Skip to content

L
linux

Linux-御风守护者 / linux
与 Fork 源项目一致

从无法访问的项目Fork

通知 1
Star 0
Fork 0
L
linux

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
  1. 22 5月, 2009 1 次提交
    • E
      IMA: Minimal IMA policy and boot param for TCB IMA policy · 5789ba3b
      由 Eric Paris 提交于 
      The IMA TCB policy is dangerous.  A normal use can use all of a system's
memory (which cannot be freed) simply by building and running lots of
executables.  The TCB policy is also nearly useless because logging in as root
often causes a policy violation when dealing with utmp, thus rendering the
measurements meaningless.

There is no good fix for this in the kernel.  A full TCB policy would need to
be loaded in userspace using LSM rule matching to get both a protected and
useful system.  But, if too little is measured before userspace can load a real
policy one again ends up with a meaningless set of measurements.  One option
would be to put the policy load inside the initrd in order to get it early
enough in the boot sequence to be useful, but this runs into trouble with the
LSM.  For IMA to measure the LSM policy and the LSM policy loading mechanism
it needs rules to do so, but we already talked about problems with defaulting
to such broad rules....

IMA also depends on the files being measured to be on an FS which implements
and supports i_version.  Since the only FS with this support (ext4) doesn't
even use it by default it seems silly to have any IMA rules by default.

This should reduce the performance overhead of IMA to near 0 while still
letting users who choose to configure their machine as such to inclue the
ima_tcb kernel paramenter and get measurements during boot before they can
load a customized, reasonable policy in userspace.
Signed-off-by: NEric Paris <eparis@redhat.com>
Acked-by: NMimi Zohar <zohar@us.ibm.com>
Signed-off-by: NJames Morris <jmorris@namei.org>
      5789ba3b
  3. 07 5月, 2009 2 次提交
  5. 19 4月, 2009 1 次提交
  7. 18 4月, 2009 1 次提交
  9. 14 4月, 2009 1 次提交
  11. 07 4月, 2009 1 次提交
  13. 03 4月, 2009 1 次提交
  15. 02 4月, 2009 2 次提交
  17. 30 3月, 2009 1 次提交
  19. 28 3月, 2009 1 次提交
  21. 26 3月, 2009 1 次提交
  23. 25 3月, 2009 1 次提交
    • J
      dynamic debug: combine dprintk and dynamic printk · e9d376f0
      由 Jason Baron 提交于 
      This patch combines Greg Bank's dprintk() work with the existing dynamic
printk patchset, we are now calling it 'dynamic debug'.

The new feature of this patchset is a richer /debugfs control file interface,
(an example output from my system is at the bottom), which allows fined grained
control over the the debug output. The output can be controlled by function,
file, module, format string, and line number.

for example, enabled all debug messages in module 'nf_conntrack':

echo -n 'module nf_conntrack +p' > /mnt/debugfs/dynamic_debug/control

to disable them:

echo -n 'module nf_conntrack -p' > /mnt/debugfs/dynamic_debug/control

A further explanation can be found in the documentation patch.
Signed-off-by: NGreg Banks <gnb@sgi.com>
Signed-off-by: NJason Baron <jbaron@redhat.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      e9d376f0
  25. 24 3月, 2009 2 次提交
  27. 21 3月, 2009 1 次提交
    • Y
      PCI: allow assignment of memory resources with a specified alignment · 32a9a682
      由 Yuji Shimada 提交于 
      This patch allows memory resources to be assigned with a specified
alignment at boot-time or run-time. The patch is useful when we use PCI
pass-through, because page-aligned memory resources are required to
securely share PCI resources with guest drivers.

If you want to assign the resource at boot time, please set
"pci=resource_alignment=" boot parameter.

This is format of "pci=resource_alignment=" boot parameter:

        [<order of align>@][<domain>:]<bus>:<slot>.<func>[; ...]
                Specifies alignment and device to reassign
                aligned memory resources.
                If <order of align> is not specified, PAGE_SIZE is
                used as alignment.
                PCI-PCI bridge can be specified, if resource
                windows need to be expanded.

This is example:

        pci=resource_alignment=20@07:00.0;18@0f:00.0;00:1d.7

If you want to assign the resource at run-time, please set
"/sys/bus/pci/resource_alignment" file, and hot-remove the device and
hot-add the device.  For this purpose, fakephp or PCI hotplug interfaces
can be used.

The format of "/sys/bus/pci/resource_alignment" file is the same with
boot parameter. You can use "," instead of ";".

For example:

        # cd /sys/bus/pci
        # echo -n 20@12:00.0 > resource_alignment
        # echo 1 > devices/0000:12:00.0/remove
        # echo 1 > rescan
Reviewed-by: NAlex Chiang <achiang@hp.com>
Reviewed-by: NYu Zhao <yu.zhao@intel.com>
Signed-off-by: NYuji Shimada <shimada-yxb@necst.nec.co.jp>
Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
      32a9a682
  29. 20 3月, 2009 1 次提交
  31. 10 3月, 2009 1 次提交
  33. 06 3月, 2009 1 次提交
  35. 02 3月, 2009 1 次提交
  37. 26 2月, 2009 1 次提交
    • D
      ide: ide.c 'clear' fix, update "ide=nodma" documentation · 0af80c04
      由 David Fries 提交于 
      Documentation/kernel-parameters.txt
- ide=nodma is no longer valid.

drivers/ide/Kconfig
- The module is ide-core.ko not ide.

drivers/ide/ide.c
- It took me a while to figure out what the arguments %d.%d:%d to nodma
  module parameter ment, so I added a comment to each.
- Added a comment to each of the sscanf lines.
- There is a bug, if j is 0 it would previously clear all the other bits
  except the current device, changed in three different places.
  mask &= (1 << i) should be mask &= ~(1 << i).
Signed-off-by: NDavid Fries <david@fries.net>
[bart: s/disk/device/ in ide.c, beautify patch description]
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>
      0af80c04
  39. 25 2月, 2009 1 次提交
  41. 24 2月, 2009 1 次提交
  43. 23 2月, 2009 2 次提交
  45. 06 2月, 2009 2 次提交
    • M
      integrity: IMA as an integrity service provider · 3323eec9
      由 Mimi Zohar 提交于 
      IMA provides hardware (TPM) based measurement and attestation for
file measurements. As the Trusted Computing (TPM) model requires,
IMA measures all files before they are accessed in any way (on the
integrity_bprm_check, integrity_path_check and integrity_file_mmap
hooks), and commits the measurements to the TPM. Once added to the
TPM, measurements can not be removed.

In addition, IMA maintains a list of these file measurements, which
can be used to validate the aggregate value stored in the TPM.  The
TPM can sign these measurements, and thus the system can prove, to
itself and to a third party, the system's integrity in a way that
cannot be circumvented by malicious or compromised software.

- alloc ima_template_entry before calling ima_store_template()
- log ima_add_boot_aggregate() failure
- removed unused IMA_TEMPLATE_NAME_LEN
- replaced hard coded string length with #define name
Signed-off-by: NMimi Zohar <zohar@us.ibm.com>
Signed-off-by: NJames Morris <jmorris@namei.org>
      3323eec9
    • M
      integrity: IMA hooks · 6146f0d5
      由 Mimi Zohar 提交于 
      This patch replaces the generic integrity hooks, for which IMA registered
itself, with IMA integrity hooks in the appropriate places directly
in the fs directory.
Signed-off-by: NMimi Zohar <zohar@us.ibm.com>
Acked-by: NSerge Hallyn <serue@us.ibm.com>
Signed-off-by: NJames Morris <jmorris@namei.org>
      6146f0d5
  47. 05 2月, 2009 1 次提交
  49. 18 1月, 2009 1 次提交
  51. 09 1月, 2009 3 次提交
  53. 08 1月, 2009 3 次提交
    • A
      resource: allow MMIO exclusivity for device drivers · e8de1481
      由 Arjan van de Ven 提交于 
      Device drivers that use pci_request_regions() (and similar APIs) have a
reasonable expectation that they are the only ones accessing their device.
As part of the e1000e hunt, we were afraid that some userland (X or some
bootsplash stuff) was mapping the MMIO region that the driver thought it
had exclusively via /dev/mem or via various sysfs resource mappings.

This patch adds the option for device drivers to cause their reserved
regions to the "banned from /dev/mem use" list, so now both kernel memory
and device-exclusive MMIO regions are banned.
NOTE: This is only active when CONFIG_STRICT_DEVMEM is set.

In addition to the config option, a kernel parameter iomem=relaxed is
provided for the cases where developers want to diagnose, in the field,
drivers issues from userspace.
Reviewed-by: NMatthew Wilcox <willy@linux.intel.com>
Signed-off-by: NArjan van de Ven <arjan@linux.intel.com>
Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
      e8de1481
    • A
      USB: storage: make the "quirks=" module parameter writable · c838ea46
      由 Alan Stern 提交于 
      This patch (as1190) makes usb-storage's "quirks=" module parameter
writable, so that users can add entries for their devices at runtime
with no need to reboot or reload usb-storage.

New codes are added for the SANE_SENSE, CAPACITY_HEURISTICS, and
CAPACITY_OK flags.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      c838ea46
    • A
      USB: usb-storage: add "quirks=" module parameter · d4f373e5
      由 Alan Stern 提交于 
      This patch (as1163b) adds a "quirks=" module parameter to usb-storage.
This will allow people to make short-term changes to their
unusual_devs list without rebuilding the entire driver.  Testing will
become much easier, and less-sophisticated users will be able to
access their buggy devices after a simple config-file change instead
of having to wait for a new kernel release.

The patch also adds a documentation entry for usb-storage's
"delay_use" parameter, which has been around for years but but was
never listed among the kernel parameters.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      d4f373e5
  55. 07 1月, 2009 4 次提交