)]}'
{
  "commit": "8e6c96935fcc1ed3dbebc96fddfef3f2f2395afc",
  "tree": "c26297c8ca479972010cadf2058aacd63ce1744f",
  "parents": [
    "652bb9b0d6ce007f37c098947b2cc0c45efa3f66"
  ],
  "author": {
    "name": "Lucian Adrian Grijincu",
    "email": "lucian.grijincu@gmail.com",
    "time": "Tue Feb 01 18:42:22 2011 +0200"
  },
  "committer": {
    "name": "Eric Paris",
    "email": "eparis@redhat.com",
    "time": "Tue Feb 01 11:53:54 2011 -0500"
  },
  "message": "security/selinux: fix /proc/sys/ labeling\n\nThis fixes an old (2007) selinux regression: filesystem labeling for\n/proc/sys returned\n     -r--r--r-- unknown                          /proc/sys/fs/file-nr\ninstead of\n     -r--r--r-- system_u:object_r:sysctl_fs_t:s0 /proc/sys/fs/file-nr\n\nEvents that lead to breaking of /proc/sys/ selinux labeling:\n\n1) sysctl was reimplemented to route all calls through /proc/sys/\n\n    commit 77b14db502cb85a031fe8fde6c85d52f3e0acb63\n    [PATCH] sysctl: reimplement the sysctl proc support\n\n2) proc_dir_entry was removed from ctl_table:\n\n    commit 3fbfa98112fc3962c416452a0baf2214381030e6\n    [PATCH] sysctl: remove the proc_dir_entry member for the sysctl tables\n\n3) selinux still walked the proc_dir_entry tree to apply\n   labeling. Because ctl_tables don\u0027t have a proc_dir_entry, we did\n   not label /proc/sys/ inodes any more. To achieve this the /proc/sys/\n   inodes were marked private and private inodes were ignored by\n   selinux.\n\n    commit bbaca6c2e7ef0f663bc31be4dad7cf530f6c4962\n    [PATCH] selinux: enhance selinux to always ignore private inodes\n\n    commit 86a71dbd3e81e8870d0f0e56b87875f57e58222b\n    [PATCH] sysctl: hide the sysctl proc inodes from selinux\n\nAccess control checks have been done by means of a special sysctl hook\nthat was called for read/write accesses to any /proc/sys/ entry.\n\nWe don\u0027t have to do this because, instead of walking the\nproc_dir_entry tree we can walk the dentry tree (as done in this\npatch). With this patch:\n* we don\u0027t mark /proc/sys/ inodes as private\n* we don\u0027t need the sysclt security hook\n* we walk the dentry tree to find the path to the inode.\n\nWe have to strip the PID in /proc/PID/ entries that have a\nproc_dir_entry because selinux does not know how to label paths like\n\u0027/1/net/rpc/nfsd.fh\u0027 (and defaults to \u0027proc_t\u0027 labeling). Selinux does\nknow of \u0027/net/rpc/nfsd.fh\u0027 (and applies the \u0027sysctl_rpc_t\u0027 label).\n\nPID stripping from the path was done implicitly in the previous code\nbecause the proc_dir_entry tree had the root in \u0027/net\u0027 in the example\nfrom above. The dentry tree has the root in \u0027/1\u0027.\n\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nSigned-off-by: Lucian Adrian Grijincu \u003clucian.grijincu@gmail.com\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "09a1f92a34ef2fce52b07cf394d040708e86a22b",
      "old_mode": 33188,
      "old_path": "fs/proc/proc_sysctl.c",
      "new_id": "fb707e018a816685529f75f54d9d30eb88cb5054",
      "new_mode": 33188,
      "new_path": "fs/proc/proc_sysctl.c"
    },
    {
      "type": "modify",
      "old_id": "6ae19fd28be5331e15432c47a14e39ae6665fb4a",
      "old_mode": 33188,
      "old_path": "security/selinux/hooks.c",
      "new_id": "c8b359fc294929d81cfd4ec5b96de243604716a3",
      "new_mode": 33188,
      "new_path": "security/selinux/hooks.c"
    }
  ]
}