)]}'
{
  "log": [
    {
      "commit": "5c6d1125f8dbd1bfef39e38fbc2837003be78a59",
      "tree": "368d34e800bc5478442679323270d776b79501e8",
      "parents": [
        "fe27d4b012273640e033be80f143bdc54daa8e16"
      ],
      "author": {
        "name": "Jarkko Sakkinen",
        "email": "ext-jarkko.2.sakkinen@nokia.com",
        "time": "Tue Dec 07 13:34:01 2010 +0200"
      },
      "committer": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Tue Dec 07 14:04:02 2010 -0800"
      },
      "message": "Smack: Transmute labels on specified directories\n\nIn a situation where Smack access rules allow processes\nwith multiple labels to write to a directory it is easy\nto get into a situation where the directory gets cluttered\nwith files that the owner can\u0027t deal with because while\nthey could be written to the directory a process at the\nlabel of the directory can\u0027t write them. This is generally\nthe desired behavior, but when it isn\u0027t it is a real\nissue.\n\nThis patch introduces a new attribute SMACK64TRANSMUTE that\ninstructs Smack to create the file with the label of the directory\nunder certain circumstances.\n\nA new access mode, \"t\" for transmute, is made available to\nSmack access rules, which are expanded from \"rwxa\" to \"rwxat\".\nIf a file is created in a directory marked as transmutable\nand if access was granted to perform the operation by a rule\nthat included the transmute mode, then the file gets the\nSmack label of the directory instead of the Smack label of the\ncreating process.\n\nNote that this is equivalent to creating an empty file at the\nlabel of the directory and then having the other process write\nto it. The transmute scheme requires that both the access rule\nallows transmutation and that the directory be explicitly marked.\n\nSigned-off-by: Jarkko Sakkinen \u003cext-jarkko.2.sakkinen@nokia.com\u003e\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "676dac4b1bee0469d6932f698aeb77e8489f5861",
      "tree": "196b4cb35cf8dfdff0698dc4368cfd00acc7391a",
      "parents": [
        "93ae86e759299718c611bc543b9b1633bf32905a"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Thu Dec 02 06:43:39 2010 -0800"
      },
      "committer": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Thu Dec 02 06:43:39 2010 -0800"
      },
      "message": "This patch adds a new security attribute to Smack called\nSMACK64EXEC. It defines label that is used while task is\nrunning.\n\nException: in smack_task_wait() child task is checked\nfor write access to parent task using label inherited\nfrom the task that forked it.\n\nFixed issues from previous submit:\n- SMACK64EXEC was not read when SMACK64 was not set.\n- inode security blob was not updated after setting\n  SMACK64EXEC\n- inode security blob was not updated when removing\n  SMACK64EXEC\n"
    },
    {
      "commit": "fc14f2fef682df677d64a145256dbd263df2aa7b",
      "tree": "74f6b939fbad959a43c04ec646cd0adc8af5f53a",
      "parents": [
        "848b83a59b772b8f102bc5e3f1187c2fa5676959"
      ],
      "author": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Sun Jul 25 01:48:30 2010 +0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Fri Oct 29 04:16:28 2010 -0400"
      },
      "message": "convert get_sb_single() users\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "6038f373a3dc1f1c26496e60b6c40b164716f07e",
      "tree": "a0d3bbd026eea41b9fc36b8c722cbaf56cd9f825",
      "parents": [
        "1ec5584e3edf9c4bf2c88c846534d19cf986ba11"
      ],
      "author": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Sun Aug 15 18:52:59 2010 +0200"
      },
      "committer": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Fri Oct 15 15:53:27 2010 +0200"
      },
      "message": "llseek: automatically add .llseek fop\n\nAll file_operations should get a .llseek operation so we can make\nnonseekable_open the default for future file operations without a\n.llseek pointer.\n\nThe three cases that we can automatically detect are no_llseek, seq_lseek\nand default_llseek. For cases where we can we can automatically prove that\nthe file offset is always ignored, we use noop_llseek, which maintains\nthe current behavior of not returning an error from a seek.\n\nNew drivers should normally not use noop_llseek but instead use no_llseek\nand call nonseekable_open at open time.  Existing drivers can be converted\nto do the same when the maintainer knows for certain that no user code\nrelies on calling seek on the device file.\n\nThe generated code is often incorrectly indented and right now contains\ncomments that clarify for each added line why a specific variant was\nchosen. In the version that gets submitted upstream, the comments will\nbe gone and I will manually fix the indentation, because there does not\nseem to be a way to do that using coccinelle.\n\nSome amount of new code is currently sitting in linux-next that should get\nthe same modifications, which I will do at the end of the merge window.\n\nMany thanks to Julia Lawall for helping me learn to write a semantic\npatch that does all this.\n\n\u003d\u003d\u003d\u003d\u003d begin semantic patch \u003d\u003d\u003d\u003d\u003d\n// This adds an llseek\u003d method to all file operations,\n// as a preparation for making no_llseek the default.\n//\n// The rules are\n// - use no_llseek explicitly if we do nonseekable_open\n// - use seq_lseek for sequential files\n// - use default_llseek if we know we access f_pos\n// - use noop_llseek if we know we don\u0027t access f_pos,\n//   but we still want to allow users to call lseek\n//\n@ open1 exists @\nidentifier nested_open;\n@@\nnested_open(...)\n{\n\u003c+...\nnonseekable_open(...)\n...+\u003e\n}\n\n@ open exists@\nidentifier open_f;\nidentifier i, f;\nidentifier open1.nested_open;\n@@\nint open_f(struct inode *i, struct file *f)\n{\n\u003c+...\n(\nnonseekable_open(...)\n|\nnested_open(...)\n)\n...+\u003e\n}\n\n@ read disable optional_qualifier exists @\nidentifier read_f;\nidentifier f, p, s, off;\ntype ssize_t, size_t, loff_t;\nexpression E;\nidentifier func;\n@@\nssize_t read_f(struct file *f, char *p, size_t s, loff_t *off)\n{\n\u003c+...\n(\n   *off \u003d E\n|\n   *off +\u003d E\n|\n   func(..., off, ...)\n|\n   E \u003d *off\n)\n...+\u003e\n}\n\n@ read_no_fpos disable optional_qualifier exists @\nidentifier read_f;\nidentifier f, p, s, off;\ntype ssize_t, size_t, loff_t;\n@@\nssize_t read_f(struct file *f, char *p, size_t s, loff_t *off)\n{\n... when !\u003d off\n}\n\n@ write @\nidentifier write_f;\nidentifier f, p, s, off;\ntype ssize_t, size_t, loff_t;\nexpression E;\nidentifier func;\n@@\nssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off)\n{\n\u003c+...\n(\n  *off \u003d E\n|\n  *off +\u003d E\n|\n  func(..., off, ...)\n|\n  E \u003d *off\n)\n...+\u003e\n}\n\n@ write_no_fpos @\nidentifier write_f;\nidentifier f, p, s, off;\ntype ssize_t, size_t, loff_t;\n@@\nssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off)\n{\n... when !\u003d off\n}\n\n@ fops0 @\nidentifier fops;\n@@\nstruct file_operations fops \u003d {\n ...\n};\n\n@ has_llseek depends on fops0 @\nidentifier fops0.fops;\nidentifier llseek_f;\n@@\nstruct file_operations fops \u003d {\n...\n .llseek \u003d llseek_f,\n...\n};\n\n@ has_read depends on fops0 @\nidentifier fops0.fops;\nidentifier read_f;\n@@\nstruct file_operations fops \u003d {\n...\n .read \u003d read_f,\n...\n};\n\n@ has_write depends on fops0 @\nidentifier fops0.fops;\nidentifier write_f;\n@@\nstruct file_operations fops \u003d {\n...\n .write \u003d write_f,\n...\n};\n\n@ has_open depends on fops0 @\nidentifier fops0.fops;\nidentifier open_f;\n@@\nstruct file_operations fops \u003d {\n...\n .open \u003d open_f,\n...\n};\n\n// use no_llseek if we call nonseekable_open\n////////////////////////////////////////////\n@ nonseekable1 depends on !has_llseek \u0026\u0026 has_open @\nidentifier fops0.fops;\nidentifier nso ~\u003d \"nonseekable_open\";\n@@\nstruct file_operations fops \u003d {\n...  .open \u003d nso, ...\n+.llseek \u003d no_llseek, /* nonseekable */\n};\n\n@ nonseekable2 depends on !has_llseek @\nidentifier fops0.fops;\nidentifier open.open_f;\n@@\nstruct file_operations fops \u003d {\n...  .open \u003d open_f, ...\n+.llseek \u003d no_llseek, /* open uses nonseekable */\n};\n\n// use seq_lseek for sequential files\n/////////////////////////////////////\n@ seq depends on !has_llseek @\nidentifier fops0.fops;\nidentifier sr ~\u003d \"seq_read\";\n@@\nstruct file_operations fops \u003d {\n...  .read \u003d sr, ...\n+.llseek \u003d seq_lseek, /* we have seq_read */\n};\n\n// use default_llseek if there is a readdir\n///////////////////////////////////////////\n@ fops1 depends on !has_llseek \u0026\u0026 !nonseekable1 \u0026\u0026 !nonseekable2 \u0026\u0026 !seq @\nidentifier fops0.fops;\nidentifier readdir_e;\n@@\n// any other fop is used that changes pos\nstruct file_operations fops \u003d {\n... .readdir \u003d readdir_e, ...\n+.llseek \u003d default_llseek, /* readdir is present */\n};\n\n// use default_llseek if at least one of read/write touches f_pos\n/////////////////////////////////////////////////////////////////\n@ fops2 depends on !fops1 \u0026\u0026 !has_llseek \u0026\u0026 !nonseekable1 \u0026\u0026 !nonseekable2 \u0026\u0026 !seq @\nidentifier fops0.fops;\nidentifier read.read_f;\n@@\n// read fops use offset\nstruct file_operations fops \u003d {\n... .read \u003d read_f, ...\n+.llseek \u003d default_llseek, /* read accesses f_pos */\n};\n\n@ fops3 depends on !fops1 \u0026\u0026 !fops2 \u0026\u0026 !has_llseek \u0026\u0026 !nonseekable1 \u0026\u0026 !nonseekable2 \u0026\u0026 !seq @\nidentifier fops0.fops;\nidentifier write.write_f;\n@@\n// write fops use offset\nstruct file_operations fops \u003d {\n... .write \u003d write_f, ...\n+\t.llseek \u003d default_llseek, /* write accesses f_pos */\n};\n\n// Use noop_llseek if neither read nor write accesses f_pos\n///////////////////////////////////////////////////////////\n\n@ fops4 depends on !fops1 \u0026\u0026 !fops2 \u0026\u0026 !fops3 \u0026\u0026 !has_llseek \u0026\u0026 !nonseekable1 \u0026\u0026 !nonseekable2 \u0026\u0026 !seq @\nidentifier fops0.fops;\nidentifier read_no_fpos.read_f;\nidentifier write_no_fpos.write_f;\n@@\n// write fops use offset\nstruct file_operations fops \u003d {\n...\n .write \u003d write_f,\n .read \u003d read_f,\n...\n+.llseek \u003d noop_llseek, /* read and write both use no f_pos */\n};\n\n@ depends on has_write \u0026\u0026 !has_read \u0026\u0026 !fops1 \u0026\u0026 !fops2 \u0026\u0026 !has_llseek \u0026\u0026 !nonseekable1 \u0026\u0026 !nonseekable2 \u0026\u0026 !seq @\nidentifier fops0.fops;\nidentifier write_no_fpos.write_f;\n@@\nstruct file_operations fops \u003d {\n... .write \u003d write_f, ...\n+.llseek \u003d noop_llseek, /* write uses no f_pos */\n};\n\n@ depends on has_read \u0026\u0026 !has_write \u0026\u0026 !fops1 \u0026\u0026 !fops2 \u0026\u0026 !has_llseek \u0026\u0026 !nonseekable1 \u0026\u0026 !nonseekable2 \u0026\u0026 !seq @\nidentifier fops0.fops;\nidentifier read_no_fpos.read_f;\n@@\nstruct file_operations fops \u003d {\n... .read \u003d read_f, ...\n+.llseek \u003d noop_llseek, /* read uses no f_pos */\n};\n\n@ depends on !has_read \u0026\u0026 !has_write \u0026\u0026 !fops1 \u0026\u0026 !fops2 \u0026\u0026 !has_llseek \u0026\u0026 !nonseekable1 \u0026\u0026 !nonseekable2 \u0026\u0026 !seq @\nidentifier fops0.fops;\n@@\nstruct file_operations fops \u003d {\n...\n+.llseek \u003d noop_llseek, /* no read or write fn */\n};\n\u003d\u003d\u003d\u003d\u003d End semantic patch \u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Julia Lawall \u003cjulia@diku.dk\u003e\nCc: Christoph Hellwig \u003chch@infradead.org\u003e\n"
    },
    {
      "commit": "5a0e3ad6af8660be21ca98a971cd00f331318c05",
      "tree": "5bfb7be11a03176a87296a43ac6647975c00a1d1",
      "parents": [
        "ed391f4ebf8f701d3566423ce8f17e614cde9806"
      ],
      "author": {
        "name": "Tejun Heo",
        "email": "tj@kernel.org",
        "time": "Wed Mar 24 17:04:11 2010 +0900"
      },
      "committer": {
        "name": "Tejun Heo",
        "email": "tj@kernel.org",
        "time": "Tue Mar 30 22:02:32 2010 +0900"
      },
      "message": "include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h\n\npercpu.h is included by sched.h and module.h and thus ends up being\nincluded when building most .c files.  percpu.h includes slab.h which\nin turn includes gfp.h making everything defined by the two files\nuniversally available and complicating inclusion dependencies.\n\npercpu.h -\u003e slab.h dependency is about to be removed.  Prepare for\nthis change by updating users of gfp and slab facilities include those\nheaders directly instead of assuming availability.  As this conversion\nneeds to touch large number of source files, the following script is\nused as the basis of conversion.\n\n  http://userweb.kernel.org/~tj/misc/slabh-sweep.py\n\nThe script does the followings.\n\n* Scan files for gfp and slab usages and update includes such that\n  only the necessary includes are there.  ie. if only gfp is used,\n  gfp.h, if slab is used, slab.h.\n\n* When the script inserts a new include, it looks at the include\n  blocks and try to put the new include such that its order conforms\n  to its surrounding.  It\u0027s put in the include block which contains\n  core kernel includes, in the same order that the rest are ordered -\n  alphabetical, Christmas tree, rev-Xmas-tree or at the end if there\n  doesn\u0027t seem to be any matching order.\n\n* If the script can\u0027t find a place to put a new include (mostly\n  because the file doesn\u0027t have fitting include block), it prints out\n  an error message indicating which .h file needs to be added to the\n  file.\n\nThe conversion was done in the following steps.\n\n1. The initial automatic conversion of all .c files updated slightly\n   over 4000 files, deleting around 700 includes and adding ~480 gfp.h\n   and ~3000 slab.h inclusions.  The script emitted errors for ~400\n   files.\n\n2. Each error was manually checked.  Some didn\u0027t need the inclusion,\n   some needed manual addition while adding it to implementation .h or\n   embedding .c file was more appropriate for others.  This step added\n   inclusions to around 150 files.\n\n3. The script was run again and the output was compared to the edits\n   from #2 to make sure no file was left behind.\n\n4. Several build tests were done and a couple of problems were fixed.\n   e.g. lib/decompress_*.c used malloc/free() wrappers around slab\n   APIs requiring slab.h to be added manually.\n\n5. The script was run on all .h files but without automatically\n   editing them as sprinkling gfp.h and slab.h inclusions around .h\n   files could easily lead to inclusion dependency hell.  Most gfp.h\n   inclusion directives were ignored as stuff from gfp.h was usually\n   wildly available and often used in preprocessor macros.  Each\n   slab.h inclusion directive was examined and added manually as\n   necessary.\n\n6. percpu.h was updated not to include slab.h.\n\n7. Build test were done on the following configurations and failures\n   were fixed.  CONFIG_GCOV_KERNEL was turned off for all tests (as my\n   distributed build env didn\u0027t work with gcov compiles) and a few\n   more options had to be turned off depending on archs to make things\n   build (like ipr on powerpc/64 which failed due to missing writeq).\n\n   * x86 and x86_64 UP and SMP allmodconfig and a custom test config.\n   * powerpc and powerpc64 SMP allmodconfig\n   * sparc and sparc64 SMP allmodconfig\n   * ia64 SMP allmodconfig\n   * s390 SMP allmodconfig\n   * alpha SMP allmodconfig\n   * um on x86_64 SMP allmodconfig\n\n8. percpu.h modifications were reverted so that it could be applied as\n   a separate patch and serve as bisection point.\n\nGiven the fact that I had only a couple of failures from tests on step\n6, I\u0027m fairly confident about the coverage of this conversion patch.\nIf there is a breakage, it\u0027s likely to be something in one of the arch\nheaders which should be easily discoverable easily on most builds of\nthe specific arch.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nGuess-its-ok-by: Christoph Lameter \u003ccl@linux-foundation.org\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Lee Schermerhorn \u003cLee.Schermerhorn@hp.com\u003e\n"
    },
    {
      "commit": "88e9d34c727883d7d6f02cf1475b3ec98b8480c7",
      "tree": "475f544536d52739e0929e7727cab5124e855a06",
      "parents": [
        "b7ed698cc9d556306a4088c238e2ea9311ea2cb3"
      ],
      "author": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Tue Sep 22 16:43:43 2009 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Sep 23 07:39:29 2009 -0700"
      },
      "message": "seq_file: constify seq_operations\n\nMake all seq_operations structs const, to help mitigate against\nrevectoring user-triggerable function pointers.\n\nThis is derived from the grsecurity patch, although generated from scratch\nbecause it\u0027s simpler than extracting the changes from there.\n\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "3296ca27f50ecbd71db1d808c7a72d311027f919",
      "tree": "833eaa58b2013bda86d4bd95faf6efad7a2d5ca4",
      "parents": [
        "e893123c7378192c094747dadec326b7c000c190",
        "73fbad283cfbbcf02939bdbda31fc4a30e729cca"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 11 10:01:41 2009 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 11 10:01:41 2009 -0700"
      },
      "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: (44 commits)\n  nommu: Provide mmap_min_addr definition.\n  TOMOYO: Add description of lists and structures.\n  TOMOYO: Remove unused field.\n  integrity: ima audit dentry_open failure\n  TOMOYO: Remove unused parameter.\n  security: use mmap_min_addr indepedently of security models\n  TOMOYO: Simplify policy reader.\n  TOMOYO: Remove redundant markers.\n  SELinux: define audit permissions for audit tree netlink messages\n  TOMOYO: Remove unused mutex.\n  tomoyo: avoid get+put of task_struct\n  smack: Remove redundant initialization.\n  integrity: nfsd imbalance bug fix\n  rootplug: Remove redundant initialization.\n  smack: do not beyond ARRAY_SIZE of data\n  integrity: move ima_counts_get\n  integrity: path_check update\n  IMA: Add __init notation to ima functions\n  IMA: Minimal IMA policy and boot param for TCB IMA policy\n  selinux: remove obsolete read buffer limit from sel_read_bool\n  ...\n"
    },
    {
      "commit": "6470c077cae12227318f40f3e6d756caadcce4b0",
      "tree": "c8a543bccd29dfcf7d4bbb104a4786da0c93cf56",
      "parents": [
        "c9d9ac525a0285a5b5ad9c3f9aa8b7c1753e6121"
      ],
      "author": {
        "name": "Roel Kluin",
        "email": "roel.kluin@gmail.com",
        "time": "Thu May 21 18:42:54 2009 +0200"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Fri May 22 12:34:48 2009 +1000"
      },
      "message": "smack: do not beyond ARRAY_SIZE of data\n\nDo not go beyond ARRAY_SIZE of data\n\nSigned-off-by: Roel Kluin \u003croel.kluin@gmail.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "05725f7eb4b8acb147c5fc7b91397b1f6bcab00d",
      "tree": "1f22c6bec3429f7ec9ebb8acd25672249e39b380",
      "parents": [
        "72c6a9870f901045f2464c3dc6ee8914bfdc07aa"
      ],
      "author": {
        "name": "Jiri Pirko",
        "email": "jpirko@redhat.com",
        "time": "Tue Apr 14 20:17:16 2009 +0200"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@elte.hu",
        "time": "Wed Apr 15 12:05:25 2009 +0200"
      },
      "message": "rculist: use list_entry_rcu in places where it\u0027s appropriate\n\nUse previously introduced list_entry_rcu instead of an open-coded\nlist_entry + rcu_dereference combination.\n\nSigned-off-by: Jiri Pirko \u003cjpirko@redhat.com\u003e\nReviewed-by: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nCc: dipankar@in.ibm.com\nLKML-Reference: \u003c20090414181715.GA3634@psychotron.englab.brq.redhat.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n"
    },
    {
      "commit": "ecfcc53fef3c357574bb6143dce6631e6d56295c",
      "tree": "d7bee04b64c5ad2ba0ed273bff2c8c7c98b3eee5",
      "parents": [
        "6e837fb152410e571a81aaadbd9884f0bc46a55e"
      ],
      "author": {
        "name": "Etienne Basset",
        "email": "etienne.basset@numericable.fr",
        "time": "Wed Apr 08 20:40:06 2009 +0200"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Tue Apr 14 09:00:23 2009 +1000"
      },
      "message": "smack: implement logging V3\n\nthe following patch, add logging of Smack security decisions.\nThis is of course very useful to understand what your current smack policy does.\nAs suggested by Casey, it also now forbids labels with \u0027, \" or \\\n\nIt introduces a \u0027/smack/logging\u0027 switch :\n0: no logging\n1: log denied (default)\n2: log accepted\n3: log denied\u0026accepted\n\nSigned-off-by: Etienne Basset \u003cetienne.basset@numericable.fr\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nAcked-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "4303154e86597885bc3cbc178a48ccbc8213875f",
      "tree": "11989bcc2ec5d9cd5a1b7952f169ec5cbd8abb8e",
      "parents": [
        "07feee8f812f7327a46186f7604df312c8c81962"
      ],
      "author": {
        "name": "Etienne Basset",
        "email": "etienne.basset@numericable.fr",
        "time": "Fri Mar 27 17:11:01 2009 -0400"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Sat Mar 28 15:01:37 2009 +1100"
      },
      "message": "smack: Add a new \u0027-CIPSO\u0027 option to the network address label configuration\n\nThis patch adds a new special option \u0027-CIPSO\u0027 to the Smack subsystem. When used\nin the netlabel list, it means \"use CIPSO networking\". A use case is when your\nlocal network speaks CIPSO and you want also to connect to the unlabeled\nInternet. This patch also add some documentation describing that. The patch\nalso corrects an oops when setting a \u0027\u0027 SMACK64 xattr to a file.\n\nSigned-off-by: Etienne Basset \u003cetienne.basset@numericable.fr\u003e\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "7198e2eeb44b3fe7cc97f997824002da47a9c644",
      "tree": "4989ad0f9727ac4b861189217760517aa8beea43",
      "parents": [
        "703a3cd72817e99201cef84a8a7aecc60b2b3581"
      ],
      "author": {
        "name": "Etienne Basset",
        "email": "etienne.basset@numericable.fr",
        "time": "Tue Mar 24 20:53:24 2009 +0100"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Thu Mar 26 09:17:04 2009 +1100"
      },
      "message": "smack: convert smack to standard linux lists\n\nthe following patch (on top of 2.6.29) converts Smack lists to standard linux lists\nPlease review and consider for inclusion in 2.6.30-rc\n\nregards,\nEtienne\n\nSigned-off-by: Etienne Basset \u003cetienne.basset@numericable.fr\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "113a0e4590881ce579ca992a80ddc562b3372ede",
      "tree": "29dd1cd1c5f594efb51cdf9530a90ba2f3f2854e",
      "parents": [
        "454804ab0302b354e35d992d08e53fe03313baaf"
      ],
      "author": {
        "name": "etienne",
        "email": "etienne.basset@numericable.fr",
        "time": "Wed Mar 04 07:33:51 2009 +0100"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Thu Mar 05 08:30:01 2009 +1100"
      },
      "message": "smack: fixes for unlabeled host support\n\nThe following patch (against 2.6.29rc5) fixes a few issues in the\nsmack/netlabel \"unlabeled host support\" functionnality that was added in\n2.6.29rc.  It should go in before -final.\n\n1) smack_host_label disregard a \"0.0.0.0/0 @\" rule (or other label),\npreventing \u0027tagged\u0027 tasks to access Internet (many systems drop packets with\nIP options)\n\n2) netmasks were not handled correctly, they were stored in a way _not\nequivalent_ to conversion to be32 (it was equivalent for /0, /8, /16, /24,\n/32 masks but not other masks)\n\n3) smack_netlbladdr prefixes (IP/mask) were not consistent (mask\u0026IP was not\ndone), so there could have been different list entries for the same IP\nprefix; if those entries had different labels, well ...\n\n4) they were not sorted\n\n1) 2) 3) are bugs, 4) is a more cosmetic issue.\nThe patch :\n\n-creates a new helper smk_netlbladdr_insert to insert a smk_netlbladdr,\n-sorted by netmask length\n\n-use the new sorted nature of  smack_netlbladdrs list to simplify\n smack_host_label : the first match _will_ be the more specific\n\n-corrects endianness issues in smk_write_netlbladdr \u0026  netlbladdr_seq_show\n\nSigned-off-by: \u003cetienne.basset@numericable.fr\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nReviewed-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "251a2a958b0455d11b711aeeb57cabad66259461",
      "tree": "6e89b9a3f79c4a46573682044188c7d4692f0cb5",
      "parents": [
        "e5a3b95f581da62e2054ef79d3be2d383e9ed664"
      ],
      "author": {
        "name": "Randy Dunlap",
        "email": "randy.dunlap@oracle.com",
        "time": "Wed Feb 18 11:42:33 2009 -0800"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Thu Feb 19 15:51:10 2009 +1100"
      },
      "message": "smack: fix lots of kernel-doc notation\n\nFix/add kernel-doc notation and fix typos in security/smack/.\n\nSigned-off-by: Randy Dunlap \u003crandy.dunlap@oracle.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "152a649b647a8ef47bb74ff9e11850fa6001bedc",
      "tree": "ea626697e2cbf07f1cba973158b99125e98344ae",
      "parents": [
        "e4a7ca29039e615ce13a61b9c6abfb2aa394e9a1"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Tue Jan 27 19:56:30 2009 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Jan 27 20:13:32 2009 -0800"
      },
      "message": "smackfs load append mode fix\n\nGiven just how hard it is to find the code that uses MAY_APPEND\nit\u0027s probably not a big surprise that this went unnoticed for so\nlong. The Smack rules loading code is incorrectly setting the\nMAY_READ bit when MAY_APPEND is requested.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nReviewed-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "c19a28e1193a6c854738d609ae9b2fe2f6e6bea4",
      "tree": "79a354f827a5d3656be3f55d18d31265750d9d06",
      "parents": [
        "f15659628b43b27c20447c731456c39cbec973e9"
      ],
      "author": {
        "name": "Fernando Carrijo",
        "email": "fcarrijo@yahoo.com.br",
        "time": "Wed Jan 07 18:09:08 2009 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jan 08 08:31:14 2009 -0800"
      },
      "message": "remove lots of double-semicolons\n\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nAcked-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nAcked-by: Mark Fasheh \u003cmfasheh@suse.com\u003e\nAcked-by: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nAcked-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "6d3dc07cbb1e88deed2e8710e215f232a56b1dce",
      "tree": "4c294d1ddac8c9f417bcd406771993aa58106f6d",
      "parents": [
        "277d342fc423fca5e66e677fe629d1b2f8f1b9e2"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Wed Dec 31 12:54:12 2008 -0500"
      },
      "committer": {
        "name": "Paul Moore",
        "email": "paul.moore@hp.com",
        "time": "Wed Dec 31 12:54:12 2008 -0500"
      },
      "message": "smack: Add support for unlabeled network hosts and networks\n\nAdd support for unlabeled network hosts and networks.\nRelies heavily on Paul Moore\u0027s netlabel support.\n\nCreates a new entry in /smack called netlabel. Writes to /smack/netlabel\ntake the form:\n\n    A.B.C.D LABEL\nor\n    A.B.C.D/N LABEL\n\nwhere A.B.C.D is a network address, N is an integer between 0-32,\nand LABEL is the Smack label to be used. If /N is omitted /32 is\nassumed. N designates the netmask for the address. Entries are\nmatched by the most specific address/mask pair. 0.0.0.0/0 will\nmatch everything, while 192.168.1.117/32 will match exactly one\nhost.\n\nA new system label \"@\", pronounced \"web\", is defined. Processes\ncan not be assigned the web label. An address assigned the web\nlabel can be written to by any process, and packets coming from\na web address can be written to any socket. Use of the web label\nis a violation of any strict MAC policy, but the web label has\nbeen requested many times.\n\nThe nltype entry has been removed from /smack. It did not work right\nand the netlabel interface can be used to specify that all hosts\nbe treated as unlabeled.\n\nCIPSO labels on incoming packets will be honored, even from designated\nsingle label hosts. Single label hosts can only be written to by\nprocesses with labels that can write to the label of the host.\nPackets sent to single label hosts will always be unlabeled.\n\nOnce added a single label designation cannot be removed, however\nthe label may be changed.\n\nThe behavior of the ambient label remains unchanged.\n\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\n"
    },
    {
      "commit": "6c2e8ac0953fccdd24dc6c4b9e08e8f1cd68cf07",
      "tree": "c52e242ec5e5c2d131af2d9dbb038f78f724a74c",
      "parents": [
        "6a94cb73064c952255336cc57731904174b2c58f"
      ],
      "author": {
        "name": "Paul Moore",
        "email": "paul.moore@hp.com",
        "time": "Wed Dec 31 12:54:11 2008 -0500"
      },
      "committer": {
        "name": "Paul Moore",
        "email": "paul.moore@hp.com",
        "time": "Wed Dec 31 12:54:11 2008 -0500"
      },
      "message": "netlabel: Update kernel configuration API\n\nUpdate the NetLabel kernel API to expose the new features added in kernel\nreleases 2.6.25 and 2.6.28: the static/fallback label functionality and network\naddress based selectors.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\n"
    },
    {
      "commit": "81ea714bf148fce35e931edcbdfd3aedda20d1dc",
      "tree": "e3cabfd2ce35bc8be542910bffc4b9b99288a7f4",
      "parents": [
        "74192246910ff4fb95309ba1a683215644beeb62"
      ],
      "author": {
        "name": "Sergio Luis",
        "email": "sergio@larces.uece.br",
        "time": "Mon Dec 22 01:16:15 2008 -0300"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Thu Dec 25 12:14:55 2008 +1100"
      },
      "message": "smackfs: check for allocation failures in smk_set_access()\n\nsmackfs: check for allocation failures in smk_set_access()\n\n While adding a new subject/object pair to smack_list, smk_set_access()\n didn\u0027t check the return of kzalloc().\n\n This patch changes smk_set_access() to return 0 or -ENOMEM, based on\n kzalloc()\u0027s return. It also updates its caller, smk_write_load(), to\n check for smk_set_access()\u0027s return, given it is no longer a void\n return function.\n\n Signed-off-by: Sergio Luis \u003csergio@larces.uece.br\u003e\n To: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n Cc: Ahmed S. Darwish \u003cdarwish.07@gmail.com\u003e\n Cc: LSM \u003clinux-security-module@vger.kernel.org\u003e\n Cc: LKLM \u003clinux-kernel@vger.kernel.org\u003e\n\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "86a264abe542cfececb4df129bc45a0338d8cdb9",
      "tree": "30152f04ba847f311028d5ca697f864c16c7ebb3",
      "parents": [
        "f1752eec6145c97163dbce62d17cf5d928e28a27"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Fri Nov 14 10:39:18 2008 +1100"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Fri Nov 14 10:39:18 2008 +1100"
      },
      "message": "CRED: Wrap current-\u003ecred and a few other accessors\n\nWrap current-\u003ecred and a few other accessors to hide their actual\nimplementation.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "b6dff3ec5e116e3af6f537d4caedcad6b9e5082a",
      "tree": "9e76f972eb7ce9b84e0146c8e4126a3f86acb428",
      "parents": [
        "15a2460ed0af7538ca8e6c610fe607a2cd9da142"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Fri Nov 14 10:39:16 2008 +1100"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Fri Nov 14 10:39:16 2008 +1100"
      },
      "message": "CRED: Separate task security context from task_struct\n\nSeparate the task security context from task_struct.  At this point, the\nsecurity data is temporarily embedded in the task_struct with two pointers\npointing to it.\n\nNote that the Alpha arch is altered as it refers to (E)UID and (E)GID in\nentry.S via asm-offsets.\n\nWith comment fixes Signed-off-by: Marc Dionne \u003cmarc.c.dionne@gmail.com\u003e\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "0da939b0058742ad2d8580b7db6b966d0fc72252",
      "tree": "47cb109fdf97135191bff5db4e3bfc905136bf8b",
      "parents": [
        "4bdec11f560b8f405a011288a50e65b1a81b3654",
        "d91d40799165b0c84c97e7c71fb8039494ff07dc"
      ],
      "author": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Sat Oct 11 09:26:14 2008 +1100"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Sat Oct 11 09:26:14 2008 +1100"
      },
      "message": "Merge branch \u0027master\u0027 of git://git.infradead.org/users/pcmoore/lblnet-2.6_next into next\n"
    },
    {
      "commit": "b1edeb102397546438ab4624489c6ccd7b410d97",
      "tree": "ce7033f678ffe46ec3f517bb2771b9cbb04d62bb",
      "parents": [
        "a8134296ba9940b5b271d908666e532d34430a3c"
      ],
      "author": {
        "name": "Paul Moore",
        "email": "paul.moore@hp.com",
        "time": "Fri Oct 10 10:16:31 2008 -0400"
      },
      "committer": {
        "name": "Paul Moore",
        "email": "paul.moore@hp.com",
        "time": "Fri Oct 10 10:16:31 2008 -0400"
      },
      "message": "netlabel: Replace protocol/NetLabel linking with refrerence counts\n\nNetLabel has always had a list of backpointers in the CIPSO DOI definition\nstructure which pointed to the NetLabel LSM domain mapping structures which\nreferenced the CIPSO DOI struct.  The rationale for this was that when an\nadministrator removed a CIPSO DOI from the system all of the associated\nNetLabel LSM domain mappings should be removed as well; a list of\nbackpointers made this a simple operation.\n\nUnfortunately, while the backpointers did make the removal easier they were\na bit of a mess from an implementation point of view which was making\nfurther development difficult.  Since the removal of a CIPSO DOI is a\nrealtively rare event it seems to make sense to remove this backpointer\nlist as the optimization was hurting us more then it was helping.  However,\nwe still need to be able to track when a CIPSO DOI definition is being used\nso replace the backpointer list with a reference count.  In order to\npreserve the current functionality of removing the associated LSM domain\nmappings when a CIPSO DOI is removed we walk the LSM domain mapping table,\nremoving the relevant entries.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nReviewed-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "15446235367fa4a621ff5abfa4b6ebbe25b33763",
      "tree": "bc6823055afbef26560c63f8041caeadd4cef078",
      "parents": [
        "cf9481e289247fe9cf40f2e2481220d899132049"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Wed Jul 30 15:37:11 2008 -0700"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Tue Aug 05 10:55:53 2008 +1000"
      },
      "message": "smack: limit privilege by label\n\nThere have been a number of requests to make the Smack LSM\nenforce MAC even in the face of privilege, either capability\nbased or superuser based. This is not universally desired,\nhowever, so it seems desirable to make it optional. Further,\nat least one legacy OS implemented a scheme whereby only\nprocesses running with one particular label could be exempt\nfrom MAC. This patch supports these three cases.\n\nIf /smack/onlycap is empty (unset or null-string) privilege\nis enforced in the normal way.\n\nIf /smack/onlycap contains a label only processes running with\nthat label may be MAC exempt.\n\nIf the label in /smack/onlycap is the star label (\"*\") the\nsemantics of the star label combine with the privilege\nrestrictions to prevent any violations of MAC, even in the\npresence of privilege.\n\nAgain, this will be independent of the privilege scheme.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nReviewed-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "9781db7b345b5dfe93787aaaf310c861db7c1ede",
      "tree": "d9796e29fd914ca04835636be95bbd5082a034fd",
      "parents": [
        "97094dcf5cefc8ccfdf93839f54dac2c4d316165",
        "8b67dca9420474623709e00d72a066068a502b20"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Apr 29 11:41:22 2008 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Apr 29 11:41:22 2008 -0700"
      },
      "message": "Merge branch \u0027audit.b50\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current\n\n* \u0027audit.b50\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current:\n  [PATCH] new predicate - AUDIT_FILETYPE\n  [patch 2/2] Use find_task_by_vpid in audit code\n  [patch 1/2] audit: let userspace fully control TTY input auditing\n  [PATCH 2/2] audit: fix sparse shadowed variable warnings\n  [PATCH 1/2] audit: move extern declarations to audit.h\n  Audit: MAINTAINERS update\n  Audit: increase the maximum length of the key field\n  Audit: standardize string audit interfaces\n  Audit: stop deadlock from signals under load\n  Audit: save audit_backlog_limit audit messages in case auditd comes back\n  Audit: collect sessionid in netlink messages\n  Audit: end printk with newline\n"
    },
    {
      "commit": "30aa4faf62b2dd9b239ae06ca7a85f1d36d7ef25",
      "tree": "37eb2c4fa1195f668d1d3a16653bdc93da5f5e6b",
      "parents": [
        "55d00ccfb336b4f85a476a24e18c17b2eaff919e"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Mon Apr 28 02:13:43 2008 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Mon Apr 28 08:58:27 2008 -0700"
      },
      "message": "smack: make smk_cipso_doi() and smk_unlbl_ambient()\n\nThe functions smk_cipso_doi and smk_unlbl_ambient are not used outside\nsmackfs.c and should hence be static.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "2532386f480eefbdd67b48be55fb4fb3e5a6081c",
      "tree": "dd6a5a3c4116a67380a1336319c16632f04f80f9",
      "parents": [
        "436c405c7d19455a71f42c9bec5fd5e028f1eb4e"
      ],
      "author": {
        "name": "Eric Paris",
        "email": "eparis@redhat.com",
        "time": "Fri Apr 18 10:09:25 2008 -0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Apr 28 06:18:03 2008 -0400"
      },
      "message": "Audit: collect sessionid in netlink messages\n\nPreviously I added sessionid output to all audit messages where it was\navailable but we still didn\u0027t know the sessionid of the sender of\nnetlink messages.  This patch adds that information to netlink messages\nso we can audit who sent netlink messages.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "076c54c5bcaed2081c0cba94a6f77c4d470236ad",
      "tree": "5e8f05cab20a49922618bb3af697a6b46e610eee",
      "parents": [
        "04305e4aff8b0533dc05f9f6f1a34d0796bd985f"
      ],
      "author": {
        "name": "Ahmed S. Darwish",
        "email": "darwish.07@gmail.com",
        "time": "Thu Mar 06 18:09:10 2008 +0200"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Sat Apr 19 10:00:51 2008 +1000"
      },
      "message": "Security: Introduce security\u003d boot parameter\n\nAdd the security\u003d boot parameter. This is done to avoid LSM\nregistration clashes in case of more than one bult-in module.\n\nUser can choose a security module to enable at boot. If no\nsecurity\u003d boot parameter is specified, only the first LSM\nasking for registration will be loaded. An invalid security\nmodule name will be treated as if no module has been chosen.\n\nLSM modules must check now if they are allowed to register\nby calling security_module_enable(ops) first. Modify SELinux\nand SMACK to do so.\n\nDo not let SMACK register smackfs if it was not chosen on\nboot. Smackfs assumes that smack hooks are registered and\nthe initial task security setup (swapper-\u003esecurity) is done.\n\nSigned-off-by: Ahmed S. Darwish \u003cdarwish.07@gmail.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "cb622bbb69e41f2746aadf5d7d527e77597abe2e",
      "tree": "537a1ce6f76bd915bf9acd197d6bf4d042063998",
      "parents": [
        "58336114af4d2cce830201aae49e50b93ede6c5c"
      ],
      "author": {
        "name": "Ahmed S. Darwish",
        "email": "darwish.07@gmail.com",
        "time": "Mon Mar 24 12:29:49 2008 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Mon Mar 24 19:22:19 2008 -0700"
      },
      "message": "smackfs: remove redundant lock, fix open(,O_RDWR)\n\nOlder smackfs was parsing MAC rules by characters, thus a need of locking\nwrite sessions on open() was needed.  This lock is no longer useful now since\neach rule is handled by a single write() call.\n\nThis is also a bugfix since seq_open() was not called if an open() O_RDWR flag\nwas given, leading to a seq_read() without an initialized seq_file, thus an\nOops.\n\nSigned-off-by: Ahmed S. Darwish \u003cdarwish.07@gmail.com\u003e\nReported-by: Jonathan Corbet \u003ccorbet@lwn.net\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "b500ce8d24d1f14426643da5f6fada28c1f60533",
      "tree": "17b6084b29434a968f787e238548a843126e2ec3",
      "parents": [
        "93d74463d018ddf05c169ad399e62e90e0f82fc0"
      ],
      "author": {
        "name": "Ahmed S. Darwish",
        "email": "darwish.07@gmail.com",
        "time": "Thu Mar 13 12:32:34 2008 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 13 13:11:43 2008 -0700"
      },
      "message": "smackfs: do not trust `count\u0027 in inodes write()s\n\nSmackfs write() implementation does not put a higher bound on the number of\nbytes to copy from user-space.  This may lead to a DOS attack if a malicious\n`count\u0027 field is given.\n\nAssure that given `count\u0027 is exactly the length needed for a /smack/load rule.\n In case of /smack/cipso where the length is relative, assure that `count\u0027\ndoes not exceed the size needed for a buffer representing maximum possible\nnumber of CIPSO 2.2 categories.\n\nSigned-off-by: Ahmed S. Darwish \u003cdarwish.07@gmail.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "4bc87e62775052aac0be7574d5f84ff06f61c6b4",
      "tree": "23063e82de8f7b7506d795919d7d4c13725e74a0",
      "parents": [
        "9a4c8546f3e7c893888bccc2b3416d6214f2664a"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Fri Feb 15 15:24:25 2008 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@woody.linux-foundation.org",
        "time": "Tue Feb 19 07:51:00 2008 -0800"
      },
      "message": "Smack: unlabeled outgoing ambient packets\n\nSmack uses CIPSO labeling, but allows for unlabeled packets by\nspecifying an \"ambient\" label that is applied to incoming unlabeled\npackets.\n\nBecause the other end of the connection may dislike IP options, and ssh\nis one know application that behaves thus, it is prudent to respond in\nkind.\n\nThis patch changes the network labeling behavior such that an outgoing\npacket that would be given a CIPSO label that matches the ambient label\nis left unlabeled.  An \"unlbl\" domain is added and the netlabel\ndefaulting mechanism invoked rather than assuming that everything is\nCIPSO.  Locking has been added around changes to the ambient label as\nthe mechanisms used to do so are more involved.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nAcked-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
      "tree": "933b840f3ccac6860da56291c742094f9b5a20cb",
      "parents": [
        "eda61d32e8ad1d9102872f9a0abf3344bf9c5e67"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Mon Feb 04 22:29:50 2008 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@woody.linux-foundation.org",
        "time": "Tue Feb 05 09:44:20 2008 -0800"
      },
      "message": "Smack: Simplified Mandatory Access Control Kernel\n\nSmack is the Simplified Mandatory Access Control Kernel.\n\nSmack implements mandatory access control (MAC) using labels\nattached to tasks and data containers, including files, SVIPC,\nand other tasks. Smack is a kernel based scheme that requires\nan absolute minimum of application support and a very small\namount of configuration data.\n\nSmack uses extended attributes and\nprovides a set of general mount options, borrowing technics used\nelsewhere. Smack uses netlabel for CIPSO labeling. Smack provides\na pseudo-filesystem smackfs that is used for manipulation of\nsystem Smack attributes.\n\nThe patch, patches for ls and sshd, a README, a startup script,\nand x86 binaries for ls and sshd are also available on\n\n    http://www.schaufler-ca.com\n\nDevelopment has been done using Fedora Core 7 in a virtual machine\nenvironment and on an old Sony laptop.\n\nSmack provides mandatory access controls based on the label attached\nto a task and the label attached to the object it is attempting to\naccess. Smack labels are deliberately short (1-23 characters) text\nstrings. Single character labels using special characters are reserved\nfor system use. The only operation applied to Smack labels is equality\ncomparison. No wildcards or expressions, regular or otherwise, are\nused. Smack labels are composed of printable characters and may not\ninclude \"/\".\n\nA file always gets the Smack label of the task that created it.\n\nSmack defines and uses these labels:\n\n    \"*\" - pronounced \"star\"\n    \"_\" - pronounced \"floor\"\n    \"^\" - pronounced \"hat\"\n    \"?\" - pronounced \"huh\"\n\nThe access rules enforced by Smack are, in order:\n\n1. Any access requested by a task labeled \"*\" is denied.\n2. A read or execute access requested by a task labeled \"^\"\n   is permitted.\n3. A read or execute access requested on an object labeled \"_\"\n   is permitted.\n4. Any access requested on an object labeled \"*\" is permitted.\n5. Any access requested by a task on an object with the same\n   label is permitted.\n6. Any access requested that is explicitly defined in the loaded\n   rule set is permitted.\n7. Any other access is denied.\n\nRules may be explicitly defined by writing subject,object,access\ntriples to /smack/load.\n\nSmack rule sets can be easily defined that describe Bell\u0026LaPadula\nsensitivity, Biba integrity, and a variety of interesting\nconfigurations. Smack rule sets can be modified on the fly to\naccommodate changes in the operating environment or even the time\nof day.\n\nSome practical use cases:\n\nHierarchical levels. The less common of the two usual uses\nfor MLS systems is to define hierarchical levels, often\nunclassified, confidential, secret, and so on. To set up smack\nto support this, these rules could be defined:\n\n   C        Unclass rx\n   S        C       rx\n   S        Unclass rx\n   TS       S       rx\n   TS       C       rx\n   TS       Unclass rx\n\nA TS process can read S, C, and Unclass data, but cannot write it.\nAn S process can read C and Unclass. Note that specifying that\nTS can read S and S can read C does not imply TS can read C, it\nhas to be explicitly stated.\n\nNon-hierarchical categories. This is the more common of the\nusual uses for an MLS system. Since the default rule is that a\nsubject cannot access an object with a different label no\naccess rules are required to implement compartmentalization.\n\nA case that the Bell \u0026 LaPadula policy does not allow is demonstrated\nwith this Smack access rule:\n\nA case that Bell\u0026LaPadula does not allow that Smack does:\n\n    ESPN    ABC   r\n    ABC     ESPN  r\n\nOn my portable video device I have two applications, one that\nshows ABC programming and the other ESPN programming. ESPN wants\nto show me sport stories that show up as news, and ABC will\nonly provide minimal information about a sports story if ESPN\nis covering it. Each side can look at the other\u0027s info, neither\ncan change the other. Neither can see what FOX is up to, which\nis just as well all things considered.\n\nAnother case that I especially like:\n\n    SatData Guard   w\n    Guard   Publish w\n\nA program running with the Guard label opens a UDP socket and\naccepts messages sent by a program running with a SatData label.\nThe Guard program inspects the message to ensure it is wholesome\nand if it is sends it to a program running with the Publish label.\nThis program then puts the information passed in an appropriate\nplace. Note that the Guard program cannot write to a Publish\nfile system object because file system semanitic require read as\nwell as write.\n\nThe four cases (categories, levels, mutual read, guardbox) here\nare all quite real, and problems I\u0027ve been asked to solve over\nthe years. The first two are easy to do with traditonal MLS systems\nwhile the last two you can\u0027t without invoking privilege, at least\nfor a while.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nCc: Joshua Brindle \u003cmethod@manicmethod.com\u003e\nCc: Paul Moore \u003cpaul.moore@hp.com\u003e\nCc: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nCc: Chris Wright \u003cchrisw@sous-sol.org\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: \"Ahmed S. Darwish\" \u003cdarwish.07@gmail.com\u003e\nCc: Andrew G. Morgan \u003cmorgan@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    }
  ]
}