)]}' { "log": [ { "commit": "a74574aafea3a63add3251047601611111f44562", "tree": "a8f4a809589513c666c6f5518cbe84f50ee5523e", "parents": [ "570bc1c2e5ccdb408081e77507a385dc7ebed7fa" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Fri Sep 09 13:01:44 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Sep 09 13:57:28 2005 -0700" }, "message": "[PATCH] Remove security_inode_post_create/mkdir/symlink/mknod hooks\n\nThis patch removes the inode_post_create/mkdir/mknod/symlink LSM hooks as\nthey are obsoleted by the new inode_init_security hook that enables atomic\ninode security labeling.\n\nIf anyone sees any reason to retain these hooks, please speak now. Also,\nis anyone using the post_rename/link hooks; if not, those could also be\nremoved.\n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "5e41ff9e0650f327a6c819841fa412da95d57319", "tree": "a525df8bda34c2aa52f30326f94cd15109bb58b3", "parents": [ "f5ee56cc184e0944ebc9ff1691985219959596f6" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Fri Sep 09 13:01:35 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Sep 09 13:57:27 2005 -0700" }, "message": "[PATCH] security: enable atomic inode security labeling\n\nThe following patch set enables atomic security labeling of newly created\ninodes by altering the fs code to invoke a new LSM hook to obtain the security\nattribute to apply to a newly created inode and to set up the incore inode\nsecurity state during the inode creation transaction. This parallels the\nexisting processing for setting ACLs on newly created inodes. Otherwise, it\nis possible for new inodes to be accessed by another thread via the dcache\nprior to complete security setup (presently handled by the\npost_create/mkdir/... LSM hooks in the VFS) and a newly created inode may be\nleft unlabeled on the disk in the event of a crash. SELinux presently works\naround the issue by ensuring that the incore inode security label is\ninitialized to a special SID that is inaccessible to unprivileged processes\n(in accordance with policy), thereby preventing inappropriate access but\npotentially causing false denials on legitimate accesses. A simple test\nprogram demonstrates such false denials on SELinux, and the patch solves the\nproblem. Similar such false denials have been encountered in real\napplications.\n\nThis patch defines a new inode_init_security LSM hook to obtain the security\nattribute to apply to a newly created inode and to set up the incore inode\nsecurity state for it, and adds a corresponding hook function implementation\nto SELinux.\n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "782ebb992ec20b5afdd5786ee8c2f1b58b631f24", "tree": "adf0af44fa591d803ec6b9ab7541ff3e5745dd93", "parents": [ "720d6c29e146e96cca858057469951e91e0e6850" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Sat Sep 03 15:55:16 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@evo.osdl.org", "time": "Mon Sep 05 00:05:50 2005 -0700" }, "message": "[PATCH] selinux: Reduce memory use by avtab\n\nThis patch improves memory use by SELinux by both reducing the avtab node\nsize and reducing the number of avtab nodes. The memory savings are\nsubstantial, e.g. on a 64-bit system after boot, James Morris reported the\nfollowing data for the targeted and strict policies:\n\n #objs objsize kernmem\nTargeted:\n Before: 237888 40 9.1MB\n After: 19968 24 468KB\n\nStrict:\n Before: 571680 40 21.81MB\n After: 221052 24 5.06MB\n\nThe improvement in memory use comes at a cost in the speed of security\nserver computations of access vectors, but these computations are only\nrequired on AVC cache misses, and performance measurements by James Morris\nusing a number of benchmarks have shown that the change does not cause any\nsignificant degradation.\n\nNote that a rebuilt policy via an updated policy toolchain\n(libsepol/checkpolicy) is required in order to gain the full benefits of\nthis patch, although some memory savings benefits are immediately applied\neven to older policies (in particular, the reduction in avtab node size).\nSources for the updated toolchain are presently available from the\nsourceforge CVS tree (http://sourceforge.net/cvs/?group_id\u003d21266), and\ntarballs are available from http://www.flux.utah.edu/~sds.\n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "f5c1d5b2aaf9a98f15a6dcdfbba1f494d0aaae52", "tree": "e896d0b6b9f561c9d124fa81efd261518ccbddf4", "parents": [ "e1699f508ab5098de4b258268fa8913db38d9d35" ], "author": { "name": "James Morris", "email": "jmorris@redhat.com", "time": "Thu Jul 28 01:07:37 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Thu Jul 28 08:39:02 2005 -0700" }, "message": "[PATCH] SELinux: default labeling of MLS field\n\nImplement kernel labeling of the MLS (multilevel security) field of\nsecurity contexts for files which have no existing MLS field. This is to\nenable upgrades of a system from non-MLS to MLS without performing a full\nfilesystem relabel including all of the mountpoints, which would be quite\npainful for users.\n\nWith this patch, with MLS enabled, if a file has no MLS field, the kernel\ninternally adds an MLS field to the in-core inode (but not to the on-disk\nfile). This MLS field added is the default for the superblock, allowing\nper-mountpoint control over the values via fixed policy or mount options.\n\nThis patch has been tested by enabling MLS without relabeling its\nfilesystem, and seems to be working correctly.\n\nSigned-off-by: James Morris \u003cjmorris@redhat.com\u003e\nSigned-off-by: Stephen Smalley \u003csds@epoch.ncsc.mil\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "09ffd94fb15d85fbf9eebb8180f50264b264d6fe", "tree": "688a5b60f9718a56a5d4386ef10596e77fb65b7b", "parents": [ "6b9921976f0861e04828b3aff66696c1f3fd900d" ], "author": { "name": "Lorenzo Hernández García-Hierro", "email": "lorenzo@gnu.org", "time": "Sat Jun 25 14:54:35 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@ppc970.osdl.org", "time": "Sat Jun 25 16:24:26 2005 -0700" }, "message": "[PATCH] selinux: add executable heap check\n\nThis patch,based on sample code by Roland McGrath, adds an execheap\npermission check that controls the ability to make the heap executable so\nthat this can be prevented in almost all cases (the X server is presently\nan exception, but this will hopefully be resolved in the future) so that\neven programs with execmem permission will need to have the anonymous\nmemory mapped in order to make it executable.\n\nThe only reason that we use a permission check for such restriction (vs.\nmaking it unconditional) is that the X module loader presently needs it; it\ncould possibly be made unconditional in the future when X is changed.\n\nThe policy patch for the execheap permission is available at:\nhttp://pearls.tuxedo-es.org/patches/selinux/policy-execheap.patch\n\nSigned-off-by: Lorenzo Hernandez Garcia-Hierro \u003clorenzo@gnu.org\u003e\nAcked-by: James Morris \u003cjmorris@redhat.com\u003e\nAcked-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "6b9921976f0861e04828b3aff66696c1f3fd900d", "tree": "be372b9dc81e393c909c7fecf8778e8864ba3a0d", "parents": [ "2d15cab85b85a56cc886037cab43cc292923ff22" ], "author": { "name": "Lorenzo Hernandez García-Hierro", "email": "lorenzo@gnu.org", "time": "Sat Jun 25 14:54:34 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@ppc970.osdl.org", "time": "Sat Jun 25 16:24:26 2005 -0700" }, "message": "[PATCH] selinux: add executable stack check\n\nThis patch adds an execstack permission check that controls the ability to\nmake the main process stack executable so that attempts to make the stack\nexecutable can still be prevented even if the process is allowed the\nexisting execmem permission in order to e.g. perform runtime code\ngeneration. Note that this does not yet address thread stacks. Note also\nthat unlike the execmem check, the execstack check is only applied on\nmprotect calls, not mmap calls, as the current security_file_mmap hook is\nnot passed the necessary information presently.\n\nThe original author of the code that makes the distinction of the stack\nregion, is Ingo Molnar, who wrote it within his patch for\n/proc/\u003cpid\u003e/maps markers.\n(http://marc.theaimsgroup.com/?l\u003dlinux-kernel\u0026m\u003d110719881508591\u0026w\u003d2)\n\nThe patches also can be found at:\nhttp://pearls.tuxedo-es.org/patches/selinux/policy-execstack.patch\nhttp://pearls.tuxedo-es.org/patches/selinux/kernel-execstack.patch\n\npolicy-execstack.patch is the patch that needs to be applied to the policy in\norder to support the execstack permission and exclude it\nfrom general_domain_access within macros/core_macros.te.\n\nkernel-execstack.patch adds such permission to the SELinux code within\nthe kernel and adds the proper permission check to the selinux_file_mprotect() hook.\n\nSigned-off-by: Lorenzo Hernandez Garcia-Hierro \u003clorenzo@gnu.org\u003e\nAcked-by: James Morris \u003cjmorris@redhat.com\u003e\nAcked-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "b207a290ea7dc83dba02e40b81cc8a29415a9c60", "tree": "fe76d1c494977ba95ab576e9207dc13c4a66a04a", "parents": [ "6af963f1d6789ef20abca5696cd52a758b396e52" ], "author": { "name": "James Morris", "email": "jmorris@redhat.com", "time": "Sun May 01 08:58:40 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@ppc970.osdl.org", "time": "Sun May 01 08:58:40 2005 -0700" }, "message": "[PATCH] SELinux: add finer grained permissions to Netlink audit processing\n\nThis patch provides finer grained permissions for the audit family of\nNetlink sockets under SELinux.\n\n1. We need a way to differentiate between privileged and unprivileged\n reads of kernel data maintained by the audit subsystem. The AUDIT_GET\n operation is unprivileged: it returns the current status of the audit\n subsystem (e.g. whether it\u0027s enabled etc.). The AUDIT_LIST operation\n however returns a list of the current audit ruleset, which is considered\n privileged by the audit folk. To deal with this, a new SELinux\n permission has been implemented and applied to the operation:\n nlmsg_readpriv, which can be allocated to appropriately privileged\n domains. Unprivileged domains would only be allocated nlmsg_read.\n\n2. There is a requirement for certain domains to generate audit events\n from userspace. These events need to be collected by the kernel,\n collated and transmitted sequentially back to the audit daemon. An\n example is user level login, an auditable event under CAPP, where\n login-related domains generate AUDIT_USER messages via PAM which are\n relayed back to auditd via the kernel. To prevent handing out\n nlmsg_write permissions to such domains, a new permission has been\n added, nlmsg_relay, which is intended for this type of purpose: data is\n passed via the kernel back to userspace but no privileged information is\n written to the kernel.\n\nAlso, AUDIT_LOGIN messages are now valid only for kernel-\u003euser messaging,\nso this value has been removed from the SELinux nlmsgtab (which is only\nused to check user-\u003ekernel messages).\n\nSigned-off-by: James Morris \u003cjmorris@redhat.com\u003e\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "0c9b79429c83a404a04908be65baa9d97836bbb6", "tree": "66cdf9fc4cf40867ed8c9dc060661615941cd95f", "parents": [ "7e5c6bc0a600c49e5922591ad41ff41987f54eb4" ], "author": { "name": "James Morris", "email": "jmorris@redhat.com", "time": "Sat Apr 16 15:24:13 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@ppc970.osdl.org", "time": "Sat Apr 16 15:24:13 2005 -0700" }, "message": "[PATCH] SELinux: add support for NETLINK_KOBJECT_UEVENT\n\nThis patch adds SELinux support for the KOBJECT_UEVENT Netlink family, so\nthat SELinux can apply finer grained controls to it. For example, security\npolicy for hald can be locked down to the KOBJECT_UEVENT Netlink family\nonly. Currently, this family simply defaults to the default Netlink socket\nclass.\n\nNote that some new permission definitions are added to sync with changes in\nthe core userspace policy package, which auto-generates header files.\n\nSigned-off-by: James Morris \u003cjmorris@redhat.com\u003e\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "tree": "0bba044c4ce775e45a88a51686b5d9f90697ea9d", "parents": [], "author": { "name": "Linus Torvalds", "email": "torvalds@ppc970.osdl.org", "time": "Sat Apr 16 15:20:36 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@ppc970.osdl.org", "time": "Sat Apr 16 15:20:36 2005 -0700" }, "message": "Linux-2.6.12-rc2\n\nInitial git repository build. I\u0027m not bothering with the full history,\neven though we have it. We can create a separate \"historical\" git\narchive of that later if we want to, and in the meantime it\u0027s about\n3.2GB when imported into git - space that would just make the early\ngit days unnecessarily complicated, when we don\u0027t have a lot of good\ninfrastructure for it.\n\nLet it rip!\n" } ] }