)]}' { "log": [ { "commit": "e7b0a61b7929632d36cf052d9e2820ef0a9c1bfe", "tree": "69dbe6f03abc5a9ef0dea3a2c28921cebcc59a08", "parents": [ "96be753af91fc9d582450a84722f6a6721d218ad" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@linux.vnet.ibm.com", "time": "Mon Feb 22 17:04:56 2010 -0800" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Thu Feb 25 10:34:52 2010 +0100" }, "message": "security: Apply lockdep-based checking to rcu_dereference() uses\n\nApply lockdep-ified RCU primitives to key_gc_keyring() and\nkeyring_destroy().\n\nCc: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nCc: laijs@cn.fujitsu.com\nCc: dipankar@in.ibm.com\nCc: mathieu.desnoyers@polymtl.ca\nCc: josh@joshtriplett.org\nCc: dvhltc@us.ibm.com\nCc: niv@us.ibm.com\nCc: peterz@infradead.org\nCc: rostedt@goodmis.org\nCc: Valdis.Kletnieks@vt.edu\nCc: dhowells@redhat.com\nLKML-Reference: \u003c1266887105-1528-12-git-send-email-paulmck@linux.vnet.ibm.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "a00ae4d21b2fa9379914f270ffffd8d3bec55430", "tree": "81950b31b2bbd816e5ad119acba46d859de9aceb", "parents": [ "6e1415467614e854fee660ff6648bd10fa976e95" ], "author": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Sun Dec 13 20:21:34 2009 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Thu Dec 17 09:27:59 2009 +1100" }, "message": "Keys: KEYCTL_SESSION_TO_PARENT needs TIF_NOTIFY_RESUME architecture support\n\nAs of commit ee18d64c1f632043a02e6f5ba5e045bb26a5465f (\"KEYS: Add a keyctl to\ninstall a process\u0027s session keyring on its parent [try #6]\"), CONFIG_KEYS\u003dy\nfails to build on architectures that haven\u0027t implemented TIF_NOTIFY_RESUME yet:\n\nsecurity/keys/keyctl.c: In function \u0027keyctl_session_to_parent\u0027:\nsecurity/keys/keyctl.c:1312: error: \u0027TIF_NOTIFY_RESUME\u0027 undeclared (first use in this function)\nsecurity/keys/keyctl.c:1312: error: (Each undeclared identifier is reported only once\nsecurity/keys/keyctl.c:1312: error: for each function it appears in.)\n\nMake KEYCTL_SESSION_TO_PARENT depend on TIF_NOTIFY_RESUME until\nm68k, and xtensa have implemented it.\n\nSigned-off-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Mike Frysinger \u003cvapier@gentoo.org\u003e\n" }, { "commit": "fa1cc7b5a5c4171dfdcac855428295340ccf87ec", "tree": "eccd00dd480c980a45159e3964038cee255ff9f8", "parents": [ "d4220f987cf473c65a342ca69e3eb13dea919a49" ], "author": { "name": "Roel Kluin", "email": "roel.kluin@gmail.com", "time": "Tue Dec 15 15:05:12 2009 -0800" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Thu Dec 17 09:23:48 2009 +1100" }, "message": "keys: PTR_ERR return of wrong pointer in keyctl_get_security()\n\nReturn the PTR_ERR of the correct pointer.\n\nSigned-off-by: Roel Kluin \u003croel.kluin@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "6d4561110a3e9fa742aeec6717248a491dfb1878", "tree": "689e2abf19940416ce597ba56ed31026ff59bd21", "parents": [ "86926d0096279b9739ceeff40f68d3c33b9119a9" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Mon Nov 16 03:11:48 2009 -0800" }, "committer": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Wed Nov 18 08:37:40 2009 -0800" }, "message": "sysctl: Drop \u0026 in front of every proc_handler.\n\nFor consistency drop \u0026 in front of every proc_handler. Explicity\ntaking the address is unnecessary and it prevents optimizations\nlike stubbing the proc_handlers to NULL.\n\nCc: Alexey Dobriyan \u003cadobriyan@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Joe Perches \u003cjoe@perches.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n" }, { "commit": "5cdb35557d022f8dc51b532b5cd1a8e9ed7bcdb7", "tree": "f2d947dd3d0302b23ef7dc515f0ff4841e5a5b87", "parents": [ "56992309ccbe71f4321ddd50ee2f76f91b412c1a" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Fri Apr 03 05:08:03 2009 -0700" }, "committer": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Thu Nov 12 02:04:56 2009 -0800" }, "message": "sysctl security/keys: Remove dead binary sysctl support\n\nNow that sys_sysctl is a generic wrapper around /proc/sys .ctl_name\nand .strategy members of sysctl tables are dead code. Remove them.\n\nCc: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n" }, { "commit": "21279cfa107af07ef985539ac0de2152b9cba5f5", "tree": "a31f1447e0246316c00b26fb599c1595301bb4b5", "parents": [ "37a08b13eba6ce3b42df30b2a5ca3a9845f429ec" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Oct 15 10:14:35 2009 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 15 15:19:58 2009 -0700" }, "message": "KEYS: get_instantiation_keyring() should inc the keyring refcount in all cases\n\nThe destination keyring specified to request_key() and co. is made available to\nthe process that instantiates the key (the slave process started by\n/sbin/request-key typically). This is passed in the request_key_auth struct as\nthe dest_keyring member.\n\nkeyctl_instantiate_key and keyctl_negate_key() call get_instantiation_keyring()\nto get the keyring to attach the newly constructed key to at the end of\ninstantiation. This may be given a specific keyring into which a link will be\nmade later, or it may be asked to find the keyring passed to request_key(). In\nthe former case, it returns a keyring with the refcount incremented by\nlookup_user_key(); in the latter case, it returns the keyring from the\nrequest_key_auth struct - and does _not_ increment the refcount.\n\nThe latter case will eventually result in an oops when the keyring prematurely\nruns out of references and gets destroyed. The effect may take some time to\nshow up as the key is destroyed lazily.\n\nTo fix this, the keyring returned by get_instantiation_keyring() must always\nhave its refcount incremented, no matter where it comes from.\n\nThis can be tested by setting /etc/request-key.conf to:\n\n#OP\tTYPE\tDESCRIPTION\tCALLOUT INFO\tPROGRAM ARG1 ARG2 ARG3 ...\n#\u003d\u003d\u003d\u003d\u003d\u003d\t\u003d\u003d\u003d\u003d\u003d\u003d\u003d\t\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\t\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\t\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ncreate *\ttest:*\t\t*\t\t|/bin/false %u %g %d %{user:_display}\nnegate\t*\t*\t\t*\t\t/bin/keyctl negate %k 10 @u\n\nand then doing:\n\n\tkeyctl add user _display aaaaaaaa @u\n while keyctl request2 user test:x test:x @u \u0026\u0026\n keyctl list @u;\n do\n keyctl request2 user test:x test:x @u;\n sleep 31;\n keyctl list @u;\n done\n\nwhich will oops eventually. Changing the negate line to have @u rather than\n%S at the end is important as that forces the latter case by passing a special\nkeyring ID rather than an actual keyring ID.\n\nReported-by: Alexander Zangerl \u003caz@bond.edu.au\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nTested-by: Alexander Zangerl \u003caz@bond.edu.au\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "606531c316d30e9639473a6da09ee917125ab467", "tree": "b83f3d8d82597401bdee6a451facaa5c2de006d1", "parents": [ "0afd9056f1b43c9fcbfdf933b263d72023d382fe" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Sep 16 15:54:14 2009 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Wed Sep 23 11:03:47 2009 -0700" }, "message": "KEYS: Have the garbage collector set its timer for live expired keys\n\nThe key garbage collector sets a timer to start a new collection cycle at the\npoint the earliest key to expire should be considered garbage. However, it\ncurrently only does this if the key it is considering hasn\u0027t yet expired.\n\nIf the key being considering has expired, but hasn\u0027t yet reached the collection\ntime then it is ignored, and won\u0027t be collected until some other key provokes a\nround of collection.\n\nMake the garbage collector set the timer for the earliest key that hasn\u0027t yet\npassed its collection time, rather than the earliest key that hasn\u0027t yet\nexpired.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "c08ef808ef24df32e25fbd949fe5310172f3c408", "tree": "12bae6fd48e1cdcc1b792c221376c727d9472cc6", "parents": [ "5c84342a3e147a23752276650340801c237d0e56" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Mon Sep 14 17:26:13 2009 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Tue Sep 15 09:11:02 2009 +1000" }, "message": "KEYS: Fix garbage collector\n\nFix a number of problems with the new key garbage collector:\n\n (1) A rogue semicolon in keyring_gc() was causing the initial count of dead\n keys to be miscalculated.\n\n (2) A missing return in keyring_gc() meant that under certain circumstances,\n the keyring semaphore would be unlocked twice.\n\n (3) The key serial tree iterator (key_garbage_collector()) part of the garbage\n collector has been modified to:\n\n (a) Complete each scan of the keyrings before setting the new timer.\n\n (b) Only set the new timer for keys that have yet to expire. This means\n that the new timer is now calculated correctly, and the gc doesn\u0027t\n get into a loop continually scanning for keys that have expired, and\n preventing other things from happening, like RCU cleaning up the old\n keyring contents.\n\n (c) Perform an extra scan if any keys were garbage collected in this one\n \t as a key might become garbage during a scan, and (b) could mean we\n \t don\u0027t set the timer again.\n\n (4) Made key_schedule_gc() take the time at which to do a collection run,\n rather than the time at which the key expires. This means the collection\n of dead keys (key type unregistered) can happen immediately.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "5c84342a3e147a23752276650340801c237d0e56", "tree": "a57a81dd9b48f8bd837ab13e319375c248cc7b89", "parents": [ "4a5d6ba1914d1bf1fcfb5e15834c29d84a879219" ], "author": { "name": "Marc Dionne", "email": "marc.c.dionne@gmail.com", "time": "Mon Sep 14 12:46:23 2009 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Tue Sep 15 09:10:59 2009 +1000" }, "message": "KEYS: Unlock tasklist when exiting early from keyctl_session_to_parent\n\nWhen we exit early from keyctl_session_to_parent because of permissions or\nbecause the session keyring is the same as the parent, we need to unlock the\ntasklist.\n\nThe missing unlock causes the system to hang completely when using\nkeyctl(KEYCTL_SESSION_TO_PARENT) with a keyring shared with the parent.\n\nSigned-off-by: Marc Dionne \u003cmarc.c.dionne@gmail.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "ee18d64c1f632043a02e6f5ba5e045bb26a5465f", "tree": "80b5a4d530ec7d5fd69799920f0db7b78aba6b9d", "parents": [ "d0420c83f39f79afb82010c2d2cafd150eef651b" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Sep 02 09:14:21 2009 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Wed Sep 02 21:29:22 2009 +1000" }, "message": "KEYS: Add a keyctl to install a process\u0027s session keyring on its parent [try #6]\n\nAdd a keyctl to install a process\u0027s session keyring onto its parent. This\nreplaces the parent\u0027s session keyring. Because the COW credential code does\nnot permit one process to change another process\u0027s credentials directly, the\nchange is deferred until userspace next starts executing again. Normally this\nwill be after a wait*() syscall.\n\nTo support this, three new security hooks have been provided:\ncred_alloc_blank() to allocate unset security creds, cred_transfer() to fill in\nthe blank security creds and key_session_to_parent() - which asks the LSM if\nthe process may replace its parent\u0027s session keyring.\n\nThe replacement may only happen if the process has the same ownership details\nas its parent, and the process has LINK permission on the session keyring, and\nthe session keyring is owned by the process, and the LSM permits it.\n\nNote that this requires alteration to each architecture\u0027s notify_resume path.\nThis has been done for all arches barring blackfin, m68k* and xtensa, all of\nwhich need assembly alteration to support TIF_NOTIFY_RESUME. This allows the\nreplacement to be performed at the point the parent process resumes userspace\nexecution.\n\nThis allows the userspace AFS pioctl emulation to fully emulate newpag() and\nthe VIOCSETTOK and VIOCSETTOK2 pioctls, all of which require the ability to\nalter the parent process\u0027s PAG membership. However, since kAFS doesn\u0027t use\nPAGs per se, but rather dumps the keys into the session keyring, the session\nkeyring of the parent must be replaced if, for example, VIOCSETTOK is passed\nthe newpag flag.\n\nThis can be tested with the following program:\n\n\t#include \u003cstdio.h\u003e\n\t#include \u003cstdlib.h\u003e\n\t#include \u003ckeyutils.h\u003e\n\n\t#define KEYCTL_SESSION_TO_PARENT\t18\n\n\t#define OSERROR(X, S) do { if ((long)(X) \u003d\u003d -1) { perror(S); exit(1); } } while(0)\n\n\tint main(int argc, char **argv)\n\t{\n\t\tkey_serial_t keyring, key;\n\t\tlong ret;\n\n\t\tkeyring \u003d keyctl_join_session_keyring(argv[1]);\n\t\tOSERROR(keyring, \"keyctl_join_session_keyring\");\n\n\t\tkey \u003d add_key(\"user\", \"a\", \"b\", 1, keyring);\n\t\tOSERROR(key, \"add_key\");\n\n\t\tret \u003d keyctl(KEYCTL_SESSION_TO_PARENT);\n\t\tOSERROR(ret, \"KEYCTL_SESSION_TO_PARENT\");\n\n\t\treturn 0;\n\t}\n\nCompiled and linked with -lkeyutils, you should see something like:\n\n\t[dhowells@andromeda ~]$ keyctl show\n\tSession Keyring\n\t -3 --alswrv 4043 4043 keyring: _ses\n\t355907932 --alswrv 4043 -1 \\_ keyring: _uid.4043\n\t[dhowells@andromeda ~]$ /tmp/newpag\n\t[dhowells@andromeda ~]$ keyctl show\n\tSession Keyring\n\t -3 --alswrv 4043 4043 keyring: _ses\n\t1055658746 --alswrv 4043 4043 \\_ user: a\n\t[dhowells@andromeda ~]$ /tmp/newpag hello\n\t[dhowells@andromeda ~]$ keyctl show\n\tSession Keyring\n\t -3 --alswrv 4043 4043 keyring: hello\n\t340417692 --alswrv 4043 4043 \\_ user: a\n\nWhere the test program creates a new session keyring, sticks a user key named\n\u0027a\u0027 into it and then installs it on its parent.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "7b1b9164598286fe93927ff41eed2a2609fd9056", "tree": "b37a8f4991c5aa6416e269f4edd7317dacc2c67c", "parents": [ "ad73a717e0fc6949c44e587ca5d63c273a30e6f5" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Sep 02 09:14:11 2009 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Wed Sep 02 21:29:16 2009 +1000" }, "message": "KEYS: Do some whitespace cleanups [try #6]\n\nDo some whitespace cleanups in the key management code.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "ad73a717e0fc6949c44e587ca5d63c273a30e6f5", "tree": "28aa8de2eb924a60713abd01bbc790879da5b70c", "parents": [ "5d135440faf7db8d566de0c6fab36b16cf9cfc3b" ], "author": { "name": "Serge E. Hallyn", "email": "serue@us.ibm.com", "time": "Wed Sep 02 09:14:05 2009 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Wed Sep 02 21:29:14 2009 +1000" }, "message": "KEYS: Make /proc/keys use keyid not numread as file position [try #6]\n\nMake the file position maintained by /proc/keys represent the ID of the key\njust read rather than the number of keys read. This should make it faster to\nperform a lookup as we don\u0027t have to scan the key ID tree from the beginning to\nfind the current position.\n\nSigned-off-by: Serge E. Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "5d135440faf7db8d566de0c6fab36b16cf9cfc3b", "tree": "d9c022e73ed51dfe5729fde9a97150cb64b68196", "parents": [ "f041ae2f99d49adc914153a34a2d0e14e4389d90" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Sep 02 09:14:00 2009 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Wed Sep 02 21:29:11 2009 +1000" }, "message": "KEYS: Add garbage collection for dead, revoked and expired keys. [try #6]\n\nAdd garbage collection for dead, revoked and expired keys. This involved\nerasing all links to such keys from keyrings that point to them. At that\npoint, the key will be deleted in the normal manner.\n\nKeyrings from which garbage collection occurs are shrunk and their quota\nconsumption reduced as appropriate.\n\nDead keys (for which the key type has been removed) will be garbage collected\nimmediately.\n\nRevoked and expired keys will hang around for a number of seconds, as set in\n/proc/sys/kernel/keys/gc_delay before being automatically removed. The default\nis 5 minutes.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "f041ae2f99d49adc914153a34a2d0e14e4389d90", "tree": "02cf0a1e85920122e1059496942b979e5832ff1b", "parents": [ "0c2c9a3fc77e8b60d43d9bd2ca46eb4dddb0ff76" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Sep 02 09:13:55 2009 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Wed Sep 02 21:29:09 2009 +1000" }, "message": "KEYS: Flag dead keys to induce EKEYREVOKED [try #6]\n\nSet the KEY_FLAG_DEAD flag on keys for which the type has been removed. This\ncauses the key_permission() function to return EKEYREVOKED in response to\nvarious commands. It does not, however, prevent unlinking or clearing of\nkeyrings from detaching the key.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "0c2c9a3fc77e8b60d43d9bd2ca46eb4dddb0ff76", "tree": "e718aa64ab3b5d4fd73f7a837ee9ea0debfcc773", "parents": [ "5593122eec26b061cc0b6fbff32118f1aadf4a27" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Sep 02 09:13:50 2009 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Wed Sep 02 21:29:06 2009 +1000" }, "message": "KEYS: Allow keyctl_revoke() on keys that have SETATTR but not WRITE perm [try #6]\n\nAllow keyctl_revoke() to operate on keys that have SETATTR but not WRITE\npermission, rather than only on keys that have WRITE permission.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "5593122eec26b061cc0b6fbff32118f1aadf4a27", "tree": "f148b182ada54b722962607567bd5b1ace06640a", "parents": [ "e0e817392b9acf2c98d3be80c233dddb1b52003d" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Sep 02 09:13:45 2009 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Wed Sep 02 21:29:04 2009 +1000" }, "message": "KEYS: Deal with dead-type keys appropriately [try #6]\n\nAllow keys for which the key type has been removed to be unlinked. Currently\ndead-type keys can only be disposed of by completely clearing the keyrings\nthat point to them.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "5bb459bb45d1ad3c177485dcf0af01580aa31125", "tree": "fd6d11d424d222b97f56d8b870bdecbacaab8a17", "parents": [ "d2e3ee9b29f5de5b01e611b04e6fb29760589b01" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Fri Jul 10 03:48:23 2009 +0200" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Jul 17 09:10:42 2009 +1000" }, "message": "kernel: rename is_single_threaded(task) to current_is_single_threaded(void)\n\n- is_single_threaded(task) is not safe unless task \u003d\u003d current,\n we can\u0027t use task-\u003esignal or task-\u003emm.\n\n- it doesn\u0027t make sense unless task \u003d\u003d current, the task can\n fork right after the check.\n\nRename it to current_is_single_threaded() and kill the argument.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "86abcf9cebf7b5ceb33facde297face5ec4d2260", "tree": "1b71608a4c025882f82a952d56d0f546d461736b", "parents": [ "20dda18be9035c487c2e9534e4d18d2a1e1deade" ], "author": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Thu Jun 18 22:00:05 2009 +1000" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Thu Jun 25 00:09:12 2009 +1000" }, "message": "keys: annotate seqfile ops with __releases and __acquires\n\nAnnotate seqfile ops with __releases and __acquires to stop sparse\ncomplaining about unbalanced locking.\n\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\nReviewed-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\n" }, { "commit": "34574dd10b6d0697b86703388d6d6af9cbf4bb48", "tree": "89eb52c0777687d4704d3ab3a370c50c1fe9479c", "parents": [ "11ff5f6affe9b75f115a900a5584db339d46002b" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Apr 09 17:14:05 2009 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 10:41:19 2009 -0700" }, "message": "keys: Handle there being no fallback destination keyring for request_key()\n\nWhen request_key() is called, without there being any standard process\nkeyrings on which to fall back if a destination keyring is not specified, an\noops is liable to occur when construct_alloc_key() calls down_write() on\ndest_keyring\u0027s semaphore.\n\nDue to function inlining this may be seen as an oops in down_write() as called\nfrom request_key_and_link().\n\nThis situation crops up during boot, where request_key() is called from within\nthe kernel (such as in CIFS mounts) where nobody is actually logged in, and so\nPAM has not had a chance to create a session keyring and user keyrings to act\nas the fallback.\n\nTo fix this, make construct_alloc_key() not attempt to cache a key if there is\nno fallback key if no destination keyring is given specifically.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nTested-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "454804ab0302b354e35d992d08e53fe03313baaf", "tree": "e01a4928e19ac2e8318bc88d0b79970cccc60665", "parents": [ "2ea190d0a006ce5218baa6e798512652446a605a" ], "author": { "name": "Serge E. Hallyn", "email": "serue@us.ibm.com", "time": "Thu Feb 26 18:28:04 2009 -0600" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Feb 27 12:35:15 2009 +1100" }, "message": "keys: make procfiles per-user-namespace\n\nRestrict the /proc/keys and /proc/key-users output to keys\nbelonging to the same user namespace as the reading task.\n\nWe may want to make this more complicated - so that any\nkeys in a user-namespace which is belongs to the reading\ntask are also shown. But let\u0027s see if anyone wants that\nfirst.\n\nSigned-off-by: Serge E. Hallyn \u003cserue@us.ibm.com\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "2ea190d0a006ce5218baa6e798512652446a605a", "tree": "1d8612678355c77d8ea9f316ef6ce7d80ee6d613", "parents": [ "8ff3bc3138a400294ee9e126ac75fc9a9fae4e0b" ], "author": { "name": "Serge E. Hallyn", "email": "serue@us.ibm.com", "time": "Thu Feb 26 18:27:55 2009 -0600" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Feb 27 12:35:12 2009 +1100" }, "message": "keys: skip keys from another user namespace\n\nWhen listing keys, do not return keys belonging to the\nsame uid in another user namespace. Otherwise uid 500\nin another user namespace will return keyrings called\nuid.500 for another user namespace.\n\nSigned-off-by: Serge E. Hallyn \u003cserue@us.ibm.com\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "8ff3bc3138a400294ee9e126ac75fc9a9fae4e0b", "tree": "f1e2f21f17268cb9a88446da2f1ced9dbccd5138", "parents": [ "1d1e97562e5e2ac60fb7b25437ba619f95f67fab" ], "author": { "name": "Serge E. Hallyn", "email": "serue@us.ibm.com", "time": "Thu Feb 26 18:27:47 2009 -0600" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Feb 27 12:35:09 2009 +1100" }, "message": "keys: consider user namespace in key_permission\n\nIf a key is owned by another user namespace, then treat the\nkey as though it is owned by both another uid and gid.\n\nSigned-off-by: Serge E. Hallyn \u003cserue@us.ibm.com\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "1d1e97562e5e2ac60fb7b25437ba619f95f67fab", "tree": "68a9c52ecbff0782dd9b9438685afc3b40b6f707", "parents": [ "be38e0fd5f90a91d09e0a85ffb294b70a7be6259" ], "author": { "name": "Serge E. Hallyn", "email": "serue@us.ibm.com", "time": "Thu Feb 26 18:27:38 2009 -0600" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Feb 27 12:35:06 2009 +1100" }, "message": "keys: distinguish per-uid keys in different namespaces\n\nper-uid keys were looked by uid only. Use the user namespace\nto distinguish the same uid in different namespaces.\n\nThis does not address key_permission. So a task can for instance\ntry to join a keyring owned by the same uid in another namespace.\nThat will be handled by a separate patch.\n\nSigned-off-by: Serge E. Hallyn \u003cserue@us.ibm.com\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "0d54ee1c7850a954026deec4cd4885f331da35cc", "tree": "00f5219a49428dabca10428cbeaaa2c44e774808", "parents": [ "1de9e8e70f5acc441550ca75433563d91b269bbe" ], "author": { "name": "Vegard Nossum", "email": "vegard.nossum@gmail.com", "time": "Sat Jan 17 17:45:45 2009 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 17 14:24:46 2009 -0800" }, "message": "security: introduce missing kfree\n\nPlug this leak.\n\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Vegard Nossum \u003cvegard.nossum@gmail.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "938bb9f5e840eddbf54e4f62f6c5ba9b3ae12c9d", "tree": "a25324159ed8cc96b97a4d39aaf228bbd07e3824", "parents": [ "1e7bfb2134dfec37ce04fb3a4ca89299e892d10c" ], "author": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Wed Jan 14 14:14:30 2009 +0100" }, "committer": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Wed Jan 14 14:15:30 2009 +0100" }, "message": "[CVE-2009-0029] System call wrappers part 28\n\nSigned-off-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\n" }, { "commit": "1e7bfb2134dfec37ce04fb3a4ca89299e892d10c", "tree": "99c676262e696754dcbfb2d6f59499972cd0c38c", "parents": [ "c4ea37c26a691ad0b7e86aa5884aab27830e95c9" ], "author": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Wed Jan 14 14:14:29 2009 +0100" }, "committer": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Wed Jan 14 14:15:29 2009 +0100" }, "message": "[CVE-2009-0029] System call wrappers part 27\n\nSigned-off-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\n" }, { "commit": "90bd49ab6649269cd10d0edc86d0e0f62864726a", "tree": "504e95359f2e021ae1ba4c53a1000dd08ad63c55", "parents": [ "6a94cb73064c952255336cc57731904174b2c58f" ], "author": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Mon Dec 29 14:35:35 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Thu Jan 01 10:32:44 2009 +1100" }, "message": "keys: fix sparse warning by adding __user annotation to cast\n\nFix the following sparse warning:\n\n CC security/keys/key.o\n security/keys/keyctl.c:1297:10: warning: incorrect type in argument 2 (different address spaces)\n security/keys/keyctl.c:1297:10: expected char [noderef] \u003casn:1\u003e*buffer\n security/keys/keyctl.c:1297:10: got char *\u003cnoident\u003e\n\nwhich appears to be caused by lack of __user annotation to the cast of\na syscall argument.\n\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\n" }, { "commit": "eca1bf5b4fab56d2feb1572d34d59fcd92ea7df3", "tree": "58ce85049625d01d52f3b32a6035bce9dbbc4ebf", "parents": [ "3c92ec8ae91ecf59d88c798301833d7cf83f2179" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Mon Dec 29 00:41:51 2008 +0000" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Mon Dec 29 14:24:43 2008 +1100" }, "message": "KEYS: Fix variable uninitialisation warnings\n\nFix variable uninitialisation warnings introduced in:\n\n\tcommit 8bbf4976b59fc9fc2861e79cab7beb3f6d647640\n\tAuthor: David Howells \u003cdhowells@redhat.com\u003e\n\tDate: Fri Nov 14 10:39:14 2008 +1100\n\n\tKEYS: Alter use of key instantiation link-to-keyring argument\n\nAs:\n\n security/keys/keyctl.c: In function \u0027keyctl_negate_key\u0027:\n security/keys/keyctl.c:976: warning: \u0027dest_keyring\u0027 may be used uninitialized in this function\n security/keys/keyctl.c: In function \u0027keyctl_instantiate_key\u0027:\n security/keys/keyctl.c:898: warning: \u0027dest_keyring\u0027 may be used uninitialized in this function\n\nSome versions of gcc notice that get_instantiation_key() doesn\u0027t always set\n*_dest_keyring, but fail to observe that if this happens then *_dest_keyring\nwill not be read by the caller.\n\nReported-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "a6f76f23d297f70e2a6b3ec607f7aeeea9e37e8d", "tree": "8f95617996d0974507f176163459212a7def8b9a", "parents": [ "d84f4f992cbd76e8f39c488cf0c5d123843923b1" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 14 10:39:24 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Nov 14 10:39:24 2008 +1100" }, "message": "CRED: Make execve() take advantage of copy-on-write credentials\n\nMake execve() take advantage of copy-on-write credentials, allowing it to set\nup the credentials in advance, and then commit the whole lot after the point\nof no return.\n\nThis patch and the preceding patches have been tested with the LTP SELinux\ntestsuite.\n\nThis patch makes several logical sets of alteration:\n\n (1) execve().\n\n The credential bits from struct linux_binprm are, for the most part,\n replaced with a single credentials pointer (bprm-\u003ecred). This means that\n all the creds can be calculated in advance and then applied at the point\n of no return with no possibility of failure.\n\n I would like to replace bprm-\u003ecap_effective with:\n\n\tcap_isclear(bprm-\u003ecap_effective)\n\n but this seems impossible due to special behaviour for processes of pid 1\n (they always retain their parent\u0027s capability masks where normally they\u0027d\n be changed - see cap_bprm_set_creds()).\n\n The following sequence of events now happens:\n\n (a) At the start of do_execve, the current task\u0027s cred_exec_mutex is\n \t locked to prevent PTRACE_ATTACH from obsoleting the calculation of\n \t creds that we make.\n\n (a) prepare_exec_creds() is then called to make a copy of the current\n \t task\u0027s credentials and prepare it. This copy is then assigned to\n \t bprm-\u003ecred.\n\n \t This renders security_bprm_alloc() and security_bprm_free()\n \t unnecessary, and so they\u0027ve been removed.\n\n (b) The determination of unsafe execution is now performed immediately\n \t after (a) rather than later on in the code. The result is stored in\n \t bprm-\u003eunsafe for future reference.\n\n (c) prepare_binprm() is called, possibly multiple times.\n\n \t (i) This applies the result of set[ug]id binaries to the new creds\n \t attached to bprm-\u003ecred. Personality bit clearance is recorded,\n \t but now deferred on the basis that the exec procedure may yet\n \t fail.\n\n (ii) This then calls the new security_bprm_set_creds(). This should\n\t calculate the new LSM and capability credentials into *bprm-\u003ecred.\n\n\t This folds together security_bprm_set() and parts of\n\t security_bprm_apply_creds() (these two have been removed).\n\t Anything that might fail must be done at this point.\n\n (iii) bprm-\u003ecred_prepared is set to 1.\n\n\t bprm-\u003ecred_prepared is 0 on the first pass of the security\n\t calculations, and 1 on all subsequent passes. This allows SELinux\n\t in (ii) to base its calculations only on the initial script and\n\t not on the interpreter.\n\n (d) flush_old_exec() is called to commit the task to execution. This\n \t performs the following steps with regard to credentials:\n\n\t (i) Clear pdeath_signal and set dumpable on certain circumstances that\n\t may not be covered by commit_creds().\n\n (ii) Clear any bits in current-\u003epersonality that were deferred from\n (c.i).\n\n (e) install_exec_creds() [compute_creds() as was] is called to install the\n \t new credentials. This performs the following steps with regard to\n \t credentials:\n\n (i) Calls security_bprm_committing_creds() to apply any security\n requirements, such as flushing unauthorised files in SELinux, that\n must be done before the credentials are changed.\n\n\t This is made up of bits of security_bprm_apply_creds() and\n\t security_bprm_post_apply_creds(), both of which have been removed.\n\t This function is not allowed to fail; anything that might fail\n\t must have been done in (c.ii).\n\n (ii) Calls commit_creds() to apply the new credentials in a single\n assignment (more or less). Possibly pdeath_signal and dumpable\n should be part of struct creds.\n\n\t (iii) Unlocks the task\u0027s cred_replace_mutex, thus allowing\n\t PTRACE_ATTACH to take place.\n\n (iv) Clears The bprm-\u003ecred pointer as the credentials it was holding\n are now immutable.\n\n (v) Calls security_bprm_committed_creds() to apply any security\n alterations that must be done after the creds have been changed.\n SELinux uses this to flush signals and signal handlers.\n\n (f) If an error occurs before (d.i), bprm_free() will call abort_creds()\n \t to destroy the proposed new credentials and will then unlock\n \t cred_replace_mutex. No changes to the credentials will have been\n \t made.\n\n (2) LSM interface.\n\n A number of functions have been changed, added or removed:\n\n (*) security_bprm_alloc(), -\u003ebprm_alloc_security()\n (*) security_bprm_free(), -\u003ebprm_free_security()\n\n \t Removed in favour of preparing new credentials and modifying those.\n\n (*) security_bprm_apply_creds(), -\u003ebprm_apply_creds()\n (*) security_bprm_post_apply_creds(), -\u003ebprm_post_apply_creds()\n\n \t Removed; split between security_bprm_set_creds(),\n \t security_bprm_committing_creds() and security_bprm_committed_creds().\n\n (*) security_bprm_set(), -\u003ebprm_set_security()\n\n \t Removed; folded into security_bprm_set_creds().\n\n (*) security_bprm_set_creds(), -\u003ebprm_set_creds()\n\n \t New. The new credentials in bprm-\u003ecreds should be checked and set up\n \t as appropriate. bprm-\u003ecred_prepared is 0 on the first call, 1 on the\n \t second and subsequent calls.\n\n (*) security_bprm_committing_creds(), -\u003ebprm_committing_creds()\n (*) security_bprm_committed_creds(), -\u003ebprm_committed_creds()\n\n \t New. Apply the security effects of the new credentials. This\n \t includes closing unauthorised files in SELinux. This function may not\n \t fail. When the former is called, the creds haven\u0027t yet been applied\n \t to the process; when the latter is called, they have.\n\n \t The former may access bprm-\u003ecred, the latter may not.\n\n (3) SELinux.\n\n SELinux has a number of changes, in addition to those to support the LSM\n interface changes mentioned above:\n\n (a) The bprm_security_struct struct has been removed in favour of using\n \t the credentials-under-construction approach.\n\n (c) flush_unauthorized_files() now takes a cred pointer and passes it on\n \t to inode_has_perm(), file_has_perm() and dentry_open().\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "d84f4f992cbd76e8f39c488cf0c5d123843923b1", "tree": "fc4a0349c42995715b93d0f7a3c78e9ea9b3f36e", "parents": [ "745ca2475a6ac596e3d8d37c2759c0fbe2586227" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 14 10:39:23 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Nov 14 10:39:23 2008 +1100" }, "message": "CRED: Inaugurate COW credentials\n\nInaugurate copy-on-write credentials management. This uses RCU to manage the\ncredentials pointer in the task_struct with respect to accesses by other tasks.\nA process may only modify its own credentials, and so does not need locking to\naccess or modify its own credentials.\n\nA mutex (cred_replace_mutex) is added to the task_struct to control the effect\nof PTRACE_ATTACHED on credential calculations, particularly with respect to\nexecve().\n\nWith this patch, the contents of an active credentials struct may not be\nchanged directly; rather a new set of credentials must be prepared, modified\nand committed using something like the following sequence of events:\n\n\tstruct cred *new \u003d prepare_creds();\n\tint ret \u003d blah(new);\n\tif (ret \u003c 0) {\n\t\tabort_creds(new);\n\t\treturn ret;\n\t}\n\treturn commit_creds(new);\n\nThere are some exceptions to this rule: the keyrings pointed to by the active\ncredentials may be instantiated - keyrings violate the COW rule as managing\nCOW keyrings is tricky, given that it is possible for a task to directly alter\nthe keys in a keyring in use by another task.\n\nTo help enforce this, various pointers to sets of credentials, such as those in\nthe task_struct, are declared const. The purpose of this is compile-time\ndiscouragement of altering credentials through those pointers. Once a set of\ncredentials has been made public through one of these pointers, it may not be\nmodified, except under special circumstances:\n\n (1) Its reference count may incremented and decremented.\n\n (2) The keyrings to which it points may be modified, but not replaced.\n\nThe only safe way to modify anything else is to create a replacement and commit\nusing the functions described in Documentation/credentials.txt (which will be\nadded by a later patch).\n\nThis patch and the preceding patches have been tested with the LTP SELinux\ntestsuite.\n\nThis patch makes several logical sets of alteration:\n\n (1) execve().\n\n This now prepares and commits credentials in various places in the\n security code rather than altering the current creds directly.\n\n (2) Temporary credential overrides.\n\n do_coredump() and sys_faccessat() now prepare their own credentials and\n temporarily override the ones currently on the acting thread, whilst\n preventing interference from other threads by holding cred_replace_mutex\n on the thread being dumped.\n\n This will be replaced in a future patch by something that hands down the\n credentials directly to the functions being called, rather than altering\n the task\u0027s objective credentials.\n\n (3) LSM interface.\n\n A number of functions have been changed, added or removed:\n\n (*) security_capset_check(), -\u003ecapset_check()\n (*) security_capset_set(), -\u003ecapset_set()\n\n \t Removed in favour of security_capset().\n\n (*) security_capset(), -\u003ecapset()\n\n \t New. This is passed a pointer to the new creds, a pointer to the old\n \t creds and the proposed capability sets. It should fill in the new\n \t creds or return an error. All pointers, barring the pointer to the\n \t new creds, are now const.\n\n (*) security_bprm_apply_creds(), -\u003ebprm_apply_creds()\n\n \t Changed; now returns a value, which will cause the process to be\n \t killed if it\u0027s an error.\n\n (*) security_task_alloc(), -\u003etask_alloc_security()\n\n \t Removed in favour of security_prepare_creds().\n\n (*) security_cred_free(), -\u003ecred_free()\n\n \t New. Free security data attached to cred-\u003esecurity.\n\n (*) security_prepare_creds(), -\u003ecred_prepare()\n\n \t New. Duplicate any security data attached to cred-\u003esecurity.\n\n (*) security_commit_creds(), -\u003ecred_commit()\n\n \t New. Apply any security effects for the upcoming installation of new\n \t security by commit_creds().\n\n (*) security_task_post_setuid(), -\u003etask_post_setuid()\n\n \t Removed in favour of security_task_fix_setuid().\n\n (*) security_task_fix_setuid(), -\u003etask_fix_setuid()\n\n \t Fix up the proposed new credentials for setuid(). This is used by\n \t cap_set_fix_setuid() to implicitly adjust capabilities in line with\n \t setuid() changes. Changes are made to the new credentials, rather\n \t than the task itself as in security_task_post_setuid().\n\n (*) security_task_reparent_to_init(), -\u003etask_reparent_to_init()\n\n \t Removed. Instead the task being reparented to init is referred\n \t directly to init\u0027s credentials.\n\n\t NOTE! This results in the loss of some state: SELinux\u0027s osid no\n\t longer records the sid of the thread that forked it.\n\n (*) security_key_alloc(), -\u003ekey_alloc()\n (*) security_key_permission(), -\u003ekey_permission()\n\n \t Changed. These now take cred pointers rather than task pointers to\n \t refer to the security context.\n\n (4) sys_capset().\n\n This has been simplified and uses less locking. The LSM functions it\n calls have been merged.\n\n (5) reparent_to_kthreadd().\n\n This gives the current thread the same credentials as init by simply using\n commit_thread() to point that way.\n\n (6) __sigqueue_alloc() and switch_uid()\n\n __sigqueue_alloc() can\u0027t stop the target task from changing its creds\n beneath it, so this function gets a reference to the currently applicable\n user_struct which it then passes into the sigqueue struct it returns if\n successful.\n\n switch_uid() is now called from commit_creds(), and possibly should be\n folded into that. commit_creds() should take care of protecting\n __sigqueue_alloc().\n\n (7) [sg]et[ug]id() and co and [sg]et_current_groups.\n\n The set functions now all use prepare_creds(), commit_creds() and\n abort_creds() to build and check a new set of credentials before applying\n it.\n\n security_task_set[ug]id() is called inside the prepared section. This\n guarantees that nothing else will affect the creds until we\u0027ve finished.\n\n The calling of set_dumpable() has been moved into commit_creds().\n\n Much of the functionality of set_user() has been moved into\n commit_creds().\n\n The get functions all simply access the data directly.\n\n (8) security_task_prctl() and cap_task_prctl().\n\n security_task_prctl() has been modified to return -ENOSYS if it doesn\u0027t\n want to handle a function, or otherwise return the return value directly\n rather than through an argument.\n\n Additionally, cap_task_prctl() now prepares a new set of credentials, even\n if it doesn\u0027t end up using it.\n\n (9) Keyrings.\n\n A number of changes have been made to the keyrings code:\n\n (a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have\n \t all been dropped and built in to the credentials functions directly.\n \t They may want separating out again later.\n\n (b) key_alloc() and search_process_keyrings() now take a cred pointer\n \t rather than a task pointer to specify the security context.\n\n (c) copy_creds() gives a new thread within the same thread group a new\n \t thread keyring if its parent had one, otherwise it discards the thread\n \t keyring.\n\n (d) The authorisation key now points directly to the credentials to extend\n \t the search into rather pointing to the task that carries them.\n\n (e) Installing thread, process or session keyrings causes a new set of\n \t credentials to be created, even though it\u0027s not strictly necessary for\n \t process or session keyrings (they\u0027re shared).\n\n(10) Usermode helper.\n\n The usermode helper code now carries a cred struct pointer in its\n subprocess_info struct instead of a new session keyring pointer. This set\n of credentials is derived from init_cred and installed on the new process\n after it has been cloned.\n\n call_usermodehelper_setup() allocates the new credentials and\n call_usermodehelper_freeinfo() discards them if they haven\u0027t been used. A\n special cred function (prepare_usermodeinfo_creds()) is provided\n specifically for call_usermodehelper_setup() to call.\n\n call_usermodehelper_setkeys() adjusts the credentials to sport the\n supplied keyring as the new session keyring.\n\n(11) SELinux.\n\n SELinux has a number of changes, in addition to those to support the LSM\n interface changes mentioned above:\n\n (a) selinux_setprocattr() no longer does its check for whether the\n \t current ptracer can access processes with the new SID inside the lock\n \t that covers getting the ptracer\u0027s SID. Whilst this lock ensures that\n \t the check is done with the ptracer pinned, the result is only valid\n \t until the lock is released, so there\u0027s no point doing it inside the\n \t lock.\n\n(12) is_single_threaded().\n\n This function has been extracted from selinux_setprocattr() and put into\n a file of its own in the lib/ directory as join_session_keyring() now\n wants to use it too.\n\n The code in SELinux just checked to see whether a task shared mm_structs\n with other tasks (CLONE_VM), but that isn\u0027t good enough. We really want\n to know if they\u0027re part of the same thread group (CLONE_THREAD).\n\n(13) nfsd.\n\n The NFS server daemon now has to use the COW credentials to set the\n credentials it is going to use. It really needs to pass the credentials\n down to the functions it calls, but it can\u0027t do that until other patches\n in this series have been applied.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "bb952bb98a7e479262c7eb25d5592545a3af147d", "tree": "9a2158c07a22a5fbddcec412944d2e7534eecc8f", "parents": [ "275bb41e9d058fbb327e7642f077e1beaeac162e" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 14 10:39:20 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Nov 14 10:39:20 2008 +1100" }, "message": "CRED: Separate per-task-group keyrings from signal_struct\n\nSeparate per-task-group keyrings from signal_struct and dangle their anchor\nfrom the cred struct rather than the signal_struct.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "c69e8d9c01db2adc503464993c358901c9af9de4", "tree": "bed94aaa9aeb7a7834d1c880f72b62a11a752c78", "parents": [ "86a264abe542cfececb4df129bc45a0338d8cdb9" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 14 10:39:19 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Nov 14 10:39:19 2008 +1100" }, "message": "CRED: Use RCU to access another task\u0027s creds and to release a task\u0027s own creds\n\nUse RCU to access another task\u0027s creds and to release a task\u0027s own creds.\nThis means that it will be possible for the credentials of a task to be\nreplaced without another task (a) requiring a full lock to read them, and (b)\nseeing deallocated memory.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "86a264abe542cfececb4df129bc45a0338d8cdb9", "tree": "30152f04ba847f311028d5ca697f864c16c7ebb3", "parents": [ "f1752eec6145c97163dbce62d17cf5d928e28a27" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 14 10:39:18 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Nov 14 10:39:18 2008 +1100" }, "message": "CRED: Wrap current-\u003ecred and a few other accessors\n\nWrap current-\u003ecred and a few other accessors to hide their actual\nimplementation.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "b6dff3ec5e116e3af6f537d4caedcad6b9e5082a", "tree": "9e76f972eb7ce9b84e0146c8e4126a3f86acb428", "parents": [ "15a2460ed0af7538ca8e6c610fe607a2cd9da142" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 14 10:39:16 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Nov 14 10:39:16 2008 +1100" }, "message": "CRED: Separate task security context from task_struct\n\nSeparate the task security context from task_struct. At this point, the\nsecurity data is temporarily embedded in the task_struct with two pointers\npointing to it.\n\nNote that the Alpha arch is altered as it refers to (E)UID and (E)GID in\nentry.S via asm-offsets.\n\nWith comment fixes Signed-off-by: Marc Dionne \u003cmarc.c.dionne@gmail.com\u003e\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "8bbf4976b59fc9fc2861e79cab7beb3f6d647640", "tree": "9bd621217cbdfcf94aca5b220de7363254d7fc23", "parents": [ "e9e349b051d98799b743ebf248cc2d986fedf090" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 14 10:39:14 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Nov 14 10:39:14 2008 +1100" }, "message": "KEYS: Alter use of key instantiation link-to-keyring argument\n\nAlter the use of the key instantiation and negation functions\u0027 link-to-keyring\narguments. Currently this specifies a keyring in the target process to link\nthe key into, creating the keyring if it doesn\u0027t exist. This, however, can be\na problem for copy-on-write credentials as it means that the instantiating\nprocess can alter the credentials of the requesting process.\n\nThis patch alters the behaviour such that:\n\n (1) If keyctl_instantiate_key() or keyctl_negate_key() are given a specific\n keyring by ID (ringid \u003e\u003d 0), then that keyring will be used.\n\n (2) If keyctl_instantiate_key() or keyctl_negate_key() are given one of the\n special constants that refer to the requesting process\u0027s keyrings\n (KEY_SPEC_*_KEYRING, all \u003c\u003d 0), then:\n\n (a) If sys_request_key() was given a keyring to use (destringid) then the\n \t key will be attached to that keyring.\n\n (b) If sys_request_key() was given a NULL keyring, then the key being\n \t instantiated will be attached to the default keyring as set by\n \t keyctl_set_reqkey_keyring().\n\n (3) No extra link will be made.\n\nDecision point (1) follows current behaviour, and allows those instantiators\nwho\u0027ve searched for a specifically named keyring in the requestor\u0027s keyring so\nas to partition the keys by type to still have their named keyrings.\n\nDecision point (2) allows the requestor to make sure that the key or keys that\nget produced by request_key() go where they want, whilst allowing the\ninstantiator to request that the key is retained. This is mainly useful for\nsituations where the instantiator makes a secondary request, the key for which\nshould be retained by the initial requestor:\n\n\t+-----------+ +--------------+ +--------------+\n\t| | | | | |\n\t| Requestor |-------\u003e| Instantiator |-------\u003e| Instantiator |\n\t| | | | | |\n\t+-----------+ +--------------+ +--------------+\n\t request_key() request_key()\n\nThis might be useful, for example, in Kerberos, where the requestor requests a\nticket, and then the ticket instantiator requests the TGT, which someone else\nthen has to go and fetch. The TGT, however, should be retained in the\nkeyrings of the requestor, not the first instantiator. To make this explict\nan extra special keyring constant is also added.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "e9e349b051d98799b743ebf248cc2d986fedf090", "tree": "d59a46ae39d81d27bcf605663ce0e24d1c6db375", "parents": [ "76aac0e9a17742e60d408be1a706e9aaad370891" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 14 10:39:13 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Nov 14 10:39:13 2008 +1100" }, "message": "KEYS: Disperse linux/key_ui.h\n\nDisperse the bits of linux/key_ui.h as the reason they were put here (keyfs)\ndidn\u0027t get in.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "47d804bfa1857b0edcac972c86499dcd14df3cf2", "tree": "200b2d1190e29be40c771bf6a4e0db0ef9e7d383", "parents": [ "8192b0c482d7078fcdcb4854341b977426f6f09b" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 14 10:39:11 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Nov 14 10:39:11 2008 +1100" }, "message": "CRED: Wrap task credential accesses in the key management code\n\nWrap access to task credentials so that they can be separated more easily from\nthe task_struct during the introduction of COW creds.\n\nChange most current-\u003e(|e|s|fs)[ug]id to current_(|e|s|fs)[ug]id().\n\nChange some task-\u003ee?[ug]id to task_e?[ug]id(). In some places it makes more\nsense to use RCU directly rather than a convenient wrapper; these will be\naddressed by later patches.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "dba6a4d32d8677c99e73798d3375417f8a6d46de", "tree": "1011eef6e948f2db35805c017324648e1eddb61a", "parents": [ "37340746a66e5e7feed5945f28cb75d90a8fd9f6" ], "author": { "name": "Daniel Walker", "email": "dwalker@mvista.com", "time": "Thu Jun 05 22:46:32 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 06 11:29:11 2008 -0700" }, "message": "keys: remove unused key_alloc_sem\n\nThis semaphore doesn\u0027t appear to be used, so remove it.\n\nSigned-off-by: Daniel Walker \u003cdwalker@mvista.com\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "fdb89bce6c9ccb17dae13ec43a25d2fdd405233f", "tree": "1b6c0e38bc194758e7d6ad2cbb509977900591b9", "parents": [ "0b77f5bfb45c13e1e5142374f9d6ca75292252a4" ], "author": { "name": "Robert P. J. Day", "email": "rpjday@crashcourse.ca", "time": "Tue Apr 29 01:01:32 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 29 08:06:17 2008 -0700" }, "message": "keys: explicitly include required slab.h header file.\n\nSince these two source files invoke kmalloc(), they should explicitly\ninclude \u003clinux/slab.h\u003e.\n\nSigned-off-by: Robert P. J. Day \u003crpjday@crashcourse.ca\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "0b77f5bfb45c13e1e5142374f9d6ca75292252a4", "tree": "cf62055536d267e9a4abe6518e5d9f683a1ceb75", "parents": [ "69664cf16af4f31cd54d77948a4baf9c7e0ca7b9" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Apr 29 01:01:32 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 29 08:06:17 2008 -0700" }, "message": "keys: make the keyring quotas controllable through /proc/sys\n\nMake the keyring quotas controllable through /proc/sys files:\n\n (*) /proc/sys/kernel/keys/root_maxkeys\n /proc/sys/kernel/keys/root_maxbytes\n\n Maximum number of keys that root may have and the maximum total number of\n bytes of data that root may have stored in those keys.\n\n (*) /proc/sys/kernel/keys/maxkeys\n /proc/sys/kernel/keys/maxbytes\n\n Maximum number of keys that each non-root user may have and the maximum\n total number of bytes of data that each of those users may have stored in\n their keys.\n\nAlso increase the quotas as a number of people have been complaining that it\u0027s\nnot big enough. I\u0027m not sure that it\u0027s big enough now either, but on the\nother hand, it can now be set in /etc/sysctl.conf.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: \u003ckwc@citi.umich.edu\u003e\nCc: \u003carunsr@cse.iitk.ac.in\u003e\nCc: \u003cdwalsh@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "69664cf16af4f31cd54d77948a4baf9c7e0ca7b9", "tree": "3ff4ecae21c140a2beed25cfa9e55b788f9814ac", "parents": [ "6b79ccb5144f9ffb4d4596c23e7570238dd12abc" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Apr 29 01:01:31 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 29 08:06:17 2008 -0700" }, "message": "keys: don\u0027t generate user and user session keyrings unless they\u0027re accessed\n\nDon\u0027t generate the per-UID user and user session keyrings unless they\u0027re\nexplicitly accessed. This solves a problem during a login process whereby\nset*uid() is called before the SELinux PAM module, resulting in the per-UID\nkeyrings having the wrong security labels.\n\nThis also cures the problem of multiple per-UID keyrings sometimes appearing\ndue to PAM modules (including pam_keyinit) setuiding and causing user_structs\nto come into and go out of existence whilst the session keyring pins the user\nkeyring. This is achieved by first searching for extant per-UID keyrings\nbefore inventing new ones.\n\nThe serial bound argument is also dropped from find_keyring_by_name() as it\u0027s\nnot currently made use of (setting it to 0 disables the feature).\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: \u003ckwc@citi.umich.edu\u003e\nCc: \u003carunsr@cse.iitk.ac.in\u003e\nCc: \u003cdwalsh@redhat.com\u003e\nCc: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: Chris Wright \u003cchrisw@sous-sol.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6b79ccb5144f9ffb4d4596c23e7570238dd12abc", "tree": "e674339e9f86c3607304496792b417b0ed66de6f", "parents": [ "da91d2ef9fe4fd84cc0a8a729201d38e40ac9f2e" ], "author": { "name": "Arun Raghavan", "email": "arunsr@cse.iitk.ac.in", "time": "Tue Apr 29 01:01:28 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 29 08:06:16 2008 -0700" }, "message": "keys: allow clients to set key perms in key_create_or_update()\n\nThe key_create_or_update() function provided by the keyring code has a default\nset of permissions that are always applied to the key when created. This\nmight not be desirable to all clients.\n\nHere\u0027s a patch that adds a \"perm\" parameter to the function to address this,\nwhich can be set to KEY_PERM_UNDEF to revert to the current behaviour.\n\nSigned-off-by: Arun Raghavan \u003carunsr@cse.iitk.ac.in\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: Satyam Sharma \u003cssatyam@cse.iitk.ac.in\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "da91d2ef9fe4fd84cc0a8a729201d38e40ac9f2e", "tree": "091f2781c5256eac28665a1512038fe07227f9b0", "parents": [ "70a5bb72b55e82fbfbf1e22cae6975fac58a1e2d" ], "author": { "name": "Alexey Dobriyan", "email": "adobriyan@sw.ru", "time": "Tue Apr 29 01:01:27 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 29 08:06:16 2008 -0700" }, "message": "keys: switch to proc_create()\n\nSigned-off-by: Alexey Dobriyan \u003cadobriyan@sw.ru\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "70a5bb72b55e82fbfbf1e22cae6975fac58a1e2d", "tree": "8e6dcaf5630388d81b23845f293789f2d6a3596b", "parents": [ "4a38e122e2cc6294779021ff4ccc784a3997059e" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Apr 29 01:01:26 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 29 08:06:16 2008 -0700" }, "message": "keys: add keyctl function to get a security label\n\nAdd a keyctl() function to get the security label of a key.\n\nThe following is added to Documentation/keys.txt:\n\n (*) Get the LSM security context attached to a key.\n\n\tlong keyctl(KEYCTL_GET_SECURITY, key_serial_t key, char *buffer,\n\t\t size_t buflen)\n\n This function returns a string that represents the LSM security context\n attached to a key in the buffer provided.\n\n Unless there\u0027s an error, it always returns the amount of data it could\n produce, even if that\u0027s too big for the buffer, but it won\u0027t copy more\n than requested to userspace. If the buffer pointer is NULL then no copy\n will take place.\n\n A NUL character is included at the end of the string if the buffer is\n sufficiently big. This is included in the returned count. If no LSM is\n in force then an empty string will be returned.\n\n A process must have view permission on the key for this function to be\n successful.\n\n[akpm@linux-foundation.org: declare keyctl_get_security()]\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nCc: Paul Moore \u003cpaul.moore@hp.com\u003e\nCc: Chris Wright \u003cchrisw@sous-sol.org\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: Kevin Coffman \u003ckwc@citi.umich.edu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4a38e122e2cc6294779021ff4ccc784a3997059e", "tree": "84b401b44e0550b04f831d98a91eacfd7cffb51d", "parents": [ "dceba9944181b1fd5993417b5c8fa0e3dda38f8d" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Apr 29 01:01:24 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 29 08:06:16 2008 -0700" }, "message": "keys: allow the callout data to be passed as a blob rather than a string\n\nAllow the callout data to be passed as a blob rather than a string for\ninternal kernel services that call any request_key_*() interface other than\nrequest_key(). request_key() itself still takes a NUL-terminated string.\n\nThe functions that change are:\n\n\trequest_key_with_auxdata()\n\trequest_key_async()\n\trequest_key_async_with_auxdata()\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: Paul Moore \u003cpaul.moore@hp.com\u003e\nCc: Chris Wright \u003cchrisw@sous-sol.org\u003e\nCc: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: Kevin Coffman \u003ckwc@citi.umich.edu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "dceba9944181b1fd5993417b5c8fa0e3dda38f8d", "tree": "697e247a7a99c81af7ba4d7ad5d9cdf9941b3741", "parents": [ "38bbca6b6f164e08a4a9cdfd719fff679af98375" ], "author": { "name": "Kevin Coffman", "email": "kwc@citi.umich.edu", "time": "Tue Apr 29 01:01:22 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 29 08:06:16 2008 -0700" }, "message": "keys: check starting keyring as part of search\n\nCheck the starting keyring as part of the search to (a) see if that is what\nwe\u0027re searching for, and (b) to check it is still valid for searching.\n\nThe scenario: User in process A does things that cause things to be created in\nits process session keyring. The user then does an su to another user and\nstarts a new process, B. The two processes now share the same process session\nkeyring.\n\nProcess B does an NFS access which results in an upcall to gssd. When gssd\nattempts to instantiate the context key (to be linked into the process session\nkeyring), it is denied access even though it has an authorization key.\n\nThe order of calls is:\n\n keyctl_instantiate_key()\n lookup_user_key()\t\t\t\t (the default: case)\n search_process_keyrings(current)\n\t search_process_keyrings(rka-\u003econtext) (recursive call)\n\t keyring_search_aux()\n\nkeyring_search_aux() verifies the keys and keyrings underneath the top-level\nkeyring it is given, but that top-level keyring is neither fully validated nor\nchecked to see if it is the thing being searched for.\n\nThis patch changes keyring_search_aux() to:\n1) do more validation on the top keyring it is given and\n2) check whether that top-level keyring is the thing being searched for\n\nSigned-off-by: Kevin Coffman \u003ckwc@citi.umich.edu\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: Paul Moore \u003cpaul.moore@hp.com\u003e\nCc: Chris Wright \u003cchrisw@sous-sol.org\u003e\nCc: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: Kevin Coffman \u003ckwc@citi.umich.edu\u003e\nCc: Trond Myklebust \u003ctrond.myklebust@fys.uio.no\u003e\nCc: \"J. Bruce Fields\" \u003cbfields@fieldses.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "38bbca6b6f164e08a4a9cdfd719fff679af98375", "tree": "c4d4839e57bbcbae1ecfa7867b810c6203b0d601", "parents": [ "4220b7fe89f8c0623e09168ab81dd0da2fdadd72" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Apr 29 01:01:19 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 29 08:06:16 2008 -0700" }, "message": "keys: increase the payload size when instantiating a key\n\nIncrease the size of a payload that can be used to instantiate a key in\nadd_key() and keyctl_instantiate_key(). This permits huge CIFS SPNEGO blobs\nto be passed around. The limit is raised to 1MB. If kmalloc() can\u0027t allocate\na buffer of sufficient size, vmalloc() will be tried instead.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: Paul Moore \u003cpaul.moore@hp.com\u003e\nCc: Chris Wright \u003cchrisw@sous-sol.org\u003e\nCc: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: Kevin Coffman \u003ckwc@citi.umich.edu\u003e\nCc: Steven French \u003csfrench@us.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "dd6f953adb5c4deb9cd7b6a5054e7d5eafe4ed71", "tree": "0ed459ca8da43b7e0486c8f0a840845a731920bf", "parents": [ "b0c636b99997c8594da6a46e166ce4fcf6956fda" ], "author": { "name": "Harvey Harrison", "email": "harvey.harrison@gmail.com", "time": "Thu Mar 06 10:03:59 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Apr 18 20:26:07 2008 +1000" }, "message": "security: replace remaining __FUNCTION__ occurrences\n\n__FUNCTION__ is gcc-specific, use __func__\n\nSigned-off-by: Harvey Harrison \u003charvey.harrison@gmail.com\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "e231c2ee64eb1c5cd3c63c31da9dac7d888dcf7f", "tree": "d4b17ef65960594681397a3acac02c2d248200b5", "parents": [ "d1bc8e95445224276d7896b8b08cbb0b28a0ca80" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Feb 07 00:15:26 2008 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Thu Feb 07 08:42:26 2008 -0800" }, "message": "Convert ERR_PTR(PTR_ERR(p)) instances to ERR_CAST(p)\n\nConvert instances of ERR_PTR(PTR_ERR(p)) to ERR_CAST(p) using:\n\nperl -spi -e \u0027s/ERR_PTR[(]PTR_ERR[(](.*)[)][)]/ERR_CAST(\\1)/\u0027 `grep -rl \u0027ERR_PTR[(]*PTR_ERR\u0027 fs crypto net security`\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "1996a10948e50e546dc2b64276723c0b64d3173b", "tree": "971b235907b7c6911c21c9139e0ba85c5b84ef80", "parents": [ "63cb34492351078479b2d4bae6a881806a396286" ], "author": { "name": "Jan Engelhardt", "email": "jengelh@computergmbh.de", "time": "Wed Jan 23 00:02:58 2008 +0100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Jan 25 11:29:54 2008 +1100" }, "message": "security/selinux: constify function pointer tables and fields\n\nConstify function pointer tables and fields.\n\nSigned-off-by: Jan Engelhardt \u003cjengelh@computergmbh.de\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "76181c134f87479fa13bf2548ddf2999055d34d4", "tree": "34694341c190e7ecdd3111ee48e4b98602ff012f", "parents": [ "398c95bdf2c24d7866692a40ba04425aef238cdd" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Oct 16 23:29:46 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Wed Oct 17 08:42:57 2007 -0700" }, "message": "KEYS: Make request_key() and co fundamentally asynchronous\n\nMake request_key() and co fundamentally asynchronous to make it easier for\nNFS to make use of them. There are now accessor functions that do\nasynchronous constructions, a wait function to wait for construction to\ncomplete, and a completion function for the key type to indicate completion\nof construction.\n\nNote that the construction queue is now gone. Instead, keys under\nconstruction are linked in to the appropriate keyring in advance, and that\nanyone encountering one must wait for it to be complete before they can use\nit. This is done automatically for userspace.\n\nThe following auxiliary changes are also made:\n\n (1) Key type implementation stuff is split from linux/key.h into\n linux/key-type.h.\n\n (2) AF_RXRPC provides a way to allocate null rxrpc-type keys so that AFS does\n not need to call key_instantiate_and_link() directly.\n\n (3) Adjust the debugging macros so that they\u0027re -Wformat checked even if\n they are disabled, and make it so they can be enabled simply by defining\n __KDEBUG to be consistent with other code of mine.\n\n (3) Documentation.\n\n[alan@lxorguk.ukuu.org.uk: keys: missing word in documentation]\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Alan Cox \u003calan@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "20c2df83d25c6a95affe6157a4c9cac4cf5ffaac", "tree": "415c4453d2b17a50abe7a3e515177e1fa337bd67", "parents": [ "64fb98fc40738ae1a98bcea9ca3145b89fb71524" ], "author": { "name": "Paul Mundt", "email": "lethal@linux-sh.org", "time": "Fri Jul 20 10:11:58 2007 +0900" }, "committer": { "name": "Paul Mundt", "email": "lethal@linux-sh.org", "time": "Fri Jul 20 10:11:58 2007 +0900" }, "message": "mm: Remove slab destructors from kmem_cache_create().\n\nSlab destructors were no longer supported after Christoph\u0027s\nc59def9f222d44bb7e2f0a559f2906191a0862d7 change. They\u0027ve been\nBUGs for both slab and slub, and slob never supported them\neither.\n\nThis rips out support for the dtor pointer from kmem_cache_create()\ncompletely and fixes up every single callsite in the kernel (there were\nabout 224, not including the slab allocator definitions themselves,\nor the documentation references).\n\nSigned-off-by: Paul Mundt \u003clethal@linux-sh.org\u003e\n" }, { "commit": "86313c488a6848b7ec2ba04e74f25f79dd32a0b7", "tree": "3b190f7afc338362470573b563f65a1eb83795ac", "parents": [ "10a0a8d4e3f6bf2d077f94344441909abe670f5a" ], "author": { "name": "Jeremy Fitzhardinge", "email": "jeremy@xensource.com", "time": "Tue Jul 17 18:37:03 2007 -0700" }, "committer": { "name": "Jeremy Fitzhardinge", "email": "jeremy@goop.org", "time": "Wed Jul 18 08:47:40 2007 -0700" }, "message": "usermodehelper: Tidy up waiting\n\nRather than using a tri-state integer for the wait flag in\ncall_usermodehelper_exec, define a proper enum, and use that. I\u0027ve\npreserved the integer values so that any callers I\u0027ve missed should\nstill work OK.\n\nSigned-off-by: Jeremy Fitzhardinge \u003cjeremy@xensource.com\u003e\nCc: James Bottomley \u003cJames.Bottomley@HansenPartnership.com\u003e\nCc: Randy Dunlap \u003crandy.dunlap@oracle.com\u003e\nCc: Christoph Hellwig \u003chch@infradead.org\u003e\nCc: Andi Kleen \u003cak@suse.de\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nCc: Ralf Baechle \u003cralf@linux-mips.org\u003e\nCc: Bjorn Helgaas \u003cbjorn.helgaas@hp.com\u003e\nCc: Joel Becker \u003cjoel.becker@oracle.com\u003e\nCc: Tony Luck \u003ctony.luck@intel.com\u003e\nCc: Kay Sievers \u003ckay.sievers@vrfy.org\u003e\nCc: Srivatsa Vaddagiri \u003cvatsa@in.ibm.com\u003e\nCc: Oleg Nesterov \u003coleg@tv-sign.ru\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\n" }, { "commit": "7318226ea2931a627f3572e5f4804c91ca19ecbc", "tree": "d2492bb7e87a9c1740432c4dcde13e75ee46ad8d", "parents": [ "071b638689464c6b39407025eedd810d5b5e6f5d" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Apr 26 15:46:23 2007 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Apr 26 15:46:23 2007 -0700" }, "message": "[AF_RXRPC]: Key facility changes for AF_RXRPC\n\nExport the keyring key type definition and document its availability.\n\nAdd alternative types into the key\u0027s type_data union to make it more useful.\nNot all users necessarily want to use it as a list_head (AF_RXRPC doesn\u0027t, for\nexample), so make it clear that it can be used in other ways.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cd354f1ae75e6466a7e31b727faede57a1f89ca5", "tree": "09a2da1672465fefbc7fe06ff4e6084f1dd14c6b", "parents": [ "3fc605a2aa38899c12180ca311f1eeb61a6d867e" ], "author": { "name": "Tim Schmielau", "email": "tim@physik3.uni-rostock.de", "time": "Wed Feb 14 00:33:14 2007 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Wed Feb 14 08:09:54 2007 -0800" }, "message": "[PATCH] remove many unneeded #includes of sched.h\n\nAfter Al Viro (finally) succeeded in removing the sched.h #include in module.h\nrecently, it makes sense again to remove other superfluous sched.h includes.\nThere are quite a lot of files which include it but don\u0027t actually need\nanything defined in there. Presumably these includes were once needed for\nmacros that used to live in sched.h, but moved to other header files in the\ncourse of cleaning it up.\n\nTo ease the pain, this time I did not fiddle with any header files and only\nremoved #includes from .c-files, which tend to cause less trouble.\n\nCompile tested against 2.6.20-rc2 and 2.6.20-rc2-mm2 (with offsets) on alpha,\narm, i386, ia64, mips, powerpc, and x86_64 with allnoconfig, defconfig,\nallmodconfig, and allyesconfig as well as a few randconfigs on x86_64 and all\nconfigs in arch/arm/configs on arm. I also checked that no new warnings were\nintroduced by the patch (actually, some warnings are removed that were emitted\nby unnecessarily included header files).\n\nSigned-off-by: Tim Schmielau \u003ctim@physik3.uni-rostock.de\u003e\nAcked-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9c2e08c592cd357a8330c34def1e8ecfdcf53275", "tree": "62e7449e43bb502f2e9630ab41832ceccd9a0f65", "parents": [ "da7071d7e32d15149cc513f096a3638097b66387" ], "author": { "name": "Arjan van de Ven", "email": "arjan@linux.intel.com", "time": "Mon Feb 12 00:55:37 2007 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Mon Feb 12 09:48:46 2007 -0800" }, "message": "[PATCH] mark struct file_operations const 9\n\nMany struct file_operations in the kernel can be \"const\". Marking them const\nmoves these to the .rodata section, which avoids false sharing with potential\ndirty data. In addition it\u0027ll catch accidental writes at compile time to\nthese shared resources.\n\nSigned-off-by: Arjan van de Ven \u003carjan@linux.intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9ad0830f307bcd8dc285cfae58998d43b21727f4", "tree": "237119861640847301c6af758650b05ea353a1da", "parents": [ "768c242b30d9ec5581dd245e8289acb6b77815d1" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Feb 06 13:45:51 2007 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Tue Feb 06 14:45:00 2007 -0800" }, "message": "[PATCH] Keys: Fix key serial number collision handling\n\nFix the key serial number collision avoidance code in key_alloc_serial().\n\nThis didn\u0027t use to be so much of a problem as the key serial numbers were\nallocated from a simple incremental counter, and it would have to go through\ntwo billion keys before it could possibly encounter a collision. However, now\nthat random numbers are used instead, collisions are much more likely.\n\nThis is fixed by finding a hole in the rbtree where the next unused serial\nnumber ought to be and using that by going almost back to the top of the\ninsertion routine and redoing the insertion with the new serial number rather\nthan trying to be clever and attempting to work out the insertion point\npointer directly.\n\nThis fixes kernel BZ #7727.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6cfd76a26d9fe2ba54b9d496a48c1d9285e5c5ed", "tree": "1114a0630c5045d0650c6d78a8097fdea6f94d8e", "parents": [ "a4c410f00f7ca4bd448b0d63f6f882fd244dc991" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Wed Dec 06 20:37:22 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Thu Dec 07 08:39:36 2006 -0800" }, "message": "[PATCH] lockdep: name some old style locks\n\nName some of the remaning \u0027old_style_spin_init\u0027 locks\n\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "48ad504ee7d598431cb2d0b2f01c6d1aff1d2a07", "tree": "52862e12cdca605b04959fc0fa28164dc015013b", "parents": [ "7cf9c2c76c1a17b32f2da85b50cd4fe468ed44b5" ], "author": { "name": "Eric Sesterhenn", "email": "snakebyte@gmx.de", "time": "Wed Dec 06 20:33:47 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Thu Dec 07 08:39:25 2006 -0800" }, "message": "[PATCH] security/keys/*: user kmemdup()\n\nSigned-off-by: Eric Sesterhenn \u003csnakebyte@gmx.de\u003e\nSigned-off-by: Alexey Dobriyan \u003cadobriyan@gmail.com\u003e\nAcked-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "e18b890bb0881bbab6f4f1a6cd20d9c60d66b003", "tree": "4828be07e1c24781c264b42c5a75bcd968223c3f", "parents": [ "441e143e95f5aa1e04026cb0aa71c801ba53982f" ], "author": { "name": "Christoph Lameter", "email": "clameter@sgi.com", "time": "Wed Dec 06 20:33:20 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Thu Dec 07 08:39:25 2006 -0800" }, "message": "[PATCH] slab: remove kmem_cache_t\n\nReplace all uses of kmem_cache_t with struct kmem_cache.\n\nThe patch was generated using the following script:\n\n\t#!/bin/sh\n\t#\n\t# Replace one string by another in all the kernel sources.\n\t#\n\n\tset -e\n\n\tfor file in `find * -name \"*.c\" -o -name \"*.h\"|xargs grep -l $1`; do\n\t\tquilt add $file\n\t\tsed -e \"1,\\$s/$1/$2/g\" $file \u003e/tmp/$$\n\t\tmv /tmp/$$ $file\n\t\tquilt refresh\n\tdone\n\nThe script was run like this\n\n\tsh replace kmem_cache_t \"struct kmem_cache\"\n\nSigned-off-by: Christoph Lameter \u003cclameter@sgi.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "e94b1766097d53e6f3ccfb36c8baa562ffeda3fc", "tree": "93fa0a8ab84976d4e89c50768ca8b8878d642a0d", "parents": [ "54e6ecb23951b195d02433a741c7f7cb0b796c78" ], "author": { "name": "Christoph Lameter", "email": "clameter@sgi.com", "time": "Wed Dec 06 20:33:17 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Thu Dec 07 08:39:24 2006 -0800" }, "message": "[PATCH] slab: remove SLAB_KERNEL\n\nSLAB_KERNEL is an alias of GFP_KERNEL.\n\nSigned-off-by: Christoph Lameter \u003cclameter@sgi.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "65f27f38446e1976cc98fd3004b110fedcddd189", "tree": "68f8be93feae31dfa018c22db392a05546b63ee1", "parents": [ "365970a1ea76d81cb1ad2f652acb605f06dae256" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Nov 22 14:55:48 2006 +0000" }, "committer": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Nov 22 14:55:48 2006 +0000" }, "message": "WorkStruct: Pass the work_struct pointer instead of context data\n\nPass the work_struct pointer to the work function rather than context data.\nThe work function can use container_of() to work out the data.\n\nFor the cases where the container of the work_struct may go away the moment the\npending bit is cleared, it is made possible to defer the release of the\nstructure by deferring the clearing of the pending bit.\n\nTo make this work, an extra flag is introduced into the management side of the\nwork_struct. This governs auto-release of the structure upon execution.\n\nOrdinarily, the work queue executor would release the work_struct for further\nscheduling or deallocation by clearing the pending bit prior to jumping to the\nwork function. This means that, unless the driver makes some guarantee itself\nthat the work_struct won\u0027t go away, the work function may not access anything\nelse in the work_struct or its container lest they be deallocated.. This is a\nproblem if the auxiliary data is taken away (as done by the last patch).\n\nHowever, if the pending bit is *not* cleared before jumping to the work\nfunction, then the work function *may* access the work_struct and its container\nwith no problems. But then the work function must itself release the\nwork_struct by calling work_release().\n\nIn most cases, automatic release is fine, so this is the default. Special\ninitiators exist for the non-auto-release case (ending in _NAR).\n\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\n" }, { "commit": "4e54f08543d05e519e601368571cc3787fefae96", "tree": "0cd9d982e5bb25abcb9251d26c36ff11e7dc81a5", "parents": [ "94583779e6625154e8d7fce33d097ae7d089e9de" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Jun 29 02:24:28 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Thu Jun 29 10:26:20 2006 -0700" }, "message": "[PATCH] Keys: Allow in-kernel key requestor to pass auxiliary data to upcaller\n\nThe proposed NFS key type uses its own method of passing key requests to\nuserspace (upcalling) rather than invoking /sbin/request-key. This is\nbecause the responsible userspace daemon should already be running and will\nbe contacted through rpc_pipefs.\n\nThis patch permits the NFS filesystem to pass auxiliary data to the upcall\noperation (struct key_type::request_key) so that the upcaller can use a\npre-existing communications channel more easily.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-By: Kevin Coffman \u003ckwc@citi.umich.edu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "a7807a32bbb027ab9955b96734fdc7f1e6497a9f", "tree": "8ed62e305638e1b853f1c80b5bb7ed818418765c", "parents": [ "b3c681e09193559ba15f6c9562bd37045f120a96" ], "author": { "name": "Randy Dunlap", "email": "rdunlap@xenotime.net", "time": "Tue Jun 27 02:53:54 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Tue Jun 27 17:32:38 2006 -0700" }, "message": "[PATCH] poison: add \u0026 use more constants\n\nAdd more poison values to include/linux/poison.h. It\u0027s not clear to me\nwhether some others should be added or not, so I haven\u0027t added any of\nthese:\n\n./include/linux/libata.h:#define ATA_TAG_POISON\t\t0xfafbfcfdU\n./arch/ppc/8260_io/fcc_enet.c:1918:\tmemset((char *)(\u0026(immap-\u003eim_dprambase[(mem_addr+64)])), 0x88, 32);\n./drivers/usb/mon/mon_text.c:429:\tmemset(mem, 0xe5, sizeof(struct mon_event_text));\n./drivers/char/ftape/lowlevel/ftape-ctl.c:738:\t\tmemset(ft_buffer[i]-\u003eaddress, 0xAA, FT_BUFF_SIZE);\n./drivers/block/sx8.c:/* 0xf is just arbitrary, non-zero noise; this is sorta like poisoning */\n\nSigned-off-by: Randy Dunlap \u003crdunlap@xenotime.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "06ec7be557a1259611d6093a00463c42650dc71a", "tree": "b83cdbc8405e0a174939d36e4fe40fb8adb51071", "parents": [ "e51f6d343789a4f0a2a7587ad7ec7746969d5c1c" ], "author": { "name": "Michael LeMay", "email": "mdlemay@epoch.ncsc.mil", "time": "Mon Jun 26 00:24:56 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Mon Jun 26 09:58:18 2006 -0700" }, "message": "[PATCH] keys: restrict contents of /proc/keys to Viewable keys\n\nRestrict /proc/keys such that only those keys to which the current task is\ngranted View permission are presented.\n\nThe documentation is also updated to reflect these changes.\n\nSigned-off-by: Michael LeMay \u003cmdlemay@epoch.ncsc.mil\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "e51f6d343789a4f0a2a7587ad7ec7746969d5c1c", "tree": "39ca4e05c0dda995f3eaaea1aaa2c8689003f1d0", "parents": [ "5801649d8b83e7cb9b15839761bdee594653c294" ], "author": { "name": "Michael LeMay", "email": "mdlemay@epoch.ncsc.mil", "time": "Mon Jun 26 00:24:54 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Mon Jun 26 09:58:18 2006 -0700" }, "message": "[PATCH] keys: allocate key serial numbers randomly\n\nCause key_alloc_serial() to generate key serial numbers randomly rather than\nin linear sequence.\n\nUsing an linear sequence permits a covert communication channel to be\nestablished, in which one process can communicate with another by creating or\nnot creating new keys within a certain timeframe. The second process can\nprobe for the expected next key serial number and judge its existence by the\nerror returned.\n\nThis is a problem as the serial number namespace is globally shared between\nall tasks, regardless of their context.\n\nFor more information on this topic, this old TCSEC guide is recommended:\n\n\thttp://www.radium.ncsc.mil/tpep/library/rainbow/NCSC-TG-030.html\n\nSigned-off-by: Michael LeMay \u003cmdlemay@epoch.ncsc.mil\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "5801649d8b83e7cb9b15839761bdee594653c294", "tree": "4534b606908596651a533b2f51418444b5a1e705", "parents": [ "31204ed925b067d2bb65adb89501656f8274a32a" ], "author": { "name": "Fredrik Tolf", "email": "fredrik@dolda2000.com", "time": "Mon Jun 26 00:24:51 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Mon Jun 26 09:58:18 2006 -0700" }, "message": "[PATCH] keys: let keyctl_chown() change a key\u0027s owner\n\nLet keyctl_chown() change a key\u0027s owner, including attempting to transfer the\nquota burden to the new user.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "31204ed925b067d2bb65adb89501656f8274a32a", "tree": "a5c3e5101e9f79bf39672f02c0eea573e7a47cb8", "parents": [ "7e047ef5fe2d52e83020e856b1bf2556a6a2ce98" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Mon Jun 26 00:24:51 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Mon Jun 26 09:58:18 2006 -0700" }, "message": "[PATCH] keys: discard the contents of a key on revocation\n\nCause the keys linked to a keyring to be unlinked from it when revoked and it\ncauses the data attached to a user-defined key to be discarded when revoked.\n\nThis frees up most of the quota a key occupied at that point, rather than\nwaiting for the key to actually be destroyed.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "7e047ef5fe2d52e83020e856b1bf2556a6a2ce98", "tree": "97656e2c56a27be9d1da451dde627b693b8643f2", "parents": [ "f116629d03655adaf7832b93b03c99391d09d4a7" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Mon Jun 26 00:24:50 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Mon Jun 26 09:58:18 2006 -0700" }, "message": "[PATCH] keys: sort out key quota system\n\nAdd the ability for key creation to overrun the user\u0027s quota in some\ncircumstances - notably when a session keyring is created and assigned to a\nprocess that didn\u0027t previously have one.\n\nThis means it\u0027s still possible to log in, should PAM require the creation of a\nnew session keyring, and fix an overburdened key quota.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "04c567d9313e4927b9835361d8ac0318ce65af6b", "tree": "d040ef59337342603f2cc30917493fb6a74a212a", "parents": [ "d720024e94de4e8b7f10ee83c532926f3ad5d708" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Jun 22 14:47:18 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Thu Jun 22 15:05:56 2006 -0700" }, "message": "[PATCH] Keys: Fix race between two instantiators of a key\n\nAdd a revocation notification method to the key type and calls it whilst\nthe key\u0027s semaphore is still write-locked after setting the revocation\nflag.\n\nThe patch then uses this to maintain a reference on the task_struct of the\nprocess that calls request_key() for as long as the authorisation key\nremains unrevoked.\n\nThis fixes a potential race between two processes both of which have\nassumed the authority to instantiate a key (one may have forked the other\nfor example). The problem is that there\u0027s no locking around the check for\nrevocation of the auth key and the use of the task_struct it points to, nor\ndoes the auth key keep a reference on the task_struct.\n\nAccess to the \"context\" pointer in the auth key must thenceforth be done\nwith the auth key semaphore held. The revocation method is called with the\ntarget key semaphore held write-locked and the search of the context\nprocess\u0027s keyrings is done with the auth key semaphore read-locked.\n\nThe check for the revocation state of the auth key just prior to searching\nit is done after the auth key is read-locked for the search. This ensures\nthat the auth key can\u0027t be revoked between the check and the search.\n\nThe revocation notification method is added so that the context task_struct\ncan be released as soon as instantiation happens rather than waiting for\nthe auth key to be destroyed, thus avoiding the unnecessary pinning of the\nrequesting process.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "d720024e94de4e8b7f10ee83c532926f3ad5d708", "tree": "8f21613c29a26bfbeb334cb0104b8b998b09fbdc", "parents": [ "f893afbe1262e27e91234506f72e17716190dd2f" ], "author": { "name": "Michael LeMay", "email": "mdlemay@epoch.ncsc.mil", "time": "Thu Jun 22 14:47:17 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Thu Jun 22 15:05:55 2006 -0700" }, "message": "[PATCH] selinux: add hooks for key subsystem\n\nIntroduce SELinux hooks to support the access key retention subsystem\nwithin the kernel. Incorporate new flask headers from a modified version\nof the SELinux reference policy, with support for the new security class\nrepresenting retained keys. Extend the \"key_alloc\" security hook with a\ntask parameter representing the intended ownership context for the key\nbeing allocated. Attach security information to root\u0027s default keyrings\nwithin the SELinux initialization routine.\n\nHas passed David\u0027s testsuite.\n\nSigned-off-by: Michael LeMay \u003cmdlemay@epoch.ncsc.mil\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Chris Wright \u003cchrisw@sous-sol.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "fed306f2baa170220b0299198a39c6be2a91bf19", "tree": "366ad7c6f8029608587d5e45738f8c229c3ff924", "parents": [ "52b5108ca7490c0609e4dbddd8439bc03d702c99" ], "author": { "name": "David Woodhouse", "email": "dwmw2@infradead.org", "time": "Fri Apr 21 13:16:49 2006 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@infradead.org", "time": "Fri Apr 21 13:16:49 2006 +0100" }, "message": "[RBTREE] Update key.c to use rb_parent() accessor macro.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "1a26feb9622f1b1bc5e4f5f60f65557b73c38cbf", "tree": "2404fc0d346127b71b9c30d9f9c95603c652ac93", "parents": [ "25a80759c5c237f0ecf57eb11fdd4efb21079c88" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Mon Apr 10 22:54:26 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Tue Apr 11 06:18:45 2006 -0700" }, "message": "[PATCH] Keys: Improve usage of memory barriers and remove IRQ disablement\n\nRemove an unnecessary memory barrier (implicit in rcu_dereference()) from\ninstall_session_keyring().\n\ninstall_session_keyring() is also rearranged a little to make it slightly\nmore efficient.\n\nAs install_*_keyring() may schedule (in synchronize_rcu() or\nkeyring_alloc()), they may not be entered with interrupts disabled - and so\nthere\u0027s no point saving the interrupt disablement state over the critical\nsection.\n\nexec_keys() will also be invoked with interrupts enabled, and so that doesn\u0027t\nneed to save the interrupt state either.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "c3a9d6541f84ac3ff566982d08389b87c1c36b4e", "tree": "161e507b276105b35dadf0c2637be9f018b0f664", "parents": [ "460fbf82c0842cad3f3c744c4dcb81978b7829f3" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Mon Apr 10 15:15:21 2006 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Mon Apr 10 09:33:46 2006 -0700" }, "message": "[Security] Keys: Fix oops when adding key to non-keyring\n\nThis fixes the problem of an oops occuring when a user attempts to add a\nkey to a non-keyring key [CVE-2006-1522].\n\nThe problem is that __keyring_search_one() doesn\u0027t check that the\nkeyring it\u0027s been given is actually a keyring.\n\nI\u0027ve fixed this problem by:\n\n (1) declaring that caller of __keyring_search_one() must guarantee that\n the keyring is a keyring; and\n\n (2) making key_create_or_update() check that the keyring is a keyring,\n and return -ENOTDIR if it isn\u0027t.\n\nThis can be tested by:\n\n\tkeyctl add user b b `keyctl add user a a @s`\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "1d9b7d97d6661edb44ce08f17e47c66d4ac20e34", "tree": "aacf3d99c547d94e4fb1bbeb2a4eb887301c2319", "parents": [ "3dccff8dc00994428777f483922058c554db85bd" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Sat Mar 25 03:06:52 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sat Mar 25 08:22:50 2006 -0800" }, "message": "[PATCH] Keys: Replace duplicate non-updateable keys rather than failing\n\nCause an attempt to add a duplicate non-updateable key (such as a keyring) to\na keyring to discard the extant copy in favour of the new one rather than\nfailing with EEXIST:\n\n\t# do the test in an empty session\n\tkeyctl session\n\t# create a new keyring called \"a\" and attach to session\n\tkeyctl newring a @s\n\t# create another new keyring called \"a\" and attach to session,\n\t# displacing the keyring added by the second command:\n\tkeyctl newring a @s\n\nWithout this patch, the third command will fail.\n\nFor updateable keys (such as those of \"user\" type), the update method will\nstill be called rather than a new key being created.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "3dccff8dc00994428777f483922058c554db85bd", "tree": "14c72fa82afa4e325c4aaa3f84c31ab154f60b1d", "parents": [ "a7d06ca7b626c9257bee4439d9d80a7e44ae237e" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Sat Mar 25 03:06:51 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sat Mar 25 08:22:50 2006 -0800" }, "message": "[PATCH] Keys: Fix key quota management on key allocation\n\nMake key quota detection generate an error if either quota is exceeded rather\nthan only if both quotas are exceeded.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "0cb409d98e351e6817e0bc37fe6815fc14b2c036", "tree": "2d3636949d65d5e4911bc9106ddfdf75872c2380", "parents": [ "24277dda3a54aa5e6265487e1a3091e27f3c0c45" ], "author": { "name": "Davi Arnaut", "email": "davi.arnaut@gmail.com", "time": "Fri Mar 24 03:18:43 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Mar 24 07:33:31 2006 -0800" }, "message": "[PATCH] strndup_user: convert keyctl\n\nCopies user-space string with strndup_user() and moves the type string\nduplication code to a function (thus fixing a wrong check on the length of the\ntype.)\n\nSigned-off-by: Davi Arnaut \u003cdavi.arnaut@gmail.com\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "bb0030797f55c9996ea1cebd16b65750ceb7e4fd", "tree": "58256f9840bf05f141d986b6329a08e38065616a", "parents": [ "8aad38752e81d1d4de67e3d8e2524618ce7c9276" ], "author": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Wed Mar 22 00:09:14 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Wed Mar 22 07:54:06 2006 -0800" }, "message": "[PATCH] sem2mutex: security/\n\nSemaphore to mutex conversion.\n\nThe conversion was generated via scripts, and the result was validated\nautomatically via a script as well.\n\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Stephen Smalley \u003csds@epoch.ncsc.mil\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "6d94074f0804143eac6bce72dc04447c0040e7d8", "tree": "2833a03682e12d81d4bd849435cd9f95e64e9350", "parents": [ "353368dffb56b066cbe00264581a56caf0241b29" ], "author": { "name": "Davi Arnaut", "email": "davi.arnaut@gmail.com", "time": "Fri Feb 03 03:04:46 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Feb 03 08:32:10 2006 -0800" }, "message": "[PATCH] Fix keyctl usage of strnlen_user()\n\nIn the small window between strnlen_user() and copy_from_user() userspace\ncould alter the terminating `\\0\u0027 character.\n\nSigned-off-by: Davi Arnaut \u003cdavi.arnaut@gmail.com\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "c59ede7b78db329949d9cdcd7064e22d357560ef", "tree": "f9dc9d464fdad5bfd464d983e77c1af031389dda", "parents": [ "e16885c5ad624a6efe1b1bf764e075d75f65a788" ], "author": { "name": "Randy.Dunlap", "email": "rdunlap@xenotime.net", "time": "Wed Jan 11 12:17:46 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Wed Jan 11 18:42:13 2006 -0800" }, "message": "[PATCH] move capable() to capability.h\n\n- Move capable() from sched.h to capability.h;\n\n- Use \u003clinux/capability.h\u003e where capable() is used\n\t(in include/, block/, ipc/, kernel/, a few drivers/,\n\tmm/, security/, \u0026 sound/;\n\tmany more drivers/ to go)\n\nSigned-off-by: Randy Dunlap \u003crdunlap@xenotime.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "b5f545c880a2a47947ba2118b2509644ab7a2969", "tree": "8720e02262b0ff6309ae79603f6c63965296d378", "parents": [ "cab8eb594e84b434d20412fc5a3985b0bee3ab9f" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Sun Jan 08 01:02:47 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sun Jan 08 20:13:53 2006 -0800" }, "message": "[PATCH] keys: Permit running process to instantiate keys\n\nMake it possible for a running process (such as gssapid) to be able to\ninstantiate a key, as was requested by Trond Myklebust for NFS4.\n\nThe patch makes the following changes:\n\n (1) A new, optional key type method has been added. This permits a key type\n to intercept requests at the point /sbin/request-key is about to be\n spawned and do something else with them - passing them over the\n rpc_pipefs files or netlink sockets for instance.\n\n The uninstantiated key, the authorisation key and the intended operation\n name are passed to the method.\n\n (2) The callout_info is no longer passed as an argument to /sbin/request-key\n to prevent unauthorised viewing of this data using ps or by looking in\n /proc/pid/cmdline.\n\n This means that the old /sbin/request-key program will not work with the\n patched kernel as it will expect to see an extra argument that is no\n longer there.\n\n A revised keyutils package will be made available tomorrow.\n\n (3) The callout_info is now attached to the authorisation key. Reading this\n key will retrieve the information.\n\n (4) A new field has been added to the task_struct. This holds the\n authorisation key currently active for a thread. Searches now look here\n for the caller\u0027s set of keys rather than looking for an auth key in the\n lowest level of the session keyring.\n\n This permits a thread to be servicing multiple requests at once and to\n switch between them. Note that this is per-thread, not per-process, and\n so is usable in multithreaded programs.\n\n The setting of this field is inherited across fork and exec.\n\n (5) A new keyctl function (KEYCTL_ASSUME_AUTHORITY) has been added that\n permits a thread to assume the authority to deal with an uninstantiated\n key. Assumption is only permitted if the authorisation key associated\n with the uninstantiated key is somewhere in the thread\u0027s keyrings.\n\n This function can also clear the assumption.\n\n (6) A new magic key specifier has been added to refer to the currently\n assumed authorisation key (KEY_SPEC_REQKEY_AUTH_KEY).\n\n (7) Instantiation will only proceed if the appropriate authorisation key is\n assumed first. The assumed authorisation key is discarded if\n instantiation is successful.\n\n (8) key_validate() is moved from the file of request_key functions to the\n file of permissions functions.\n\n (9) The documentation is updated.\n\nFrom: \u003cValdis.Kletnieks@vt.edu\u003e\n\n Build fix.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: Trond Myklebust \u003ctrond.myklebust@fys.uio.no\u003e\nCc: Alexander Zangerl \u003caz@bond.edu.au\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "cab8eb594e84b434d20412fc5a3985b0bee3ab9f", "tree": "307dc5bf813effdcabe439a74ad2ae866516adb0", "parents": [ "017679c4d45783158dba1dd6f79e712c22bb3d9a" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Sun Jan 08 01:02:45 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sun Jan 08 20:13:53 2006 -0800" }, "message": "[PATCH] keys: Discard duplicate keys from a keyring on link\n\nCause any links within a keyring to keys that match a key to be linked into\nthat keyring to be discarded as a link to the new key is added. The match is\ncontingent on the type and description strings being the same.\n\nThis permits requests, adds and searches to displace negative, expired,\nrevoked and dead keys easily. After some discussion it was concluded that\nduplicate valid keys should probably be discarded also as they would otherwise\nhide the new key.\n\nSince request_key() is intended to be the primary method by which keys are\nadded to a keyring, duplicate valid keys wouldn\u0027t be an issue there as that\nfunction would return an existing match in preference to creating a new key.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: Trond Myklebust \u003ctrond.myklebust@fys.uio.no\u003e\nCc: Alexander Zangerl \u003caz@bond.edu.au\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "017679c4d45783158dba1dd6f79e712c22bb3d9a", "tree": "a536f0b581eacd88a64077f5ff15b29d23fc6405", "parents": [ "cd140a5c1f456f50897af4a2e9a23d228a5fe719" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Sun Jan 08 01:02:43 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sun Jan 08 20:13:53 2006 -0800" }, "message": "[PATCH] keys: Permit key expiry time to be set\n\nAdd a new keyctl function that allows the expiry time to be set on a key or\nremoved from a key, provided the caller has attribute modification access.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: Trond Myklebust \u003ctrond.myklebust@fys.uio.no\u003e\nCc: Alexander Zangerl \u003caz@bond.edu.au\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "1ae8f40767a3afc6244719a2c8fbcf546767d5b0", "tree": "f41d957bbc60ad940132fd28ea13a8fced63a398", "parents": [ "8d9067bda99c68e1a17d93e78cf3a5a3f67e0c35" ], "author": { "name": "Adrian Bunk", "email": "bunk@stusta.de", "time": "Fri Jan 06 00:11:25 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Jan 06 08:33:30 2006 -0800" }, "message": "[PATCH] security/: possible cleanups\n\nmake needlessly global code static\n\nSigned-off-by: Adrian Bunk \u003cbunk@stusta.de\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "8d9067bda99c68e1a17d93e78cf3a5a3f67e0c35", "tree": "6f3c7fe665012c456b57840c290eafd4deabbeb2", "parents": [ "32725ad8430b58e42c5d54757ce7871e680d05cb" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Jan 06 00:11:24 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Jan 06 08:33:29 2006 -0800" }, "message": "[PATCH] Keys: Remove key duplication\n\nRemove the key duplication stuff since there\u0027s nothing that uses it, no way\nto get at it and it\u0027s awkward to deal with for LSM purposes.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "db1d1d57e97700b4131fe80556dc6ef976d534c4", "tree": "abdc78339b1c1bd4e37cb496c68424d9d7d98592", "parents": [ "5c72c343719a8c5dba675cd1b27b63c06bfe23d1" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Dec 01 00:51:18 2005 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Thu Dec 01 15:48:56 2005 -0800" }, "message": "[PATCH] Keys: Fix permissions check for update vs add\n\nPermit add_key() to once again update a matching key rather than adding a\nnew one if a matching key already exists in the target keyring.\n\nThis bug causes add_key() to always add a new key, displacing the old from\nthe target keyring.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "a7f988ba304c5f6e78f937a06d120a0097b4d351", "tree": "7a19e078e12ff093fa7daa3ea207a8e442ebf0c7", "parents": [ "b2325fe1b7e5654fac9e9419423aa2c58a3dbd83" ], "author": { "name": "Jesper Juhl", "email": "jesper.juhl@gmail.com", "time": "Mon Nov 07 01:01:35 2005 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Mon Nov 07 07:54:06 2005 -0800" }, "message": "[PATCH] kfree cleanup: security\n\nThis is the security/ part of the big kfree cleanup patch.\n\nRemove pointless checks for NULL prior to calling kfree() in security/.\n\nSigned-off-by: Jesper Juhl \u003cjesper.juhl@gmail.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "0f6ed7c2641fe4cea83cd09c21928ca30c0983ec", "tree": "15662837acd37f24dddeb11eb12980429c8c4ef4", "parents": [ "28ef35845f2c8da8e1bed068277d2fab1e8c8979" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Mon Nov 07 00:59:30 2005 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Mon Nov 07 07:53:37 2005 -0800" }, "message": "[PATCH] Keys: Remove incorrect and obsolete \u0027!\u0027 operators\n\nThe attached patch removes a couple of incorrect and obsolete \u0027!\u0027 operators\nleft over from the conversion of the key permission functions from\ntrue/false returns to zero/error returns.\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "29db9190634067c5a328ee5fcc2890251b836b4b", "tree": "07ec242789230824f1fa8bcbbe681fd5bf166fa8", "parents": [ "2aa349f6e37ce030060c994d3aebbff4ab703565" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Sun Oct 30 15:02:44 2005 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sun Oct 30 17:37:23 2005 -0800" }, "message": "[PATCH] Keys: Add LSM hooks for key management [try #3]\n\nThe attached patch adds LSM hooks for key management facilities. The notable\nchanges are:\n\n (1) The key struct now supports a security pointer for the use of security\n modules. This will permit key labelling and restrictions on which\n programs may access a key.\n\n (2) Security modules get a chance to note (or abort) the allocation of a key.\n\n (3) The key permission checking can now be enhanced by the security modules;\n the permissions check consults LSM if all other checks bear out.\n\n (4) The key permissions checking functions now return an error code rather\n than a boolean value.\n\n (5) An extra permission has been added to govern the modification of\n attributes (UID, GID, permissions).\n\nNote that there isn\u0027t an LSM hook specifically for each keyctl() operation,\nbut rather the permissions hook allows control of individual operations based\non the permission request bits.\n\nKey management access control through LSM is enabled by automatically if both\nCONFIG_KEYS and CONFIG_SECURITY are enabled.\n\nThis should be applied on top of the patch ensubjected:\n\n\t[PATCH] Keys: Possessor permissions should be additive\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "2aa349f6e37ce030060c994d3aebbff4ab703565", "tree": "7a0937469f0376931b82d9c3392727dba13c9d45", "parents": [ "1426d7a81dea8e9d85f9d69de85ab04ba37018ab" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Sun Oct 30 15:02:42 2005 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sun Oct 30 17:37:22 2005 -0800" }, "message": "[PATCH] Keys: Export user-defined keyring operations\n\nExport user-defined key operations so that those who wish to define their\nown key type based on the user-defined key operations may do so (as has\nbeen requested).\n\nThe header file created has been placed into include/keys/user-type.h, thus\ncreating a directory where other key types may also be placed. Any\nobjections to doing this?\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-Off-By: Arjan van de Ven \u003carjan@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "7ab501db8cb6659efdf04034e0de6b44c059a51b", "tree": "cdcf34873ab91219e17b265610a83bea213ec3c4", "parents": [ "468ed2b0c85ec4310b429e60358213b6d077289e" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Oct 07 16:41:24 2005 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sat Oct 08 14:54:48 2005 -0700" }, "message": "[PATCH] Keys: Possessor permissions should be additive\n\nThis patch makes the possessor permissions on a key additive with\nuser/group/other permissions on the same key.\n\nThis permits extra rights to be granted to the possessor of a key without\ntaking away any rights conferred by them owning the key or having common group\nmembership.\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "468ed2b0c85ec4310b429e60358213b6d077289e", "tree": "d1f570c1b89df450753cbec8768b1c1cfac6d9a2", "parents": [ "f1a9badcf6ecad9975240d94514721cb93932151" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Oct 07 15:07:38 2005 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sat Oct 08 14:53:31 2005 -0700" }, "message": "[PATCH] Keys: Split key permissions checking into a .c file\n\nThe attached patch splits key permissions checking out of key-ui.h and\nmoves it into a .c file. It\u0027s quite large and called quite a lot, and\nit\u0027s about to get bigger with the addition of LSM support for keys...\n\nkey_any_permission() is also discarded as it\u0027s no longer used.\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "f1a9badcf6ecad9975240d94514721cb93932151", "tree": "dc37fe427d645dd84331b7385523b39efa41ffad", "parents": [ "74fd92c511bd4a0771ac0faaaef38bb1be3a29f6" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Oct 07 15:04:52 2005 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sat Oct 08 14:53:31 2005 -0700" }, "message": "[PATCH] Keys: Add request-key process documentation\n\nThe attached patch adds documentation for the process by which request-key\nworks, including how it permits helper processes to gain access to the\nrequestor\u0027s keyrings.\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "74fd92c511bd4a0771ac0faaaef38bb1be3a29f6", "tree": "86d0006605f5abe600a2b3a7f6d03cf554c4e761", "parents": [ "c2059b2e0b209a0674c21f78337bb158d3ccb22b" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Oct 07 15:01:09 2005 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sat Oct 08 14:53:31 2005 -0700" }, "message": "[PATCH] key: plug request_key_auth memleak\n\nPlug request_key_auth memleak. This can be triggered by unprivileged\nusers, so is local DoS.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "664cceb0093b755739e56572b836a99104ee8a75", "tree": "dbaa3ab802803879f29532db4d8a91a54294cf88", "parents": [ "5134fc15b643dc36eb9aa77e4318b886844a9ac5" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Sep 28 17:03:15 2005 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Wed Sep 28 09:10:47 2005 -0700" }, "message": "[PATCH] Keys: Add possessor permissions to keys [try #3]\n\nThe attached patch adds extra permission grants to keys for the possessor of a\nkey in addition to the owner, group and other permissions bits. This makes\nSUID binaries easier to support without going as far as labelling keys and key\ntargets using the LSM facilities.\n\nThis patch adds a second \"pointer type\" to key structures (struct key_ref *)\nthat can have the bottom bit of the address set to indicate the possession of\na key. This is propagated through searches from the keyring to the discovered\nkey. It has been made a separate type so that the compiler can spot attempts\nto dereference a potentially incorrect pointer.\n\nThe \"possession\" attribute can\u0027t be attached to a key structure directly as\nit\u0027s not an intrinsic property of a key.\n\nPointers to keys have been replaced with struct key_ref *\u0027s wherever\npossession information needs to be passed through.\n\nThis does assume that the bottom bit of the pointer will always be zero on\nreturn from kmem_cache_alloc().\n\nThe key reference type has been made into a typedef so that at least it can be\nlocated in the sources, even though it\u0027s basically a pointer to an undefined\ntype. I\u0027ve also renamed the accessor functions to be more useful, and all\nreference variables should now end in \"_ref\".\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "94efe72f762e2c147d8146d637d5ece5614c8d94", "tree": "002e4719541ad838342e01a5f8ff63ae0a618b29", "parents": [ "bcf945d36fa0598f41ac4ad46a9dc43135460263" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Aug 04 13:07:07 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Thu Aug 04 13:11:14 2005 -0700" }, "message": "[PATCH] Destruction of failed keyring oopses\n\nThe attached patch makes sure that a keyring that failed to instantiate\nproperly is destroyed without oopsing [CAN-2005-2099].\n\nThe problem occurs in three stages:\n\n (1) The key allocator initialises the type-specific data to all zeroes. In\n the case of a keyring, this will become a link in the keyring name list\n when the keyring is instantiated.\n\n (2) If a user (any user) attempts to add a keyring with anything other than\n an empty payload, the keyring instantiation function will fail with an\n error and won\u0027t add the keyring to the name list.\n\n (3) The keyring\u0027s destructor then sees that the keyring has a description\n (name) and tries to remove the keyring from the name list, which oopses\n because the link pointers are both zero.\n\nThis bug permits any user to take down a box trivially.\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "bcf945d36fa0598f41ac4ad46a9dc43135460263", "tree": "7a2aa188442bf863f20055a001baf85143d7a5b9", "parents": [ "6fb0caa42308923d9e4ed7b36ec077b97c107e24" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Aug 04 13:07:06 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Thu Aug 04 13:11:14 2005 -0700" }, "message": "[PATCH] Error during attempt to join key management session can leave semaphore pinned\n\nThe attached patch prevents an error during the key session joining operation\nfrom hanging future joins in the D state [CAN-2005-2098].\n\nThe problem is that the error handling path for the KEYCTL_JOIN_SESSION_KEYRING\noperation has one error path that doesn\u0027t release the session management\nsemaphore. Further attempts to get the semaphore will then sleep for ever in\nthe D state.\n\nThis can happen in four situations, all involving an attempt to allocate a new\nsession keyring:\n\n (1) ENOMEM.\n\n (2) The users key quota being reached.\n\n (3) A keyring name that is an empty string.\n\n (4) A keyring name that is too long.\n\nAny user may attempt this operation, and so any user can cause the problem to\noccur.\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "1260f801b4e4ba7be200886b4a53d730de05ca19", "tree": "319a68125252ac50df21b6e84cc1131c96e60d6f", "parents": [ "c36f19e02a96488f550fdb678c92500afca3109b" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Aug 04 11:50:01 2005 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Thu Aug 04 08:20:47 2005 -0700" }, "message": "[PATCH] Keys: Fix key management syscall interface bugs\n\nThis fixes five bugs in the key management syscall interface:\n\n (1) add_key() returns 0 rather than EINVAL if the key type is \"\".\n\n Checking the key type isn\u0027t \"\" should be left to lookup_user_key().\n\n (2) request_key() returns ENOKEY rather than EPERM if the key type begins\n with a \".\".\n\n lookup_user_key() can\u0027t do this because internal key types begin with a\n \".\".\n\n (3) Key revocation always returns 0, even if it fails.\n\n (4) Key read can return EAGAIN rather than EACCES under some circumstances.\n\n A key is permitted to by read by a process if it doesn\u0027t grant read\n access, but it does grant search access and it is in the process\u0027s\n keyrings. That search returns EAGAIN if it fails, and this needs\n translating to EACCES.\n\n (5) request_key() never adds the new key to the destination keyring if one is\n supplied.\n\n The wrong macro was being used to test for an error condition: PTR_ERR()\n will always return true, whether or not there\u0027s an error; this should\u0027ve\n been IS_ERR().\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-Off-By: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "a4014d8f61a6a136d22422cf8aa978e6495dbad9", "tree": "bb5d995c2511b99e131ca92020ffc10cafee4447", "parents": [ "682d4fc93105ebf0bdfbb04a4b85047999b17844" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Jul 07 17:57:03 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Thu Jul 07 18:23:46 2005 -0700" }, "message": "[PATCH] Keys: Base keyring size on key pointer not key struct\n\nThe attached patch makes the keyring functions calculate the new size of a\nkeyring\u0027s payload based on the size of pointer to the key struct, not the size\nof the key struct itself.\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "b2b18660066997420b716c1881a6be8b82700d97", "tree": "7c6eb8e7b8163e3d332bd4a4efe2ae5b5cfabdd2", "parents": [ "ae67cd643e9e64217fd92457324625c67fec6e35" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@us.ibm.com", "time": "Sat Jun 25 14:55:38 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@ppc970.osdl.org", "time": "Sat Jun 25 16:24:38 2005 -0700" }, "message": "[PATCH] RCU: clean up a few remaining synchronize_kernel() calls\n\n2.6.12-rc6-mm1 has a few remaining synchronize_kernel()s, some (but not\nall) in comments. This patch changes these synchronize_kernel() calls (and\ncomments) to synchronize_rcu() or synchronize_sched() as follows:\n\n- arch/x86_64/kernel/mce.c mce_read(): change to synchronize_sched() to\n handle races with machine-check exceptions (synchronize_rcu() would not cut\n it given RCU implementations intended for hardcore realtime use.\n\n- drivers/input/serio/i8042.c i8042_stop(): change to synchronize_sched() to\n handle races with i8042_interrupt() interrupt handler. Again,\n synchronize_rcu() would not cut it given RCU implementations intended for\n hardcore realtime use.\n\n- include/*/kdebug.h comments: change to synchronize_sched() to handle races\n with NMIs. As before, synchronize_rcu() would not cut it...\n\n- include/linux/list.h comment: change to synchronize_rcu(), since this\n comment is for list_del_rcu().\n\n- security/keys/key.c unregister_key_type(): change to synchronize_rcu(),\n since this is interacting with RCU read side.\n\n- security/keys/process_keys.c install_session_keyring(): change to\n synchronize_rcu(), since this is interacting with RCU read side.\n\nSigned-off-by: \"Paul E. McKenney\" \u003cpaulmck@us.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" } ], "next": "16c29b67fb3bbacfc2a71f9e5f7d85728ef45efa" }