the mls portion
of the contexts that are impossible with only string comparisons.
Signed-off-by: NDarrel Goeddel <dgoeddel@trustedcs.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      376bd9cb
  37. 22 3月, 2006 1 次提交
  39. 21 3月, 2006 1 次提交