)]}' { "log": [ { "commit": "8eaa22acbe8a6ecbd23cd8e2cba5929d56136b62", "tree": "0b9b67ed401f909e5e6902a91df0ca103d4bd47f", "parents": [ "e4154cf9b1ebdb77e05874996c34dd8730d7e530" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Wed Oct 26 16:27:45 2016 -0700" }, "committer": { "name": "William Bellavnce", "email": "flintman@flintmancomputers.com", "time": "Thu Mar 21 09:12:20 2019 -0400" }, "message": "vfs: Add permission2 for filesystems with per mount permissions\n\nThis allows filesystems to use their mount private data to\ninfluence the permssions they return in permission2. It has\nbeen separated into a new call to avoid disrupting current\npermission users.\n\nChange-Id: I9d416e3b8b6eca84ef3e336bd2af89ddd51df6ca\nSigned-off-by: Daniel Rosenberg \u003cdrosen@google.com\u003e\n" }, { "commit": "e23e2d978bf59068a8c7faaee6117f2434a59824", "tree": "14576c7d7086aaaafae06fb69c9da55e5630b301", "parents": [ "06374eb9366cbad6860e6d3ab97ee5090178d7d8", "cb121ea9e86cd51e814cb50048fd64544e672bcc" ], "author": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Wed Nov 01 10:46:21 2017 -0400" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Mon Nov 06 07:19:21 2017 -0500" }, "message": "Merge remote-tracking branch \u0027lineage/cm-14.1\u0027 into HEAD\n\nChange-Id: I9e8cb7935bb224132ac69dd34cd232e47972a504\n" }, { "commit": "9f4b6c9ebdbddcf8b58e617dc64d078ed66a2c8c", "tree": "740605f264c705cf035128910faddef2bc8667a6", "parents": [ "26babde4f3b68e22c03ece150e1ff6ede68d4ede" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Tue Jan 31 11:54:04 2017 -0500" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Tue Sep 19 05:26:11 2017 +0000" }, "message": "selinux: fix off-by-one in setprocattr\n\ncommit 0c461cb727d146c9ef2d3e86214f498b78b7d125 upstream.\n\nSELinux tries to support setting/clearing of /proc/pid/attr attributes\nfrom the shell by ignoring terminating newlines and treating an\nattribute value that begins with a NUL or newline as an attempt to\nclear the attribute. However, the test for clearing attributes has\nalways been wrong; it has an off-by-one error, and this could further\nlead to reading past the end of the allocated buffer since commit\nbb646cdb12e75d82258c2f2e7746d5952d3e321a (\"proc_pid_attr_write():\nswitch to memdup_user()\"). Fix the off-by-one error.\n\nEven with this fix, setting and clearing /proc/pid/attr attributes\nfrom the shell is not straightforward since the interface does not\nsupport multiple write() calls (so shells that write the value and\nnewline separately will set and then immediately clear the attribute,\nrequiring use of echo -n to set the attribute), whereas trying to use\necho -n \"\" to clear the attribute causes the shell to skip the\nwrite() call altogether since POSIX says that a zero-length write\ncauses no side effects. Thus, one must use echo -n to set and echo\nwithout -n to clear, as in the following example:\n$ echo -n unconfined_u:object_r:user_home_t:s0 \u003e /proc/$$/attr/fscreate\n$ cat /proc/$$/attr/fscreate\nunconfined_u:object_r:user_home_t:s0\n$ echo \"\" \u003e /proc/$$/attr/fscreate\n$ cat /proc/$$/attr/fscreate\n\nNote the use of /proc/$$ rather than /proc/self, as otherwise\nthe cat command will read its own attribute value, not that of the shell.\n\nThere are no users of this facility to my knowledge; possibly we\nshould just get rid of it.\n\nUPDATE: Upon further investigation it appears that a local process\nwith the process:setfscreate permission can cause a kernel panic as a\nresult of this bug. This patch fixes CVE-2017-2618.\n\nChange-Id: I1c81289a1b60d9e0895b5ec96d081a9493d5e4e3\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\n[PM: added the update about CVE-2017-2618 to the commit description]\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nSigned-off-by: Jiri Slaby \u003cjslaby@suse.cz\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\nSigned-off-by: Willy Tarreau \u003cw@1wt.eu\u003e\n" }, { "commit": "a0b341a7e0e9620c728fa910b997a5d9bf2588ff", "tree": "e9ca46ad3ac20909b7135590ba8e1e9a1f2ac0c9", "parents": [ "2bee42a584c84e1e10c819b0dcecae9bb47bb8ff" ], "author": { "name": "Tetsuo Handa", "email": "penguin-kernel@I-love.SAKURA.ne.jp", "time": "Tue Jul 22 21:20:01 2014 +0900" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Thu Sep 07 05:58:28 2017 -0400" }, "message": "BACKPORT: commoncap: don\u0027t alloc the credential unless needed in cap_task_prctl\n\nIn function cap_task_prctl(), we would allocate a credential\nunconditionally and then check if we support the requested function.\nIf not we would release this credential with abort_creds() by using\nRCU method. But on some archs such as powerpc, the sys_prctl is heavily\nused to get/set the floating point exception mode. So the unnecessary\nallocating/releasing of credential not only introduce runtime overhead\nbut also do cause OOM due to the RCU implementation.\n\nThis patch removes abort_creds() from cap_task_prctl() by calling\nprepare_creds() only when we need to modify it.\n\nReported-by: Kevin Hao \u003chaokexin@gmail.com\u003e\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nReviewed-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nAcked-by: Serge E. Hallyn \u003cserge.hallyn@ubuntu.com\u003e\nReviewed-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n(cherry picked from commit 6d6f3328422a3bc56b0d8dd026a5de845d2abfa7)\n\nBug: 35074030\nTest: Builds.\nChange-Id: I6f8136b017fd0dcafbf82553e64fbf002a268f20\nSigned-off-by: Jorge Lucangeli Obes \u003cjorgelo@google.com\u003e\n" }, { "commit": "2bee42a584c84e1e10c819b0dcecae9bb47bb8ff", "tree": "778234dfe2e27f3b12e1955445e738ae5a703e52", "parents": [ "d928192dc4d5e3b001411401097903b2091af43d" ], "author": { "name": "Andy Lutomirski", "email": "luto@kernel.org", "time": "Fri Sep 04 15:42:45 2015 -0700" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Thu Sep 07 05:58:27 2017 -0400" }, "message": "UPSTREAM: capabilities: ambient capabilities\n\nCredit where credit is due: this idea comes from Christoph Lameter with\na lot of valuable input from Serge Hallyn. This patch is heavily based\non Christoph\u0027s patch.\n\n\u003d\u003d\u003d\u003d\u003d The status quo \u003d\u003d\u003d\u003d\u003d\n\nOn Linux, there are a number of capabilities defined by the kernel. To\nperform various privileged tasks, processes can wield capabilities that\nthey hold.\n\nEach task has four capability masks: effective (pE), permitted (pP),\ninheritable (pI), and a bounding set (X). When the kernel checks for a\ncapability, it checks pE. The other capability masks serve to modify\nwhat capabilities can be in pE.\n\nAny task can remove capabilities from pE, pP, or pI at any time. If a\ntask has a capability in pP, it can add that capability to pE and/or pI.\nIf a task has CAP_SETPCAP, then it can add any capability to pI, and it\ncan remove capabilities from X.\n\nTasks are not the only things that can have capabilities; files can also\nhave capabilities. A file can have no capabilty information at all [1].\nIf a file has capability information, then it has a permitted mask (fP)\nand an inheritable mask (fI) as well as a single effective bit (fE) [2].\nFile capabilities modify the capabilities of tasks that execve(2) them.\n\nA task that successfully calls execve has its capabilities modified for\nthe file ultimately being excecuted (i.e. the binary itself if that\nbinary is ELF or for the interpreter if the binary is a script.) [3] In\nthe capability evolution rules, for each mask Z, pZ represents the old\nvalue and pZ\u0027 represents the new value. The rules are:\n\n pP\u0027 \u003d (X \u0026 fP) | (pI \u0026 fI)\n pI\u0027 \u003d pI\n pE\u0027 \u003d (fE ? pP\u0027 : 0)\n X is unchanged\n\nFor setuid binaries, fP, fI, and fE are modified by a moderately\ncomplicated set of rules that emulate POSIX behavior. Similarly, if\neuid \u003d\u003d 0 or ruid \u003d\u003d 0, then fP, fI, and fE are modified differently\n(primary, fP and fI usually end up being the full set). For nonroot\nusers executing binaries with neither setuid nor file caps, fI and fP\nare empty and fE is false.\n\nAs an extra complication, if you execute a process as nonroot and fE is\nset, then the \"secure exec\" rules are in effect: AT_SECURE gets set,\nLD_PRELOAD doesn\u0027t work, etc.\n\nThis is rather messy. We\u0027ve learned that making any changes is\ndangerous, though: if a new kernel version allows an unprivileged\nprogram to change its security state in a way that persists cross\nexecution of a setuid program or a program with file caps, this\npersistent state is surprisingly likely to allow setuid or file-capped\nprograms to be exploited for privilege escalation.\n\n\u003d\u003d\u003d\u003d\u003d The problem \u003d\u003d\u003d\u003d\u003d\n\nCapability inheritance is basically useless.\n\nIf you aren\u0027t root and you execute an ordinary binary, fI is zero, so\nyour capabilities have no effect whatsoever on pP\u0027. This means that you\ncan\u0027t usefully execute a helper process or a shell command with elevated\ncapabilities if you aren\u0027t root.\n\nOn current kernels, you can sort of work around this by setting fI to\nthe full set for most or all non-setuid executable files. This causes\npP\u0027 \u003d pI for nonroot, and inheritance works. No one does this because\nit\u0027s a PITA and it isn\u0027t even supported on most filesystems.\n\nIf you try this, you\u0027ll discover that every nonroot program ends up with\nsecure exec rules, breaking many things.\n\nThis is a problem that has bitten many people who have tried to use\ncapabilities for anything useful.\n\n\u003d\u003d\u003d\u003d\u003d The proposed change \u003d\u003d\u003d\u003d\u003d\n\nThis patch adds a fifth capability mask called the ambient mask (pA).\npA does what most people expect pI to do.\n\npA obeys the invariant that no bit can ever be set in pA if it is not\nset in both pP and pI. Dropping a bit from pP or pI drops that bit from\npA. This ensures that existing programs that try to drop capabilities\nstill do so, with a complication. Because capability inheritance is so\nbroken, setting KEEPCAPS, using setresuid to switch to nonroot uids, and\nthen calling execve effectively drops capabilities. Therefore,\nsetresuid from root to nonroot conditionally clears pA unless\nSECBIT_NO_SETUID_FIXUP is set. Processes that don\u0027t like this can\nre-add bits to pA afterwards.\n\nThe capability evolution rules are changed:\n\n pA\u0027 \u003d (file caps or setuid or setgid ? 0 : pA)\n pP\u0027 \u003d (X \u0026 fP) | (pI \u0026 fI) | pA\u0027\n pI\u0027 \u003d pI\n pE\u0027 \u003d (fE ? pP\u0027 : pA\u0027)\n X is unchanged\n\nIf you are nonroot but you have a capability, you can add it to pA. If\nyou do so, your children get that capability in pA, pP, and pE. For\nexample, you can set pA \u003d CAP_NET_BIND_SERVICE, and your children can\nautomatically bind low-numbered ports. Hallelujah!\n\nUnprivileged users can create user namespaces, map themselves to a\nnonzero uid, and create both privileged (relative to their namespace)\nand unprivileged process trees. This is currently more or less\nimpossible. Hallelujah!\n\nYou cannot use pA to try to subvert a setuid, setgid, or file-capped\nprogram: if you execute any such program, pA gets cleared and the\nresulting evolution rules are unchanged by this patch.\n\nUsers with nonzero pA are unlikely to unintentionally leak that\ncapability. If they run programs that try to drop privileges, dropping\nprivileges will still work.\n\nIt\u0027s worth noting that the degree of paranoia in this patch could\npossibly be reduced without causing serious problems. Specifically, if\nwe allowed pA to persist across executing non-pA-aware setuid binaries\nand across setresuid, then, naively, the only capabilities that could\nleak as a result would be the capabilities in pA, and any attacker\n*already* has those capabilities. This would make me nervous, though --\nsetuid binaries that tried to privilege-separate might fail to do so,\nand putting CAP_DAC_READ_SEARCH or CAP_DAC_OVERRIDE into pA could have\nunexpected side effects. (Whether these unexpected side effects would\nbe exploitable is an open question.) I\u0027ve therefore taken the more\nparanoid route. We can revisit this later.\n\nAn alternative would be to require PR_SET_NO_NEW_PRIVS before setting\nambient capabilities. I think that this would be annoying and would\nmake granting otherwise unprivileged users minor ambient capabilities\n(CAP_NET_BIND_SERVICE or CAP_NET_RAW for example) much less useful than\nit is with this patch.\n\n\u003d\u003d\u003d\u003d\u003d Footnotes \u003d\u003d\u003d\u003d\u003d\n\n[1] Files that are missing the \"security.capability\" xattr or that have\nunrecognized values for that xattr end up with has_cap set to false.\nThe code that does that appears to be complicated for no good reason.\n\n[2] The libcap capability mask parsers and formatters are dangerously\nmisleading and the documentation is flat-out wrong. fE is *not* a mask;\nit\u0027s a single bit. This has probably confused every single person who\nhas tried to use file capabilities.\n\n[3] Linux very confusingly processes both the script and the interpreter\nif applicable, for reasons that elude me. The results from thinking\nabout a script\u0027s file capabilities and/or setuid bits are mostly\ndiscarded.\n\nPreliminary userspace code is here, but it needs updating:\nhttps://git.kernel.org/cgit/linux/kernel/git/luto/util-linux-playground.git/commit/?h\u003dcap_ambient\u0026id\u003d7f5afbd175d2\n\nHere is a test program that can be used to verify the functionality\n(from Christoph):\n\n/*\n * Test program for the ambient capabilities. This program spawns a shell\n * that allows running processes with a defined set of capabilities.\n *\n * (C) 2015 Christoph Lameter \u003ccl@linux.com\u003e\n * Released under: GPL v3 or later.\n *\n *\n * Compile using:\n *\n *\tgcc -o ambient_test ambient_test.o -lcap-ng\n *\n * This program must have the following capabilities to run properly:\n * Permissions for CAP_NET_RAW, CAP_NET_ADMIN, CAP_SYS_NICE\n *\n * A command to equip the binary with the right caps is:\n *\n *\tsetcap cap_net_raw,cap_net_admin,cap_sys_nice+p ambient_test\n *\n *\n * To get a shell with additional caps that can be inherited by other processes:\n *\n *\t./ambient_test /bin/bash\n *\n *\n * Verifying that it works:\n *\n * From the bash spawed by ambient_test run\n *\n *\tcat /proc/$$/status\n *\n * and have a look at the capabilities.\n */\n\n/*\n * Definitions from the kernel header files. These are going to be removed\n * when the /usr/include files have these defined.\n */\n\nstatic void set_ambient_cap(int cap)\n{\n\tint rc;\n\n\tcapng_get_caps_process();\n\trc \u003d capng_update(CAPNG_ADD, CAPNG_INHERITABLE, cap);\n\tif (rc) {\n\t\tprintf(\"Cannot add inheritable cap\\n\");\n\t\texit(2);\n\t}\n\tcapng_apply(CAPNG_SELECT_CAPS);\n\n\t/* Note the two 0s at the end. Kernel checks for these */\n\tif (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0)) {\n\t\tperror(\"Cannot set cap\");\n\t\texit(1);\n\t}\n}\n\nint main(int argc, char **argv)\n{\n\tint rc;\n\n\tset_ambient_cap(CAP_NET_RAW);\n\tset_ambient_cap(CAP_NET_ADMIN);\n\tset_ambient_cap(CAP_SYS_NICE);\n\n\tprintf(\"Ambient_test forking shell\\n\");\n\tif (execv(argv[1], argv + 1))\n\t\tperror(\"Cannot exec\");\n\n\treturn 0;\n}\n\nSigned-off-by: Christoph Lameter \u003ccl@linux.com\u003e # Original author\nSigned-off-by: Andy Lutomirski \u003cluto@kernel.org\u003e\nAcked-by: Serge E. Hallyn \u003cserge.hallyn@ubuntu.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Jonathan Corbet \u003ccorbet@lwn.net\u003e\nCc: Aaron Jones \u003caaronmdjones@gmail.com\u003e\nCc: Ted Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: Andrew G. Morgan \u003cmorgan@kernel.org\u003e\nCc: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\nCc: Austin S Hemmelgarn \u003cahferroin7@gmail.com\u003e\nCc: Markku Savela \u003cmsa@moth.iki.fi\u003e\nCc: Jarkko Sakkinen \u003cjarkko.sakkinen@linux.intel.com\u003e\nCc: Michael Kerrisk \u003cmtk.manpages@gmail.com\u003e\nCc: James Morris \u003cjames.l.morris@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n(cherry picked from commit 58319057b7847667f0c9585b9de0e8932b0fdb08)\n\nBug: 31038224\nChange-Id: I88bc5caa782dc6be23dc7e839ff8e11b9a903f8c\nSigned-off-by: Jorge Lucangeli Obes \u003cjorgelo@google.com\u003e\n" }, { "commit": "f44bd27f2230364d09155713a6a565af8435e7e5", "tree": "41cf4f0828f68df0b47a95af4b0d795da4f34fc8", "parents": [ "3ae32ffd3fadbf2a0357d04ac47b659e3a1ef6f6" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Apr 18 15:31:08 2017 +0100" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sun Aug 13 00:18:48 2017 +0000" }, "message": "KEYS: Change the name of the dead type to \".dead\" to prevent user access\n\ncommit c1644fe041ebaf6519f6809146a77c3ead9193af upstream.\n\nThis fixes CVE-2017-6951.\n\nUserspace should not be able to do things with the \"dead\" key type as it\ndoesn\u0027t have some of the helper functions set upon it that the kernel\nneeds. Attempting to use it may cause the kernel to crash.\n\nFix this by changing the name of the type to \".dead\" so that it\u0027s rejected\nup front on userspace syscalls by key_get_type_from_user().\n\nThough this doesn\u0027t seem to affect recent kernels, it does affect older\nones, certainly those prior to:\n\n\tcommit c06cfb08b88dfbe13be44a69ae2fdc3a7c902d81\n\tAuthor: David Howells \u003cdhowells@redhat.com\u003e\n\tDate: Tue Sep 16 17:36:06 2014 +0100\n\tKEYS: Remove key_type::match in favour of overriding default by match_preparse\n\nwhich went in before 3.18-rc1.\n\nChange-Id: I1bc7e5f1389d703e3f252bae69b1bcab88809b00\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ab968c7b090d728838ef4294dbf924af7f2597a5", "tree": "d1397379c77be69c9b1668259676d910cb208fcc", "parents": [ "dc2517b4e0b8bfe2295ba3d4e189d4cdd1bef8aa" ], "author": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Tue Jul 25 20:49:56 2017 -0500" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Wed Jul 26 07:29:47 2017 -0400" }, "message": "tenderloin: quiet avc denied log spam\n\n this device is unlikely to get full selinux support,\n so for now lets just shut this up to clean up the log spew.\n\nChange-Id: Iad5936f2cbbddbde2482df108926860aeaed7f32\n" }, { "commit": "8f155263510c8d70769af1396ce9130b9ec40488", "tree": "2d84da6d1b6987e4cc208c1ac8fb491013db3e84", "parents": [ "39b151f449a46ccbd528442e8d6dfacd4d7f46c2" ], "author": { "name": "Eric Biggers", "email": "ebiggers@google.com", "time": "Tue Apr 18 15:31:09 2017 +0100" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Jun 17 23:05:47 2017 +0000" }, "message": "KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings\n\ncommit c9f838d104fed6f2f61d68164712e3204bf5271b upstream.\n\nThis fixes CVE-2017-7472.\n\nRunning the following program as an unprivileged user exhausts kernel\nmemory by leaking thread keyrings:\n\n\t#include \u003ckeyutils.h\u003e\n\n\tint main()\n\t{\n\t\tfor (;;)\n\t\t\tkeyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_THREAD_KEYRING);\n\t}\n\nFix it by only creating a new thread keyring if there wasn\u0027t one before.\nTo make things more consistent, make install_thread_keyring_to_cred()\nand install_process_keyring_to_cred() both return 0 if the corresponding\nkeyring is already present.\n\nFixes: d84f4f992cbd (\"CRED: Inaugurate COW credentials\")\nSigned-off-by: Eric Biggers \u003cebiggers@google.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\nChange-Id: I295fe07c94ec6eba3856cbfff453870ef6673a3d\nSigned-off-by: Kevin F. Haggerty \u003chaggertk@lineageos.org\u003e\n" }, { "commit": "a1a9618996c47e5fde8234119a858382e4f0a0a0", "tree": "b71412bf598c7771a83f2b5ed85358bc89802b4c", "parents": [ "cdcac5b42d1f1bf0c3129cfc65bc52e60773e717" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Apr 18 15:31:07 2017 +0100" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Mon May 29 17:41:53 2017 -0700" }, "message": "KEYS: Disallow keyrings beginning with \u0027.\u0027 to be joined as session keyrings\n\nThis fixes CVE-2016-9604.\n\nKeyrings whose name begin with a \u0027.\u0027 are special internal keyrings and so\nuserspace isn\u0027t allowed to create keyrings by this name to prevent\nshadowing. However, the patch that added the guard didn\u0027t fix\nKEYCTL_JOIN_SESSION_KEYRING. Not only can that create dot-named keyrings,\nit can also subscribe to them as a session keyring if they grant SEARCH\npermission to the user.\n\nThis, for example, allows a root process to set .builtin_trusted_keys as\nits session keyring, at which point it has full access because now the\npossessor permissions are added. This permits root to add extra public\nkeys, thereby bypassing module verification.\n\nThis also affects kexec and IMA.\n\nThis can be tested by (as root):\n\n\tkeyctl session .builtin_trusted_keys\n\tkeyctl add user a a @s\n\tkeyctl list @s\n\nwhich on my test box gives me:\n\n\t2 keys in keyring:\n\t180010936: ---lswrv 0 0 asymmetric: Build time autogenerated kernel key: ae3d4a31b82daa8e1a75b49dc2bba949fd992a05\n\t801382539: --alswrv 0 0 user: a\n\nFix this by rejecting names beginning with a \u0027.\u0027 in the keyctl.\n\nChange-Id: I9ff468aa61e0f64acfe27cb2e10670c9defb0ae3\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\ncc: linux-ima-devel@lists.sourceforge.net\ncc: stable@vger.kernel.org\n" }, { "commit": "16a39eddb18a2daf21142a8fd1fd0cfde76a9397", "tree": "5f858f20e445c8a45078ca0ec5f61c4e088e1deb", "parents": [ "e39192331424b6e0695038c1dd57f43efebe9355", "8d1988f838a95e836342b505398d38b223181f17" ], "author": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 30 09:42:57 2016 -0600" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 30 10:00:46 2016 -0600" }, "message": "Merge tag \u0027v3.4.113\u0027 into cm-14.1\n\nChange-Id: Ifa814958fd557299a5442731fc22fcb62139898b\n" }, { "commit": "c18a0097da6a205a69624297c45e632b252bc3b0", "tree": "a8622b43b61ddab60536740af915b77b3ac7e4d6", "parents": [ "e4f8aea9525a44dd4929846a3ce62f4f881c5f6b" ], "author": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Fri Dec 16 14:05:28 2016 -0600" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Fri Dec 16 14:05:28 2016 -0600" }, "message": "kernel: fix mismerges\n\nChange-Id: I7b3cb41f9b3158e6d96818b4ad40108eccf69336\n" }, { "commit": "5d9e7568b0d5b11ad168fbeb0ea08e68da7433ef", "tree": "d065013343a55b538ae5cd3611f00a5b02bc2aaf", "parents": [ "4e50a957d5365d4145187626073f6febf022534c" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Sep 06 14:03:45 2016 +0100" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Thu Dec 08 21:14:42 2016 -0600" }, "message": "KEYS: Fix short sprintf buffer in /proc/keys show function\n\nFix a short sprintf buffer in proc_keys_show(). If the gcc stack protector\nis turned on, this can cause a panic due to stack corruption.\n\nThe problem is that xbuf[] is not big enough to hold a 64-bit timeout\nrendered as weeks:\n\n\t(gdb) p 0xffffffffffffffffULL/(60*60*24*7)\n\t$2 \u003d 30500568904943\n\nThat\u0027s 14 chars plus NUL, not 11 chars plus NUL.\n\nExpand the buffer to 16 chars.\n\nI think the unpatched code apparently works if the stack-protector is not\nenabled because on a 32-bit machine the buffer won\u0027t be overflowed and on a\n64-bit machine there\u0027s a 64-bit aligned pointer at one side and an int that\nisn\u0027t checked again on the other side.\n\nThe panic incurred looks something like:\n\nKernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff81352ebe\nCPU: 0 PID: 1692 Comm: reproducer Not tainted 4.7.2-201.fc24.x86_64 #1\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n 0000000000000086 00000000fbbd2679 ffff8800a044bc00 ffffffff813d941f\n ffffffff81a28d58 ffff8800a044bc98 ffff8800a044bc88 ffffffff811b2cb6\n ffff880000000010 ffff8800a044bc98 ffff8800a044bc30 00000000fbbd2679\nCall Trace:\n [\u003cffffffff813d941f\u003e] dump_stack+0x63/0x84\n [\u003cffffffff811b2cb6\u003e] panic+0xde/0x22a\n [\u003cffffffff81352ebe\u003e] ? proc_keys_show+0x3ce/0x3d0\n [\u003cffffffff8109f7f9\u003e] __stack_chk_fail+0x19/0x30\n [\u003cffffffff81352ebe\u003e] proc_keys_show+0x3ce/0x3d0\n [\u003cffffffff81350410\u003e] ? key_validate+0x50/0x50\n [\u003cffffffff8134db30\u003e] ? key_default_cmp+0x20/0x20\n [\u003cffffffff8126b31c\u003e] seq_read+0x2cc/0x390\n [\u003cffffffff812b6b12\u003e] proc_reg_read+0x42/0x70\n [\u003cffffffff81244fc7\u003e] __vfs_read+0x37/0x150\n [\u003cffffffff81357020\u003e] ? security_file_permission+0xa0/0xc0\n [\u003cffffffff81246156\u003e] vfs_read+0x96/0x130\n [\u003cffffffff81247635\u003e] SyS_read+0x55/0xc0\n [\u003cffffffff817eb872\u003e] entry_SYSCALL_64_fastpath+0x1a/0xa4\n\nChange-Id: I0787d5a38c730ecb75d3c08f28f0ab36295d59e7\nReported-by: Ondrej Kozina \u003cokozina@redhat.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nTested-by: Ondrej Kozina \u003cokozina@redhat.com\u003e\n" }, { "commit": "a2333f57bd0d268a81a51a28eca3e535070f8cdb", "tree": "94ef3208322f5694ed86f583c08e91e6d28c4658", "parents": [ "184d099950767dd590799e77aca19eff5fa54bf9" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Sun May 29 14:22:32 2016 -0700" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Thu Dec 08 21:05:22 2016 -0600" }, "message": "FROMLIST: security,perf: Allow further restriction of perf_event_open\n\nWhen kernel.perf_event_open is set to 3 (or greater), disallow all\naccess to performance events by users without CAP_SYS_ADMIN.\nAdd a Kconfig symbol CONFIG_SECURITY_PERF_EVENTS_RESTRICT that\nmakes this value the default.\n\nThis is based on a similar feature in grsecurity\n(CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn\u0027t include making\nthe variable read-only. It also allows enabling further restriction\nat run-time regardless of whether the default is changed.\n\nhttps://lkml.org/lkml/2016/1/11/587\n\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n\nBug: 29054680\nChange-Id: Iff5bff4fc1042e85866df9faa01bce8d04335ab8\n" }, { "commit": "7ede6f69f76506772ad5547bb149120962323312", "tree": "86b537db95c8ffe5eedd2e3963d836076157dbdb", "parents": [ "c0db3f0d61a77f6e4155d137ab9a1536d8947b87", "8d1988f838a95e836342b505398d38b223181f17" ], "author": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Sat Dec 03 17:58:38 2016 -0500" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Sat Dec 03 17:58:38 2016 -0500" }, "message": "Merge remote-tracking branch \u0027linux/linux-3.4.y\u0027 into ng-7.1-113\n" }, { "commit": "c97fe2418e51a47b1966fbdd60beb9d84f703bc0", "tree": "0a846a146fbacd8906efc9c2c1f786d62bec7ccb", "parents": [ "7156334b7baca9408eb48f5306676c4d262189f9" ], "author": { "name": "Lorenzo Colitti", "email": "lorenzo@google.com", "time": "Thu Feb 04 00:52:15 2016 +0900" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:57 2016 -0600" }, "message": "selinux: nlmsgtab: add SOCK_DESTROY to the netlink mapping tables\n\nWithout this, using SOCK_DESTROY in enforcing mode results in:\n\n SELinux: unrecognized netlink message type\u003d21 for sclass\u003d32\n\nChange-Id: I7862bb0fc83573567243ffa9549a2c7405b5986c\n" }, { "commit": "7156334b7baca9408eb48f5306676c4d262189f9", "tree": "273a06224a4bc58ae871f69ca9e8d06ea6a3a08d", "parents": [ "094e2328c4f91d16008bfbced519a54166071a92" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Mon Nov 23 16:07:41 2015 -0500" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:51 2016 -0600" }, "message": "UPSTREAM: selinux: fix bug in conditional rules handling\n\n(cherry picked from commit commit f3bef67992e8698897b584616535803887c4a73e)\n\ncommit fa1aa143ac4a (\"selinux: extended permissions for ioctls\")\nintroduced a bug into the handling of conditional rules, skipping the\nprocessing entirely when the caller does not provide an extended\npermissions (xperms) structure. Access checks from userspace using\n/sys/fs/selinux/access do not include such a structure since that\ninterface does not presently expose extended permission information.\nAs a result, conditional rules were being ignored entirely on userspace\naccess requests, producing denials when access was allowed by\nconditional rules in the policy. Fix the bug by only skipping\ncomputation of extended permissions in this situation, not the entire\nconditional rules processing.\n\nChange-Id: I6f81765f6cdb9ce72f93c290d7987d93688651a0\nReported-by: Laurent Bigonville \u003cbigon@debian.org\u003e\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\n[PM: fixed long lines in patch description]\nCc: stable@vger.kernel.org # 4.3\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\n" }, { "commit": "094e2328c4f91d16008bfbced519a54166071a92", "tree": "3e1c4cbf2ff3014384e3691f2e9619eac9f1c8b2", "parents": [ "d81c0562be6de1daf743aab55e908a10933d91d8" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Thu Oct 22 09:30:40 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:42 2016 -0600" }, "message": "selinux: Android kernel compatibility with M userspace\n\nNOT intended for new Android devices - this commit is unnecessary\nfor a target device that does not have a previous M variant.\n\nDO NOT upstream. Android only.\n\nMotivation:\n\nThis commit mitigates a mismatch between selinux kernel and\nselinux userspace. The selinux ioctl white-listing binary policy\nformat that was accepted into Android M differs slightly from what\nwas later accepted into the upstream kernel. This leaves Android\nmaster branch kernels incompatible with Android M releases. This\npatch restores backwards compatibility. This is important because:\n\n1. kernels may be updated on a different cycle than the rest of the\n OS e.g. security patching.\n2. Android M bringup may still be ongoing for some devices. The\n same kernel should work for both M and master.\n\nBackwards compatibility is achieved by checking for an Android M\npolicy characteristic during initial policy read and converting to\nupstream policy format. The inverse conversion is done for policy\nwrite as required for CTS testing.\n\nBug: 22846070\nChange-Id: I2f1ee2eee402f37cf3c9df9f9e03c1b9ddec1929\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "d81c0562be6de1daf743aab55e908a10933d91d8", "tree": "76dc86cf268d68583f6d47acd60148c49120dc20", "parents": [ "e05c4ff48e4957ab652baec4f71c1c25aea43354" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Fri Jul 10 17:19:56 2015 -0400" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:34 2016 -0600" }, "message": "selinux: extended permissions for ioctls\n\n(cherry picked from commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a)\n\nAdd extended permissions logic to selinux. Extended permissions\nprovides additional permissions in 256 bit increments. Extend the\ngeneric ioctl permission check to use the extended permissions for\nper-command filtering. Source/target/class sets including the ioctl\npermission may additionally include a set of commands. Example:\n\nallowxperm \u003csource\u003e \u003ctarget\u003e:\u003cclass\u003e ioctl unpriv_app_socket_cmds\nauditallowxperm \u003csource\u003e \u003ctarget\u003e:\u003cclass\u003e ioctl priv_gpu_cmds\n\nWhere unpriv_app_socket_cmds and priv_gpu_cmds are macros\nrepresenting commonly granted sets of ioctl commands.\n\nWhen ioctl commands are omitted only the permissions are checked.\nThis feature is intended to provide finer granularity for the ioctl\npermission that may be too imprecise. For example, the same driver\nmay use ioctls to provide important and benign functionality such as\ndriver version or socket type as well as dangerous capabilities such\nas debugging features, read/write/execute to physical memory or\naccess to sensitive data. Per-command filtering provides a mechanism\nto reduce the attack surface of the kernel, and limit applications\nto the subset of commands required.\n\nThe format of the policy binary has been modified to include ioctl\ncommands, and the policy version number has been incremented to\nPOLICYDB_VERSION_XPERMS_IOCTL\u003d30 to account for the format\nchange.\n\nThe extended permissions logic is deliberately generic to allow\ncomponents to be reused e.g. netlink filters\n\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\nAcked-by: Nick Kralevich \u003cnnk@google.com\u003e\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nBug: 22846070\nChange-Id: I299dc776d2f98d593ecc051707110c92a085350f\n" }, { "commit": "e05c4ff48e4957ab652baec4f71c1c25aea43354", "tree": "b85958d51d16f4e0adee5c7e0c9a9dbd7abf2aa4", "parents": [ "5c3bc39810588c40b8cce9cb30d8f520f88a6fde" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Thu Feb 26 13:54:17 2015 -0800" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:29 2016 -0600" }, "message": "selinux: remove unnecessary pointer reassignment\n\n(cherry pick from commit 83d4a806ae46397f606de7376b831524bd3a21e5)\n\nCommit f01e1af445fa (\"selinux: don\u0027t pass in NULL avd to avc_has_perm_noaudit\")\nmade this pointer reassignment unnecessary. Avd should continue to reference\nthe stack-based copy.\n\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\nAcked-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\n[PM: tweaked subject line]\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nBug: 22846070\nChange-Id: Ie33688d163870705272607309a27fb7c8f870748\n" }, { "commit": "5c3bc39810588c40b8cce9cb30d8f520f88a6fde", "tree": "4c283be9b9d38878dd36e58bbc46bda3d453d7d2", "parents": [ "009677b8d16082a62a107c7ad281488af2c92bfd" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jul 29 18:36:41 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:24 2016 -0600" }, "message": "Revert \"SELinux: per-command whitelisting of ioctls\"\n\nThis reverts commit bc84b4adb1469e3d05ad76c304a4c545feaf1f88.\n\nBug: 22846070\nChange-Id: Ib4cb130b2225ea2e22556ff852313e0de7dddcab\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "009677b8d16082a62a107c7ad281488af2c92bfd", "tree": "1bca3b0d84942e89f20e1d725a5d2d90bd16890e", "parents": [ "7ef868d65cd83362a0e0072c244622fc15b647e3" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jul 29 18:35:33 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:19 2016 -0600" }, "message": "Revert \"SELinux: use deletion-safe iterator to free list\"\n\nThis reverts commit c9a8571249fa3a55a0490bd571eaf0cea097fab0.\n\nBug: 22846070\nChange-Id: I85e2b6322f98bd584ed523b0bd0291375dbc35dc\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "7ef868d65cd83362a0e0072c244622fc15b647e3", "tree": "db7ee36fa57c2f5b5dd060a26150ec84dd7eb621", "parents": [ "8a3c3991b1d80ba40ee0515c4a7747285655d266" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jul 29 18:33:33 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:13 2016 -0600" }, "message": "Revert \"SELinux: ss: Fix policy write for ioctl operations\"\n\nThis reverts commit c06168226f5eaaaad93af5b2811f213b01382363.\n\nBug: 22846070\nChange-Id: I665c1f2350e10ce890e7c4be1a06e666929d5d7a\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "87f4dcb8c9aeffa0b2ef13bc68401d50a3ffcec5", "tree": "4207e1f5018fad2446faf2fa1ebafc157dede59f", "parents": [ "7a42c72c2d222f7887074396d83a806d8c50176d" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Dec 18 01:34:26 2015 +0000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Wed Oct 26 23:15:41 2016 +0800" }, "message": "KEYS: Fix race between read and revoke\n\ncommit b4a1b4f5047e4f54e194681125c74c0aa64d637d upstream.\n\nThis fixes CVE-2015-7550.\n\nThere\u0027s a race between keyctl_read() and keyctl_revoke(). If the revoke\nhappens between keyctl_read() checking the validity of a key and the key\u0027s\nsemaphore being taken, then the key type read method will see a revoked key.\n\nThis causes a problem for the user-defined key type because it assumes in\nits read method that there will always be a payload in a non-revoked key\nand doesn\u0027t check for a NULL pointer.\n\nFix this by making keyctl_read() check the validity of a key after taking\nsemaphore instead of before.\n\nI think the bug was introduced with the original keyrings code.\n\nThis was discovered by a multithreaded test program generated by syzkaller\n(http://github.com/google/syzkaller). Here\u0027s a cleaned up version:\n\n\t#include \u003csys/types.h\u003e\n\t#include \u003ckeyutils.h\u003e\n\t#include \u003cpthread.h\u003e\n\tvoid *thr0(void *arg)\n\t{\n\t\tkey_serial_t key \u003d (unsigned long)arg;\n\t\tkeyctl_revoke(key);\n\t\treturn 0;\n\t}\n\tvoid *thr1(void *arg)\n\t{\n\t\tkey_serial_t key \u003d (unsigned long)arg;\n\t\tchar buffer[16];\n\t\tkeyctl_read(key, buffer, 16);\n\t\treturn 0;\n\t}\n\tint main()\n\t{\n\t\tkey_serial_t key \u003d add_key(\"user\", \"%\", \"foo\", 3, KEY_SPEC_USER_KEYRING);\n\t\tpthread_t th[5];\n\t\tpthread_create(\u0026th[0], 0, thr0, (void *)(unsigned long)key);\n\t\tpthread_create(\u0026th[1], 0, thr1, (void *)(unsigned long)key);\n\t\tpthread_create(\u0026th[2], 0, thr0, (void *)(unsigned long)key);\n\t\tpthread_create(\u0026th[3], 0, thr1, (void *)(unsigned long)key);\n\t\tpthread_join(th[0], 0);\n\t\tpthread_join(th[1], 0);\n\t\tpthread_join(th[2], 0);\n\t\tpthread_join(th[3], 0);\n\t\treturn 0;\n\t}\n\nBuild as:\n\n\tcc -o keyctl-race keyctl-race.c -lkeyutils -lpthread\n\nRun as:\n\n\twhile keyctl-race; do :; done\n\nas it may need several iterations to crash the kernel. The crash can be\nsummarised as:\n\n\tBUG: unable to handle kernel NULL pointer dereference at 0000000000000010\n\tIP: [\u003cffffffff81279b08\u003e] user_read+0x56/0xa3\n\t...\n\tCall Trace:\n\t [\u003cffffffff81276aa9\u003e] keyctl_read_key+0xb6/0xd7\n\t [\u003cffffffff81277815\u003e] SyS_keyctl+0x83/0xe0\n\t [\u003cffffffff815dbb97\u003e] entry_SYSCALL_64_fastpath+0x12/0x6f\n\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nTested-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "851c34bdf9e5002c0be2a9ac3332742f7328b87f", "tree": "a0d28b89a18ea31262f40c0a847ddc11972b3fc6", "parents": [ "4447dfca8d1f6cdafceea49b61fc4f5f8533231f" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Sep 06 14:03:45 2016 +0100" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Tue Oct 25 13:48:22 2016 -0500" }, "message": "KEYS: Fix short sprintf buffer in /proc/keys show function\n\nFix a short sprintf buffer in proc_keys_show(). If the gcc stack protector\nis turned on, this can cause a panic due to stack corruption.\n\nThe problem is that xbuf[] is not big enough to hold a 64-bit timeout\nrendered as weeks:\n\n\t(gdb) p 0xffffffffffffffffULL/(60*60*24*7)\n\t$2 \u003d 30500568904943\n\nThat\u0027s 14 chars plus NUL, not 11 chars plus NUL.\n\nExpand the buffer to 16 chars.\n\nI think the unpatched code apparently works if the stack-protector is not\nenabled because on a 32-bit machine the buffer won\u0027t be overflowed and on a\n64-bit machine there\u0027s a 64-bit aligned pointer at one side and an int that\nisn\u0027t checked again on the other side.\n\nThe panic incurred looks something like:\n\nKernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff81352ebe\nCPU: 0 PID: 1692 Comm: reproducer Not tainted 4.7.2-201.fc24.x86_64 #1\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n 0000000000000086 00000000fbbd2679 ffff8800a044bc00 ffffffff813d941f\n ffffffff81a28d58 ffff8800a044bc98 ffff8800a044bc88 ffffffff811b2cb6\n ffff880000000010 ffff8800a044bc98 ffff8800a044bc30 00000000fbbd2679\nCall Trace:\n [\u003cffffffff813d941f\u003e] dump_stack+0x63/0x84\n [\u003cffffffff811b2cb6\u003e] panic+0xde/0x22a\n [\u003cffffffff81352ebe\u003e] ? proc_keys_show+0x3ce/0x3d0\n [\u003cffffffff8109f7f9\u003e] __stack_chk_fail+0x19/0x30\n [\u003cffffffff81352ebe\u003e] proc_keys_show+0x3ce/0x3d0\n [\u003cffffffff81350410\u003e] ? key_validate+0x50/0x50\n [\u003cffffffff8134db30\u003e] ? key_default_cmp+0x20/0x20\n [\u003cffffffff8126b31c\u003e] seq_read+0x2cc/0x390\n [\u003cffffffff812b6b12\u003e] proc_reg_read+0x42/0x70\n [\u003cffffffff81244fc7\u003e] __vfs_read+0x37/0x150\n [\u003cffffffff81357020\u003e] ? security_file_permission+0xa0/0xc0\n [\u003cffffffff81246156\u003e] vfs_read+0x96/0x130\n [\u003cffffffff81247635\u003e] SyS_read+0x55/0xc0\n [\u003cffffffff817eb872\u003e] entry_SYSCALL_64_fastpath+0x1a/0xa4\n\nChange-Id: I0787d5a38c730ecb75d3c08f28f0ab36295d59e7\nReported-by: Ondrej Kozina \u003cokozina@redhat.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nTested-by: Ondrej Kozina \u003cokozina@redhat.com\u003e\n" }, { "commit": "a7ca179d673b837593b696f0198271702edff776", "tree": "a2178cd25681d1c0048b1a16840a32d481d1b0cb", "parents": [ "92661998000623fd1bb02897c2d3f6d67c6beb9c" ], "author": { "name": "Lorenzo Colitti", "email": "lorenzo@google.com", "time": "Thu Feb 04 00:52:15 2016 +0900" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Mon Aug 29 16:06:09 2016 -0400" }, "message": "selinux: nlmsgtab: add SOCK_DESTROY to the netlink mapping tables\n\nWithout this, using SOCK_DESTROY in enforcing mode results in:\n\n SELinux: unrecognized netlink message type\u003d21 for sclass\u003d32\n\nChange-Id: I7862bb0fc83573567243ffa9549a2c7405b5986c\n" }, { "commit": "92661998000623fd1bb02897c2d3f6d67c6beb9c", "tree": "f740241cd3534b193740fd4a7a88b4a953336dd3", "parents": [ "8b9fba378bcc514b2390afa023fad2128000293b" ], "author": { "name": "Paul Moore", "email": "pmoore@redhat.com", "time": "Tue Jan 28 14:45:41 2014 -0500" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Mon Aug 29 16:05:59 2016 -0400" }, "message": "selinux: add SOCK_DIAG_BY_FAMILY to the list of netlink message types\n\ncommit 6a96e15096da6e7491107321cfa660c7c2aa119d upstream.\n\nThe SELinux AF_NETLINK/NETLINK_SOCK_DIAG socket class was missing the\nSOCK_DIAG_BY_FAMILY definition which caused SELINUX_ERR messages when\nthe ss tool was run.\n\n # ss\n Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port\n u_str ESTAB 0 0 * 14189 * 14190\n u_str ESTAB 0 0 * 14145 * 14144\n u_str ESTAB 0 0 * 14151 * 14150\n {...}\n # ausearch -m SELINUX_ERR\n ----\n time-\u003eThu Jan 23 11:11:16 2014\n type\u003dSYSCALL msg\u003daudit(1390493476.445:374):\n arch\u003dc000003e syscall\u003d44 success\u003dyes exit\u003d40\n a0\u003d3 a1\u003d7fff03aa11f0 a2\u003d28 a3\u003d0 items\u003d0 ppid\u003d1852 pid\u003d1895\n auid\u003d0 uid\u003d0 gid\u003d0 euid\u003d0 suid\u003d0 fsuid\u003d0 egid\u003d0 sgid\u003d0 fsgid\u003d0\n tty\u003dpts0 ses\u003d1 comm\u003d\"ss\" exe\u003d\"/usr/sbin/ss\"\n subj\u003dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key\u003d(null)\n type\u003dSELINUX_ERR msg\u003daudit(1390493476.445:374):\n SELinux: unrecognized netlink message type\u003d20 for sclass\u003d32\n\nChange-Id: I22218ec620bc3ee6396145f1c2ad8ed222648309\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\n" }, { "commit": "d4117cd7bc8131671b26d343334e850f5b98ca78", "tree": "7d18b9dc28ee974403d5988b7301ab1ca91decfb", "parents": [ "a9084a0d907255dd7300bb785403e6383d32ed81" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Mon Nov 23 16:07:41 2015 -0500" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Wed Aug 10 16:27:58 2016 -0500" }, "message": "UPSTREAM: selinux: fix bug in conditional rules handling\n\n(cherry picked from commit commit f3bef67992e8698897b584616535803887c4a73e)\n\ncommit fa1aa143ac4a (\"selinux: extended permissions for ioctls\")\nintroduced a bug into the handling of conditional rules, skipping the\nprocessing entirely when the caller does not provide an extended\npermissions (xperms) structure. Access checks from userspace using\n/sys/fs/selinux/access do not include such a structure since that\ninterface does not presently expose extended permission information.\nAs a result, conditional rules were being ignored entirely on userspace\naccess requests, producing denials when access was allowed by\nconditional rules in the policy. Fix the bug by only skipping\ncomputation of extended permissions in this situation, not the entire\nconditional rules processing.\n\nChange-Id: I6f81765f6cdb9ce72f93c290d7987d93688651a0\nReported-by: Laurent Bigonville \u003cbigon@debian.org\u003e\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\n[PM: fixed long lines in patch description]\nCc: stable@vger.kernel.org # 4.3\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\n" }, { "commit": "accef775d1bdf690ffff927016d26da9859d543c", "tree": "a2b09c7f8d8ea23243214fb3874cd04af23c5118", "parents": [ "ecf1088a677b3526db4903a96b796939c9ca8d4f" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Thu Oct 22 09:30:40 2015 -0700" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Wed Aug 10 16:27:35 2016 -0500" }, "message": "selinux: Android kernel compatibility with M userspace\n\nNOT intended for new Android devices - this commit is unnecessary\nfor a target device that does not have a previous M variant.\n\nDO NOT upstream. Android only.\n\nMotivation:\n\nThis commit mitigates a mismatch between selinux kernel and\nselinux userspace. The selinux ioctl white-listing binary policy\nformat that was accepted into Android M differs slightly from what\nwas later accepted into the upstream kernel. This leaves Android\nmaster branch kernels incompatible with Android M releases. This\npatch restores backwards compatibility. This is important because:\n\n1. kernels may be updated on a different cycle than the rest of the\n OS e.g. security patching.\n2. Android M bringup may still be ongoing for some devices. The\n same kernel should work for both M and master.\n\nBackwards compatibility is achieved by checking for an Android M\npolicy characteristic during initial policy read and converting to\nupstream policy format. The inverse conversion is done for policy\nwrite as required for CTS testing.\n\nBug: 22846070\nChange-Id: I2f1ee2eee402f37cf3c9df9f9e03c1b9ddec1929\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "ecf1088a677b3526db4903a96b796939c9ca8d4f", "tree": "952282f6ad9e273075337638d19aaef02c0630d0", "parents": [ "29ea3244f7ee375a4af4d776caf721663dd4293d" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Fri Jul 10 17:19:56 2015 -0400" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Wed Aug 10 16:27:27 2016 -0500" }, "message": "selinux: extended permissions for ioctls\n\n(cherry picked from commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a)\n\nAdd extended permissions logic to selinux. Extended permissions\nprovides additional permissions in 256 bit increments. Extend the\ngeneric ioctl permission check to use the extended permissions for\nper-command filtering. Source/target/class sets including the ioctl\npermission may additionally include a set of commands. Example:\n\nallowxperm \u003csource\u003e \u003ctarget\u003e:\u003cclass\u003e ioctl unpriv_app_socket_cmds\nauditallowxperm \u003csource\u003e \u003ctarget\u003e:\u003cclass\u003e ioctl priv_gpu_cmds\n\nWhere unpriv_app_socket_cmds and priv_gpu_cmds are macros\nrepresenting commonly granted sets of ioctl commands.\n\nWhen ioctl commands are omitted only the permissions are checked.\nThis feature is intended to provide finer granularity for the ioctl\npermission that may be too imprecise. For example, the same driver\nmay use ioctls to provide important and benign functionality such as\ndriver version or socket type as well as dangerous capabilities such\nas debugging features, read/write/execute to physical memory or\naccess to sensitive data. Per-command filtering provides a mechanism\nto reduce the attack surface of the kernel, and limit applications\nto the subset of commands required.\n\nThe format of the policy binary has been modified to include ioctl\ncommands, and the policy version number has been incremented to\nPOLICYDB_VERSION_XPERMS_IOCTL\u003d30 to account for the format\nchange.\n\nThe extended permissions logic is deliberately generic to allow\ncomponents to be reused e.g. netlink filters\n\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\nAcked-by: Nick Kralevich \u003cnnk@google.com\u003e\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nBug: 22846070\nChange-Id: I299dc776d2f98d593ecc051707110c92a085350f\n" }, { "commit": "29ea3244f7ee375a4af4d776caf721663dd4293d", "tree": "73bcd568996ad1950f1870c508ac35beef242f3f", "parents": [ "b0cde1e4b20d5be5b79eba284358bdff1283612b" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Fri Jul 10 17:19:55 2015 -0400" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Wed Aug 10 16:27:22 2016 -0500" }, "message": "security: add ioctl specific auditing to lsm_audit\n\n(cherry pick from commit 671a2781ff01abf4fdc8904881fc3abd3a8279af)\n\nAdd information about ioctl calls to the LSM audit data. Log the\nfile path and command number.\n\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\nAcked-by: Nick Kralevich \u003cnnk@google.com\u003e\n[PM: subject line tweak]\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nBug: 22846070\nChange-Id: I4a7678294e0a3075f57bd77c76fd17e6f0d33e75\n" }, { "commit": "b0cde1e4b20d5be5b79eba284358bdff1283612b", "tree": "1f6126a84a86289bcc33905b9ea8574d9559fdbd", "parents": [ "94bdaadcca0aa203549385016b26cb5c6c31fe56" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Thu Feb 26 13:54:17 2015 -0800" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Wed Aug 10 16:27:16 2016 -0500" }, "message": "selinux: remove unnecessary pointer reassignment\n\n(cherry pick from commit 83d4a806ae46397f606de7376b831524bd3a21e5)\n\nCommit f01e1af445fa (\"selinux: don\u0027t pass in NULL avd to avc_has_perm_noaudit\")\nmade this pointer reassignment unnecessary. Avd should continue to reference\nthe stack-based copy.\n\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\nAcked-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\n[PM: tweaked subject line]\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nBug: 22846070\nChange-Id: Ie33688d163870705272607309a27fb7c8f870748\n" }, { "commit": "94bdaadcca0aa203549385016b26cb5c6c31fe56", "tree": "8f3ecd3bed66653cec28ea4070da85e46affbe54", "parents": [ "8c4c81bd0040ba7054fc6c8b6ff17f4856a28db9" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jul 29 18:37:24 2015 -0700" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Wed Aug 10 16:27:07 2016 -0500" }, "message": "Revert \"security: lsm_audit: add ioctl specific auditing\"\n\nThis reverts commit 643ce43c226cdfa73bcac2fa91f1f8a3dfd171a2.\n\nBug: 22846070\nChange-Id: I5dde1878e5baac43b4968141c0dc60b70e042183\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "8c4c81bd0040ba7054fc6c8b6ff17f4856a28db9", "tree": "ee77a4514ab8b305c312f3fb70c910e0e6c41a6f", "parents": [ "f636525feee1d47035b972ad87d397f727b2ed5b" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jul 29 18:36:41 2015 -0700" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Wed Aug 10 16:27:02 2016 -0500" }, "message": "Revert \"SELinux: per-command whitelisting of ioctls\"\n\nThis reverts commit bc84b4adb1469e3d05ad76c304a4c545feaf1f88.\n\nBug: 22846070\nChange-Id: Ib4cb130b2225ea2e22556ff852313e0de7dddcab\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "f636525feee1d47035b972ad87d397f727b2ed5b", "tree": "fab2f0eccd40abd34cfe7fadc7028dac6f399573", "parents": [ "97df93a063d060bcf2c8fa4baaf0094cb8e256a0" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jul 29 18:35:33 2015 -0700" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Wed Aug 10 16:26:56 2016 -0500" }, "message": "Revert \"SELinux: use deletion-safe iterator to free list\"\n\nThis reverts commit c9a8571249fa3a55a0490bd571eaf0cea097fab0.\n\nBug: 22846070\nChange-Id: I85e2b6322f98bd584ed523b0bd0291375dbc35dc\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "97df93a063d060bcf2c8fa4baaf0094cb8e256a0", "tree": "0de22ddb1e60f17afd79ab2b47145fa7b8ff5417", "parents": [ "3c22c9a2b6b280f82fe03aa15113982158238b0a" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jul 29 18:33:33 2015 -0700" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Wed Aug 10 16:26:51 2016 -0500" }, "message": "Revert \"SELinux: ss: Fix policy write for ioctl operations\"\n\nThis reverts commit c06168226f5eaaaad93af5b2811f213b01382363.\n\nBug: 22846070\nChange-Id: I665c1f2350e10ce890e7c4be1a06e666929d5d7a\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "cd51ac61016591337ceaad723db2b7053f2ae397", "tree": "917b39782ff3ac576657c26fb1de50ef7bf6c611", "parents": [ "0895af992ba8c721461ea09d4f7b2694e2efe822" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Thu May 26 06:45:59 2016 -0500" }, "committer": { "name": "Nick Reuter", "email": "nreuter85@gmail.com", "time": "Fri Aug 05 02:10:58 2016 -0500" }, "message": "KEYS: potential uninitialized variable\n\nIf __key_link_begin() failed then \"edit\" would be uninitialized. I\u0027ve\nadded a check to fix that.\n\nChange-Id: I0e28bdba07f645437db2b08daf67ca27f16c6f5c\nFixes: f70e2e06196a (\u0027KEYS: Do preallocation for __key_link()\u0027)\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\n" }, { "commit": "7ec47fdb4ed668f2be0e6f4bb5421a3c7b3d9a52", "tree": "02f113d88caca31298a862fdaaffaa0c6c2026e2", "parents": [ "42343d5c2679ce1e0abb2ef8b3b8152287e4ee8d" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Thu May 26 06:45:59 2016 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Jun 23 23:15:14 2016 -0500" }, "message": "KEYS: potential uninitialized variable\n\nIf __key_link_begin() failed then \"edit\" would be uninitialized. I\u0027ve\nadded a check to fix that.\n\nChange-Id: I0e28bdba07f645437db2b08daf67ca27f16c6f5c\nFixes: f70e2e06196a (\u0027KEYS: Do preallocation for __key_link()\u0027)\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\n" }, { "commit": "766ce4e5a952510f9f27511cbfecc884bf5147cd", "tree": "93ad1970e254fc3b1fb0650a4dc449d86ad5114e", "parents": [ "3bc527393379fcd740cc66c700da808abdbf5a5d" ], "author": { "name": "Ivan Grinko", "email": "iivanich@gmail.com", "time": "Thu Apr 28 22:06:41 2016 +0300" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Tue May 17 08:03:16 2016 -0400" }, "message": "Linux 3.4.112\n\nhttps://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.112\n\nChange-Id: Ic146bc84c10ebcfe256eb6bffa8ffef44c9a1d38\n" }, { "commit": "58f794b5648f3bd9146bf060897abe9473189649", "tree": "4920af6c625f6794c42c0888a739ccf7cb6ab974", "parents": [ "9c1dfc61f68c81c89856dde4c67f11db38067db3" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Dec 18 01:34:26 2015 +0000" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Tue May 17 07:52:00 2016 -0400" }, "message": "KEYS: Fix race between read and revoke\n\nThis fixes CVE-2015-7550.\n\nThere\u0027s a race between keyctl_read() and keyctl_revoke(). If the revoke\nhappens between keyctl_read() checking the validity of a key and the key\u0027s\nsemaphore being taken, then the key type read method will see a revoked key.\n\nThis causes a problem for the user-defined key type because it assumes in\nits read method that there will always be a payload in a non-revoked key\nand doesn\u0027t check for a NULL pointer.\n\nFix this by making keyctl_read() check the validity of a key after taking\nsemaphore instead of before.\n\nI think the bug was introduced with the original keyrings code.\n\nThis was discovered by a multithreaded test program generated by syzkaller\n(http://github.com/google/syzkaller). Here\u0027s a cleaned up version:\n\n\t#include \u003csys/types.h\u003e\n\t#include \u003ckeyutils.h\u003e\n\t#include \u003cpthread.h\u003e\n\tvoid *thr0(void *arg)\n\t{\n\t\tkey_serial_t key \u003d (unsigned long)arg;\n\t\tkeyctl_revoke(key);\n\t\treturn 0;\n\t}\n\tvoid *thr1(void *arg)\n\t{\n\t\tkey_serial_t key \u003d (unsigned long)arg;\n\t\tchar buffer[16];\n\t\tkeyctl_read(key, buffer, 16);\n\t\treturn 0;\n\t}\n\tint main()\n\t{\n\t\tkey_serial_t key \u003d add_key(\"user\", \"%\", \"foo\", 3, KEY_SPEC_USER_KEYRING);\n\t\tpthread_t th[5];\n\t\tpthread_create(\u0026th[0], 0, thr0, (void *)(unsigned long)key);\n\t\tpthread_create(\u0026th[1], 0, thr1, (void *)(unsigned long)key);\n\t\tpthread_create(\u0026th[2], 0, thr0, (void *)(unsigned long)key);\n\t\tpthread_create(\u0026th[3], 0, thr1, (void *)(unsigned long)key);\n\t\tpthread_join(th[0], 0);\n\t\tpthread_join(th[1], 0);\n\t\tpthread_join(th[2], 0);\n\t\tpthread_join(th[3], 0);\n\t\treturn 0;\n\t}\n\nBuild as:\n\n\tcc -o keyctl-race keyctl-race.c -lkeyutils -lpthread\n\nRun as:\n\n\twhile keyctl-race; do :; done\n\nas it may need several iterations to crash the kernel. The crash can be\nsummarised as:\n\n\tBUG: unable to handle kernel NULL pointer dereference at 0000000000000010\n\tIP: [\u003cffffffff81279b08\u003e] user_read+0x56/0xa3\n\t...\n\tCall Trace:\n\t [\u003cffffffff81276aa9\u003e] keyctl_read_key+0xb6/0xd7\n\t [\u003cffffffff81277815\u003e] SyS_keyctl+0x83/0xe0\n\t [\u003cffffffff815dbb97\u003e] entry_SYSCALL_64_fastpath+0x12/0x6f\n\nChange-Id: I4b4011c628b471701cdda77265d8f130b0ed8f22\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nTested-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "8094624a26bd87d40e019ebf16f2e57e22c79c74", "tree": "0dbb8f49485835ded234d4de87e52ea437d8a0b4", "parents": [ "5ee52010ffedbeeb58d5314585e7e1d75345ba4f" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Wed Apr 08 18:36:40 2015 +0200" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Tue May 17 07:51:20 2016 -0400" }, "message": "selinux/nlmsg: add XFRM_MSG_NEWSPDINFO\n\ncommit 2b7834d3e1b828429faa5dc41a480919e52d3f31 upstream (net-next).\n\nThis new command is missing.\n\nBug: 20350607\nChange-Id: If511000c19aa9af7220ff775d88ace9834b35dcb\nFixes: 880a6fab8f6b (\"xfrm: configure policy hash table thresholds by netlink\")\nReported-by: Christophe Gouault \u003cchristophe.gouault@6wind.com\u003e\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b0cce01be5f58ed399fdfc8e1b0fbcd827a35aef", "tree": "cf61f307b591ed355c8a8df39d43d9649fd0ee18", "parents": [ "7646c507f1ad8bd14a3196f84b0eabb229dafb75" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Fri Sep 04 15:44:57 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Wed Apr 27 18:55:18 2016 +0800" }, "message": "fs: create and use seq_show_option for escaping\n\ncommit a068acf2ee77693e0bf39d6e07139ba704f461c3 upstream.\n\nMany file systems that implement the show_options hook fail to correctly\nescape their output which could lead to unescaped characters (e.g. new\nlines) leaking into /proc/mounts and /proc/[pid]/mountinfo files. This\ncould lead to confusion, spoofed entries (resulting in things like\nsystemd issuing false d-bus \"mount\" notifications), and who knows what\nelse. This looks like it would only be the root user stepping on\nthemselves, but it\u0027s possible weird things could happen in containers or\nin other situations with delegated mount privileges.\n\nHere\u0027s an example using overlay with setuid fusermount trusting the\ncontents of /proc/mounts (via the /etc/mtab symlink). Imagine the use\nof \"sudo\" is something more sneaky:\n\n $ BASE\u003d\"ovl\"\n $ MNT\u003d\"$BASE/mnt\"\n $ LOW\u003d\"$BASE/lower\"\n $ UP\u003d\"$BASE/upper\"\n $ WORK\u003d\"$BASE/work/ 0 0\n none /proc fuse.pwn user_id\u003d1000\"\n $ mkdir -p \"$LOW\" \"$UP\" \"$WORK\"\n $ sudo mount -t overlay -o \"lowerdir\u003d$LOW,upperdir\u003d$UP,workdir\u003d$WORK\" none /mnt\n $ cat /proc/mounts\n none /root/ovl/mnt overlay rw,relatime,lowerdir\u003dovl/lower,upperdir\u003dovl/upper,workdir\u003dovl/work/ 0 0\n none /proc fuse.pwn user_id\u003d1000 0 0\n $ fusermount -u /proc\n $ cat /proc/mounts\n cat: /proc/mounts: No such file or directory\n\nThis fixes the problem by adding new seq_show_option and\nseq_show_option_n helpers, and updating the vulnerable show_option\nhandlers to use them as needed. Some, like SELinux, need to be open\ncoded due to unusual existing escape mechanisms.\n\n[akpm@linux-foundation.org: add lost chunk, per Kees]\n[keescook@chromium.org: seq_show_option should be using const parameters]\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nAcked-by: Jan Kara \u003cjack@suse.com\u003e\nAcked-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nCc: J. R. Okajima \u003chooanon05g@gmail.com\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - one more place in ceph needs to be changed\n - drop changes to overlayfs\n - drop showing vers in cifs]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "9793b7bc42a334c7cc4af947e2ecdafb76b3a73d", "tree": "4a9971e2519dfec7576af32e7dc58813db22b11b", "parents": [ "48ec02cc771de41cc8b063a2f60890242c09bfba" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Oct 15 17:21:37 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:55 2016 +0800" }, "message": "KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring\n\ncommit f05819df10d7b09f6d1eb6f8534a8f68e5a4fe61 upstream.\n\nThe following sequence of commands:\n\n i\u003d`keyctl add user a a @s`\n keyctl request2 keyring foo bar @t\n keyctl unlink $i @s\n\ntries to invoke an upcall to instantiate a keyring if one doesn\u0027t already\nexist by that name within the user\u0027s keyring set. However, if the upcall\nfails, the code sets keyring-\u003etype_data.reject_error to -ENOKEY or some\nother error code. When the key is garbage collected, the key destroy\nfunction is called unconditionally and keyring_destroy() uses list_empty()\non keyring-\u003etype_data.link - which is in a union with reject_error.\nSubsequently, the kernel tries to unlink the keyring from the keyring names\nlist - which oopses like this:\n\n\tBUG: unable to handle kernel paging request at 00000000ffffff8a\n\tIP: [\u003cffffffff8126e051\u003e] keyring_destroy+0x3d/0x88\n\t...\n\tWorkqueue: events key_garbage_collector\n\t...\n\tRIP: 0010:[\u003cffffffff8126e051\u003e] keyring_destroy+0x3d/0x88\n\tRSP: 0018:ffff88003e2f3d30 EFLAGS: 00010203\n\tRAX: 00000000ffffff82 RBX: ffff88003bf1a900 RCX: 0000000000000000\n\tRDX: 0000000000000000 RSI: 000000003bfc6901 RDI: ffffffff81a73a40\n\tRBP: ffff88003e2f3d38 R08: 0000000000000152 R09: 0000000000000000\n\tR10: ffff88003e2f3c18 R11: 000000000000865b R12: ffff88003bf1a900\n\tR13: 0000000000000000 R14: ffff88003bf1a908 R15: ffff88003e2f4000\n\t...\n\tCR2: 00000000ffffff8a CR3: 000000003e3ec000 CR4: 00000000000006f0\n\t...\n\tCall Trace:\n\t [\u003cffffffff8126c756\u003e] key_gc_unused_keys.constprop.1+0x5d/0x10f\n\t [\u003cffffffff8126ca71\u003e] key_garbage_collector+0x1fa/0x351\n\t [\u003cffffffff8105ec9b\u003e] process_one_work+0x28e/0x547\n\t [\u003cffffffff8105fd17\u003e] worker_thread+0x26e/0x361\n\t [\u003cffffffff8105faa9\u003e] ? rescuer_thread+0x2a8/0x2a8\n\t [\u003cffffffff810648ad\u003e] kthread+0xf3/0xfb\n\t [\u003cffffffff810647ba\u003e] ? kthread_create_on_node+0x1c2/0x1c2\n\t [\u003cffffffff815f2ccf\u003e] ret_from_fork+0x3f/0x70\n\t [\u003cffffffff810647ba\u003e] ? kthread_create_on_node+0x1c2/0x1c2\n\nNote the value in RAX. This is a 32-bit representation of -ENOKEY.\n\nThe solution is to only call -\u003edestroy() if the key was successfully\ninstantiated.\n\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nTested-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\n[lizf: Backported to 3.4: adjust indentation]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "48ec02cc771de41cc8b063a2f60890242c09bfba", "tree": "d90655f4944980f32082aa257baf78d46c64ca77", "parents": [ "04d6387f6f3f1727abd3e8f77686efd125c5f691" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Sep 25 16:30:08 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:55 2016 +0800" }, "message": "KEYS: Fix race between key destruction and finding a keyring by name\n\ncommit 94c4554ba07adbdde396748ee7ae01e86cf2d8d7 upstream.\n\nThere appears to be a race between:\n\n (1) key_gc_unused_keys() which frees key-\u003esecurity and then calls\n keyring_destroy() to unlink the name from the name list\n\n (2) find_keyring_by_name() which calls key_permission(), thus accessing\n key-\u003esecurity, on a key before checking to see whether the key usage is 0\n (ie. the key is dead and might be cleaned up).\n\nFix this by calling -\u003edestroy() before cleaning up the core key data -\nincluding key-\u003esecurity.\n\nReported-by: Petr Matousek \u003cpmatouse@redhat.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\n[lizf: Backported to 3.4: adjust indentation]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "1b4c14a071f0d2d95a0efa01be715ace819aa53a", "tree": "607ecfff4ace170d73c6f85957f034aecb80fec9", "parents": [ "f11f974014f3a2b6919510bf19f2d74003a76d97" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Dec 18 01:34:26 2015 +0000" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sun Mar 13 23:18:19 2016 -0500" }, "message": "KEYS: Fix race between read and revoke\n\nThis fixes CVE-2015-7550.\n\nThere\u0027s a race between keyctl_read() and keyctl_revoke(). If the revoke\nhappens between keyctl_read() checking the validity of a key and the key\u0027s\nsemaphore being taken, then the key type read method will see a revoked key.\n\nThis causes a problem for the user-defined key type because it assumes in\nits read method that there will always be a payload in a non-revoked key\nand doesn\u0027t check for a NULL pointer.\n\nFix this by making keyctl_read() check the validity of a key after taking\nsemaphore instead of before.\n\nI think the bug was introduced with the original keyrings code.\n\nThis was discovered by a multithreaded test program generated by syzkaller\n(http://github.com/google/syzkaller). Here\u0027s a cleaned up version:\n\n\t#include \u003csys/types.h\u003e\n\t#include \u003ckeyutils.h\u003e\n\t#include \u003cpthread.h\u003e\n\tvoid *thr0(void *arg)\n\t{\n\t\tkey_serial_t key \u003d (unsigned long)arg;\n\t\tkeyctl_revoke(key);\n\t\treturn 0;\n\t}\n\tvoid *thr1(void *arg)\n\t{\n\t\tkey_serial_t key \u003d (unsigned long)arg;\n\t\tchar buffer[16];\n\t\tkeyctl_read(key, buffer, 16);\n\t\treturn 0;\n\t}\n\tint main()\n\t{\n\t\tkey_serial_t key \u003d add_key(\"user\", \"%\", \"foo\", 3, KEY_SPEC_USER_KEYRING);\n\t\tpthread_t th[5];\n\t\tpthread_create(\u0026th[0], 0, thr0, (void *)(unsigned long)key);\n\t\tpthread_create(\u0026th[1], 0, thr1, (void *)(unsigned long)key);\n\t\tpthread_create(\u0026th[2], 0, thr0, (void *)(unsigned long)key);\n\t\tpthread_create(\u0026th[3], 0, thr1, (void *)(unsigned long)key);\n\t\tpthread_join(th[0], 0);\n\t\tpthread_join(th[1], 0);\n\t\tpthread_join(th[2], 0);\n\t\tpthread_join(th[3], 0);\n\t\treturn 0;\n\t}\n\nBuild as:\n\n\tcc -o keyctl-race keyctl-race.c -lkeyutils -lpthread\n\nRun as:\n\n\twhile keyctl-race; do :; done\n\nas it may need several iterations to crash the kernel. The crash can be\nsummarised as:\n\n\tBUG: unable to handle kernel NULL pointer dereference at 0000000000000010\n\tIP: [\u003cffffffff81279b08\u003e] user_read+0x56/0xa3\n\t...\n\tCall Trace:\n\t [\u003cffffffff81276aa9\u003e] keyctl_read_key+0xb6/0xd7\n\t [\u003cffffffff81277815\u003e] SyS_keyctl+0x83/0xe0\n\t [\u003cffffffff815dbb97\u003e] entry_SYSCALL_64_fastpath+0x12/0x6f\n\nChange-Id: I4b4011c628b471701cdda77265d8f130b0ed8f22\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nTested-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "ad31516703a7c1210078f690ea94a8efe4d01e91", "tree": "ab4494f3a60980909ac339ea58ec920c363dbf18", "parents": [ "e8a835b9a482c3ab97c08847361900f7ed8ab1a6", "3edd6224c2a677bb59efe0b083a51fc2b3b5c64d" ], "author": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Mon Feb 22 00:00:29 2016 -0500" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Mon Feb 22 17:33:37 2016 -0500" }, "message": "Merge tag v3.4.110 into cm-13.0\n\nConflicts:\n\tdrivers/bluetooth/btusb.c\n\tdrivers/cpufreq/cpufreq.c\n\tdrivers/md/dm-crypt.c\n\tdrivers/mmc/core/core.c\n\tfs/namespace.c\n\tinclude/linux/usb/quirks.h\n\tnet/bluetooth/l2cap_core.c\n\tnet/bluetooth/smp.c\n\tnet/netfilter/xt_socket.c\n\tsecurity/keys/gc.c\n\tsecurity/selinux/nlmsgtab.c\n\nChange-Id: I336fc28268bf70846a49e8f1db4899a10a4e5edb\n" }, { "commit": "975f9dbf00e56518bcb19f7ad3e117f1a99434b1", "tree": "b77c7422da7790353e56d67c0f09081f69a7fbf0", "parents": [ "923480c61fff1ed30eaede62ca83a6631adfc570" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Oct 15 17:21:37 2015 +0100" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Feb 17 10:56:47 2016 -0500" }, "message": "KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring\n\nThe following sequence of commands:\n\n i\u003d`keyctl add user a a @s`\n keyctl request2 keyring foo bar @t\n keyctl unlink $i @s\n\ntries to invoke an upcall to instantiate a keyring if one doesn\u0027t already\nexist by that name within the user\u0027s keyring set. However, if the upcall\nfails, the code sets keyring-\u003etype_data.reject_error to -ENOKEY or some\nother error code. When the key is garbage collected, the key destroy\nfunction is called unconditionally and keyring_destroy() uses list_empty()\non keyring-\u003etype_data.link - which is in a union with reject_error.\nSubsequently, the kernel tries to unlink the keyring from the keyring names\nlist - which oopses like this:\n\n\tBUG: unable to handle kernel paging request at 00000000ffffff8a\n\tIP: [\u003cffffffff8126e051\u003e] keyring_destroy+0x3d/0x88\n\t...\n\tWorkqueue: events key_garbage_collector\n\t...\n\tRIP: 0010:[\u003cffffffff8126e051\u003e] keyring_destroy+0x3d/0x88\n\tRSP: 0018:ffff88003e2f3d30 EFLAGS: 00010203\n\tRAX: 00000000ffffff82 RBX: ffff88003bf1a900 RCX: 0000000000000000\n\tRDX: 0000000000000000 RSI: 000000003bfc6901 RDI: ffffffff81a73a40\n\tRBP: ffff88003e2f3d38 R08: 0000000000000152 R09: 0000000000000000\n\tR10: ffff88003e2f3c18 R11: 000000000000865b R12: ffff88003bf1a900\n\tR13: 0000000000000000 R14: ffff88003bf1a908 R15: ffff88003e2f4000\n\t...\n\tCR2: 00000000ffffff8a CR3: 000000003e3ec000 CR4: 00000000000006f0\n\t...\n\tCall Trace:\n\t [\u003cffffffff8126c756\u003e] key_gc_unused_keys.constprop.1+0x5d/0x10f\n\t [\u003cffffffff8126ca71\u003e] key_garbage_collector+0x1fa/0x351\n\t [\u003cffffffff8105ec9b\u003e] process_one_work+0x28e/0x547\n\t [\u003cffffffff8105fd17\u003e] worker_thread+0x26e/0x361\n\t [\u003cffffffff8105faa9\u003e] ? rescuer_thread+0x2a8/0x2a8\n\t [\u003cffffffff810648ad\u003e] kthread+0xf3/0xfb\n\t [\u003cffffffff810647ba\u003e] ? kthread_create_on_node+0x1c2/0x1c2\n\t [\u003cffffffff815f2ccf\u003e] ret_from_fork+0x3f/0x70\n\t [\u003cffffffff810647ba\u003e] ? kthread_create_on_node+0x1c2/0x1c2\n\nNote the value in RAX. This is a 32-bit representation of -ENOKEY.\n\nThe solution is to only call -\u003edestroy() if the key was successfully\ninstantiated.\n\nChange-Id: Ia52370813b7e8231fdd99d2a208340af1c7b4007\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nTested-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\n" }, { "commit": "923480c61fff1ed30eaede62ca83a6631adfc570", "tree": "6d2483a7a99631d5551793df61082df6328c6788", "parents": [ "9f62ded449a12eee28b004208cc7ed4aa7e2a311" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Sep 25 16:30:08 2015 +0100" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Feb 17 10:56:32 2016 -0500" }, "message": "KEYS: Fix race between key destruction and finding a keyring by name\n\nThere appears to be a race between:\n\n (1) key_gc_unused_keys() which frees key-\u003esecurity and then calls\n keyring_destroy() to unlink the name from the name list\n\n (2) find_keyring_by_name() which calls key_permission(), thus accessing\n key-\u003esecurity, on a key before checking to see whether the key usage is 0\n (ie. the key is dead and might be cleaned up).\n\nFix this by calling -\u003edestroy() before cleaning up the core key data -\nincluding key-\u003esecurity.\n\nChange-Id: I4b9b89af020e6348af095e9014bf23b5eb1a9ef9\nReported-by: Petr Matousek \u003cpmatouse@redhat.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\n" }, { "commit": "9f62ded449a12eee28b004208cc7ed4aa7e2a311", "tree": "3be2e5dab59557027e0dfcb574ffa84dccadf017", "parents": [ "039b1209eee164ab26ea181c60e98e10175c5d89" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Feb 17 10:56:16 2016 -0500" }, "message": "KEYS: Perform RCU synchronisation on keys prior to key destruction\n\nMake the keys garbage collector invoke synchronize_rcu() prior to destroying\nkeys with a zero usage count. This means that a key can be examined under the\nRCU read lock in the safe knowledge that it won\u0027t get deallocated until after\nthe lock is released - even if its usage count becomes zero whilst we\u0027re\nlooking at it.\n\nThis is useful in keyring search vs key link. Consider a keyring containing a\nlink to a key. That link can be replaced in-place in the keyring without\nrequiring an RCU copy-and-replace on the keyring contents without breaking a\nsearch underway on that keyring when the displaced key is released, provided\nthe key is actually destroyed only after the RCU read lock held by the search\nalgorithm is released.\n\nThis permits __key_link() to replace a key without having to reallocate the key\npayload. A key gets replaced if a new key being linked into a keyring has the\nsame type and description.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Jeff Layton \u003cjlayton@redhat.com\u003e\n\nConflicts:\n\tsecurity/keys/gc.c\n\nChange-Id: Ifd8549b5b906c638d63c358ce1f34acd81139207\n" }, { "commit": "64c363146fe8b4b26285d36fad0fc01b9c8c1285", "tree": "f4597aeccc6d37aadbf3a719dfefc62632e4ee10", "parents": [ "900469d0b0c337db19908f77d172f4b17f4573ba" ], "author": { "name": "José Adolfo Galdámez", "email": "josegalre@pac-rom.com", "time": "Mon Sep 21 22:00:27 2015 -0600" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Wed Feb 10 20:03:50 2016 -0500" }, "message": "Merge tag \u0027v3.4.109\u0027 into mm-6.0\n\nChange-Id: I93b29443377e338fc5d3b031b130da720f788879\nSigned-off-by: José Adolfo Galdámez \u003cjosegalre@pac-rom.com\u003e\n" }, { "commit": "900469d0b0c337db19908f77d172f4b17f4573ba", "tree": "e7c8e6e70ad09ecc74c7385269f9a7a908489b88", "parents": [ "3591a444f6b8cb82a9b88a49a4e67d8f4b61a6de" ], "author": { "name": "José Adolfo Galdámez", "email": "josegalre@pac-rom.com", "time": "Sat Jun 20 23:45:36 2015 -0600" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Wed Feb 10 20:02:51 2016 -0500" }, "message": "Merge tag \u0027v3.4.108\u0027 into mm-6.0\n\nChange-Id: I5ee718e5c87c9647c6edf0926a887679e065a649\nSigned-off-by: José Adolfo Galdámez \u003cjosegalre@pac-rom.com\u003e\n" }, { "commit": "a49e6ce46b2174e740908332b4ec1796af9e029a", "tree": "abef367c23b20577a299f363a7d76154fd1e7c21", "parents": [ "5aaf989a3f7a116df4a0dd9a6c537f13cb0e32d2" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Oct 26 19:19:16 2014 -0400" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Wed Feb 10 20:01:44 2016 -0500" }, "message": "move d_rcu from overlapping d_child to overlapping d_alias\n\ncommit 946e51f2bf37f1656916eb75bd0742ba33983c28 upstream.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[bwh: Backported to 3.2:\n - Apply name changes in all the different places we use d_alias and d_child\n - Move the WARN_ON() in __d_free() to d_free() as we don\u0027t have dentry_free()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - need one more name change in debugfs]\n" }, { "commit": "e1404a083531a5811009997e73c0be4cf12e123c", "tree": "97b285269f0c2a0a3a7c156e707ee0db572b7920", "parents": [ "8588a96db2df2bfe263b09508dd472302577815a" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Dec 04 18:25:19 2014 +0100" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Wed Feb 10 20:00:07 2016 -0500" }, "message": "KEYS: Fix stale key registration at error path\n\ncommit b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 upstream.\n\nWhen loading encrypted-keys module, if the last check of\naes_get_sizes() in init_encrypted() fails, the driver just returns an\nerror without unregistering its key type. This results in the stale\nentry in the list. In addition to memory leaks, this leads to a kernel\ncrash when registering a new key type later.\n\nThis patch fixes the problem by swapping the calls of aes_get_sizes()\nand register_key_type(), and releasing resources properly at the error\npaths.\n\nBugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id\u003d908163\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "0fbb248bd3e76a39fdc944b9a2bd2b108b95352b", "tree": "c69c5a70235fb8150d577089e2630141b53c1033", "parents": [ "8048eac1e925f6c2d9ad4ae4324d98c95414aa6d" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Oct 15 17:21:37 2015 +0100" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Sat Dec 19 08:41:00 2015 -0500" }, "message": "KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring\n\nThe following sequence of commands:\n\n i\u003d`keyctl add user a a @s`\n keyctl request2 keyring foo bar @t\n keyctl unlink $i @s\n\ntries to invoke an upcall to instantiate a keyring if one doesn\u0027t already\nexist by that name within the user\u0027s keyring set. However, if the upcall\nfails, the code sets keyring-\u003etype_data.reject_error to -ENOKEY or some\nother error code. When the key is garbage collected, the key destroy\nfunction is called unconditionally and keyring_destroy() uses list_empty()\non keyring-\u003etype_data.link - which is in a union with reject_error.\nSubsequently, the kernel tries to unlink the keyring from the keyring names\nlist - which oopses like this:\n\n\tBUG: unable to handle kernel paging request at 00000000ffffff8a\n\tIP: [\u003cffffffff8126e051\u003e] keyring_destroy+0x3d/0x88\n\t...\n\tWorkqueue: events key_garbage_collector\n\t...\n\tRIP: 0010:[\u003cffffffff8126e051\u003e] keyring_destroy+0x3d/0x88\n\tRSP: 0018:ffff88003e2f3d30 EFLAGS: 00010203\n\tRAX: 00000000ffffff82 RBX: ffff88003bf1a900 RCX: 0000000000000000\n\tRDX: 0000000000000000 RSI: 000000003bfc6901 RDI: ffffffff81a73a40\n\tRBP: ffff88003e2f3d38 R08: 0000000000000152 R09: 0000000000000000\n\tR10: ffff88003e2f3c18 R11: 000000000000865b R12: ffff88003bf1a900\n\tR13: 0000000000000000 R14: ffff88003bf1a908 R15: ffff88003e2f4000\n\t...\n\tCR2: 00000000ffffff8a CR3: 000000003e3ec000 CR4: 00000000000006f0\n\t...\n\tCall Trace:\n\t [\u003cffffffff8126c756\u003e] key_gc_unused_keys.constprop.1+0x5d/0x10f\n\t [\u003cffffffff8126ca71\u003e] key_garbage_collector+0x1fa/0x351\n\t [\u003cffffffff8105ec9b\u003e] process_one_work+0x28e/0x547\n\t [\u003cffffffff8105fd17\u003e] worker_thread+0x26e/0x361\n\t [\u003cffffffff8105faa9\u003e] ? rescuer_thread+0x2a8/0x2a8\n\t [\u003cffffffff810648ad\u003e] kthread+0xf3/0xfb\n\t [\u003cffffffff810647ba\u003e] ? kthread_create_on_node+0x1c2/0x1c2\n\t [\u003cffffffff815f2ccf\u003e] ret_from_fork+0x3f/0x70\n\t [\u003cffffffff810647ba\u003e] ? kthread_create_on_node+0x1c2/0x1c2\n\nNote the value in RAX. This is a 32-bit representation of -ENOKEY.\n\nThe solution is to only call -\u003edestroy() if the key was successfully\ninstantiated.\n\nChange-Id: Ia52370813b7e8231fdd99d2a208340af1c7b4007\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nTested-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\n" }, { "commit": "8048eac1e925f6c2d9ad4ae4324d98c95414aa6d", "tree": "b078f391f0728d6a761fd4eb3041b48b8a7563cf", "parents": [ "b5401aa15d058b45abd5ade0f96484af4afb4ae7" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Sep 25 16:30:08 2015 +0100" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Sat Dec 19 08:40:58 2015 -0500" }, "message": "KEYS: Fix race between key destruction and finding a keyring by name\n\nThere appears to be a race between:\n\n (1) key_gc_unused_keys() which frees key-\u003esecurity and then calls\n keyring_destroy() to unlink the name from the name list\n\n (2) find_keyring_by_name() which calls key_permission(), thus accessing\n key-\u003esecurity, on a key before checking to see whether the key usage is 0\n (ie. the key is dead and might be cleaned up).\n\nFix this by calling -\u003edestroy() before cleaning up the core key data -\nincluding key-\u003esecurity.\n\nChange-Id: I4b9b89af020e6348af095e9014bf23b5eb1a9ef9\nReported-by: Petr Matousek \u003cpmatouse@redhat.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\n" }, { "commit": "b5401aa15d058b45abd5ade0f96484af4afb4ae7", "tree": "84ab3c877c6ca08d12d046617f4b3fdef91ac4fa", "parents": [ "6b1fa60f0b88faec25f6bb3bcc494ccb09498294" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Sat Dec 19 08:40:56 2015 -0500" }, "message": "KEYS: Add invalidation support\n\nAdd support for invalidating a key - which renders it immediately invisible to\nfurther searches and causes the garbage collector to immediately wake up,\nremove it from keyrings and then destroy it when it\u0027s no longer referenced.\n\nIt\u0027s better not to do this with keyctl_revoke() as that marks the key to start\nreturning -EKEYREVOKED to searches when what is actually desired is to have the\nkey refetched.\n\nTo invalidate a key the caller must be granted SEARCH permission by the key.\nThis may be too strict. It may be better to also permit invalidation if the\ncaller has any of READ, WRITE or SETATTR permission.\n\nThe primary use for this is to evict keys that are cached in special keyrings,\nsuch as the DNS resolver or an ID mapper.\n\nChange-Id: I923ea0f0b8f9d6b3ff8ec8beca77b1774984f1c3\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\n" }, { "commit": "6b1fa60f0b88faec25f6bb3bcc494ccb09498294", "tree": "78ca2a99f83a48f5bf44a9143eaa0ff1d4a67a38", "parents": [ "c2035a53e48959fc1ce6ed862a156f4c76b3ca85" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Sat Dec 19 08:40:55 2015 -0500" }, "message": "KEYS: Permit in-place link replacement in keyring list\n\nMake use of the previous patch that makes the garbage collector perform RCU\nsynchronisation before destroying defunct keys. Key pointers can now be\nreplaced in-place without creating a new keyring payload and replacing the\nwhole thing as the discarded keys will not be destroyed until all currently\nheld RCU read locks are released.\n\nIf the keyring payload space needs to be expanded or contracted, then a\nreplacement will still need allocating, and the original will still have to be\nfreed by RCU.\n\nChange-Id: I6c4f784f120951fb51ac9c23856ea37f51770bb9\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\n" }, { "commit": "c2035a53e48959fc1ce6ed862a156f4c76b3ca85", "tree": "0d2e070337254c64e8be0fa3c3590da25c1e4537", "parents": [ "c7cbbb1cbddfff2bf8e0983249d4635e2770b133" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "committer": { "name": "William Bellavance", "email": "flintman@flintmancomputers.com", "time": "Sat Dec 19 08:40:43 2015 -0500" }, "message": "KEYS: Perform RCU synchronisation on keys prior to key destruction\n\nMake the keys garbage collector invoke synchronize_rcu() prior to destroying\nkeys with a zero usage count. This means that a key can be examined under the\nRCU read lock in the safe knowledge that it won\u0027t get deallocated until after\nthe lock is released - even if its usage count becomes zero whilst we\u0027re\nlooking at it.\n\nThis is useful in keyring search vs key link. Consider a keyring containing a\nlink to a key. That link can be replaced in-place in the keyring without\nrequiring an RCU copy-and-replace on the keyring contents without breaking a\nsearch underway on that keyring when the displaced key is released, provided\nthe key is actually destroyed only after the RCU read lock held by the search\nalgorithm is released.\n\nThis permits __key_link() to replace a key without having to reallocate the key\npayload. A key gets replaced if a new key being linked into a keyring has the\nsame type and description.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Jeff Layton \u003cjlayton@redhat.com\u003e\n\nConflicts:\n\tsecurity/keys/gc.c\n\nChange-Id: Ifd8549b5b906c638d63c358ce1f34acd81139207\n" }, { "commit": "5c3c41cfb9f790356cc0175f4ee1b6bd29ec64df", "tree": "cf3c8b206acf9e5e54b8ef50e0f462a5c958390f", "parents": [ "5a94380f76fd75ef9b57e3dfad4499e823e12cc7" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Nov 24 21:36:31 2015 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "gerrit@cyanogenmod.org", "time": "Wed Dec 16 10:29:50 2015 -0800" }, "message": "KEYS: Fix handling of stored error in a negatively instantiated user key\n\nIf a user key gets negatively instantiated, an error code is cached in the\npayload area. A negatively instantiated key may be then be positively\ninstantiated by updating it with valid data. However, the -\u003eupdate key\ntype method must be aware that the error code may be there.\n\nThe following may be used to trigger the bug in the user key type:\n\n keyctl request2 user user \"\" @u\n keyctl add user user \"a\" @u\n\nwhich manifests itself as:\n\n\tBUG: unable to handle kernel paging request at 00000000ffffff8a\n\tIP: [\u003cffffffff810a376f\u003e] __call_rcu.constprop.76+0x1f/0x280 kernel/rcu/tree.c:3046\n\tPGD 7cc30067 PUD 0\n\tOops: 0002 [#1] SMP\n\tModules linked in:\n\tCPU: 3 PID: 2644 Comm: a.out Not tainted 4.3.0+ #49\n\tHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n\ttask: ffff88003ddea700 ti: ffff88003dd88000 task.ti: ffff88003dd88000\n\tRIP: 0010:[\u003cffffffff810a376f\u003e] [\u003cffffffff810a376f\u003e] __call_rcu.constprop.76+0x1f/0x280\n\t [\u003cffffffff810a376f\u003e] __call_rcu.constprop.76+0x1f/0x280 kernel/rcu/tree.c:3046\n\tRSP: 0018:ffff88003dd8bdb0 EFLAGS: 00010246\n\tRAX: 00000000ffffff82 RBX: 0000000000000000 RCX: 0000000000000001\n\tRDX: ffffffff81e3fe40 RSI: 0000000000000000 RDI: 00000000ffffff82\n\tRBP: ffff88003dd8bde0 R08: ffff88007d2d2da0 R09: 0000000000000000\n\tR10: 0000000000000000 R11: ffff88003e8073c0 R12: 00000000ffffff82\n\tR13: ffff88003dd8be68 R14: ffff88007d027600 R15: ffff88003ddea700\n\tFS: 0000000000b92880(0063) GS:ffff88007fd00000(0000) knlGS:0000000000000000\n\tCS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n\tCR2: 00000000ffffff8a CR3: 000000007cc5f000 CR4: 00000000000006e0\n\tStack:\n\t ffff88003dd8bdf0 ffffffff81160a8a 0000000000000000 00000000ffffff82\n\t ffff88003dd8be68 ffff88007d027600 ffff88003dd8bdf0 ffffffff810a39e5\n\t ffff88003dd8be20 ffffffff812a31ab ffff88007d027600 ffff88007d027620\n\tCall Trace:\n\t [\u003cffffffff810a39e5\u003e] kfree_call_rcu+0x15/0x20 kernel/rcu/tree.c:3136\n\t [\u003cffffffff812a31ab\u003e] user_update+0x8b/0xb0 security/keys/user_defined.c:129\n\t [\u003c inline \u003e] __key_update security/keys/key.c:730\n\t [\u003cffffffff8129e5c1\u003e] key_create_or_update+0x291/0x440 security/keys/key.c:908\n\t [\u003c inline \u003e] SYSC_add_key security/keys/keyctl.c:125\n\t [\u003cffffffff8129fc21\u003e] SyS_add_key+0x101/0x1e0 security/keys/keyctl.c:60\n\t [\u003cffffffff8185f617\u003e] entry_SYSCALL_64_fastpath+0x12/0x6a arch/x86/entry/entry_64.S:185\n\nNote the error code (-ENOKEY) in EDX.\n\nA similar bug can be tripped by:\n\n keyctl request2 trusted user \"\" @u\n keyctl add trusted user \"a\" @u\n\nThis should also affect encrypted keys - but that has to be correctly\nparameterised or it will fail with EINVAL before getting to the bit that\nwill crashes.\n\nChange-Id: I171d566f431c56208e1fe279f466d2d399a9ac7c\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "c9ec5028049b974988c98f11f953c9fb5ef540ac", "tree": "cbcebc3ffbc436aff40a48a77d5c8b9112ce3a75", "parents": [ "d92ec408ad768845400cbed6a18cc2a6ffe2def1" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Nov 24 21:36:31 2015 +0000" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Thu Dec 10 05:21:38 2015 -0500" }, "message": "KEYS: Fix handling of stored error in a negatively instantiated user key\n\nIf a user key gets negatively instantiated, an error code is cached in the\npayload area. A negatively instantiated key may be then be positively\ninstantiated by updating it with valid data. However, the -\u003eupdate key\ntype method must be aware that the error code may be there.\n\nThe following may be used to trigger the bug in the user key type:\n\n keyctl request2 user user \"\" @u\n keyctl add user user \"a\" @u\n\nwhich manifests itself as:\n\n\tBUG: unable to handle kernel paging request at 00000000ffffff8a\n\tIP: [\u003cffffffff810a376f\u003e] __call_rcu.constprop.76+0x1f/0x280 kernel/rcu/tree.c:3046\n\tPGD 7cc30067 PUD 0\n\tOops: 0002 [#1] SMP\n\tModules linked in:\n\tCPU: 3 PID: 2644 Comm: a.out Not tainted 4.3.0+ #49\n\tHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n\ttask: ffff88003ddea700 ti: ffff88003dd88000 task.ti: ffff88003dd88000\n\tRIP: 0010:[\u003cffffffff810a376f\u003e] [\u003cffffffff810a376f\u003e] __call_rcu.constprop.76+0x1f/0x280\n\t [\u003cffffffff810a376f\u003e] __call_rcu.constprop.76+0x1f/0x280 kernel/rcu/tree.c:3046\n\tRSP: 0018:ffff88003dd8bdb0 EFLAGS: 00010246\n\tRAX: 00000000ffffff82 RBX: 0000000000000000 RCX: 0000000000000001\n\tRDX: ffffffff81e3fe40 RSI: 0000000000000000 RDI: 00000000ffffff82\n\tRBP: ffff88003dd8bde0 R08: ffff88007d2d2da0 R09: 0000000000000000\n\tR10: 0000000000000000 R11: ffff88003e8073c0 R12: 00000000ffffff82\n\tR13: ffff88003dd8be68 R14: ffff88007d027600 R15: ffff88003ddea700\n\tFS: 0000000000b92880(0063) GS:ffff88007fd00000(0000) knlGS:0000000000000000\n\tCS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n\tCR2: 00000000ffffff8a CR3: 000000007cc5f000 CR4: 00000000000006e0\n\tStack:\n\t ffff88003dd8bdf0 ffffffff81160a8a 0000000000000000 00000000ffffff82\n\t ffff88003dd8be68 ffff88007d027600 ffff88003dd8bdf0 ffffffff810a39e5\n\t ffff88003dd8be20 ffffffff812a31ab ffff88007d027600 ffff88007d027620\n\tCall Trace:\n\t [\u003cffffffff810a39e5\u003e] kfree_call_rcu+0x15/0x20 kernel/rcu/tree.c:3136\n\t [\u003cffffffff812a31ab\u003e] user_update+0x8b/0xb0 security/keys/user_defined.c:129\n\t [\u003c inline \u003e] __key_update security/keys/key.c:730\n\t [\u003cffffffff8129e5c1\u003e] key_create_or_update+0x291/0x440 security/keys/key.c:908\n\t [\u003c inline \u003e] SYSC_add_key security/keys/keyctl.c:125\n\t [\u003cffffffff8129fc21\u003e] SyS_add_key+0x101/0x1e0 security/keys/keyctl.c:60\n\t [\u003cffffffff8185f617\u003e] entry_SYSCALL_64_fastpath+0x12/0x6a arch/x86/entry/entry_64.S:185\n\nNote the error code (-ENOKEY) in EDX.\n\nA similar bug can be tripped by:\n\n keyctl request2 trusted user \"\" @u\n keyctl add trusted user \"a\" @u\n\nThis should also affect encrypted keys - but that has to be correctly\nparameterised or it will fail with EINVAL before getting to the bit that\nwill crashes.\n\nChange-Id: I171d566f431c56208e1fe279f466d2d399a9ac7c\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "f3565936d74a0f04cff7a7f960ba3cd0e2beca76", "tree": "0e9d36de5c89a12fdcf689efbbd295d0eafacaee", "parents": [ "1b0a36cca2297351d5e889397b35df0dea590d28" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Oct 11 11:42:01 2012 -0400" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 16:13:15 2015 -0700" }, "message": "consitify do_mount() arguments\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n(cherry picked from commit 808d4e3cfdcc52b19276175464f6dbca4df13b09)\n" }, { "commit": "590e98661587f5cd605691ae44392698ddce6fd8", "tree": "166d89cdb0ceebd6cd3ab1df58d30ec5c265af12", "parents": [ "3e3b5ca2a5174d77f48c609a665e48b0fdf3cbde" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Apr 29 11:14:23 2015 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:58:34 2015 -0700" }, "message": "SELinux: ss: Fix policy write for ioctl operations\n\nSecurity server omits the type field when writing out the contents of the\navtab from /sys/fs/selinux/policy. This leads to a corrupt output. No impact\non the running kernel or its loaded policy. Impacts CTS neverallow tests.\n\nBug: 20665861\nChange-Id: I657e18013dd5a1f40052bc2b02dd8e0afee9bcfb\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n(cherry picked from commit 8cdfb356b51e29494ca0b9e4e86727d6f841a52d)\n" }, { "commit": "3e3b5ca2a5174d77f48c609a665e48b0fdf3cbde", "tree": "822fabfdd8681f23d2ba2df15e722aa550906dff", "parents": [ "14c40d82a3c3d3337aca574fe1f401ca4759055f" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Mon Apr 20 17:45:42 2015 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:58:23 2015 -0700" }, "message": "SELinux: use deletion-safe iterator to free list\n\nThis code is not exercised by policy version 26, but will be upon\nupgrade to policy version 30.\n\nBug: 18087110\nChange-Id: I07c6f34607713294a6a12c43a64d9936f0602200\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "14c40d82a3c3d3337aca574fe1f401ca4759055f", "tree": "c1e1a241f08111689f24507d49a778286416b99a", "parents": [ "d5c5dbff34a1b8cb1204bff4e80a23cdce900461" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Apr 08 11:27:46 2015 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:58:18 2015 -0700" }, "message": "SELinux: per-command whitelisting of ioctls\n\n note that this patch depends on a prior patch that is already in\n android-3.4 but has not apparently found its way into the msm 3.4\n branches (but is included in exynos and tegra),\n https://android-review.googlesource.com/#/c/92962/\n\nExtend the generic ioctl permission check with support for per-command\nfiltering. Source/target/class sets including the ioctl permission may\nadditionally include a set of commands. Example:\n\nallow \u003csource\u003e \u003ctarget\u003e:\u003cclass\u003e { 0x8910-0x8926 0x892A-0x8935 }\nauditallow \u003csource\u003e \u003ctarget\u003e:\u003cclass\u003e 0x892A\n\nWhen ioctl commands are omitted only the permissions are checked. This\nfeature is intended to provide finer granularity for the ioctl\npermission which may be too imprecise in some circumstances. For\nexample, the same driver may use ioctls to provide important and\nbenign functionality such as driver version or socket type as well as\ndangerous capabilities such as debugging features, read/write/execute\nto physical memory or access to sensitive data. Per-command filtering\nprovides a mechanism to reduce the attack surface of the kernel, and\nlimit applications to the subset of commands required.\n\nThe format of the policy binary has been modified to include ioctl\ncommands, and the policy version number has been incremented to\nPOLICYDB_VERSION_IOCTL_OPERATIONS\u003d30 to account for the format change.\n\nBug: 20350607\nBug: 18087110\nChange-Id: Ibf0e36728f6f3f0d5af56ccdeddee40800af689d\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "d5c5dbff34a1b8cb1204bff4e80a23cdce900461", "tree": "2933bacdb57cd71b8732a43da0a3d2c9b99921e3", "parents": [ "b26b27c9b907e144555719fb8bc0d2cb2728c59d" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Sat Apr 04 16:15:54 2015 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:58:09 2015 -0700" }, "message": "security: lsm_audit: add ioctl specific auditing\n\nAdd information about ioctl calls to the LSM audit data. Log the\nfile path and command number.\n\nBug: 20350607\nBug: 18087110\nChange-Id: Idbbd106db6226683cb30022d9e8f6f3b8fab7f84\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "b26b27c9b907e144555719fb8bc0d2cb2728c59d", "tree": "c6f70fbd53fd6eb23fcc03ee9a701df8a9d98264", "parents": [ "557ab23d2ccd124d92c3c0cb531dbc5ea507ad5f" ], "author": { "name": "Richard Haines", "email": "richard_c_haines@btinternet.com", "time": "Tue Nov 19 17:34:23 2013 -0500" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:58:04 2015 -0700" }, "message": "SELinux: Update policy version to support constraints info\n\nUpdate the policy version (POLICYDB_VERSION_CONSTRAINT_NAMES) to allow\nholding of policy source info for constraints.\n\nUpstream commit a660bec1d84ad19a39e380af129e207b3b8f609e\n\nBug: 20350607\nSigned-off-by: Richard Haines \u003crichard_c_haines@btinternet.com\u003e\nAcked-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nChange-Id: If419c7bfdea2f7006c9a62ea595f0cbfe5c78871\n" }, { "commit": "557ab23d2ccd124d92c3c0cb531dbc5ea507ad5f", "tree": "4773b544fca7c20cfc411b78e62fdace22f72db3", "parents": [ "13931298780000fcf355b5ad70ec5667af561c72" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Tue Mar 20 14:35:12 2012 -0400" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:57:59 2015 -0700" }, "message": "SELinux: add default_type statements\n\nBecause Fedora shipped userspace based on my development tree we now\nhave policy version 27 in the wild defining only default user, role, and\nrange. Thus to add default_type we need a policy.28.\n\nUpstream commit eed7795d0a2c9b2e934afc088e903fa2c17b7958\n\nBug: 20350607\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nChange-Id: Icb3324af7f740249977a4559c2c5692c7fcc22a2\n" }, { "commit": "13931298780000fcf355b5ad70ec5667af561c72", "tree": "2e5660864e3498b8df4f65dabaf311eacf86c85c", "parents": [ "462304cfc16253d48e69e0e6c9f0efa3acb7616a" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Tue Mar 20 14:35:12 2012 -0400" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:57:48 2015 -0700" }, "message": "SELinux: allow default source/target selectors for user/role/range\n\nWhen new objects are created we have great and flexible rules to\ndetermine the type of the new object. We aren\u0027t quite as flexible or\nmature when it comes to determining the user, role, and range. This\npatch adds a new ability to specify the place a new objects user, role,\nand range should come from. For users and roles it can come from either\nthe source or the target of the operation. aka for files the user can\neither come from the source (the running process and todays default) or\nit can come from the target (aka the parent directory of the new file)\n\nexamples always are done with\ndirectory context: system_u:object_r:mnt_t:s0-s0:c0.c512\nprocess context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023\n\n[no rule]\n\tunconfined_u:object_r:mnt_t:s0 test_none\n[default user source]\n\tunconfined_u:object_r:mnt_t:s0 test_user_source\n[default user target]\n\tsystem_u:object_r:mnt_t:s0 test_user_target\n[default role source]\n\tunconfined_u:unconfined_r:mnt_t:s0 test_role_source\n[default role target]\n\tunconfined_u:object_r:mnt_t:s0 test_role_target\n[default range source low]\n\tunconfined_u:object_r:mnt_t:s0 test_range_source_low\n[default range source high]\n\tunconfined_u:object_r:mnt_t:s0:c0.c1023 test_range_source_high\n[default range source low-high]\n\tunconfined_u:object_r:mnt_t:s0-s0:c0.c1023 test_range_source_low-high\n[default range target low]\n\tunconfined_u:object_r:mnt_t:s0 test_range_target_low\n[default range target high]\n\tunconfined_u:object_r:mnt_t:s0:c0.c512 test_range_target_high\n[default range target low-high]\n\tunconfined_u:object_r:mnt_t:s0-s0:c0.c512 test_range_target_low-high\n\nupstream commit aa893269de6277b44be88e25dcd5331c934c29c4\n\nBug: 20350607\nChange-Id: Ic8f33d05793bf742c70c68ea79e33c7f40ffbd53\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "462304cfc16253d48e69e0e6c9f0efa3acb7616a", "tree": "2b26e62ef2d8396907c019df77e2e7eee81356ab", "parents": [ "af05c4d8884b863495a30a7dad2676f69165b00a" ], "author": { "name": "Paul Moore", "email": "pmoore@redhat.com", "time": "Tue Jan 28 14:45:41 2014 -0500" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:57:38 2015 -0700" }, "message": "selinux: add SOCK_DIAG_BY_FAMILY to the list of netlink message types\n\ncommit 6a96e15096da6e7491107321cfa660c7c2aa119d upstream.\n\nThe SELinux AF_NETLINK/NETLINK_SOCK_DIAG socket class was missing the\nSOCK_DIAG_BY_FAMILY definition which caused SELINUX_ERR messages when\nthe ss tool was run.\n\n # ss\n Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port\n u_str ESTAB 0 0 * 14189 * 14190\n u_str ESTAB 0 0 * 14145 * 14144\n u_str ESTAB 0 0 * 14151 * 14150\n {...}\n # ausearch -m SELINUX_ERR\n ----\n time-\u003eThu Jan 23 11:11:16 2014\n type\u003dSYSCALL msg\u003daudit(1390493476.445:374):\n arch\u003dc000003e syscall\u003d44 success\u003dyes exit\u003d40\n a0\u003d3 a1\u003d7fff03aa11f0 a2\u003d28 a3\u003d0 items\u003d0 ppid\u003d1852 pid\u003d1895\n auid\u003d0 uid\u003d0 gid\u003d0 euid\u003d0 suid\u003d0 fsuid\u003d0 egid\u003d0 sgid\u003d0 fsgid\u003d0\n tty\u003dpts0 ses\u003d1 comm\u003d\"ss\" exe\u003d\"/usr/sbin/ss\"\n subj\u003dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key\u003d(null)\n type\u003dSELINUX_ERR msg\u003daudit(1390493476.445:374):\n SELinux: unrecognized netlink message type\u003d20 for sclass\u003d32\n\nBug: 20350607\nChange-Id: I22218ec620bc3ee6396145f1c2ad8ed222648309\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\n" }, { "commit": "af05c4d8884b863495a30a7dad2676f69165b00a", "tree": "8a5d8b51830cc367b0b5ea999ba452fea4ee50eb", "parents": [ "e72f109edb6333800eed1b9b89b879c98a774b9d" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Fri Apr 10 16:24:28 2015 +0200" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:57:29 2015 -0700" }, "message": "selinux/nlmsg: add XFRM_MSG_MAPPING\n\ncommit bd2cba07381a6dba60bc1c87ed8b37931d244da1 upstream (net-next).\n\nThis command is missing.\n\nBug: 20350607\nChange-Id: Ida52130382e42355e5f3b39134aa61a1ea98026d\nFixes: 3a2dfbe8acb1 (\"xfrm: Notify changes in UDP encapsulation via netlink\")\nCC: Martin Willi \u003cmartin@strongswan.org\u003e\nReported-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e72f109edb6333800eed1b9b89b879c98a774b9d", "tree": "64cb93e3062e55222b68af9023f778505abab5e4", "parents": [ "15fd1d199d934eb29294f2d07b11f88351f14beb" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Fri Apr 10 16:24:27 2015 +0200" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:57:24 2015 -0700" }, "message": "selinux/nlmsg: add XFRM_MSG_MIGRATE\n\ncommit 8d465bb777179c4bea731b828ec484088cc9fbc1 upstream (net-next).\n\nThis command is missing.\n\nBug: 20350607\nChange-Id: Id2c9344ca1ab2c96e0b758ad1efb38e16cf23b86\nFixes: 5c79de6e79cd (\"[XFRM]: User interface for handling XFRM_MSG_MIGRATE\")\nReported-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "15fd1d199d934eb29294f2d07b11f88351f14beb", "tree": "5b1d9408e962ab5d482fa9a24dcb2119d853c68b", "parents": [ "251f80a351c78f73d4dca414a8725d44f7499672" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Fri Apr 10 16:24:26 2015 +0200" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:57:19 2015 -0700" }, "message": "selinux/nlmsg: add XFRM_MSG_REPORT\n\ncommit b0b59b0056acd6f157a04cc895f7e24692fb08aa upstream (net-next).\n\nThis command is missing.\n\nBug: 20350607\nChange-Id: I8fa3b1b9815296d3b001244d2212f79f5654bd01\nFixes: 97a64b4577ae (\"[XFRM]: Introduce XFRM_MSG_REPORT.\")\nReported-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "251f80a351c78f73d4dca414a8725d44f7499672", "tree": "d107f9c080c742c9dbc6b1d1a99b99e55db02fe5", "parents": [ "94ef22eda27fba74f975c85d2c4f4d67af4029dc" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Wed Apr 08 18:36:42 2015 +0200" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:57:06 2015 -0700" }, "message": "selinux/nlmsg: add XFRM_MSG_[NEW|GET]SADINFO\n\ncommit 5b5800fad072133e4a9c2efbf735baaac83dec86 upstream (net-next).\n\nThese commands are missing.\n\nBug: 20350607\nChange-Id: I3fd1d3d700592c653e1a5c5199125805d55aaa95\nFixes: 28d8909bc790 (\"[XFRM]: Export SAD info.\")\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "94ef22eda27fba74f975c85d2c4f4d67af4029dc", "tree": "1997226a3f90636a2eb4f7889ab649e7904e80e2", "parents": [ "0d84a2c68f35e914201027c073d24495402ba112" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Wed Apr 08 18:36:41 2015 +0200" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:55:06 2015 -0700" }, "message": "selinux/nlmsg: add XFRM_MSG_GETSPDINFO\n\ncommit 5e6deebafb45fb271ae6939d48832e920b8fb74e upstream (net-next).\n\nThis command is missing.\n\nBug: 20350607\nChange-Id: Id0a0d9bf7a4af98a8f761fec902d1296138a911f\nFixes: ecfd6b183780 (\"[XFRM]: Export SPD info\")\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0d84a2c68f35e914201027c073d24495402ba112", "tree": "74c0d108c54d21f23a5db82812692e4584b933c1", "parents": [ "3938b92409ccee2219fcf08f14e527e92400b265" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Wed Apr 08 18:36:40 2015 +0200" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:54:55 2015 -0700" }, "message": "selinux/nlmsg: add XFRM_MSG_NEWSPDINFO\n\ncommit 2b7834d3e1b828429faa5dc41a480919e52d3f31 upstream (net-next).\n\nThis new command is missing.\n\nBug: 20350607\nChange-Id: If511000c19aa9af7220ff775d88ace9834b35dcb\nFixes: 880a6fab8f6b (\"xfrm: configure policy hash table thresholds by netlink\")\nReported-by: Christophe Gouault \u003cchristophe.gouault@6wind.com\u003e\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3938b92409ccee2219fcf08f14e527e92400b265", "tree": "480138f0310a839906a4b7f9ca34f19bf5bd6757", "parents": [ "d074261abb3aaf6334d444898f7991238b284bb5" ], "author": { "name": "Mark Salyzyn", "email": "salyzyn@google.com", "time": "Wed Jan 07 09:27:15 2015 -0800" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 14:54:39 2015 -0700" }, "message": "pstore: selinux: add security in-core xattr support for pstore and debugfs\n\n- add \"pstore\" and \"debugfs\" to list of in-core exceptions\n- change fstype checks to boolean equation\n- change from strncmp to strcmp for checking\n\n(Cherry Pick from commit 2294d499b7969df3838becf5e58bf16b0e3c86c8)\n\nSigned-off-by: Mark Salyzyn \u003csalyzyn@google.com\u003e\nBug: 18917345\nBug: 18935184\nChange-Id: Ib648f30ce4b5d6c96f11465836d6fee89bec1c72\n" }, { "commit": "f29c68f94f0cc6b4467386d8a70b5c9e0dba0796", "tree": "9c5c73640c5535b9bb59d8418354ea95179140cc", "parents": [ "56f9e25ee138692ab12f60154ad3a96f48848d20" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Oct 11 11:42:01 2012 -0400" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Wed Oct 14 06:38:19 2015 -0400" }, "message": "consitify do_mount() arguments\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n(cherry picked from commit 808d4e3cfdcc52b19276175464f6dbca4df13b09)\n" }, { "commit": "b0fd0221d200dddfdb10befd4881a516f0721ff4", "tree": "d6ef261001b6d2500272560431061279999e30f9", "parents": [ "472d3c6c6b4d529792e965015d077cbed5faff7b" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Sat Apr 04 16:15:54 2015 -0700" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Oct 12 21:03:31 2015 -0400" }, "message": "security: lsm_audit: add ioctl specific auditing\n\nAdd information about ioctl calls to the LSM audit data. Log the\nfile path and command number.\n\nBug: 20350607\nBug: 18087110\nChange-Id: Idbbd106db6226683cb30022d9e8f6f3b8fab7f84\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "472d3c6c6b4d529792e965015d077cbed5faff7b", "tree": "f47f84165ea173f7a81b1fcbd304525701d29422", "parents": [ "6ab0e3760c374ef9da22f5acef499ef3cc06d439" ], "author": { "name": "Mark Salyzyn", "email": "salyzyn@google.com", "time": "Wed Jan 07 09:27:15 2015 -0800" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Oct 12 21:03:30 2015 -0400" }, "message": "pstore: selinux: add security in-core xattr support for pstore and debugfs\n\n- add \"pstore\" and \"debugfs\" to list of in-core exceptions\n- change fstype checks to boolean equation\n- change from strncmp to strcmp for checking\n\n(Cherry Pick from commit 2294d499b7969df3838becf5e58bf16b0e3c86c8)\n\nSigned-off-by: Mark Salyzyn \u003csalyzyn@google.com\u003e\nBug: 18917345\nBug: 18935184\nChange-Id: Ib648f30ce4b5d6c96f11465836d6fee89bec1c72\n" }, { "commit": "6ab0e3760c374ef9da22f5acef499ef3cc06d439", "tree": "850d0c8e73ddd16a350d782c4322f5adbdce6979", "parents": [ "bb8c8befdd984468a43670f4ba2c9aac7d3fe31f" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Apr 29 11:14:23 2015 -0700" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Oct 12 21:03:13 2015 -0400" }, "message": "SELinux: ss: Fix policy write for ioctl operations\n\nSecurity server omits the type field when writing out the contents of the\navtab from /sys/fs/selinux/policy. This leads to a corrupt output. No impact\non the running kernel or its loaded policy. Impacts CTS neverallow tests.\n\nBug: 20665861\nChange-Id: I657e18013dd5a1f40052bc2b02dd8e0afee9bcfb\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n(cherry picked from commit 8cdfb356b51e29494ca0b9e4e86727d6f841a52d)\n" }, { "commit": "bb8c8befdd984468a43670f4ba2c9aac7d3fe31f", "tree": "efbb52938f1f07c9ad9693303aa50b5a1717022e", "parents": [ "f3e85345addf732f1f930e91dc974ccda5f75084" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Mon Apr 20 17:45:42 2015 -0700" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Oct 12 21:03:11 2015 -0400" }, "message": "SELinux: use deletion-safe iterator to free list\n\nThis code is not exercised by policy version 26, but will be upon\nupgrade to policy version 30.\n\nBug: 18087110\nChange-Id: I07c6f34607713294a6a12c43a64d9936f0602200\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "f3e85345addf732f1f930e91dc974ccda5f75084", "tree": "81f36a2bb0308eb07f67de57f6b3a38f6da57c15", "parents": [ "f0449ea947097bfaefca995ceeb03ed9117fac38" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Apr 08 11:27:46 2015 -0700" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Oct 12 21:03:10 2015 -0400" }, "message": "SELinux: per-command whitelisting of ioctls\n\n note that this patch depends on a prior patch that is already in\n android-3.4 but has not apparently found its way into the msm 3.4\n branches (but is included in exynos and tegra),\n https://android-review.googlesource.com/#/c/92962/\n\nExtend the generic ioctl permission check with support for per-command\nfiltering. Source/target/class sets including the ioctl permission may\nadditionally include a set of commands. Example:\n\nallow \u003csource\u003e \u003ctarget\u003e:\u003cclass\u003e { 0x8910-0x8926 0x892A-0x8935 }\nauditallow \u003csource\u003e \u003ctarget\u003e:\u003cclass\u003e 0x892A\n\nWhen ioctl commands are omitted only the permissions are checked. This\nfeature is intended to provide finer granularity for the ioctl\npermission which may be too imprecise in some circumstances. For\nexample, the same driver may use ioctls to provide important and\nbenign functionality such as driver version or socket type as well as\ndangerous capabilities such as debugging features, read/write/execute\nto physical memory or access to sensitive data. Per-command filtering\nprovides a mechanism to reduce the attack surface of the kernel, and\nlimit applications to the subset of commands required.\n\nThe format of the policy binary has been modified to include ioctl\ncommands, and the policy version number has been incremented to\nPOLICYDB_VERSION_IOCTL_OPERATIONS\u003d30 to account for the format change.\n\nBug: 20350607\nBug: 18087110\nChange-Id: Ibf0e36728f6f3f0d5af56ccdeddee40800af689d\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "f0449ea947097bfaefca995ceeb03ed9117fac38", "tree": "247e2e0288dec8f7342e687391452643816fc4ff", "parents": [ "19766a54e07e30168368322037e0dda3be4c6cfb" ], "author": { "name": "Richard Haines", "email": "richard_c_haines@btinternet.com", "time": "Tue Nov 19 17:34:23 2013 -0500" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Oct 12 21:03:08 2015 -0400" }, "message": "SELinux: Update policy version to support constraints info\n\nUpdate the policy version (POLICYDB_VERSION_CONSTRAINT_NAMES) to allow\nholding of policy source info for constraints.\n\nChange-Id: Id2971142ad2e2dd47c12796480705128b230349f\nSigned-off-by: Richard Haines \u003crichard_c_haines@btinternet.com\u003e\nAcked-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\n" }, { "commit": "19766a54e07e30168368322037e0dda3be4c6cfb", "tree": "6af8a5983cf787299a59e60e47005b67bd5cee29", "parents": [ "d076bc7ce1dd23fcc2084db69e9c03bfb12e624c" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Tue Mar 20 14:35:12 2012 -0400" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Oct 12 21:03:06 2015 -0400" }, "message": "SELinux: add default_type statements\n\nBecause Fedora shipped userspace based on my development tree we now\nhave policy version 27 in the wild defining only default user, role, and\nrange. Thus to add default_type we need a policy.28.\n\nChange-Id: Ic3e0cd121ef02b951674fafe13138a33e3e95c04\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "d076bc7ce1dd23fcc2084db69e9c03bfb12e624c", "tree": "76378d2b78acb149e57d3610776c3d61a001d497", "parents": [ "d23d9267bc0393c8522aa6c3654e844f20c903eb" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Tue Mar 20 14:35:12 2012 -0400" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Oct 12 21:03:04 2015 -0400" }, "message": "SELinux: allow default source/target selectors for user/role/range\n\nWhen new objects are created we have great and flexible rules to\ndetermine the type of the new object. We aren\u0027t quite as flexible or\nmature when it comes to determining the user, role, and range. This\npatch adds a new ability to specify the place a new objects user, role,\nand range should come from. For users and roles it can come from either\nthe source or the target of the operation. aka for files the user can\neither come from the source (the running process and todays default) or\nit can come from the target (aka the parent directory of the new file)\n\nexamples always are done with\ndirectory context: system_u:object_r:mnt_t:s0-s0:c0.c512\nprocess context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023\n\n[no rule]\n\tunconfined_u:object_r:mnt_t:s0 test_none\n[default user source]\n\tunconfined_u:object_r:mnt_t:s0 test_user_source\n[default user target]\n\tsystem_u:object_r:mnt_t:s0 test_user_target\n[default role source]\n\tunconfined_u:unconfined_r:mnt_t:s0 test_role_source\n[default role target]\n\tunconfined_u:object_r:mnt_t:s0 test_role_target\n[default range source low]\n\tunconfined_u:object_r:mnt_t:s0 test_range_source_low\n[default range source high]\n\tunconfined_u:object_r:mnt_t:s0:c0.c1023 test_range_source_high\n[default range source low-high]\n\tunconfined_u:object_r:mnt_t:s0-s0:c0.c1023 test_range_source_low-high\n[default range target low]\n\tunconfined_u:object_r:mnt_t:s0 test_range_target_low\n[default range target high]\n\tunconfined_u:object_r:mnt_t:s0:c0.c512 test_range_target_high\n[default range target low-high]\n\tunconfined_u:object_r:mnt_t:s0-s0:c0.c512 test_range_target_low-high\n\nChange-Id: I7b259aee39241825aa69882701099f1089108f4e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "6ebf0333cccc1d41983a8d54a1a8da229d5c5a7d", "tree": "9529f96cc061b766a4263740f4db7dcfb54a50bd", "parents": [ "fa0ed22636c93a4b5b2fb670e014e6dbc1b97c2e" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Fri Apr 10 16:24:28 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:29 2015 +0800" }, "message": "selinux/nlmsg: add XFRM_MSG_MAPPING\n\ncommit bd2cba07381a6dba60bc1c87ed8b37931d244da1 upstream.\n\nThis command is missing.\n\nFixes: 3a2dfbe8acb1 (\"xfrm: Notify changes in UDP encapsulation via netlink\")\nCC: Martin Willi \u003cmartin@strongswan.org\u003e\nReported-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "fa0ed22636c93a4b5b2fb670e014e6dbc1b97c2e", "tree": "5cee35d2fc5b958ad4546860cbcec43af0b1514a", "parents": [ "0fcabf0bbb38ad0fd1951c43d80a6bf7c4720a7f" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Fri Apr 10 16:24:27 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:29 2015 +0800" }, "message": "selinux/nlmsg: add XFRM_MSG_MIGRATE\n\ncommit 8d465bb777179c4bea731b828ec484088cc9fbc1 upstream.\n\nThis command is missing.\n\nFixes: 5c79de6e79cd (\"[XFRM]: User interface for handling XFRM_MSG_MIGRATE\")\nReported-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "0fcabf0bbb38ad0fd1951c43d80a6bf7c4720a7f", "tree": "825e6771ba25ab6eb9c89ef8ab0c420252d43d6e", "parents": [ "5099fabbd6c12da280f7d479e7669d8316b01788" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Fri Apr 10 16:24:26 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:29 2015 +0800" }, "message": "selinux/nlmsg: add XFRM_MSG_REPORT\n\ncommit b0b59b0056acd6f157a04cc895f7e24692fb08aa upstream.\n\nThis command is missing.\n\nFixes: 97a64b4577ae (\"[XFRM]: Introduce XFRM_MSG_REPORT.\")\nReported-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "ac18a5350cf80c0db90d71fbed78b8c5d4a367c5", "tree": "ecfea47787d34c8c48c9963b22c1af7fb7e0c62d", "parents": [ "7cddc7d7e8a685682778763e35a0487a25153ca6" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Wed Apr 08 18:36:42 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:28 2015 +0800" }, "message": "selinux/nlmsg: add XFRM_MSG_[NEW|GET]SADINFO\n\ncommit 5b5800fad072133e4a9c2efbf735baaac83dec86 upstream.\n\nThese commands are missing.\n\nFixes: 28d8909bc790 (\"[XFRM]: Export SAD info.\")\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "7cddc7d7e8a685682778763e35a0487a25153ca6", "tree": "80bab5e9714cf3e16043e3f22bdfbba50c357b4a", "parents": [ "fdea68e1782a1405e7b8cc1b9621d61fcf97400a" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Wed Apr 08 18:36:41 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:28 2015 +0800" }, "message": "selinux/nlmsg: add XFRM_MSG_GETSPDINFO\n\ncommit 5e6deebafb45fb271ae6939d48832e920b8fb74e upstream.\n\nThis command is missing.\n\nFixes: ecfd6b183780 (\"[XFRM]: Export SPD info\")\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "d4cd899d8665c75ebf36d4b101da5d990662281f", "tree": "66dec35ba65e2811c03397008766050f09a37724", "parents": [ "e65b00aeda29774e3dbf18b47a0adec64469b2ff" ], "author": { "name": "Joe Perches", "email": "joe@perches.com", "time": "Mon Mar 23 18:01:35 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:29 2015 +0800" }, "message": "selinux: fix sel_write_enforce broken return value\n\ncommit 6436a123a147db51a0b06024a8350f4c230e73ff upstream.\n\nReturn a negative error value like the rest of the entries in this function.\n\nSigned-off-by: Joe Perches \u003cjoe@perches.com\u003e\nAcked-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\n[PM: tweaked subject line]\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "6b962632ba4bdae071db35520e3dbb5e2d50e780", "tree": "803bb2bf9116b199e9c789fdae38bbae3b4ffbc8", "parents": [ "de2a293c9b4cfda94aeb5572383beaa6493dd96d" ], "author": { "name": "Andrey Ryabinin", "email": "a.ryabinin@samsung.com", "time": "Tue Jan 13 18:52:40 2015 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:11 2015 +0800" }, "message": "smack: fix possible use after frees in task_security() callers\n\ncommit 6d1cff2a885850b78b40c34777b46cf5da5d1050 upstream.\n\nWe hit use after free on dereferncing pointer to task_smack struct in\nsmk_of_task() called from smack_task_to_inode().\n\ntask_security() macro uses task_cred_xxx() to get pointer to the task_smack.\ntask_cred_xxx() could be used only for non-pointer members of task\u0027s\ncredentials. It cannot be used for pointer members since what they point\nto may disapper after dropping RCU read lock.\n\nMainly task_security() used this way:\n\tsmk_of_task(task_security(p))\n\nIntead of this introduce function smk_of_task_struct() which\ntakes task_struct as argument and returns pointer to smk_known struct\nand do this under RCU read lock.\nBogus task_security() macro is not used anymore, so remove it.\n\nKASan\u0027s report for this:\n\n\tAddressSanitizer: use after free in smack_task_to_inode+0x50/0x70 at addr c4635600\n\t\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\tBUG kmalloc-64 (Tainted: PO): kasan error\n\t-----------------------------------------------------------------------------\n\n\tDisabling lock debugging due to kernel taint\n\tINFO: Allocated in new_task_smack+0x44/0xd8 age\u003d39 cpu\u003d0 pid\u003d1866\n\t\tkmem_cache_alloc_trace+0x88/0x1bc\n\t\tnew_task_smack+0x44/0xd8\n\t\tsmack_cred_prepare+0x48/0x21c\n\t\tsecurity_prepare_creds+0x44/0x4c\n\t\tprepare_creds+0xdc/0x110\n\t\tsmack_setprocattr+0x104/0x150\n\t\tsecurity_setprocattr+0x4c/0x54\n\t\tproc_pid_attr_write+0x12c/0x194\n\t\tvfs_write+0x1b0/0x370\n\t\tSyS_write+0x5c/0x94\n\t\tret_fast_syscall+0x0/0x48\n\tINFO: Freed in smack_cred_free+0xc4/0xd0 age\u003d27 cpu\u003d0 pid\u003d1564\n\t\tkfree+0x270/0x290\n\t\tsmack_cred_free+0xc4/0xd0\n\t\tsecurity_cred_free+0x34/0x3c\n\t\tput_cred_rcu+0x58/0xcc\n\t\trcu_process_callbacks+0x738/0x998\n\t\t__do_softirq+0x264/0x4cc\n\t\tdo_softirq+0x94/0xf4\n\t\tirq_exit+0xbc/0x120\n\t\thandle_IRQ+0x104/0x134\n\t\tgic_handle_irq+0x70/0xac\n\t\t__irq_svc+0x44/0x78\n\t\t_raw_spin_unlock+0x18/0x48\n\t\tsync_inodes_sb+0x17c/0x1d8\n\t\tsync_filesystem+0xac/0xfc\n\t\tvdfs_file_fsync+0x90/0xc0\n\t\tvfs_fsync_range+0x74/0x7c\n\tINFO: Slab 0xd3b23f50 objects\u003d32 used\u003d31 fp\u003d0xc4635600 flags\u003d0x4080\n\tINFO: Object 0xc4635600 @offset\u003d5632 fp\u003d0x (null)\n\n\tBytes b4 c46355f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ\n\tObject c4635600: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk\n\tObject c4635610: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk\n\tObject c4635620: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk\n\tObject c4635630: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk.\n\tRedzone c4635640: bb bb bb bb ....\n\tPadding c46356e8: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ\n\tPadding c46356f8: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ\n\tCPU: 5 PID: 834 Comm: launchpad_prelo Tainted: PBO 3.10.30 #1\n\tBacktrace:\n\t[\u003cc00233a4\u003e] (dump_backtrace+0x0/0x158) from [\u003cc0023dec\u003e] (show_stack+0x20/0x24)\n\t r7:c4634010 r6:d3b23f50 r5:c4635600 r4:d1002140\n\t[\u003cc0023dcc\u003e] (show_stack+0x0/0x24) from [\u003cc06d6d7c\u003e] (dump_stack+0x20/0x28)\n\t[\u003cc06d6d5c\u003e] (dump_stack+0x0/0x28) from [\u003cc01c1d50\u003e] (print_trailer+0x124/0x144)\n\t[\u003cc01c1c2c\u003e] (print_trailer+0x0/0x144) from [\u003cc01c1e88\u003e] (object_err+0x3c/0x44)\n\t r7:c4635600 r6:d1002140 r5:d3b23f50 r4:c4635600\n\t[\u003cc01c1e4c\u003e] (object_err+0x0/0x44) from [\u003cc01cac18\u003e] (kasan_report_error+0x2b8/0x538)\n\t r6:d1002140 r5:d3b23f50 r4:c6429cf8 r3:c09e1aa7\n\t[\u003cc01ca960\u003e] (kasan_report_error+0x0/0x538) from [\u003cc01c9430\u003e] (__asan_load4+0xd4/0xf8)\n\t[\u003cc01c935c\u003e] (__asan_load4+0x0/0xf8) from [\u003cc031e168\u003e] (smack_task_to_inode+0x50/0x70)\n\t r5:c4635600 r4:ca9da000\n\t[\u003cc031e118\u003e] (smack_task_to_inode+0x0/0x70) from [\u003cc031af64\u003e] (security_task_to_inode+0x3c/0x44)\n\t r5:cca25e80 r4:c0ba9780\n\t[\u003cc031af28\u003e] (security_task_to_inode+0x0/0x44) from [\u003cc023d614\u003e] (pid_revalidate+0x124/0x178)\n\t r6:00000000 r5:cca25e80 r4:cbabe3c0 r3:00008124\n\t[\u003cc023d4f0\u003e] (pid_revalidate+0x0/0x178) from [\u003cc01db98c\u003e] (lookup_fast+0x35c/0x43y4)\n\t r9:c6429efc r8:00000101 r7:c079d940 r6:c6429e90 r5:c6429ed8 r4:c83c4148\n\t[\u003cc01db630\u003e] (lookup_fast+0x0/0x434) from [\u003cc01deec8\u003e] (do_last.isra.24+0x1c0/0x1108)\n\t[\u003cc01ded08\u003e] (do_last.isra.24+0x0/0x1108) from [\u003cc01dff04\u003e] (path_openat.isra.25+0xf4/0x648)\n\t[\u003cc01dfe10\u003e] (path_openat.isra.25+0x0/0x648) from [\u003cc01e1458\u003e] (do_filp_open+0x3c/0x88)\n\t[\u003cc01e141c\u003e] (do_filp_open+0x0/0x88) from [\u003cc01ccb28\u003e] (do_sys_open+0xf0/0x198)\n\t r7:00000001 r6:c0ea2180 r5:0000000b r4:00000000\n\t[\u003cc01cca38\u003e] (do_sys_open+0x0/0x198) from [\u003cc01ccc00\u003e] (SyS_open+0x30/0x34)\n\t[\u003cc01ccbd0\u003e] (SyS_open+0x0/0x34) from [\u003cc001db80\u003e] (ret_fast_syscall+0x0/0x48)\n\tRead of size 4 by thread T834:\n\tMemory state around the buggy address:\n\t c4635380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\t c4635400: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc\n\t c4635480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\t c4635500: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc\n\t c4635580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\t\u003ec4635600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\t ^\n\t c4635680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\t c4635700: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc\n\t c4635780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\t c4635800: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc\n\t c4635880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\t\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Andrey Ryabinin \u003ca.ryabinin@samsung.com\u003e\n[lizf: Backported to 3.4:\n - smk_of_task() returns char* instead of smack_known *\n - replace task_security() with smk_of_task() with smk_of_task_struct()\n manually]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a71feb202f897c7978d60bfce80b58437f754209", "tree": "0475e3989443c2a1e0e8e89ef5e7c40338f7a346", "parents": [ "a6af8f91623152e98fcc0cf13ed6143d77ac3a2f" ], "author": { "name": "James Sullins", "email": "jcsullins@gmail.com", "time": "Thu Nov 21 10:01:19 2013 -0600" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Apr 27 08:05:04 2015 -0400" }, "message": "security/commoncap: fix perms for bluetooth/rfkill\n\nChange-Id: I9a8de2cf70855d6ca68195eba894c2af8eaa3e04\n" }, { "commit": "5eab130238adb0adc6100dbba713082c19794dbf", "tree": "e4c0af7539ca574904595f40c2344602116b2160", "parents": [ "d7a4f76933fc2be05f2837f46045039c9d187d45" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed May 21 15:23:46 2014 -0700" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Apr 27 08:04:54 2015 -0400" }, "message": "sched: move no_new_privs into new atomic flags\n\nSince seccomp transitions between threads requires updates to the\nno_new_privs flag to be atomic, the flag must be part of an atomic flag\nset. This moves the nnp flag into a separate task field, and introduces\naccessors.\n\nChange-Id: I4e764b1b1eb5296a3f7e498a89cfdd6624796c87\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReviewed-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nReviewed-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\n" }, { "commit": "d7a4f76933fc2be05f2837f46045039c9d187d45", "tree": "7f3f9af8d4888e568f6c22975f9f3b48b1479160", "parents": [ "95de3e500c6502922b9e66385f9f0aad23f21128" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Mon Jan 30 08:17:27 2012 -0800" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Apr 27 08:04:53 2015 -0400" }, "message": "Fix execve behavior apparmor for PR_{GET,SET}_NO_NEW_PRIVS\n\nAdd support for AppArmor to explicitly fail requested domain transitions\nif NO_NEW_PRIVS is set and the task is not unconfined.\n\nTransitions from unconfined are still allowed because this always results\nin a reduction of privileges.\n\nAcked-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Will Drewry \u003cwad@chromium.org\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\n\nv18: new acked-by, new description\n" }, { "commit": "6295f3f6b2491291726ef485b62d1b651e69ea3b", "tree": "8136b7d5d84a34dc887d3c07af0b9a9e335be3c9", "parents": [ "c389a745d038d17cf34312ee495aa51e60965385" ], "author": { "name": "Dmitry Kasatkin", "email": "d.kasatkin@samsung.com", "time": "Tue Oct 28 14:28:49 2014 +0200" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Apr 27 08:02:11 2015 -0400" }, "message": "evm: check xattr value length and type in evm_inode_setxattr()\n\ncommit 3b1deef6b1289a99505858a3b212c5b50adf0c2f upstream.\n\nevm_inode_setxattr() can be called with no value. The function does not\ncheck the length so that following command can be used to produce the\nkernel oops: setfattr -n security.evm FOO. This patch fixes it.\n\nChanges in v3:\n* there is no reason to return different error codes for EVM_XATTR_HMAC\n and non EVM_XATTR_HMAC. Remove unnecessary test then.\n\nChanges in v2:\n* testing for validity of xattr type\n\n[ 1106.396921] BUG: unable to handle kernel NULL pointer dereference at (null)\n[ 1106.398192] IP: [\u003cffffffff812af7b8\u003e] evm_inode_setxattr+0x2a/0x48\n[ 1106.399244] PGD 29048067 PUD 290d7067 PMD 0\n[ 1106.399953] Oops: 0000 [#1] SMP\n[ 1106.400020] Modules linked in: bridge stp llc evdev serio_raw i2c_piix4 button fuse\n[ 1106.400020] CPU: 0 PID: 3635 Comm: setxattr Not tainted 3.16.0-kds+ #2936\n[ 1106.400020] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 1106.400020] task: ffff8800291a0000 ti: ffff88002917c000 task.ti: ffff88002917c000\n[ 1106.400020] RIP: 0010:[\u003cffffffff812af7b8\u003e] [\u003cffffffff812af7b8\u003e] evm_inode_setxattr+0x2a/0x48\n[ 1106.400020] RSP: 0018:ffff88002917fd50 EFLAGS: 00010246\n[ 1106.400020] RAX: 0000000000000000 RBX: ffff88002917fdf8 RCX: 0000000000000000\n[ 1106.400020] RDX: 0000000000000000 RSI: ffffffff818136d3 RDI: ffff88002917fdf8\n[ 1106.400020] RBP: ffff88002917fd68 R08: 0000000000000000 R09: 00000000003ec1df\n[ 1106.400020] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800438a0a00\n[ 1106.400020] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[ 1106.400020] FS: 00007f7dfa7d7740(0000) GS:ffff88005da00000(0000) knlGS:0000000000000000\n[ 1106.400020] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1106.400020] CR2: 0000000000000000 CR3: 000000003763e000 CR4: 00000000000006f0\n[ 1106.400020] Stack:\n[ 1106.400020] ffff8800438a0a00 ffff88002917fdf8 0000000000000000 ffff88002917fd98\n[ 1106.400020] ffffffff812a1030 ffff8800438a0a00 ffff88002917fdf8 0000000000000000\n[ 1106.400020] 0000000000000000 ffff88002917fde0 ffffffff8116d08a ffff88002917fdc8\n[ 1106.400020] Call Trace:\n[ 1106.400020] [\u003cffffffff812a1030\u003e] security_inode_setxattr+0x5d/0x6a\n[ 1106.400020] [\u003cffffffff8116d08a\u003e] vfs_setxattr+0x6b/0x9f\n[ 1106.400020] [\u003cffffffff8116d1e0\u003e] setxattr+0x122/0x16c\n[ 1106.400020] [\u003cffffffff811687e8\u003e] ? mnt_want_write+0x21/0x45\n[ 1106.400020] [\u003cffffffff8114d011\u003e] ? __sb_start_write+0x10f/0x143\n[ 1106.400020] [\u003cffffffff811687e8\u003e] ? mnt_want_write+0x21/0x45\n[ 1106.400020] [\u003cffffffff811687c0\u003e] ? __mnt_want_write+0x48/0x4f\n[ 1106.400020] [\u003cffffffff8116d3e6\u003e] SyS_setxattr+0x6e/0xb0\n[ 1106.400020] [\u003cffffffff81529da9\u003e] system_call_fastpath+0x16/0x1b\n[ 1106.400020] Code: c3 0f 1f 44 00 00 55 48 89 e5 41 55 49 89 d5 41 54 49 89 fc 53 48 89 f3 48 c7 c6 d3 36 81 81 48 89 df e8 18 22 04 00 85 c0 75 07 \u003c41\u003e 80 7d 00 02 74 0d 48 89 de 4c 89 e7 e8 5a fe ff ff eb 03 83\n[ 1106.400020] RIP [\u003cffffffff812af7b8\u003e] evm_inode_setxattr+0x2a/0x48\n[ 1106.400020] RSP \u003cffff88002917fd50\u003e\n[ 1106.400020] CR2: 0000000000000000\n[ 1106.428061] ---[ end trace ae08331628ba3050 ]---\n\nReported-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Dmitry Kasatkin \u003cd.kasatkin@samsung.com\u003e\nSigned-off-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "61dedfa6a0d04c4efd7f67920bcfb48f2094a3fd", "tree": "238cabfe3daa6788e25f46eefd4c3e8306e4adef", "parents": [ "1e604b5a88fe727b9687954f2f01fb3f532e5a47" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Mon Oct 06 16:32:52 2014 -0400" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Apr 27 08:01:21 2015 -0400" }, "message": "selinux: fix inode security list corruption\n\ncommit 923190d32de4428afbea5e5773be86bea60a9925 upstream.\n\nsb_finish_set_opts() can race with inode_free_security()\nwhen initializing inode security structures for inodes\ncreated prior to initial policy load or by the filesystem\nduring -\u003emount(). This appears to have always been\na possible race, but commit 3dc91d4 (\"SELinux: Fix possible\nNULL pointer dereference in selinux_inode_permission()\")\nmade it more evident by immediately reusing the unioned\nlist/rcu element of the inode security structure for call_rcu()\nupon an inode_free_security(). But the underlying issue\nwas already present before that commit as a possible use-after-free\nof isec.\n\nShivnandan Kumar reported the list corruption and proposed\na patch to split the list and rcu elements out of the union\nas separate fields of the inode_security_struct so that setting\nthe rcu element would not affect the list element. However,\nthis would merely hide the issue and not truly fix the code.\n\nThis patch instead moves up the deletion of the list entry\nprior to dropping the sbsec-\u003eisec_lock initially. Then,\nif the inode is dropped subsequently, there will be no further\nreferences to the isec.\n\nReported-by: Shivnandan Kumar \u003cshivnandan.k@samsung.com\u003e\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "6fd17def6d964c81205230e02b4208c653106d51", "tree": "1253f07591fe80dc3442db927536c1b3f66b5cd7", "parents": [ "a42e15a485c14f6d994192af4c16775fbd6c1126" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Oct 26 19:19:16 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:58 2015 +0800" }, "message": "move d_rcu from overlapping d_child to overlapping d_alias\n\ncommit 946e51f2bf37f1656916eb75bd0742ba33983c28 upstream.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[bwh: Backported to 3.2:\n - Apply name changes in all the different places we use d_alias and d_child\n - Move the WARN_ON() in __d_free() to d_free() as we don\u0027t have dentry_free()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - need one more name change in debugfs]\n" }, { "commit": "a42e15a485c14f6d994192af4c16775fbd6c1126", "tree": "6c5eb91310f957427bb98997e55b1482b79ec0ca", "parents": [ "565d34077a24bf7819e8fbbb6c93e4d6271c992f" ], "author": { "name": "Sasha Levin", "email": "sasha.levin@oracle.com", "time": "Mon Dec 29 09:39:01 2014 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:58 2015 +0800" }, "message": "KEYS: close race between key lookup and freeing\n\ncommit a3a8784454692dd72e5d5d34dcdab17b4420e74c upstream.\n\nWhen a key is being garbage collected, it\u0027s key-\u003euser would get put before\nthe -\u003edestroy() callback is called, where the key is removed from it\u0027s\nrespective tracking structures.\n\nThis leaves a key hanging in a semi-invalid state which leaves a window open\nfor a different task to try an access key-\u003euser. An example is\nfind_keyring_by_name() which would dereference key-\u003euser for a key that is\nin the process of being garbage collected (where key-\u003euser was freed but\n-\u003edestroy() wasn\u0027t called yet - so it\u0027s still present in the linked list).\n\nThis would cause either a panic, or corrupt memory.\n\nFixes CVE-2014-9529.\n\nSigned-off-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\n[lizf: Backported to 3.4: adjust indentation]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "187c38d0b6fbcc6a17cae6754148eb3f3f117458", "tree": "0a84d57a51ec19b23013a320612055d2dad6c97f", "parents": [ "db84e0afa4ce394a30771ef2c02b36ee79f58e07" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Dec 04 18:25:19 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:45 2015 +0800" }, "message": "KEYS: Fix stale key registration at error path\n\ncommit b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 upstream.\n\nWhen loading encrypted-keys module, if the last check of\naes_get_sizes() in init_encrypted() fails, the driver just returns an\nerror without unregistering its key type. This results in the stale\nentry in the list. In addition to memory leaks, this leads to a kernel\ncrash when registering a new key type later.\n\nThis patch fixes the problem by swapping the calls of aes_get_sizes()\nand register_key_type(), and releasing resources properly at the error\npaths.\n\nBugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id\u003d908163\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "63578cc53582e6fdf441cdaff1cc9d5a3ca3f6d2", "tree": "8a65eee2ea63ed783cd29d3c33b6035fc6087dd8", "parents": [ "ad82ca3bfb2b43a17c9434ce03cfb5a91c9221e4" ], "author": { "name": "Dmitry Kasatkin", "email": "d.kasatkin@samsung.com", "time": "Tue Oct 28 14:28:49 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:05:06 2015 +0800" }, "message": "evm: check xattr value length and type in evm_inode_setxattr()\n\ncommit 3b1deef6b1289a99505858a3b212c5b50adf0c2f upstream.\n\nevm_inode_setxattr() can be called with no value. The function does not\ncheck the length so that following command can be used to produce the\nkernel oops: setfattr -n security.evm FOO. This patch fixes it.\n\nChanges in v3:\n* there is no reason to return different error codes for EVM_XATTR_HMAC\n and non EVM_XATTR_HMAC. Remove unnecessary test then.\n\nChanges in v2:\n* testing for validity of xattr type\n\n[ 1106.396921] BUG: unable to handle kernel NULL pointer dereference at (null)\n[ 1106.398192] IP: [\u003cffffffff812af7b8\u003e] evm_inode_setxattr+0x2a/0x48\n[ 1106.399244] PGD 29048067 PUD 290d7067 PMD 0\n[ 1106.399953] Oops: 0000 [#1] SMP\n[ 1106.400020] Modules linked in: bridge stp llc evdev serio_raw i2c_piix4 button fuse\n[ 1106.400020] CPU: 0 PID: 3635 Comm: setxattr Not tainted 3.16.0-kds+ #2936\n[ 1106.400020] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 1106.400020] task: ffff8800291a0000 ti: ffff88002917c000 task.ti: ffff88002917c000\n[ 1106.400020] RIP: 0010:[\u003cffffffff812af7b8\u003e] [\u003cffffffff812af7b8\u003e] evm_inode_setxattr+0x2a/0x48\n[ 1106.400020] RSP: 0018:ffff88002917fd50 EFLAGS: 00010246\n[ 1106.400020] RAX: 0000000000000000 RBX: ffff88002917fdf8 RCX: 0000000000000000\n[ 1106.400020] RDX: 0000000000000000 RSI: ffffffff818136d3 RDI: ffff88002917fdf8\n[ 1106.400020] RBP: ffff88002917fd68 R08: 0000000000000000 R09: 00000000003ec1df\n[ 1106.400020] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800438a0a00\n[ 1106.400020] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[ 1106.400020] FS: 00007f7dfa7d7740(0000) GS:ffff88005da00000(0000) knlGS:0000000000000000\n[ 1106.400020] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1106.400020] CR2: 0000000000000000 CR3: 000000003763e000 CR4: 00000000000006f0\n[ 1106.400020] Stack:\n[ 1106.400020] ffff8800438a0a00 ffff88002917fdf8 0000000000000000 ffff88002917fd98\n[ 1106.400020] ffffffff812a1030 ffff8800438a0a00 ffff88002917fdf8 0000000000000000\n[ 1106.400020] 0000000000000000 ffff88002917fde0 ffffffff8116d08a ffff88002917fdc8\n[ 1106.400020] Call Trace:\n[ 1106.400020] [\u003cffffffff812a1030\u003e] security_inode_setxattr+0x5d/0x6a\n[ 1106.400020] [\u003cffffffff8116d08a\u003e] vfs_setxattr+0x6b/0x9f\n[ 1106.400020] [\u003cffffffff8116d1e0\u003e] setxattr+0x122/0x16c\n[ 1106.400020] [\u003cffffffff811687e8\u003e] ? mnt_want_write+0x21/0x45\n[ 1106.400020] [\u003cffffffff8114d011\u003e] ? __sb_start_write+0x10f/0x143\n[ 1106.400020] [\u003cffffffff811687e8\u003e] ? mnt_want_write+0x21/0x45\n[ 1106.400020] [\u003cffffffff811687c0\u003e] ? __mnt_want_write+0x48/0x4f\n[ 1106.400020] [\u003cffffffff8116d3e6\u003e] SyS_setxattr+0x6e/0xb0\n[ 1106.400020] [\u003cffffffff81529da9\u003e] system_call_fastpath+0x16/0x1b\n[ 1106.400020] Code: c3 0f 1f 44 00 00 55 48 89 e5 41 55 49 89 d5 41 54 49 89 fc 53 48 89 f3 48 c7 c6 d3 36 81 81 48 89 df e8 18 22 04 00 85 c0 75 07 \u003c41\u003e 80 7d 00 02 74 0d 48 89 de 4c 89 e7 e8 5a fe ff ff eb 03 83\n[ 1106.400020] RIP [\u003cffffffff812af7b8\u003e] evm_inode_setxattr+0x2a/0x48\n[ 1106.400020] RSP \u003cffff88002917fd50\u003e\n[ 1106.400020] CR2: 0000000000000000\n[ 1106.428061] ---[ end trace ae08331628ba3050 ]---\n\nReported-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Dmitry Kasatkin \u003cd.kasatkin@samsung.com\u003e\nSigned-off-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" } ], "next": "e8ab53a5d68c75722c8a2ad3b08a6798ed47d4dc" }