)]}' { "log": [ { "commit": "8a478905adbb2e09a59644e76f7fe7e0ab644204", "tree": "876eef3ca926a6b7d56d7fd2065039cc45a796bc", "parents": [ "c08ef808ef24df32e25fbd949fe5310172f3c408" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Sep 14 20:59:48 2009 -0400" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Tue Sep 15 11:37:33 2009 +1000" }, "message": "SELinux: inline selinux_is_enabled in !CONFIG_SECURITY_SELINUX\n\nWithout this patch building a kernel emits millions of warning like:\n\ninclude/linux/selinux.h:92: warning: ?selinux_is_enabled? defined but not used\n\nWhen it is build without CONFIG_SECURITY_SELINUX. This is harmless, but\nthe function should be inlined, so it gets compiled out.\n\nReported-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "ed868a56988464cd31de0302426a5e94d3127f10", "tree": "cdcd1715445aa19051b6a9a671b39250a449333a", "parents": [ "86d710146fb9975f04c505ec78caa43d227c1018" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Sat Sep 12 22:54:10 2009 -0400" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Mon Sep 14 12:34:07 2009 +1000" }, "message": "Creds: creds-\u003esecurity can be NULL is selinux is disabled\n\n__validate_process_creds should check if selinux is actually enabled before\nrunning tests on the selinux portion of the credentials struct.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "9d57a7f9e23dc30783d245280fc9907cf2c87837", "tree": "508b81e213f5dca1097ccf0ece8ba092b168607b", "parents": [ "d7a96f3a1ae279a2129653d6cb18d722f2f00f91" ], "author": { "name": "Ahmed S. Darwish", "email": "darwish.07@gmail.com", "time": "Sat Mar 01 22:03:14 2008 +0200" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Sat Apr 19 09:53:46 2008 +1000" }, "message": "SELinux: use new audit hooks, remove redundant exports\n\nSetup the new Audit LSM hooks for SELinux.\nRemove the now redundant exported SELinux Audit interface.\n\nAudit: Export \u0027audit_krule\u0027 and \u0027audit_field\u0027 to the public\nsince their internals are needed by the implementation of the\nnew LSM hook \u0027audit_rule_known\u0027.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: Ahmed S. Darwish \u003cdarwish.07@gmail.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "6b89a74be0fbbc6cc639d5cf7dcf8e6ee0f120a7", "tree": "c56574f86d518feb898e934e428dbae999236b5a", "parents": [ "0ce784ca729dce8c9076a6339a15530ca13212f2" ], "author": { "name": "Ahmed S. Darwish", "email": "darwish.07@gmail.com", "time": "Sat Mar 01 21:58:32 2008 +0200" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Sat Apr 19 09:52:36 2008 +1000" }, "message": "SELinux: remove redundant exports\n\nRemove the following exported SELinux interfaces:\nselinux_get_inode_sid(inode, sid)\nselinux_get_ipc_sid(ipcp, sid)\nselinux_get_task_sid(tsk, sid)\nselinux_sid_to_string(sid, ctx, len)\n\nThey can be substitued with the following generic equivalents\nrespectively:\nnew LSM hook, inode_getsecid(inode, secid)\nnew LSM hook, ipc_getsecid*(ipcp, secid)\nLSM hook, task_getsecid(tsk, secid)\nLSM hook, sid_to_secctx(sid, ctx, len)\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: Ahmed S. Darwish \u003cdarwish.07@gmail.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nReviewed-by: Paul Moore \u003cpaul.moore@hp.com\u003e\n" }, { "commit": "d621d35e576aa20a0ddae8022c3810f38357c8ff", "tree": "318e8aa890dbe715b901b11b019ebac3badb693d", "parents": [ "220deb966ea51e0dedb6a187c0763120809f3e64" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Tue Jan 29 08:43:36 2008 -0500" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Wed Jan 30 08:17:26 2008 +1100" }, "message": "SELinux: Enable dynamic enable/disable of the network access checks\n\nThis patch introduces a mechanism for checking when labeled IPsec or SECMARK\nare in use by keeping introducing a configuration reference counter for each\nsubsystem. In the case of labeled IPsec, whenever a labeled SA or SPD entry\nis created the labeled IPsec/XFRM reference count is increased and when the\nentry is removed it is decreased. In the case of SECMARK, when a SECMARK\ntarget is created the reference count is increased and later decreased when the\ntarget is removed. These reference counters allow SELinux to quickly determine\nif either of these subsystems are enabled.\n\nNetLabel already has a similar mechanism which provides the netlbl_enabled()\nfunction.\n\nThis patch also renames the selinux_relabel_packet_permission() function to\nselinux_secmark_relabel_packet_permission() as the original name and\ndescription were misleading in that they referenced a single packet label which\nis not the case.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "ec418781708f89ef6eb8eb5ef1eeb79a6bec9d69", "tree": "fc97d5f06c6fae791590acd7c1445e30348bb9c3", "parents": [ "8c0863403f109a43d7000b4646da4818220d501f" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Fri Nov 16 16:35:56 2007 -0500" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Sat Nov 17 10:38:16 2007 +1100" }, "message": "SELinux: return EOPNOTSUPP not ENOTSUPP\n\nENOTSUPP is not a valid error code in the kernel (it is defined in some\nNFS internal error codes and has been improperly used other places). In\nthe !CONFIG_SECURITY_SELINUX case though it is possible that we could\nreturn this from selinux_audit_rule_init(). This patch just returns the\nuserspace valid EOPNOTSUPP.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "9a2f44f01a67a6ecca71515af999895b45a2aeb0", "tree": "badb3047f9a80013ad0d00a413f6ca038ba3f3ce", "parents": [ "1a70cd40cb291c25b67ec0da715a49d76719329d" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Mon Sep 25 23:31:58 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Tue Sep 26 08:48:52 2006 -0700" }, "message": "[PATCH] selinux: replace ctxid with sid in selinux_audit_rule_match interface\n\nReplace ctxid with sid in selinux_audit_rule_match interface for\nconsistency with other interfaces.\n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "1a70cd40cb291c25b67ec0da715a49d76719329d", "tree": "ffb4c6cd3f7ef1b92822ebbda11bd2b035c2bc86", "parents": [ "62bac0185ad3dfef11d9602980445c54d45199c6" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Mon Sep 25 23:31:57 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Tue Sep 26 08:48:52 2006 -0700" }, "message": "[PATCH] selinux: rename selinux_ctxid_to_string\n\nRename selinux_ctxid_to_string to selinux_sid_to_string to be\nconsistent with other interfaces.\n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "62bac0185ad3dfef11d9602980445c54d45199c6", "tree": "8478673a1dccac5f4e7add4ad802a2bf69b269a4", "parents": [ "89fa30242facca249aead2aac03c4c69764f911c" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Mon Sep 25 23:31:56 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Tue Sep 26 08:48:52 2006 -0700" }, "message": "[PATCH] selinux: eliminate selinux_task_ctxid\n\nEliminate selinux_task_ctxid since it duplicates selinux_task_get_sid.\n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "c749b29fae74ed59c507d84025b3298202b42609", "tree": "c06b1fb17cce425692f7ab40b2df8c5b00d8c931", "parents": [ "29a395eac4c320c570e73f0a90d8953d80da8359" ], "author": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Jun 09 00:28:25 2006 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@sunset.davemloft.net", "time": "Sat Jun 17 21:29:55 2006 -0700" }, "message": "[SECMARK]: Add SELinux exports\n\nAdd and export new functions to the in-kernel SELinux API in support of the\nnew secmark-based packet controls.\n\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e7c3497013a7e5496ce3d5fd3c73b5cf5af7a56e", "tree": "2a57da5e958011b300256988e414387b1455660c", "parents": [ "9c7aa6aa74fa8a5cda36e54cbbe4fffe0214497d" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Mon Apr 03 09:08:13 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:09:58 2006 -0400" }, "message": "[PATCH] Reworked patch for labels on user space messages\n\nThe below patch should be applied after the inode and ipc sid patches.\nThis patch is a reworking of Tim\u0027s patch that has been updated to match\nthe inode and ipc patches since its similar.\n\n[updated:\n\u003e Stephen Smalley also wanted to change a variable from isec to tsec in the\n\u003e user sid patch. ]\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "9c7aa6aa74fa8a5cda36e54cbbe4fffe0214497d", "tree": "1e1489ed5080ea4aff6206bfa904f549de8e56ca", "parents": [ "1b50eed9cac0e8e5e4d3a522d8aa267f7f8f8acb" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Fri Mar 31 15:22:49 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:09:56 2006 -0400" }, "message": "[PATCH] change lspp ipc auditing\n\nHi,\n\nThe patch below converts IPC auditing to collect sid\u0027s and convert to context\nstring only if it needs to output an audit record. This patch depends on the\ninode audit change patch already being applied.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "1b50eed9cac0e8e5e4d3a522d8aa267f7f8f8acb", "tree": "c66a1c3be846e34f1aac5db640b7ccb8770e8a80", "parents": [ "3dc7e3153eddfcf7ba8b50628775ba516e5f759f" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Mon Apr 03 14:06:13 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:09:53 2006 -0400" }, "message": "[PATCH] audit inode patch\n\nPreviously, we were gathering the context instead of the sid. Now in this patch,\nwe gather just the sid and convert to context only if an audit event is being\noutput.\n\nThis patch brings the performance hit from 146% down to 23%\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "376bd9cb357ec945ac893feaeb63af7370a6e70b", "tree": "7e2848792982dfe30e19a600a41fa5cb49ee6e6e", "parents": [ "97e94c453073a2aba4bb5e0825ddc5e923debf11" ], "author": { "name": "Darrel Goeddel", "email": "dgoeddel@trustedcs.com", "time": "Fri Feb 24 15:44:05 2006 -0600" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:06:24 2006 -0400" }, "message": "[PATCH] support for context based audit filtering\n\nThe following patch provides selinux interfaces that will allow the audit\nsystem to perform filtering based on the process context (user, role, type,\nsensitivity, and clearance). These interfaces will allow the selinux\nmodule to perform efficient matches based on lower level selinux constructs,\nrather than relying on context retrievals and string comparisons within\nthe audit module. It also allows for dominance checks on the mls portion\nof the contexts that are impossible with only string comparisons.\n\nSigned-off-by: Darrel Goeddel \u003cdgoeddel@trustedcs.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" } ] }