1. 06 2月, 2006 1 次提交
  2. 02 2月, 2006 3 次提交
  3. 15 1月, 2006 1 次提交
  4. 09 1月, 2006 1 次提交
  5. 04 1月, 2006 1 次提交
    • T
      [LSM-IPSec]: Per-packet access control. · d28d1e08
      Trent Jaeger 提交于
      This patch series implements per packet access control via the
      extension of the Linux Security Modules (LSM) interface by hooks in
      the XFRM and pfkey subsystems that leverage IPSec security
      associations to label packets.  Extensions to the SELinux LSM are
      included that leverage the patch for this purpose.
      
      This patch implements the changes necessary to the SELinux LSM to
      create, deallocate, and use security contexts for policies
      (xfrm_policy) and security associations (xfrm_state) that enable
      control of a socket's ability to send and receive packets.
      
      Patch purpose:
      
      The patch is designed to enable the SELinux LSM to implement access
      control on individual packets based on the strongly authenticated
      IPSec security association.  Such access controls augment the existing
      ones in SELinux based on network interface and IP address.  The former
      are very coarse-grained, and the latter can be spoofed.  By using
      IPSec, the SELinux can control access to remote hosts based on
      cryptographic keys generated using the IPSec mechanism.  This enables
      access control on a per-machine basis or per-application if the remote
      machine is running the same mechanism and trusted to enforce the
      access control policy.
      
      Patch design approach:
      
      The patch's main function is to authorize a socket's access to a IPSec
      policy based on their security contexts.  Since the communication is
      implemented by a security association, the patch ensures that the
      security association's negotiated and used have the same security
      context.  The patch enables allocation and deallocation of such
      security contexts for policies and security associations.  It also
      enables copying of the security context when policies are cloned.
      Lastly, the patch ensures that packets that are sent without using a
      IPSec security assocation with a security context are allowed to be
      sent in that manner.
      
      A presentation available at
      www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
      from the SELinux symposium describes the overall approach.
      
      Patch implementation details:
      
      The function which authorizes a socket to perform a requested
      operation (send/receive) on a IPSec policy (xfrm_policy) is
      selinux_xfrm_policy_lookup.  The Netfilter and rcv_skb hooks ensure
      that if a IPSec SA with a securit y association has not been used,
      then the socket is allowed to send or receive the packet,
      respectively.
      
      The patch implements SELinux function for allocating security contexts
      when policies (xfrm_policy) are created via the pfkey or xfrm_user
      interfaces via selinux_xfrm_policy_alloc.  When a security association
      is built, SELinux allocates the security context designated by the
      XFRM subsystem which is based on that of the authorized policy via
      selinux_xfrm_state_alloc.
      
      When a xfrm_policy is cloned, the security context of that policy, if
      any, is copied to the clone via selinux_xfrm_policy_clone.
      
      When a xfrm_policy or xfrm_state is freed, its security context, if
      any is also freed at selinux_xfrm_policy_free or
      selinux_xfrm_state_free.
      
      Testing:
      
      The SELinux authorization function is tested using ipsec-tools.  We
      created policies and security associations with particular security
      contexts and added SELinux access control policy entries to verify the
      authorization decision.  We also made sure that packets for which no
      security context was supplied (which either did or did not use
      security associations) were authorized using an unlabelled context.
      Signed-off-by: NTrent Jaeger <tjaeger@cse.psu.edu>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d28d1e08
  6. 09 11月, 2005 1 次提交
  7. 31 10月, 2005 6 次提交
  8. 28 10月, 2005 1 次提交
  9. 01 10月, 2005 1 次提交
    • J
      [PATCH] SELinux - fix SCTP socket bug and general IP protocol handling · 13402580
      James Morris 提交于
      The following patch updates the way SELinux classifies and handles IP
      based protocols.
      
      Currently, IP sockets are classified by SELinux as being either TCP, UDP
      or 'Raw', the latter being a default for IP socket that is not TCP or UDP.
      
      The classification code is out of date and uses only the socket type
      parameter to socket(2) to determine the class of IP socket.  So, any
      socket created with SOCK_STREAM will be classified by SELinux as TCP, and
      SOCK_DGRAM as UDP.  Also, other socket types such as SOCK_SEQPACKET and
      SOCK_DCCP are currently ignored by SELinux, which classifies them as
      generic sockets, which means they don't even get basic IP level checking.
      
      This patch changes the SELinux IP socket classification logic, so that
      only an IPPROTO_IP protocol value passed to socket(2) classify the socket
      as TCP or UDP.  The patch also drops the check for SOCK_RAW and converts
      it into a default, so that socket types like SOCK_DCCP and SOCK_SEQPACKET
      are classified as SECCLASS_RAWIP_SOCKET (instead of generic sockets).
      
      Note that protocol-specific support for SCTP, DCCP etc. is not addressed
      here, we're just getting these protocols checked at the IP layer.
      
      This fixes a reported problem where SCTP sockets were being recognized as
      generic SELinux sockets yet still being passed in one case to an IP level
      check, which then fails for generic sockets.
      
      It will also fix bugs where any SOCK_STREAM socket is classified as TCP or
      any SOCK_DGRAM socket is classified as UDP.
      
      This patch also unifies the way IP sockets classes are determined in
      selinux_socket_bind(), so we use the already calculated value instead of
      trying to recalculate it.
      Signed-off-by: NJames Morris <jmorris@namei.org>
      Signed-off-by: NStephen Smalley <sds@tycho.nsa.gov>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      13402580
  10. 10 9月, 2005 6 次提交
  11. 30 8月, 2005 1 次提交
  12. 29 7月, 2005 1 次提交
  13. 28 7月, 2005 1 次提交
    • J
      [PATCH] SELinux: default labeling of MLS field · f5c1d5b2
      James Morris 提交于
      Implement kernel labeling of the MLS (multilevel security) field of
      security contexts for files which have no existing MLS field.  This is to
      enable upgrades of a system from non-MLS to MLS without performing a full
      filesystem relabel including all of the mountpoints, which would be quite
      painful for users.
      
      With this patch, with MLS enabled, if a file has no MLS field, the kernel
      internally adds an MLS field to the in-core inode (but not to the on-disk
      file).  This MLS field added is the default for the superblock, allowing
      per-mountpoint control over the values via fixed policy or mount options.
      
      This patch has been tested by enabling MLS without relabeling its
      filesystem, and seems to be working correctly.
      Signed-off-by: NJames Morris <jmorris@redhat.com>
      Signed-off-by: NStephen Smalley <sds@epoch.ncsc.mil>
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      f5c1d5b2
  14. 30 6月, 2005 1 次提交
    • E
      [PATCH] selinux_sb_copy_data() should not require a whole page · 6931dfc9
      Eric Paris 提交于
      Currently selinux_sb_copy_data requires an entire page be allocated to
      *orig when the function is called.  This "requirement" is based on the fact
      that we call copy_page(in_save, nosec_save) and in_save = orig when the
      data is not FS_BINARY_MOUNTDATA.  This means that if a caller were to call
      do_kern_mount with only about 10 bytes of options, they would get passed
      here and then we would corrupt PAGE_SIZE - 10 bytes of memory (with all
      zeros.)
      
      Currently it appears all in kernel FS's use one page of data so this has
      not been a problem.  An out of kernel FS did just what is described above
      and it would almost always panic shortly after they tried to mount.  From
      looking else where in the kernel it is obvious that this string of data
      must always be null terminated.  (See example in do_mount where it always
      zeros the last byte.) Thus I suggest we use strcpy in place of copy_page.
      In this way we make sure the amount we copy is always less than or equal to
      the amount we received and since do_mount is zeroing the last byte this
      should be safe for all.
      Signed-off-by: NEric Paris <eparis@parisplace.org>
      Cc: Stephen Smalley <sds@epoch.ncsc.mil>
      Acked-by: NJames Morris <jmorris@redhat.com>
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      6931dfc9
  15. 26 6月, 2005 3 次提交
  16. 22 6月, 2005 2 次提交
  17. 14 5月, 2005 1 次提交
  18. 01 5月, 2005 1 次提交
  19. 25 4月, 2005 1 次提交
    • H
      [SELINUX]: Fix ipv6_skip_exthdr() invocation causing OOPS. · 0d3d077c
      Herbert Xu 提交于
      The SELinux hooks invoke ipv6_skip_exthdr() with an incorrect
      length final argument.  However, the length argument turns out
      to be superfluous.
      
      I was just reading ipv6_skip_exthdr and it occured to me that we can
      get rid of len altogether.  The only place where len is used is to
      check whether the skb has two bytes for ipv6_opt_hdr.  This check
      is done by skb_header_pointer/skb_copy_bits anyway.
      
      Now it might appear that we've made the code slower by deferring
      the check to skb_copy_bits.  However, this check should not trigger
      in the common case so this is OK.
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      0d3d077c
  20. 17 4月, 2005 2 次提交
    • J
      [PATCH] SELinux: add support for NETLINK_KOBJECT_UEVENT · 0c9b7942
      James Morris 提交于
      This patch adds SELinux support for the KOBJECT_UEVENT Netlink family, so
      that SELinux can apply finer grained controls to it.  For example, security
      policy for hald can be locked down to the KOBJECT_UEVENT Netlink family
      only.  Currently, this family simply defaults to the default Netlink socket
      class.
      
      Note that some new permission definitions are added to sync with changes in
      the core userspace policy package, which auto-generates header files.
      Signed-off-by: NJames Morris <jmorris@redhat.com>
      Signed-off-by: NStephen Smalley <sds@tycho.nsa.gov>
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      0c9b7942
    • L
      Linux-2.6.12-rc2 · 1da177e4
      Linus Torvalds 提交于
      Initial git repository build. I'm not bothering with the full history,
      even though we have it. We can create a separate "historical" git
      archive of that later if we want to, and in the meantime it's about
      3.2GB when imported into git - space that would just make the early
      git days unnecessarily complicated, when we don't have a lot of good
      infrastructure for it.
      
      Let it rip!
      1da177e4