1. 14 7月, 2008 7 次提交
    • S
      SELinux: fix sleeping allocation in security_context_to_sid · 9a59daa0
      Stephen Smalley 提交于
      Fix a sleeping function called from invalid context bug by moving allocation
      to the callers prior to taking the policy rdlock.
      Signed-off-by: NStephen Smalley <sds@tycho.nsa.gov>
      Signed-off-by: NJames Morris <jmorris@namei.org>
      9a59daa0
    • S
      selinux: support deferred mapping of contexts · 12b29f34
      Stephen Smalley 提交于
      Introduce SELinux support for deferred mapping of security contexts in
      the SID table upon policy reload, and use this support for inode
      security contexts when the context is not yet valid under the current
      policy.  Only processes with CAP_MAC_ADMIN + mac_admin permission in
      policy can set undefined security contexts on inodes.  Inodes with
      such undefined contexts are treated as having the unlabeled context
      until the context becomes valid upon a policy reload that defines the
      context.  Context invalidation upon policy reload also uses this
      support to save the context information in the SID table and later
      recover it upon a subsequent policy reload that defines the context
      again.
      
      This support is to enable package managers and similar programs to set
      down file contexts unknown to the system policy at the time the file
      is created in order to better support placing loadable policy modules
      in packages and to support build systems that need to create images of
      different distro releases with different policies w/o requiring all of
      the contexts to be defined or legal in the build host policy.
      
      With this patch applied, the following sequence is possible, although
      in practice it is recommended that this permission only be allowed to
      specific program domains such as the package manager.
      
      # rmdir baz
      # rm bar
      # touch bar
      # chcon -t foo_exec_t bar # foo_exec_t is not yet defined
      chcon: failed to change context of `bar' to `system_u:object_r:foo_exec_t': Invalid argument
      # mkdir -Z system_u:object_r:foo_exec_t baz
      mkdir: failed to set default file creation context to `system_u:object_r:foo_exec_t': Invalid argument
      # cat setundefined.te
      policy_module(setundefined, 1.0)
      require {
      	type unconfined_t;
      	type unlabeled_t;
      }
      files_type(unlabeled_t)
      allow unconfined_t self:capability2 mac_admin;
      # make -f /usr/share/selinux/devel/Makefile setundefined.pp
      # semodule -i setundefined.pp
      # chcon -t foo_exec_t bar # foo_exec_t is not yet defined
      # mkdir -Z system_u:object_r:foo_exec_t baz
      # ls -Zd bar baz
      -rw-r--r--  root root system_u:object_r:unlabeled_t    bar
      drwxr-xr-x  root root system_u:object_r:unlabeled_t    baz
      # cat foo.te
      policy_module(foo, 1.0)
      type foo_exec_t;
      files_type(foo_exec_t)
      # make -f /usr/share/selinux/devel/Makefile foo.pp
      # semodule -i foo.pp # defines foo_exec_t
      # ls -Zd bar baz
      -rw-r--r--  root root user_u:object_r:foo_exec_t       bar
      drwxr-xr-x  root root system_u:object_r:foo_exec_t    baz
      # semodule -r foo
      # ls -Zd bar baz
      -rw-r--r--  root root system_u:object_r:unlabeled_t    bar
      drwxr-xr-x  root root system_u:object_r:unlabeled_t    baz
      # semodule -i foo.pp
      # ls -Zd bar baz
      -rw-r--r--  root root user_u:object_r:foo_exec_t       bar
      drwxr-xr-x  root root system_u:object_r:foo_exec_t    baz
      # semodule -r setundefined foo
      # chcon -t foo_exec_t bar # no longer defined and not allowed
      chcon: failed to change context of `bar' to `system_u:object_r:foo_exec_t': Invalid argument
      # rmdir baz
      # mkdir -Z system_u:object_r:foo_exec_t baz
      mkdir: failed to set default file creation context to `system_u:object_r:foo_exec_t': Invalid argument
      Signed-off-by: NStephen Smalley <sds@tycho.nsa.gov>
      Signed-off-by: NJames Morris <jmorris@namei.org>
      12b29f34
    • L
      Linux 2.6.26 · bce7f793
      Linus Torvalds 提交于
      bce7f793
    • L
      devcgroup: fix permission check when adding entry to child cgroup · ec229e83
      Li Zefan 提交于
       # cat devices.list
       c 1:3 r
       # echo 'c 1:3 w' > sub/devices.allow
       # cat sub/devices.list
       c 1:3 w
      
      As illustrated, the parent group has no write permission to /dev/null, so
      it's child should not be allowed to add this write permission.
      Signed-off-by: NLi Zefan <lizf@cn.fujitsu.com>
      Acked-by: NSerge Hallyn <serue@us.ibm.com>
      Cc: Serge Hallyn <serue@us.ibm.com>
      Cc: Paul Menage <menage@google.com>
      Cc: Pavel Emelyanov <xemul@openvz.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      ec229e83
    • L
      devcgroup: always show positive major/minor num · 17d213f8
      Li Zefan 提交于
       # echo "b $((0x7fffffff)):$((0x80000000)) rwm" > devices.allow
       # cat devices.list
       b 214748364:-21474836 rwm
      
      though a major/minor number of 0x800000000 is meaningless, we
      should not cast it to a negative value.
      Signed-off-by: NLi Zefan <lizf@cn.fujitsu.com>
      Acked-by: NSerge Hallyn <serue@us.ibm.com>
      Cc: Serge Hallyn <serue@us.ibm.com>
      Cc: Paul Menage <menage@google.com>
      Cc: Pavel Emelyanov <xemul@openvz.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      17d213f8
    • J
      Documentation/HOWTO: correct wrong kernel bugzilla FAQ URL · 0302c01b
      Jiri Pirko 提交于
      Signed-off-by: NJiri Pirko <jpirko@redhat.com>
      Cc: Randy Dunlap <randy.dunlap@oracle.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      0302c01b
    • L
      Merge branch 'sched-fixes-for-linus' of... · 3b5c6b83
      Linus Torvalds 提交于
      Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
      
      * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
        cpusets, hotplug, scheduler: fix scheduler domain breakage
      3b5c6b83
  2. 13 7月, 2008 14 次提交
  3. 12 7月, 2008 8 次提交
  4. 11 7月, 2008 11 次提交