summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* apparmor: add ns being viewed as a param to policy_admin_capable()John Johansen2017-01-163-10/+16
| | | | | | | Prepare for a tighter pairing of user namespaces and apparmor policy namespaces, by making the ns to be viewed available. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add ns being viewed as a param to policy_view_capable()John Johansen2017-01-164-8/+35
| | | | | | | | | | | Prepare for a tighter pairing of user namespaces and apparmor policy namespaces, by making the ns to be viewed available and checking that the user namespace level is the same as the policy ns level. This strict pairing will be relaxed once true support of user namespaces lands. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: allow specifying the profile doing the managementJohn Johansen2017-01-161-11/+21
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: allow introspecting the policy namespace nameJohn Johansen2017-01-161-0/+24
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: Make aa_remove_profile() callable from a different viewJohn Johansen2017-01-163-5/+7
| | | | | | This is prep work for fs operations being able to remove namespaces. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: track ns level so it can be used to help in view checksJohn Johansen2017-01-161-0/+1
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add special .null file used to "close" fds at execJohn Johansen2017-01-163-1/+81
| | | | | | | Borrow the special null device file from selinux to "close" fds that don't have sufficient permissions at exec time. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: provide userspace flag indicating binfmt_elf_mmap changeJohn Johansen2017-01-161-0/+1
| | | | | | | | | | | | | | | | Commit 9f834ec18def ("binfmt_elf: switch to new creds when switching to new mm") changed when the creds are installed by the binfmt_elf handler. This affects which creds are used to mmap the executable into the address space. Which can have an affect on apparmor policy. Add a flag to apparmor at /sys/kernel/security/apparmor/features/domain/fix_binfmt_elf_mmap to make it possible to detect this semantic change so that the userspace tools and the regression test suite can correctly deal with the change. BugLink: http://bugs.launchpad.net/bugs/1630069 Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add a default null dfaJohn Johansen2017-01-166-2/+46
| | | | | | | | | | | Instead of testing whether a given dfa exists in every code path, have a default null dfa that is used when loaded policy doesn't provide a dfa. This will let us get rid of special casing and avoid dereference bugs when special casing is missed. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: allow policydb to be used as the file dfaJohn Johansen2017-01-161-4/+8
| | | | | | | | | | Newer policy will combine the file and policydb dfas, allowing for better optimizations. However to support older policy we need to keep the ability to address the "file" dfa separately. So dup the policydb as if it is the file dfa and set the appropriate start state. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add get_dfa() fnJohn Johansen2017-01-161-0/+15
| | | | | | | The dfa is currently setup to be shared (has the basis of refcounting) but currently can't be because the count can't be increased. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: prepare to support newer versions of policyJohn Johansen2017-01-162-10/+25
| | | | | | | | | | Newer policy encodes more than just version in the version tag, so add masking to make sure the comparison remains correct. Note: this is fully compatible with older policy as it will never set the bits being masked out. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add support for force complain flag to support learning modeJohn Johansen2017-01-161-1/+3
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: remove paranoid load switchJohn Johansen2017-01-162-16/+10
| | | | | | Policy should always under go a full paranoid verification. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: name null-XXX profiles after the executableJohn Johansen2017-01-163-17/+47
| | | | | | | | When possible its better to name a learning profile after the missing profile in question. This allows for both more informative names and for profile reuse. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: pass gfp_t parameter into profile allocationJohn Johansen2017-01-164-8/+9
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: refactor prepare_ns() and make usable from different viewsJohn Johansen2017-01-165-38/+79
| | | | | | | | prepare_ns() will need to be called from alternate views, and namespaces will need to be created via different interfaces. So refactor and allow specifying the view ns. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: update policy_destroy to use new debug assertsJohn Johansen2017-01-161-9/+2
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: pass gfp param into aa_policy_init()John Johansen2017-01-164-7/+7
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: constify policy name and hnameJohn Johansen2017-01-163-4/+4
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rename hname_tail to basenameJohn Johansen2017-01-163-4/+4
| | | | | | Rename to the shorter and more familiar shell cmd name Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rename mediated_filesystem() to path_mediated_fs()John Johansen2017-01-162-8/+8
| | | | | | | Rename to indicate the test is only about whether path mediation is used, not whether other types of mediation might be used. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add debug assert AA_BUG and Kconfig to control debug infoJohn Johansen2017-01-163-4/+43
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add macro for bug asserts to check that a lock is heldJohn Johansen2017-01-161-0/+11
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: allow ns visibility question to consider subnsesJohn Johansen2017-01-164-8/+14
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add fn to lookup profiles by fqnameJohn Johansen2017-01-164-7/+38
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add lib fn to find the "split" for fqnamesJohn Johansen2017-01-162-0/+55
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add strn version of aa_find_nsJohn Johansen2017-01-162-6/+29
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add strn version of lookup_profile fnJohn Johansen2017-01-162-11/+27
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rename replacedby to proxyJohn Johansen2017-01-165-65/+65
| | | | | | Proxy is shorter and a better fit than replaceby, so rename it. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rename PFLAG_INVALID to PFLAG_STALEJohn Johansen2017-01-163-5/+5
| | | | | | Invalid does not convey the meaning of the flag anymore so rename it. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rename sid to secidJohn Johansen2017-01-164-65/+65
| | | | | | Move to common terminology with other LSMs and kernel infrastucture Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rename namespace to ns to improve code line lengthsJohn Johansen2017-01-168-128/+122
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: split apparmor policy namespaces code into its own fileJohn Johansen2017-01-1610-391/+454
| | | | | | | Policy namespaces will be diverging from profile management and expanding so put it in its own file. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: split out shared policy_XXX fns to libJohn Johansen2017-01-164-132/+137
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: move lib definitions into separate lib includeJohn Johansen2017-01-165-82/+99
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: use designated initializersKees Cook2017-01-162-5/+7
| | | | | | | | | | Prepare to mark sensitive kernel structures for randomization by making sure they're using designated initializers. These were identified during allyesconfig builds of x86, arm, and arm64, with most initializer fixes extracted from grsecurity. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: John Johansen <john.johansen@canonical.com>
* AppArmor: Use GFP_KERNEL for __aa_kvmalloc().Tetsuo Handa2017-01-151-1/+2
| | | | | | | | | | | | | | | | | | | | | | | Calling kmalloc(GFP_NOIO) with order == PAGE_ALLOC_COSTLY_ORDER is not recommended because it might fall into infinite retry loop without invoking the OOM killer. Since aa_dfa_unpack() is the only caller of kvzalloc() and aa_dfa_unpack() which is calling kvzalloc() via unpack_table() is doing kzalloc(GFP_KERNEL), it is safe to use GFP_KERNEL from __aa_kvmalloc(). Since aa_simple_write_to_buffer() is the only caller of kvmalloc() and aa_simple_write_to_buffer() is calling copy_from_user() which is GFP_KERNEL context (see memdup_user_nul()), it is safe to use GFP_KERNEL from __aa_kvmalloc(). Therefore, replace GFP_NOIO with GFP_KERNEL. Also, since we have vmalloc() fallback, add __GFP_NORETRY so that we don't invoke the OOM killer by kmalloc(GFP_KERNEL) with order == PAGE_ALLOC_COSTLY_ORDER. Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: John Johansen <john.johansen@canonical.com>
* security: Fix inode_getattr documentationMickaël Salaün2017-01-101-2/+1
| | | | | | | | Replace arguments @mnt and @dentry with @path. Signed-off-by: Mickaël Salaün <mic@digikod.net> Acked-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
* samples/seccomp: fix 64-bit comparison macrosMathias Svensson2017-01-091-53/+72
| | | | | | | | | | | There were some bugs in the JNE64 and JLT64 comparision macros. This fixes them, improves comments, and cleans up the file while we are at it. Reported-by: Stephen Röttger <sroettger@google.com> Signed-off-by: Mathias Svensson <idolf@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Signed-off-by: James Morris <james.l.morris@oracle.com>
* Linux 4.10-rc3v4.10-rc3Linus Torvalds2017-01-081-1/+1
|
* Merge tag 'usb-4.10-rc3' of ↵Linus Torvalds2017-01-0846-316/+550
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a bunch of USB fixes for 4.10-rc3. Yeah, it's a lot, an artifact of the holiday break I think. Lots of gadget and the usual XHCI fixups for reported issues (one day that driver will calm down...) Also included are a bunch of usb-serial driver fixes, and for good measure, a number of much-reported MUSB driver issues have finally been resolved. All of these have been in linux-next with no reported issues" * tag 'usb-4.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (72 commits) USB: fix problems with duplicate endpoint addresses usb: ohci-at91: use descriptor-based gpio APIs correctly usb: storage: unusual_uas: Add JMicron JMS56x to unusual device usb: hub: Move hub_port_disable() to fix warning if PM is disabled usb: musb: blackfin: add bfin_fifo_offset in bfin_ops usb: musb: fix compilation warning on unused function usb: musb: Fix trying to free already-free IRQ 4 usb: musb: dsps: implement clear_ep_rxintr() callback usb: musb: core: add clear_ep_rxintr() to musb_platform_ops USB: serial: ti_usb_3410_5052: fix NULL-deref at open USB: serial: spcp8x5: fix NULL-deref at open USB: serial: quatech2: fix sleep-while-atomic in close USB: serial: pl2303: fix NULL-deref at open USB: serial: oti6858: fix NULL-deref at open USB: serial: omninet: fix NULL-derefs at open and disconnect USB: serial: mos7840: fix misleading interrupt-URB comment USB: serial: mos7840: remove unused write URB USB: serial: mos7840: fix NULL-deref at open USB: serial: mos7720: remove obsolete port initialisation USB: serial: mos7720: fix parallel probe ...
| * USB: fix problems with duplicate endpoint addressesAlan Stern2017-01-051-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When checking a new device's descriptors, the USB core does not check for duplicate endpoint addresses. This can cause a problem when the sysfs files for those endpoints are created; trying to create multiple files with the same name will provoke a WARNING: WARNING: CPU: 2 PID: 865 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x8a/0xa0 sysfs: cannot create duplicate filename '/devices/platform/dummy_hcd.0/usb2/2-1/2-1:64.0/ep_05' Kernel panic - not syncing: panic_on_warn set ... CPU: 2 PID: 865 Comm: kworker/2:1 Not tainted 4.9.0-rc7+ #34 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event ffff88006bee64c8 ffffffff81f96b8a ffffffff00000001 1ffff1000d7dcc2c ffffed000d7dcc24 0000000000000001 0000000041b58ab3 ffffffff8598b510 ffffffff81f968f8 ffffffff850fee20 ffffffff85cff020 dffffc0000000000 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff81f96b8a>] dump_stack+0x292/0x398 lib/dump_stack.c:51 [<ffffffff8168c88e>] panic+0x1cb/0x3a9 kernel/panic.c:179 [<ffffffff812b80b4>] __warn+0x1c4/0x1e0 kernel/panic.c:542 [<ffffffff812b8195>] warn_slowpath_fmt+0xc5/0x110 kernel/panic.c:565 [<ffffffff819e70ca>] sysfs_warn_dup+0x8a/0xa0 fs/sysfs/dir.c:30 [<ffffffff819e7308>] sysfs_create_dir_ns+0x178/0x1d0 fs/sysfs/dir.c:59 [< inline >] create_dir lib/kobject.c:71 [<ffffffff81fa1b07>] kobject_add_internal+0x227/0xa60 lib/kobject.c:229 [< inline >] kobject_add_varg lib/kobject.c:366 [<ffffffff81fa2479>] kobject_add+0x139/0x220 lib/kobject.c:411 [<ffffffff82737a63>] device_add+0x353/0x1660 drivers/base/core.c:1088 [<ffffffff82738d8d>] device_register+0x1d/0x20 drivers/base/core.c:1206 [<ffffffff82cb77d3>] usb_create_ep_devs+0x163/0x260 drivers/usb/core/endpoint.c:195 [<ffffffff82c9f27b>] create_intf_ep_devs+0x13b/0x200 drivers/usb/core/message.c:1030 [<ffffffff82ca39d3>] usb_set_configuration+0x1083/0x18d0 drivers/usb/core/message.c:1937 [<ffffffff82cc9e2e>] generic_probe+0x6e/0xe0 drivers/usb/core/generic.c:172 [<ffffffff82caa7fa>] usb_probe_device+0xaa/0xe0 drivers/usb/core/driver.c:263 This patch prevents the problem by checking for duplicate endpoint addresses during enumeration and skipping any duplicates. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> CC: <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: ohci-at91: use descriptor-based gpio APIs correctlyPeter Rosin2017-01-051-14/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The gpiod_get* function family does not want the -gpio suffix. Use devm_gpiod_get_index_optional instead of devm_gpiod_get_optional. The descriptor based APIs handle active high/low automatically. The vbus-gpios are output, request enable while getting the gpio. Don't try to get any vbus-gpios for ports outside num-ports. WTF? Big sigh. Fixes: 054d4b7b577d ("usb: ohci-at91: Use descriptor-based gpio APIs") Signed-off-by: Peter Rosin <peda@axentia.se> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: storage: unusual_uas: Add JMicron JMS56x to unusual deviceOliver Neukum2017-01-051-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This device gives the following error on detection. xhci_hcd 0000:00:11.0: ERROR Transfer event for disabled endpoint or incorrect stream ring The same error is not seen when it is added to unusual_device list with US_FL_NO_REPORT_OPCODES passed. Signed-off-by: George Cherian <george.cherian@cavium.com> Signed-off-by: Oliver Neukum <oneukun@suse.com> CC: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: hub: Move hub_port_disable() to fix warning if PM is disabledGeert Uytterhoeven2017-01-051-30/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If CONFIG_PM=n: drivers/usb/core/hub.c:107: warning: ‘hub_usb3_port_prepare_disable’ declared inline after being called drivers/usb/core/hub.c:107: warning: previous declaration of ‘hub_usb3_port_prepare_disable’ was here To fix this, move hub_port_disable() after hub_usb3_port_prepare_disable(), and adjust forward declarations. Fixes: 37be66767e3cae4f ("usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices") Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: musb: blackfin: add bfin_fifo_offset in bfin_opsJérémy Lefaure2017-01-051-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The function bfin_fifo_offset is defined but not used: drivers/usb/musb/blackfin.c:36:12: warning: ‘bfin_fifo_offset’ defined but not used [-Wunused-function] static u32 bfin_fifo_offset(u8 epnum) ^~~~~~~~~~~~~~~~ Adding bfin_fifo_offset to bfin_ops fixes this warning and allows musb core to call this function instead of default_fifo_offset. Fixes: cc92f6818f6e ("usb: musb: Populate new IO functions for blackfin") Signed-off-by: Jérémy Lefaure <jeremy.lefaure@lse.epita.fr> Signed-off-by: Bin Liu <b-liu@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: musb: fix compilation warning on unused functionJérémy Lefaure2017-01-051-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The function musb_run_resume_work is called only when CONFIG_PM is enabled. So this function should not be defined when CONFIG_PM is disabled. Otherwise the compiler issues a warning: drivers/usb/musb/musb_core.c:2057:12: error: ‘musb_run_resume_work’ defined but not used [-Werror=unused-function] static int musb_run_resume_work(struct musb *musb) ^~~~~~~~~~~~~~~~~~~~ Signed-off-by: Jérémy Lefaure <jeremy.lefaure@lse.epita.fr> Signed-off-by: Bin Liu <b-liu@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: musb: Fix trying to free already-free IRQ 4Tony Lindgren2017-01-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When unloading omap2430, we can get the following splat: WARNING: CPU: 1 PID: 295 at kernel/irq/manage.c:1478 __free_irq+0xa8/0x2c8 Trying to free already-free IRQ 4 ... [<c01a8b78>] (free_irq) from [<bf0aea84>] (musbhs_dma_controller_destroy+0x28/0xb0 [musb_hdrc]) [<bf0aea84>] (musbhs_dma_controller_destroy [musb_hdrc]) from [<bf09f88c>] (musb_remove+0xf0/0x12c [musb_hdrc]) [<bf09f88c>] (musb_remove [musb_hdrc]) from [<c056a384>] (platform_drv_remove+0x24/0x3c) ... This is because the irq number in use is 260 nowadays, and the dma controller is using u8 instead of int. Fixes: 6995eb68aab7 ("USB: musb: enable low level DMA operation for Blackfin") Signed-off-by: Tony Lindgren <tony@atomide.com> [b-liu@ti.com: added Fixes tag] Signed-off-by: Bin Liu <b-liu@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: musb: dsps: implement clear_ep_rxintr() callbackBin Liu2017-01-051-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During dma teardown for dequque urb, if musb load is high, musb might generate bogus rx ep interrupt even when the rx fifo is flushed. In such case any of the follow log messages could happen. musb_host_rx 1853: BOGUS RX2 ready, csr 0000, count 0 musb_host_rx 1936: RX3 dma busy, csr 2020 As mentioned in the current inline comment, clearing ep interrupt in the teardown path avoids the bogus interrupt, so implement clear_ep_rxintr() callback. This bug seems to be existing since the initial driver for musb support, but I only validated the fix back to v4.1, so only cc stable for v4.1+. cc: stable@vger.kernel.org # 4.1+ Signed-off-by: Bin Liu <b-liu@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-23 23:50:15 +0100