Skip to content

R
raspberrypi-kernel

openeuler / raspberrypi-kernel

通知 13
Star 1
Fork 0
R
raspberrypi-kernel
切换分支/标签
  1. 14 12月, 2012 1 次提交
  3. 12 10月, 2012 1 次提交
  5. 25 9月, 2012 1 次提交
  7. 21 9月, 2012 1 次提交
  9. 06 9月, 2012 1 次提交
  11. 10 8月, 2012 1 次提交
  13. 01 6月, 2012 3 次提交
  15. 14 4月, 2012 1 次提交
    • A
      Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs · 259e5e6c
      由 Andy Lutomirski 提交于 
      With this change, calling
  prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)
disables privilege granting operations at execve-time.  For example, a
process will not be able to execute a setuid binary to change their uid
or gid if this bit is set.  The same is true for file capabilities.

Additionally, LSM_UNSAFE_NO_NEW_PRIVS is defined to ensure that
LSMs respect the requested behavior.

To determine if the NO_NEW_PRIVS bit is set, a task may call
  prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
It returns 1 if set and 0 if it is not set. If any of the arguments are
non-zero, it will return -1 and set errno to -EINVAL.
(PR_SET_NO_NEW_PRIVS behaves similarly.)

This functionality is desired for the proposed seccomp filter patch
series.  By using PR_SET_NO_NEW_PRIVS, it allows a task to modify the
system call behavior for itself and its child tasks without being
able to impact the behavior of a more privileged task.

Another potential use is making certain privileged operations
unprivileged.  For example, chroot may be considered "safe" if it cannot
affect privileged tasks.

Note, this patch causes execve to fail when PR_SET_NO_NEW_PRIVS is
set and AppArmor is in use.  It is fixed in a subsequent patch.
Signed-off-by: NAndy Lutomirski <luto@amacapital.net>
Signed-off-by: NWill Drewry <wad@chromium.org>
Acked-by: NEric Paris <eparis@redhat.com>
Acked-by: NKees Cook <keescook@chromium.org>

v18: updated change desc
v17: using new define values as per 3.4
Signed-off-by: NJames Morris <james.l.morris@oracle.com>
      259e5e6c
  17. 10 4月, 2012 1 次提交
  19. 28 2月, 2012 1 次提交
  21. 14 2月, 2012 2 次提交
  23. 10 2月, 2012 1 次提交
  25. 07 1月, 2012 1 次提交
  27. 06 1月, 2012 5 次提交
    • E
      security: remove the security_netlink_recv hook as it is equivalent to capable() · fd778461
      由 Eric Paris 提交于 
      Once upon a time netlink was not sync and we had to get the effective
capabilities from the skb that was being received.  Today we instead get
the capabilities from the current task.  This has rendered the entire
purpose of the hook moot as it is now functionally equivalent to the
capable() call.
Signed-off-by: NEric Paris <eparis@redhat.com>
      fd778461
    • E
      capabilities: remove all _real_ interfaces · 2920a840
      由 Eric Paris 提交于 
      The name security_real_capable and security_real_capable_noaudit just don't
make much sense to me.  Convert them to use security_capable and
security_capable_noaudit.
Signed-off-by: NEric Paris <eparis@redhat.com>
Acked-by: NSerge E. Hallyn <serge.hallyn@canonical.com>
      2920a840
    • E
      capabilities: introduce security_capable_noaudit · c7eba4a9
      由 Eric Paris 提交于 
      Exactly like security_capable except don't audit any denials.  This is for
places where the kernel may make decisions about what to do if a task has a
given capability, but which failing that capability is not a sign of a
security policy violation.  An example is checking if a task has
CAP_SYS_ADMIN to lower it's likelyhood of being killed by the oom killer.
This check is not a security violation if it is denied.
Signed-off-by: NEric Paris <eparis@redhat.com>
Acked-by: NSerge E. Hallyn <serge.hallyn@canonical.com>
      c7eba4a9
    • E
      capabilities: reverse arguments to security_capable · b7e724d3
      由 Eric Paris 提交于 
      security_capable takes ns, cred, cap.  But the LSM capable() hook takes
cred, ns, cap.  The capability helper functions also take cred, ns, cap.
Rather than flip argument order just to flip it back, leave them alone.
Heck, this should be a little faster since argument will be in the right
place!
Signed-off-by: NEric Paris <eparis@redhat.com>
      b7e724d3
    • E
      capabilities: remove the task from capable LSM hook entirely · 6a9de491
      由 Eric Paris 提交于 
      The capabilities framework is based around credentials, not necessarily the
current task.  Yet we still passed the current task down into LSMs from the
security_capable() LSM hook as if it was a meaningful portion of the security
decision.  This patch removes the 'generic' passing of current and instead
forces individual LSMs to use current explicitly if they think it is
appropriate.  In our case those LSMs are SELinux and AppArmor.

I believe the AppArmor use of current is incorrect, but that is wholely
unrelated to this patch.  This patch does not change what AppArmor does, it
just makes it clear in the AppArmor code that it is doing it.

The SELinux code still uses current in it's audit message, which may also be
wrong and needs further investigation.  Again this is NOT a change, it may
have always been wrong, this patch just makes it clear what is happening.
Signed-off-by: NEric Paris <eparis@redhat.com>
      6a9de491
  29. 04 1月, 2012 8 次提交
  31. 20 12月, 2011 1 次提交
  33. 16 11月, 2011 1 次提交
  35. 06 11月, 2011 1 次提交
  37. 10 9月, 2011 2 次提交
  39. 16 8月, 2011 1 次提交
  41. 11 8月, 2011 1 次提交
  43. 20 7月, 2011 2 次提交
  45. 19 7月, 2011 1 次提交
    • M
      security: new security_inode_init_security API adds function callback · 9d8f13ba
      由 Mimi Zohar 提交于 
      This patch changes the security_inode_init_security API by adding a
filesystem specific callback to write security extended attributes.
This change is in preparation for supporting the initialization of
multiple LSM xattrs and the EVM xattr.  Initially the callback function
walks an array of xattrs, writing each xattr separately, but could be
optimized to write multiple xattrs at once.

For existing security_inode_init_security() calls, which have not yet
been converted to use the new callback function, such as those in
reiserfs and ocfs2, this patch defines security_old_inode_init_security().
Signed-off-by: NMimi Zohar <zohar@us.ibm.com>
      9d8f13ba
  47. 25 4月, 2011 1 次提交
    • A
      SECURITY: Move exec_permission RCU checks into security modules · 1c990429
      由 Andi Kleen 提交于 
      Right now all RCU walks fall back to reference walk when CONFIG_SECURITY
is enabled, even though just the standard capability module is active.
This is because security_inode_exec_permission unconditionally fails
RCU walks.

Move this decision to the low level security module. This requires
passing the RCU flags down the security hook. This way at least
the capability module and a few easy cases in selinux/smack work
with RCU walks with CONFIG_SECURITY=y
Signed-off-by: NAndi Kleen <ak@linux.intel.com>
Signed-off-by: NEric Paris <eparis@redhat.com>
      1c990429