)]}' { "log": [ { "commit": "2532386f480eefbdd67b48be55fb4fb3e5a6081c", "tree": "dd6a5a3c4116a67380a1336319c16632f04f80f9", "parents": [ "436c405c7d19455a71f42c9bec5fd5e028f1eb4e" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Fri Apr 18 10:09:25 2008 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Apr 28 06:18:03 2008 -0400" }, "message": "Audit: collect sessionid in netlink messages\n\nPreviously I added sessionid output to all audit messages where it was\navailable but we still didn\u0027t know the sessionid of the sender of\nnetlink messages. This patch adds that information to netlink messages\nso we can audit who sent netlink messages.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "00447872a643787411c2c0cb1df6169dda8b0c47", "tree": "ea4215f6f3040507b46bf90fe133ca73a59c9c0e", "parents": [ "b9f3124f08fffe2ad706fd164f6702fdca409a91" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Sat Apr 12 19:06:42 2008 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Apr 12 19:06:42 2008 -0700" }, "message": "NetLabel: Allow passing the LSM domain as a shared pointer\n\nSmack doesn\u0027t have the need to create a private copy of the LSM \"domain\" when\nsetting NetLabel security attributes like SELinux, however, the current\nNetLabel code requires a private copy of the LSM \"domain\". This patches fixes\nthat by letting the LSM determine how it wants to pass the domain value.\n\n * NETLBL_SECATTR_DOMAIN_CPY\n The current behavior, NetLabel assumes that the domain value is a copy and\n frees it when done\n\n * NETLBL_SECATTR_DOMAIN\n New, Smack-friendly behavior, NetLabel assumes that the domain value is a\n reference to a string managed by the LSM and does not free it when done\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "eda61d32e8ad1d9102872f9a0abf3344bf9c5e67", "tree": "d1c11a47c97b3f29d54021cd4aa9c0b8963ed0c8", "parents": [ "97829955ad291acec1d8b94e9911b3ceb1118bb1" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Mon Feb 04 22:29:47 2008 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Tue Feb 05 09:44:20 2008 -0800" }, "message": "NetLabel: introduce a new kernel configuration API for NetLabel\n\nAdd a new set of configuration functions to the NetLabel/LSM API so that\nLSMs can perform their own configuration of the NetLabel subsystem without\nrelying on assistance from userspace.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nReviewed-by: James Morris \u003cjmorris@namei.org\u003e\nCc: Chris Wright \u003cchrisw@sous-sol.org\u003e\nCc: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nCc: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd", "tree": "802d46ff2b1b1700a3baa726d2aa4aba320376c9", "parents": [ "5dbe1eb0cfc144a2b0cb1466e22bcb6fc34229a8" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Tue Jan 29 08:44:21 2008 -0500" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Wed Jan 30 08:17:28 2008 +1100" }, "message": "NetLabel: Introduce static network labels for unlabeled connections\n\nMost trusted OSs, with the exception of Linux, have the ability to specify\nstatic security labels for unlabeled networks. This patch adds this ability to\nthe NetLabel packet labeling framework.\n\nIf the NetLabel subsystem is called to determine the security attributes of an\nincoming packet it first checks to see if any recognized NetLabel packet\nlabeling protocols are in-use on the packet. If none can be found then the\nunlabled connection table is queried and based on the packets incoming\ninterface and address it is matched with a security label as configured by the\nadministrator using the netlabel_tools package. The matching security label is\nreturned to the caller just as if the packet was explicitly labeled using a\nlabeling protocol.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "75e22910cf0c26802b09dac2e34c13e648d3ed02", "tree": "bf5f5c62f6db8a3057a0265dc7748bf310d26d4a", "parents": [ "16efd45435fa695b501b7f73c3259bd7c77cc12c" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Tue Jan 29 08:38:04 2008 -0500" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Wed Jan 30 08:17:20 2008 +1100" }, "message": "NetLabel: Add IP address family information to the netlbl_skbuff_getattr() function\n\nIn order to do any sort of IP header inspection of incoming packets we need to\nknow which address family, AF_INET/AF_INET6/etc., it belongs to and since the\nsk_buff structure does not store this information we need to pass along the\naddress family separate from the packet itself.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "16efd45435fa695b501b7f73c3259bd7c77cc12c", "tree": "f26eb84f65192eb0a17aca399fd405100e4be974", "parents": [ "1c3fad936acaf87b75055b95be781437e97d787f" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Tue Jan 29 08:37:59 2008 -0500" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Wed Jan 30 08:17:19 2008 +1100" }, "message": "NetLabel: Add secid token support to the NetLabel secattr struct\n\nThis patch adds support to the NetLabel LSM secattr struct for a secid token\nand a type field, paving the way for full LSM/SELinux context support and\n\"static\" or \"fallback\" labels. In addition, this patch adds a fair amount\nof documentation to the core NetLabel structures used as part of the\nNetLabel kernel API.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "9534f71ca33e5a9de26dfd43c76af86e005005dd", "tree": "344444735f541f79ed98cc38fa9040bc018ec66e", "parents": [ "1ed4395035a6791ebbbf618429a58ab9c207cc83" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Mon Jul 30 16:33:26 2007 -0400" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Thu Aug 02 11:52:21 2007 -0400" }, "message": "SELinux: restore proper NetLabel caching behavior\n\nA small fix to the SELinux/NetLabel glue code to ensure that the NetLabel\ncache is utilized when possible. This was broken when the SELinux/NetLabel\nglue code was reorganized in the last kernel release.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nAcked-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "23bcdc1adebd3cb47d5666f2e9ecada95c0134e4", "tree": "71caf0ac9fa86e4a9cf423d968a2486656c2e196", "parents": [ "589f1e81bde732dd0b1bc5d01b6bddd4bcb4527b" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Wed Jul 18 12:28:45 2007 -0400" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Thu Jul 19 10:21:11 2007 -0400" }, "message": "SELinux: enable dynamic activation/deactivation of NetLabel/SELinux enforcement\n\nCreate a new NetLabel KAPI interface, netlbl_enabled(), which reports on the\ncurrent runtime status of NetLabel based on the existing configuration. LSMs\nthat make use of NetLabel, i.e. SELinux, can use this new function to determine\nif they should perform NetLabel access checks. This patch changes the\nNetLabel/SELinux glue code such that SELinux only enforces NetLabel related\naccess checks when netlbl_enabled() returns true.\n\nAt present NetLabel is considered to be enabled when there is at least one\nlabeled protocol configuration present. The result is that by default NetLabel\nis considered to be disabled, however, as soon as an administrator configured\na CIPSO DOI definition NetLabel is enabled and SELinux starts enforcing\nNetLabel related access controls - including unlabeled packet controls.\n\nThis patch also tries to consolidate the multiple \"#ifdef CONFIG_NETLABEL\"\nblocks into a single block to ease future review as recommended by Linus.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "ba6ff9f2b5c6018b293bd21083ffaa5ad710e671", "tree": "7a868d3a1948ab9e1aaf7b6e64e114e0f790370d", "parents": [ "6363097cc4d182f93788131b5d8f72aa91d950a0" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Thu Jun 07 18:37:15 2007 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@sunset.davemloft.net", "time": "Fri Jun 08 13:33:09 2007 -0700" }, "message": "[NetLabel]: consolidate the struct socket/sock handling to just struct sock\n\nThe current NetLabel code has some redundant APIs which allow both\n\"struct socket\" and \"struct sock\" types to be used; this may have made\nsense at some point but it is wasteful now. Remove the functions that\noperate on sockets and convert the callers. Not only does this make\nthe code smaller and more consistent but it pushes the locking burden\nup to the caller which can be more intelligent about the locks. Also,\nperform the same conversion (socket to sock) on the SELinux/NetLabel\nglue code where it make sense.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "02752760359db6b00a3ffb1acfc13ef8d9eb1e3f", "tree": "796cd65fd4cd732b295e61dac194efbf36b78842", "parents": [ "ef91fd522ba3c88d9c68261c243567bc4c5a8f55" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Wed Nov 29 13:18:18 2006 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@sunset.davemloft.net", "time": "Sat Dec 02 21:31:36 2006 -0800" }, "message": "NetLabel: convert to an extensibile/sparse category bitmap\n\nThe original NetLabel category bitmap was a straight char bitmap which worked\nfine for the initial release as it only supported 240 bits due to limitations\nin the CIPSO restricted bitmap tag (tag type 0x01). This patch converts that\nstraight char bitmap into an extensibile/sparse bitmap in order to lay the\nfoundation for other CIPSO tag types and protocols.\n\nThis patch also has a nice side effect in that all of the security attributes\npassed by NetLabel into the LSM are now in a format which is in the host\u0027s\nnative byte/bit ordering which makes the LSM specific code much simpler; look\nat the changes in security/selinux/ss/ebitmap.c as an example.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "701a90bad99b8081a824cca52c178c8fc8f46bb2", "tree": "5fed88e6707e9122d7f16e4c5d8fea7c69e090ac", "parents": [ "c6fa82a9dd6160e0bc980cb0401c16bf62f2fe66" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Fri Nov 17 17:38:46 2006 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@sunset.davemloft.net", "time": "Sat Dec 02 21:24:07 2006 -0800" }, "message": "NetLabel: make netlbl_lsm_secattr struct easier/quicker to understand\n\nThe existing netlbl_lsm_secattr struct required the LSM to check all of the\nfields to determine if any security attributes were present resulting in a lot\nof work in the common case of no attributes. This patch adds a \u0027flags\u0027 field\nwhich is used to indicate which attributes are present in the structure; this\nshould allow the LSM to do a quick comparison to determine if the structure\nholds any security attributes.\n\nExample:\n\n if (netlbl_lsm_secattr-\u003eflags)\n\t/* security attributes present */\n else\n\t/* NO security attributes present */\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "c6fa82a9dd6160e0bc980cb0401c16bf62f2fe66", "tree": "3055b0e8fd0372da0c26726b9762d01078ad593a", "parents": [ "cd28786d6d4209ec32a375d92188ec7b4d98779f" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Fri Nov 17 17:38:45 2006 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@sunset.davemloft.net", "time": "Sat Dec 02 21:24:06 2006 -0800" }, "message": "NetLabel: change netlbl_secattr_init() to return void\n\nThe netlbl_secattr_init() function would always return 0 making it pointless\nto have a return value. This patch changes the function to return void.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "1f758d93548fb3c6297c05a351a4ba532de6a497", "tree": "1f94298ed23a3992191ae88a00283f62ecc880eb", "parents": [ "352d48008b6f3e02d8ce77868432e329dd921cb1" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Fri Nov 17 17:38:43 2006 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@sunset.davemloft.net", "time": "Sat Dec 02 21:24:04 2006 -0800" }, "message": "NetLabel: use gfp_t instead of int where it makes sense\n\nThere were a few places in the NetLabel code where the int type was being used\ninstead of the gfp_t type, this patch corrects this mistake.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "645408d1ffe9f27b176a88302c22420f301607db", "tree": "354ae6fcb58ac6e2dce9fc588fa8e439f4cf4ac3", "parents": [ "b4bd8c66435a8cdf8c90334fb3b517a23ff2ab95" ], "author": { "name": "Al Viro", "email": "viro@ftp.linux.org.uk", "time": "Sat Oct 14 16:50:38 2006 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sun Oct 15 11:00:58 2006 -0700" }, "message": "[PATCH] gfp_t in netlabel\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "ffb733c65000ee701294f7b80c4eca2a5f335637", "tree": "edda8e25792fe4a7bf0c619787949291276b9ed7", "parents": [ "c25d5180441e344a3368d100c57f0a481c6944f7" ], "author": { "name": "paul.moore@hp.com", "email": "paul.moore@hp.com", "time": "Wed Oct 04 11:46:31 2006 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@sunset.davemloft.net", "time": "Wed Oct 11 23:59:29 2006 -0700" }, "message": "NetLabel: fix a cache race condition\n\nTesting revealed a problem with the NetLabel cache where a cached entry could\nbe freed while in use by the LSM layer causing an oops and other problems.\nThis patch fixes that problem by introducing a reference counter to the cache\nentry so that it is only freed when it is no longer in use.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "95d4e6be25a68cd9fbe8c0d356b585504d8db1c7", "tree": "2133c970e6786bdf82004ace225b6bca19b9ddba", "parents": [ "d6c641026dec68acfb4b0baa98aad960e963ed97" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Fri Sep 29 17:05:05 2006 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Sep 29 17:05:05 2006 -0700" }, "message": "[NetLabel]: audit fixups due to delayed feedback\n\nFix some issues Steve Grubb had with the way NetLabel was using the audit\nsubsystem. This should make NetLabel more consistent with other kernel\ngenerated audit messages specifying configuration changes.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nAcked-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "32f50cdee666333168b5203c7864bede159f789e", "tree": "c4989cc2521551714f656d60f6b895232ffdeda6", "parents": [ "8ea333eb5da3e3219f570220c56bca09f6f4d25a" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Thu Sep 28 14:51:47 2006 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@sunset.davemloft.net", "time": "Thu Sep 28 18:03:09 2006 -0700" }, "message": "[NetLabel]: add audit support for configuration changes\n\nThis patch adds audit support to NetLabel, including six new audit message\ntypes shown below.\n\n #define AUDIT_MAC_UNLBL_ACCEPT 1406\n #define AUDIT_MAC_UNLBL_DENY 1407\n #define AUDIT_MAC_CIPSOV4_ADD 1408\n #define AUDIT_MAC_CIPSOV4_DEL 1409\n #define AUDIT_MAC_MAP_ADD 1410\n #define AUDIT_MAC_MAP_DEL 1411\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "fcd48280643e92ec6cb29a04e9079dd7b6b5bfef", "tree": "c594e16a021262e97f8b41493529c95bd616529e", "parents": [ "4fe5d5c07ab615a52fd1b0ceba5aeed7c612821a" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Mon Sep 25 15:56:09 2006 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 25 15:56:09 2006 -0700" }, "message": "[NetLabel]: rework the Netlink attribute handling (part 1)\n\nAt the suggestion of Thomas Graf, rewrite NetLabel\u0027s use of Netlink attributes\nto better follow the common Netlink attribute usage.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "14a72f53fb1bb5d5c2bdd8cf172219519664729a", "tree": "95a077fb9289a95c352af77f18f12e5aba3313c6", "parents": [ "597811ec167fa01c926a0957a91d9e39baa30e64" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Mon Sep 25 15:52:01 2006 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 25 15:52:01 2006 -0700" }, "message": "[NetLabel]: correct improper handling of non-NetLabel peer contexts\n\nFix a problem where NetLabel would always set the value of \nsk_security_struct-\u003epeer_sid in selinux_netlbl_sock_graft() to the context of\nthe socket, causing problems when users would query the context of the\nconnection. This patch fixes this so that the value in\nsk_security_struct-\u003epeer_sid is only set when the connection is NetLabel based,\notherwise the value is untouched.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1db2ea398ffbfd9ea46d509ff0e4a85bb4b8c0ea", "tree": "a4c2f7df0133f46c5e92f79e3219462ee9168314", "parents": [ "8abf1064c786ef5435b2d53cc8e9ebee13020de6" ], "author": { "name": "Al Viro", "email": "viro@ftp.linux.org.uk", "time": "Sun Sep 24 23:41:42 2006 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sun Sep 24 15:55:03 2006 -0700" }, "message": "[PATCH] netlabel gfp annotations\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "7a0e1d602288370801c353221c6a938eab925053", "tree": "f11ef396a27549513a91fcaf7d06dafb2b84509a", "parents": [ "e448e931309e703f51d71a557973c620ff12fbda" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Tue Aug 29 17:56:04 2006 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@sunset.davemloft.net", "time": "Fri Sep 22 15:18:39 2006 -0700" }, "message": "[NetLabel]: add some missing #includes to various header files\n\nAdd some missing include files to the NetLabel related header files.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "11a03f78fbf15a866ba3bf6359a75cdfd1ced703", "tree": "49c4c35124c05826a940fba6633dd815985cf8a9", "parents": [ "8802f616f6de8576805f32e47602816f141118f2" ], "author": { "name": "Paul Moore", "email": "paul.moore@hp.com", "time": "Thu Aug 03 16:46:20 2006 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@sunset.davemloft.net", "time": "Fri Sep 22 14:53:32 2006 -0700" }, "message": "[NetLabel]: core network changes\n\nChanges to the core network stack to support the NetLabel subsystem. This\nincludes changes to the IPv4 option handling to support CIPSO labels.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" } ] }