)]}' { "log": [ { "commit": "9f00d9776bc5beb92e8bfc884a7e96ddc5589e2e", "tree": "2a9f9513a13c73cb1196ebe3426389c1140e2888", "parents": [ "9785e10aedfa0fad5c1aac709dce5ada1b123783" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Sat Sep 08 02:53:54 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Sep 08 18:46:30 2012 -0400" }, "message": "netlink: hide struct module parameter in netlink_kernel_create\n\nThis patch defines netlink_kernel_create as a wrapper function of\n__netlink_kernel_create to hide the struct module *me parameter\n(which seems to be THIS_MODULE in all existing netlink subsystems).\n\nSuggested by David S. Miller.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9785e10aedfa0fad5c1aac709dce5ada1b123783", "tree": "ca523e084318b6e908b18c6f3e9e53ea7e9a1c49", "parents": [ "16fa9e1d104e6f2c18005a4ac7ea60e4c7fc1286" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Sat Sep 08 02:53:53 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Sep 08 18:45:27 2012 -0400" }, "message": "netlink: kill netlink_set_nonroot\n\nReplace netlink_set_nonroot by one new field `flags\u0027 in\nstruct netlink_kernel_cfg that is passed to netlink_kernel_create.\n\nThis patch also renames NL_NONROOT_* to NL_CFG_F_NONROOT_* since\nnow the flags field in nl_table is generic (so we can add more\nflags if needed in the future).\n\nAlso adjust all callers in the net-next tree to use these flags\ninstead of netlink_set_nonroot.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7612bfeecc197bbb6629842b5c6ff1967f0a9b70", "tree": "d73acd2bc97866b256a70acb83e4ca69bce6e32d", "parents": [ "d9875690d9b89a866022ff49e3fcea892345ad92" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Aug 15 11:41:55 2012 -0700" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Fri Aug 17 20:40:38 2012 +1000" }, "message": "Yama: access task_struct-\u003ecomm directly\n\nThe core ptrace access checking routine holds a task lock, and when\nreporting a failure, Yama takes a separate task lock. To avoid a\npotential deadlock with two ptracers taking the opposite locks, do not\nuse get_task_comm() and just use -\u003ecomm directly since accuracy is not\nimportant for the report.\n\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSuggested-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCC: stable@vger.kernel.org\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nAcked-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "9d8dad742ad1c74d7e7210ee05d0b44961d5ea16", "tree": "b1e738bf17987552cdace2695d8b77328dc29bcf", "parents": [ "f4ba394c1b02e7fc2179fda8d3941a5b3b65efb6" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Thu Aug 09 19:01:26 2012 -0700" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Fri Aug 10 19:58:07 2012 +1000" }, "message": "Yama: higher restrictions should block PTRACE_TRACEME\n\nThe higher ptrace restriction levels should be blocking even\nPTRACE_TRACEME requests. The comments in the LSM documentation are\nmisleading about when the checks happen (the parent does not go through\nsecurity_ptrace_access_check() on a PTRACE_TRACEME call).\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: stable@vger.kernel.org # 3.5.x and later\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "6290c2c439732727899405f39fb76c2f5585b707", "tree": "3b016b4602b6711e4354d1b288018888574d9d48", "parents": [ "c76562b6709fee5eff8a6a779be41c0bce661fd7" ], "author": { "name": "Mel Gorman", "email": "mgorman@suse.de", "time": "Tue Jul 31 16:44:44 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 31 18:42:47 2012 -0700" }, "message": "selinux: tag avc cache alloc as non-critical\n\nFailing to allocate a cache entry will only harm performance not\ncorrectness. Do not consume valuable reserve pages for something like\nthat.\n\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nAcked-by: Eric Paris \u003ceparis@redhat.com\u003e\nAcked-by: Rik van Riel \u003criel@redhat.com\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: Christoph Hellwig \u003chch@infradead.org\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Eric B Munson \u003cemunson@mgebm.net\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Mike Christie \u003cmichaelc@cs.wisc.edu\u003e\nCc: Neil Brown \u003cneilb@suse.de\u003e\nCc: Sebastian Andrzej Siewior \u003csebastian@breakpoint.cc\u003e\nCc: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nCc: Xiaotian Feng \u003cdfeng@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "27c1ee3f929555b71fa39ec0d81a7e7185de1b16", "tree": "42e40bdfe4efac660d650658019391536ce67a42", "parents": [ "37cd9600a9e20359b0283983c9e3a55d84347168", "086ff4b3a7fb9cdf41e6a5d0ccd99b86d84633a1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 30 17:25:34 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 30 17:25:34 2012 -0700" }, "message": "Merge branch \u0027akpm\u0027 (Andrew\u0027s patch-bomb)\n\nMerge Andrew\u0027s first set of patches:\n \"Non-MM patches:\n\n - lots of misc bits\n\n - tree-wide have_clk() cleanups\n\n - quite a lot of printk tweaks. I draw your attention to \"printk:\n convert the format for KERN_\u003cLEVEL\u003e to a 2 byte pattern\" which\n looks a bit scary. But afaict it\u0027s solid.\n\n - backlight updates\n\n - lib/ feature work (notably the addition and use of memweight())\n\n - checkpatch updates\n\n - rtc updates\n\n - nilfs updates\n\n - fatfs updates (partial, still waiting for acks)\n\n - kdump, proc, fork, IPC, sysctl, taskstats, pps, etc\n\n - new fault-injection feature work\"\n\n* Merge emailed patches from Andrew Morton \u003cakpm@linux-foundation.org\u003e: (128 commits)\n drivers/misc/lkdtm.c: fix missing allocation failure check\n lib/scatterlist: do not re-write gfp_flags in __sg_alloc_table()\n fault-injection: add tool to run command with failslab or fail_page_alloc\n fault-injection: add selftests for cpu and memory hotplug\n powerpc: pSeries reconfig notifier error injection module\n memory: memory notifier error injection module\n PM: PM notifier error injection module\n cpu: rewrite cpu-notifier-error-inject module\n fault-injection: notifier error injection\n c/r: fcntl: add F_GETOWNER_UIDS option\n resource: make sure requested range is included in the root range\n include/linux/aio.h: cpp-\u003eC conversions\n fs: cachefiles: add support for large files in filesystem caching\n pps: return PTR_ERR on error in device_create\n taskstats: check nla_reserve() return\n sysctl: suppress kmemleak messages\n ipc: use Kconfig options for __ARCH_WANT_[COMPAT_]IPC_PARSE_VERSION\n ipc: compat: use signed size_t types for msgsnd and msgrcv\n ipc: allow compat IPC version field parsing if !ARCH_WANT_OLD_COMPAT_IPC\n ipc: add COMPAT_SHMLBA support\n ...\n" }, { "commit": "1d151c337d79fa3de88654d2514f58fbd916a8e0", "tree": "79f96ea4b081f310aa62246e879224467b092261", "parents": [ "65fed8f6f23070b56d0ed3841173ddd410130a89" ], "author": { "name": "Cyrill Gorcunov", "email": "gorcunov@openvz.org", "time": "Mon Jul 30 14:43:00 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 30 17:25:21 2012 -0700" }, "message": "c/r: fcntl: add F_GETOWNER_UIDS option\n\nWhen we restore file descriptors we would like them to look exactly as\nthey were at dumping time.\n\nWith help of fcntl it\u0027s almost possible, the missing snippet is file\nowners UIDs.\n\nTo be able to read their values the F_GETOWNER_UIDS is introduced.\n\nThis option is valid iif CONFIG_CHECKPOINT_RESTORE is turned on, otherwise\nreturning -EINVAL.\n\nSigned-off-by: Cyrill Gorcunov \u003cgorcunov@openvz.org\u003e\nAcked-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: \"Serge E. Hallyn\" \u003cserge@hallyn.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e3fea3f70fd68af0574a5f24246cdb4ed07f2b74", "tree": "c3a8ae06734b2987646dd89c87c0a16ee50d420e", "parents": [ "5935e6dcaaa8f666dd7f1169fa87d36752ebeb94" ], "author": { "name": "Al Viro", "email": "viro@ZenIV.linux.org.uk", "time": "Sat Jun 09 08:15:16 2012 +0100" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Mon Jul 30 15:36:50 2012 +1000" }, "message": "selinux: fix selinux_inode_setxattr oops\n\nOK, what we have so far is e.g.\n\tsetxattr(path, name, whatever, 0, XATTR_REPLACE)\nwith name being good enough to get through xattr_permission().\nThen we reach security_inode_setxattr() with the desired value and size.\nAha. name should begin with \"security.selinux\", or we won\u0027t get that\nfar in selinux_inode_setxattr(). Suppose we got there and have enough\npermissions to relabel that sucker. We call security_context_to_sid()\nwith value \u003d\u003d NULL, size \u003d\u003d 0. OK, we want ss_initialized to be non-zero.\nI.e. after everything had been set up and running. No problem...\n\nWe do 1-byte kmalloc(), zero-length memcpy() (which doesn\u0027t oops, even\nthought the source is NULL) and put a NUL there. I.e. form an empty\nstring. string_to_context_struct() is called and looks for the first\n\u0027:\u0027 in there. Not found, -EINVAL we get. OK, security_context_to_sid_core()\nhas rc \u003d\u003d -EINVAL, force \u003d\u003d 0, so it silently returns -EINVAL.\nAll it takes now is not having CAP_MAC_ADMIN and we are fucked.\n\nAll right, it might be a different bug (modulo strange code quoted in the\nreport), but it\u0027s real. Easily fixed, AFAICS:\n\nDeal with size \u003d\u003d 0, value \u003d\u003d NULL case in selinux_inode_setxattr()\n\nCc: stable@vger.kernel.org\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nTested-by: Dave Jones \u003cdavej@redhat.com\u003e\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "3b9fc37280c521b086943f9aedda767f5bf3b2d3", "tree": "c76cc02753da4df5d11e516d8e9373e5f0426b24", "parents": [ "f7da9cdf45cbbad5029d4858dcbc0134e06084ed" ], "author": { "name": "Alan Cox", "email": "alan@linux.intel.com", "time": "Thu Jul 26 14:47:11 2012 -0700" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Mon Jul 30 15:04:17 2012 +1000" }, "message": "smack: off by one error\n\nConsider the input case of a rule that consists entirely of non space\nsymbols followed by a \\0. Say 64 + \\0\n\nIn this case strlen(data) \u003d 64\nkzalloc of subject and object are 64 byte objects\nsscanfdata, \"%s %s %s\", subject, ...)\n\nwill put 65 bytes into subject.\n\nSigned-off-by: Alan Cox \u003calan@linux.intel.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "8ded2bbc1845e19c771eb55209aab166ef011243", "tree": "9ab400cdd407a9426fdfcc3432d7c0e19a0607ed", "parents": [ "4cb38750d49010ae72e718d46605ac9ba5a851b4" ], "author": { "name": "Josh Boyer", "email": "jwboyer@redhat.com", "time": "Wed Jul 25 10:40:34 2012 -0400" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 26 13:36:43 2012 -0700" }, "message": "posix_types.h: Cleanup stale __NFDBITS and related definitions\n\nRecently, glibc made a change to suppress sign-conversion warnings in\nFD_SET (glibc commit ceb9e56b3d1). This uncovered an issue with the\nkernel\u0027s definition of __NFDBITS if applications #include\n\u003clinux/types.h\u003e after including \u003csys/select.h\u003e. A build failure would\nbe seen when passing the -Werror\u003dsign-compare and -D_FORTIFY_SOURCE\u003d2\nflags to gcc.\n\nIt was suggested that the kernel should either match the glibc\ndefinition of __NFDBITS or remove that entirely. The current in-kernel\nuses of __NFDBITS can be replaced with BITS_PER_LONG, and there are no\nuses of the related __FDELT and __FDMASK defines. Given that, we\u0027ll\ncontinue the cleanup that was started with commit 8b3d1cda4f5f\n(\"posix_types: Remove fd_set macros\") and drop the remaining unused\nmacros.\n\nAdditionally, linux/time.h has similar macros defined that expand to\nnothing so we\u0027ll remove those at the same time.\n\nReported-by: Jeff Law \u003claw@redhat.com\u003e\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCC: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Josh Boyer \u003cjwboyer@redhat.com\u003e\n[ .. and fix up whitespace as per akpm ]\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "3c4cfadef6a1665d9cd02a543782d03d3e6740c6", "tree": "3df72faaacd494d5ac8c9668df4f529b1b5e4457", "parents": [ "e017507f37d5cb8b541df165a824958bc333bec3", "320f5ea0cedc08ef65d67e056bcb9d181386ef2c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 24 10:01:50 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 24 10:01:50 2012 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next\n\nPull networking changes from David S Miller:\n\n 1) Remove the ipv4 routing cache. Now lookups go directly into the FIB\n trie and use prebuilt routes cached there.\n\n No more garbage collection, no more rDOS attacks on the routing\n cache. Instead we now get predictable and consistent performance,\n no matter what the pattern of traffic we service.\n\n This has been almost 2 years in the making. Special thanks to\n Julian Anastasov, Eric Dumazet, Steffen Klassert, and others who\n have helped along the way.\n\n I\u0027m sure that with a change of this magnitude there will be some\n kind of fallout, but such things ought the be simple to fix at this\n point. Luckily I\u0027m not European so I\u0027ll be around all of August to\n fix things :-)\n\n The major stages of this work here are each fronted by a forced\n merge commit whose commit message contains a top-level description\n of the motivations and implementation issues.\n\n 2) Pre-demux of established ipv4 TCP sockets, saves a route demux on\n input.\n\n 3) TCP SYN/ACK performance tweaks from Eric Dumazet.\n\n 4) Add namespace support for netfilter L4 conntrack helpers, from Gao\n Feng.\n\n 5) Add config mechanism for Energy Efficient Ethernet to ethtool, from\n Yuval Mintz.\n\n 6) Remove quadratic behavior from /proc/net/unix, from Eric Dumazet.\n\n 7) Support for connection tracker helpers in userspace, from Pablo\n Neira Ayuso.\n\n 8) Allow userspace driven TX load balancing functions in TEAM driver,\n from Jiri Pirko.\n\n 9) Kill off NLMSG_PUT and RTA_PUT macros, more gross stuff with\n embedded gotos.\n\n10) TCP Small Queues, essentially minimize the amount of TCP data queued\n up in the packet scheduler layer. Whereas the existing BQL (Byte\n Queue Limits) limits the pkt_sched --\u003e netdevice queuing levels,\n this controls the TCP --\u003e pkt_sched queueing levels.\n\n From Eric Dumazet.\n\n11) Reduce the number of get_page/put_page ops done on SKB fragments,\n from Alexander Duyck.\n\n12) Implement protection against blind resets in TCP (RFC 5961), from\n Eric Dumazet.\n\n13) Support the client side of TCP Fast Open, basically the ability to\n send data in the SYN exchange, from Yuchung Cheng.\n\n Basically, the sender queues up data with a sendmsg() call using\n MSG_FASTOPEN, then they do the connect() which emits the queued up\n fastopen data.\n\n14) Avoid all the problems we get into in TCP when timers or PMTU events\n hit a locked socket. The TCP Small Queues changes added a\n tcp_release_cb() that allows us to queue work up to the\n release_sock() caller, and that\u0027s what we use here too. From Eric\n Dumazet.\n\n15) Zero copy on TX support for TUN driver, from Michael S. Tsirkin.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1870 commits)\n genetlink: define lockdep_genl_is_held() when CONFIG_LOCKDEP\n r8169: revert \"add byte queue limit support\".\n ipv4: Change rt-\u003ert_iif encoding.\n net: Make skb-\u003eskb_iif always track skb-\u003edev\n ipv4: Prepare for change of rt-\u003ert_iif encoding.\n ipv4: Remove all RTCF_DIRECTSRC handliing.\n ipv4: Really ignore ICMP address requests/replies.\n decnet: Don\u0027t set RTCF_DIRECTSRC.\n net/ipv4/ip_vti.c: Fix __rcu warnings detected by sparse.\n ipv4: Remove redundant assignment\n rds: set correct msg_namelen\n openvswitch: potential NULL deref in sample()\n tcp: dont drop MTU reduction indications\n bnx2x: Add new 57840 device IDs\n tcp: avoid oops in tcp_metrics and reset tcpm_stamp\n niu: Change niu_rbr_fill() to use unlikely() to check niu_rbr_add_page() return value\n niu: Fix to check for dma mapping errors.\n net: Fix references to out-of-scope variables in put_cmsg_compat()\n net: ethernet: davinci_emac: add pm_runtime support\n net: ethernet: davinci_emac: Remove unnecessary #include\n ...\n" }, { "commit": "e05644e17e744315bce12b0948cdc36910b9a76e", "tree": "92d62ff59c57f991ef6b5c3cc2c2dcd205946a11", "parents": [ "97e7292ab5ccd30a13c3612835535fc3f3e59715", "663728418e3494f8e4a82f5d1b2f23c22d11be35" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 23 18:49:06 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 23 18:49:06 2012 -0700" }, "message": "Merge branch \u0027next\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security\n\nPull security subsystem updates from James Morris:\n \"Nothing groundbreaking for this kernel, just cleanups and fixes, and a\n couple of Smack enhancements.\"\n\n* \u0027next\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (21 commits)\n Smack: Maintainer Record\n Smack: don\u0027t show empty rules when /smack/load or /smack/load2 is read\n Smack: user access check bounds\n Smack: onlycap limits on CAP_MAC_ADMIN\n Smack: fix smack_new_inode bogosities\n ima: audit is compiled only when enabled\n ima: ima_initialized is set only if successful\n ima: add policy for pseudo fs\n ima: remove unused cleanup functions\n ima: free securityfs violations file\n ima: use full pathnames in measurement list\n security: Fix nommu build.\n samples: seccomp: add .gitignore for untracked executables\n tpm: check the chip reference before using it\n TPM: fix memleak when register hardware fails\n TPM: chip disabled state erronously being reported as error\n MAINTAINERS: TPM maintainers\u0027 contacts update\n Merge branches \u0027next-queue\u0027 and \u0027next\u0027 into next\n Remove unused code from MPI library\n Revert \"crypto: GnuPG based MPI lib - additional sources (part 4)\"\n ...\n" }, { "commit": "a66d2c8f7ec1284206ca7c14569e2a607583f1e3", "tree": "08cf68bcef3559b370843cab8191e5cc0f740bde", "parents": [ "a6be1fcbc57f95bb47ef3c8e4ee3d83731b8f21e", "8cae6f7158ec1fa44c8a04a43db7d8020ec60437" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 23 12:27:27 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 23 12:27:27 2012 -0700" }, "message": "Merge branch \u0027for-linus-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull the big VFS changes from Al Viro:\n \"This one is *big* and changes quite a few things around VFS. What\u0027s in there:\n\n - the first of two really major architecture changes - death to open\n intents.\n\n The former is finally there; it was very long in making, but with\n Miklos getting through really hard and messy final push in\n fs/namei.c, we finally have it. Unlike his variant, this one\n doesn\u0027t introduce struct opendata; what we have instead is\n -\u003eatomic_open() taking preallocated struct file * and passing\n everything via its fields.\n\n Instead of returning struct file *, it returns -E... on error, 0\n on success and 1 in \"deal with it yourself\" case (e.g. symlink\n found on server, etc.).\n\n See comments before fs/namei.c:atomic_open(). That made a lot of\n goodies finally possible and quite a few are in that pile:\n -\u003elookup(), -\u003ed_revalidate() and -\u003ecreate() do not get struct\n nameidata * anymore; -\u003elookup() and -\u003ed_revalidate() get lookup\n flags instead, -\u003ecreate() gets \"do we want it exclusive\" flag.\n\n With the introduction of new helper (kern_path_locked()) we are rid\n of all struct nameidata instances outside of fs/namei.c; it\u0027s still\n visible in namei.h, but not for long. Come the next cycle,\n declaration will move either to fs/internal.h or to fs/namei.c\n itself. [me, miklos, hch]\n\n - The second major change: behaviour of final fput(). Now we have\n __fput() done without any locks held by caller *and* not from deep\n in call stack.\n\n That obviously lifts a lot of constraints on the locking in there.\n Moreover, it\u0027s legal now to call fput() from atomic contexts (which\n has immediately simplified life for aio.c). We also don\u0027t need\n anti-recursion logics in __scm_destroy() anymore.\n\n There is a price, though - the damn thing has become partially\n asynchronous. For fput() from normal process we are guaranteed\n that pending __fput() will be done before the caller returns to\n userland, exits or gets stopped for ptrace.\n\n For kernel threads and atomic contexts it\u0027s done via\n schedule_work(), so theoretically we might need a way to make sure\n it\u0027s finished; so far only one such place had been found, but there\n might be more.\n\n There\u0027s flush_delayed_fput() (do all pending __fput()) and there\u0027s\n __fput_sync() (fput() analog doing __fput() immediately). I hope\n we won\u0027t need them often; see warnings in fs/file_table.c for\n details. [me, based on task_work series from Oleg merged last\n cycle]\n\n - sync series from Jan\n\n - large part of \"death to sync_supers()\" work from Artem; the only\n bits missing here are exofs and ext4 ones. As far as I understand,\n those are going via the exofs and ext4 trees resp.; once they are\n in, we can put -\u003ewrite_super() to the rest, along with the thread\n calling it.\n\n - preparatory bits from unionmount series (from dhowells).\n\n - assorted cleanups and fixes all over the place, as usual.\n\n This is not the last pile for this cycle; there\u0027s at least jlayton\u0027s\n ESTALE work and fsfreeze series (the latter - in dire need of fixes,\n so I\u0027m not sure it\u0027ll make the cut this cycle). I\u0027ll probably throw\n symlink/hardlink restrictions stuff from Kees into the next pile, too.\n Plus there\u0027s a lot of misc patches I hadn\u0027t thrown into that one -\n it\u0027s large enough as it is...\"\n\n* \u0027for-linus-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (127 commits)\n ext4: switch EXT4_IOC_RESIZE_FS to mnt_want_write_file()\n btrfs: switch btrfs_ioctl_balance() to mnt_want_write_file()\n switch dentry_open() to struct path, make it grab references itself\n spufs: shift dget/mntget towards dentry_open()\n zoran: don\u0027t bother with struct file * in zoran_map\n ecryptfs: don\u0027t reinvent the wheels, please - use struct completion\n don\u0027t expose I_NEW inodes via dentry-\u003ed_inode\n tidy up namei.c a bit\n unobfuscate follow_up() a bit\n ext3: pass custom EOF to generic_file_llseek_size()\n ext4: use core vfs llseek code for dir seeks\n vfs: allow custom EOF in generic_file_llseek code\n vfs: Avoid unnecessary WB_SYNC_NONE writeback during sys_sync and reorder sync passes\n vfs: Remove unnecessary flushing of block devices\n vfs: Make sys_sync writeout also block device inodes\n vfs: Create function for iterating over block devices\n vfs: Reorder operations during sys_sync\n quota: Move quota syncing to -\u003esync_fs method\n quota: Split dquot_quota_sync() to writeback and cache flushing part\n vfs: Move noop_backing_dev_info check from sync into writeback\n ...\n" }, { "commit": "765927b2d508712d320c8934db963bbe14c3fcec", "tree": "97acdb14fae285764def396c4ed01d4d5c93e76a", "parents": [ "bf349a447059656ebe63fb4fd1ccb27ac1da22ad" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 26 21:58:53 2012 +0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Jul 23 00:01:29 2012 +0400" }, "message": "switch dentry_open() to struct path, make it grab references itself\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "d35abdb28824cf74f0a106a0f9c6f3ff700a35bf", "tree": "860bbe5c9e2d42293698cd93c32299b2c6dac5a2", "parents": [ "6120d3dbb1220792ebea88cd475e1ec8f8620a93" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Jun 30 11:55:24 2012 +0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Jul 22 23:58:01 2012 +0400" }, "message": "hold task_lock around checks in keyctl\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "67d1214551e800f9fe7dc7c47a346d2df0fafed5", "tree": "ffcc93af9390339adda36668255e617073b724a1", "parents": [ "158e1645e07f3e9f7e4962d7a0997f5c3b98311b" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Jun 27 11:07:19 2012 +0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Jul 22 23:57:56 2012 +0400" }, "message": "merge task_work and rcu_head, get rid of separate allocation for keyring case\n\ntask_work and rcu_head are identical now; merge them (calling the result\nstruct callback_head, rcu_head #define\u0027d to it), kill separate allocation\nin security/keys since we can just use cred-\u003ercu now.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "41f9d29f09ca0b22c3631e8a39676e74cda9bcc0", "tree": "7ab5ed25f14466471fb55536e1cf71c514fb7fe9", "parents": [ "7266702805f9d824f92ce5c4069eca65d0f21d28" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 26 22:10:04 2012 +0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Jul 22 23:57:54 2012 +0400" }, "message": "trimming task_work: kill -\u003edata\n\nget rid of the only user of -\u003edata; this is _not_ the final variant - in the\nend we\u0027ll have task_work and rcu_head identical and just use cred-\u003ercu,\nat which point the separate allocation will be gone completely.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "abaa72d7fd9a20a67b62e6afa0e746e27851dc33", "tree": "ebe4134fcc93a6e205e6004b3e652d7a62281651", "parents": [ "67da22d23fa6f3324e03bcd0580b914b2e4afbf3", "3e4b9459fb0e149c6b74c9e89399a8fc39a92b44" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 19 11:17:30 2012 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 19 11:17:30 2012 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nConflicts:\n\tdrivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c\n" }, { "commit": "e2f3b78557ff11f58d836e016900c3210f4fb1c1", "tree": "7ecaa578bee0dd90fc22daa0e3a736411f2d4309", "parents": [ "6f7024285864290259d6b4c36f9e84a4b89ec3c4", "3d2195c3324b27e65ba53d9626a6bd91a2515797" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 18 13:42:44 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 18 13:42:44 2012 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security\n\nPull SELinux regression fixes from James Morris.\n\nAndrew Morton has a box that hit that open perms problem.\n\nI also renamed the \"epollwakeup\" selinux name for the new capability to\nbe \"block_suspend\", to match the rename done by commit d9914cf66181\n(\"PM: Rename CAP_EPOLLWAKEUP to CAP_BLOCK_SUSPEND\").\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:\n SELinux: do not check open perms if they are not known to policy\n SELinux: include definition of new capabilities\n" }, { "commit": "3d2195c3324b27e65ba53d9626a6bd91a2515797", "tree": "c17445689c2926fa446c9bef4f5b169b60ce4f15", "parents": [ "64919e60915c5151b3dd4c8d2d9237a115ca990c" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Fri Jul 06 14:13:30 2012 -0400" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Mon Jul 16 11:41:47 2012 +1000" }, "message": "SELinux: do not check open perms if they are not known to policy\n\nWhen I introduced open perms policy didn\u0027t understand them and I\nimplemented them as a policycap. When I added the checking of open perm\nto truncate I forgot to conditionalize it on the userspace defined\npolicy capability. Running an old policy with a new kernel will not\ncheck open on open(2) but will check it on truncate. Conditionalize the\ntruncate check the same as the open check.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nCc: stable@vger.kernel.org # 3.4.x\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "64919e60915c5151b3dd4c8d2d9237a115ca990c", "tree": "712cbc272e15a3b3fe70f27a1ac1d7c57bf2300c", "parents": [ "918227bb1b59444a2c467711fd50cc22bb4a897b" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Fri Jul 06 14:13:29 2012 -0400" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Mon Jul 16 11:40:31 2012 +1000" }, "message": "SELinux: include definition of new capabilities\n\nThe kernel has added CAP_WAKE_ALARM and CAP_EPOLLWAKEUP. We need to\ndefine these in SELinux so they can be mediated by policy.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "65ee7f45cf075adcdd6b6ef365f5a5507f1ea5c5", "tree": "f674119c2d4e6eb877bb283dce89bdafa0442fa4", "parents": [ "3518721a8932b2a243f415c374aef020380efc9d" ], "author": { "name": "Rafal Krypa", "email": "r.krypa@samsung.com", "time": "Mon Jul 09 19:36:34 2012 +0200" }, "committer": { "name": "Casey Schaufler", "email": "casey@schaufler-ca.com", "time": "Fri Jul 13 15:49:24 2012 -0700" }, "message": "Smack: don\u0027t show empty rules when /smack/load or /smack/load2 is read\n\nThis patch removes empty rules (i.e. with access set to \u0027-\u0027) from the\nrule list presented to user space.\n\nSmack by design never removes labels nor rules from its lists. Access\nfor a rule may be set to \u0027-\u0027 to effectively disable it. Such rules would\nshow up in the listing generated when /smack/load or /smack/load2 is\nread. This may cause clutter if many rules were disabled.\n\nAs a rule with access set to \u0027-\u0027 is equivalent to no rule at all, they\nmay be safely hidden from the listing.\n\nTargeted for git://git.gitorious.org/smack-next/kernel.git\n\nSigned-off-by: Rafal Krypa \u003cr.krypa@samsung.com\u003e\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n" }, { "commit": "3518721a8932b2a243f415c374aef020380efc9d", "tree": "f16a039687aaf395e6751b7a9edda85e83b52502", "parents": [ "1880eff77e7a7cb46c68fae7cfa33f72f0a6e70e" ], "author": { "name": "Casey Schaufler", "email": "casey@schaufler-ca.com", "time": "Mon Jun 18 19:01:36 2012 -0700" }, "committer": { "name": "Casey Schaufler", "email": "casey@schaufler-ca.com", "time": "Fri Jul 13 15:49:24 2012 -0700" }, "message": "Smack: user access check bounds\n\nSome of the bounds checking used on the /smack/access\ninterface was lost when support for long labels was\nadded. No kernel access checks are affected, however\nthis is a case where /smack/access could be used\nincorrectly and fail to detect the error. This patch\nreintroduces the original checks.\n\nTargeted for git://git.gitorious.org/smack-next/kernel.git\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n" }, { "commit": "1880eff77e7a7cb46c68fae7cfa33f72f0a6e70e", "tree": "fc4b9a2ca7c643a30cbe2260886fdbd969bf2b50", "parents": [ "eb982cb4cf6405b97ea1f9e1d10864981f269d46" ], "author": { "name": "Casey Schaufler", "email": "casey@schaufler-ca.com", "time": "Tue Jun 05 15:28:30 2012 -0700" }, "committer": { "name": "Casey Schaufler", "email": "casey@schaufler-ca.com", "time": "Fri Jul 13 15:49:23 2012 -0700" }, "message": "Smack: onlycap limits on CAP_MAC_ADMIN\n\nSmack is integrated with the POSIX capabilities scheme,\nusing the capabilities CAP_MAC_OVERRIDE and CAP_MAC_ADMIN to\ndetermine if a process is allowed to ignore Smack checks or\nchange Smack related data respectively. Smack provides an\nadditional restriction that if an onlycap value is set\nby writing to /smack/onlycap only tasks with that Smack\nlabel are allowed to use CAP_MAC_OVERRIDE.\n\nThis change adds CAP_MAC_ADMIN as a capability that is affected\nby the onlycap mechanism.\n\nTargeted for git://git.gitorious.org/smack-next/kernel.git\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n" }, { "commit": "eb982cb4cf6405b97ea1f9e1d10864981f269d46", "tree": "8d89448e0ef96d587ea8052021a721e632b4b318", "parents": [ "417c6c8ee2eb6975f357d8975af94ba5fbeaf82d" ], "author": { "name": "Casey Schaufler", "email": "casey@schaufler-ca.com", "time": "Wed May 23 17:46:58 2012 -0700" }, "committer": { "name": "Casey Schaufler", "email": "casey@schaufler-ca.com", "time": "Fri Jul 13 15:49:23 2012 -0700" }, "message": "Smack: fix smack_new_inode bogosities\n\nIn January of 2012 Al Viro pointed out three bits of code that\nhe titled \"new_inode_smack bogosities\". This patch repairs these\nerrors.\n\n1. smack_sb_kern_mount() included a NULL check that is impossible.\n The check and NULL case are removed.\n2. smack_kb_kern_mount() included pointless locking. The locking is\n removed. Since this is the only place that lock was used the lock\n is removed from the superblock_smack structure.\n3. smk_fill_super() incorrectly and unnecessarily set the Smack label\n for the smackfs root inode. The assignment has been removed.\n\nTargeted for git://gitorious.org/smack-next/kernel.git\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n" }, { "commit": "417c6c8ee2eb6975f357d8975af94ba5fbeaf82d", "tree": "02af1e4363f415bfaa45c50a530cee78ecdf87b8", "parents": [ "7ff2267af595e642f1009198ab49e86a239148fa" ], "author": { "name": "Dmitry Kasatkin", "email": "dmitry.kasatkin@intel.com", "time": "Mon Jun 25 12:18:21 2012 +0300" }, "committer": { "name": "Mimi Zohar", "email": "zohar@linux.vnet.ibm.com", "time": "Thu Jul 05 16:43:59 2012 -0400" }, "message": "ima: audit is compiled only when enabled\n\nIMA auditing code was compiled even when CONFIG_AUDIT was not enabled.\nThis patch compiles auditing code only when possible and enabled.\n\nSigned-off-by: Dmitry Kasatkin \u003cdmitry.kasatkin@intel.com\u003e\nSigned-off-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\n" }, { "commit": "7ff2267af595e642f1009198ab49e86a239148fa", "tree": "bd9187795ee24b4a339593caff40ea677e706e17", "parents": [ "8445d64dd761440fb5c73a2abba25009f4bf0e4c" ], "author": { "name": "Dmitry Kasatkin", "email": "dmitry.kasatkin@intel.com", "time": "Mon Jun 25 12:18:11 2012 +0300" }, "committer": { "name": "Mimi Zohar", "email": "zohar@linux.vnet.ibm.com", "time": "Thu Jul 05 16:43:57 2012 -0400" }, "message": "ima: ima_initialized is set only if successful\n\nSet ima_initialized only if initialization was successful.\n\nSigned-off-by: Dmitry Kasatkin \u003cdmitry.kasatkin@intel.com\u003e\nSigned-off-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\n" }, { "commit": "8445d64dd761440fb5c73a2abba25009f4bf0e4c", "tree": "1529319b3b3fed827a02b5b8fafcd367045d540c", "parents": [ "c7de7adc18241a0eb10a6e1fed7cb1e01f53c85a" ], "author": { "name": "Dmitry Kasatkin", "email": "dmitry.kasatkin@intel.com", "time": "Mon Jun 25 12:18:09 2012 +0300" }, "committer": { "name": "Mimi Zohar", "email": "zohar@linux.vnet.ibm.com", "time": "Thu Jul 05 16:42:33 2012 -0400" }, "message": "ima: add policy for pseudo fs\n\nExclude DEVPTS and BINFMT filesystems from the measurement policy.\n\nSigned-off-by: Dmitry Kasatkin \u003cdmitry.kasatkin@intel.com\u003e\nSigned-off-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\n" }, { "commit": "c90a9bb9073a4096596360f02ea711c619663494", "tree": "dc85d9f4c0d423e6b523e81c41a5b68e267de14f", "parents": [ "23c342153ef2a4ad8bd4f2d6515126449658d2b3", "9e85a6f9dc231f3ed3c1dc1b12217505d970142a" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 05 03:44:25 2012 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 05 03:44:25 2012 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n" }, { "commit": "75331a597cf4cde51d9b0bb22cbd03b9837ef9e4", "tree": "799891ab0798cc42b1a0b8dc77cd4c42b0d17036", "parents": [ "09b243577be319ef55310b45c65737008f3ebf12" ], "author": { "name": "Paul Mundt", "email": "lethal@linux-sh.org", "time": "Mon Jul 02 14:34:11 2012 +0900" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Tue Jul 03 21:41:03 2012 +1000" }, "message": "security: Fix nommu build.\n\nThe security + nommu configuration presently blows up with an undefined\nreference to BDI_CAP_EXEC_MAP:\n\nsecurity/security.c: In function \u0027mmap_prot\u0027:\nsecurity/security.c:687:36: error: dereferencing pointer to incomplete type\nsecurity/security.c:688:16: error: \u0027BDI_CAP_EXEC_MAP\u0027 undeclared (first use in this function)\nsecurity/security.c:688:16: note: each undeclared identifier is reported only once for each function it appears in\n\ninclude backing-dev.h directly to fix it up.\n\nSigned-off-by: Paul Mundt \u003clethal@linux-sh.org\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "c7de7adc18241a0eb10a6e1fed7cb1e01f53c85a", "tree": "2b79a44399e29c7d20397ec5188b42528f8c90d5", "parents": [ "0ea4f8ae416a9e8d15f4e20680879358f620e8b8" ], "author": { "name": "Dmitry Kasatkin", "email": "dmitry.kasatkin@intel.com", "time": "Mon Jun 25 12:18:10 2012 +0300" }, "committer": { "name": "Mimi Zohar", "email": "zohar@linux.vnet.ibm.com", "time": "Mon Jul 02 16:43:30 2012 -0400" }, "message": "ima: remove unused cleanup functions\n\nIMA cannot be used as module and does not need __exit functions.\nRemoved them.\n\nSigned-off-by: Dmitry Kasatkin \u003cdmitry.kasatkin@intel.com\u003e\nSigned-off-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\n" }, { "commit": "0ea4f8ae416a9e8d15f4e20680879358f620e8b8", "tree": "68c03378249e4d3c543f5c6bf3833774a3c58adb", "parents": [ "08e1b76ae399a010c0d0916b125d75aed6961d16" ], "author": { "name": "Dmitry Kasatkin", "email": "dmitry.kasatkin@intel.com", "time": "Sun Jan 29 19:19:08 2012 -0500" }, "committer": { "name": "Mimi Zohar", "email": "zohar@linux.vnet.ibm.com", "time": "Mon Jul 02 16:43:30 2012 -0400" }, "message": "ima: free securityfs violations file\n\nOn ima_fs_init() error, free securityfs violations file.\n\nSigned-off-by: Dmitry Kasatkin \u003cdmitry.kasatkin@intel.com\u003e\nSigned-off-by: Mimi Zohar \u003czohar@us.ibm.com\u003e\n" }, { "commit": "08e1b76ae399a010c0d0916b125d75aed6961d16", "tree": "88806da1802a75d3edbb46436bb509150177eb76", "parents": [ "659b5e76521c10331495cbd9acb7217e38ff9750" ], "author": { "name": "Mimi Zohar", "email": "zohar@linux.vnet.ibm.com", "time": "Wed Jun 20 09:32:55 2012 -0400" }, "committer": { "name": "Mimi Zohar", "email": "zohar@linux.vnet.ibm.com", "time": "Mon Jul 02 16:43:29 2012 -0400" }, "message": "ima: use full pathnames in measurement list\n\nThe IMA measurement list contains filename hints, which can be\nambigious without the full pathname. This patch replaces the\nfilename hint with the full pathname, simplifying for userspace\nthe correlating of file hash measurements with files.\n\nChange log v1:\n- Revert to short filenames, when full pathname is longer than IMA\n measurement buffer size. (Based on Dmitry\u0027s review)\n\nSigned-off-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\n" }, { "commit": "659b5e76521c10331495cbd9acb7217e38ff9750", "tree": "ed772e27f45fe8984c47166143b48ee3fb0d3bb2", "parents": [ "8aec836acbe56a27080723187f0a0f1686662318" ], "author": { "name": "Paul Mundt", "email": "lethal@linux-sh.org", "time": "Mon Jul 02 14:34:11 2012 +0900" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Mon Jul 02 23:56:04 2012 +1000" }, "message": "security: Fix nommu build.\n\nThe security + nommu configuration presently blows up with an undefined\nreference to BDI_CAP_EXEC_MAP:\n\nsecurity/security.c: In function \u0027mmap_prot\u0027:\nsecurity/security.c:687:36: error: dereferencing pointer to incomplete type\nsecurity/security.c:688:16: error: \u0027BDI_CAP_EXEC_MAP\u0027 undeclared (first use in this function)\nsecurity/security.c:688:16: note: each undeclared identifier is reported only once for each function it appears in\n\ninclude backing-dev.h directly to fix it up.\n\nSigned-off-by: Paul Mundt \u003clethal@linux-sh.org\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "a31f2d17b331db970259e875b7223d3aba7e3821", "tree": "0d10021be81446ab360f4240b0d16729f518387f", "parents": [ "dd7f36ba3ce17d4fe85987d83efd5901b0935816" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Jun 29 06:15:21 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jun 29 16:46:02 2012 -0700" }, "message": "netlink: add netlink_kernel_cfg parameter to netlink_kernel_create\n\nThis patch adds the following structure:\n\nstruct netlink_kernel_cfg {\n unsigned int groups;\n void (*input)(struct sk_buff *skb);\n struct mutex *cb_mutex;\n};\n\nThat can be passed to netlink_kernel_create to set optional configurations\nfor netlink kernel sockets.\n\nI\u0027ve populated this structure by looking for NULL and zero parameters at the\nexisting code. The remaining parameters that always need to be set are still\nleft in the original interface.\n\nThat includes optional parameters for the netlink socket creation. This allows\neasy extensibility of this interface in the future.\n\nThis patch also adapts all callers to use this new interface.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "01f534d0ae9d7b3ad4dcd943d53418731da82ea7", "tree": "fe28a740034f70149a07812e62b5b88080e95531", "parents": [ "b61bb01974730e2fd7d36ab4cc848ca6f44cffd4" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Jun 26 21:41:57 2012 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Jun 26 21:54:06 2012 -0700" }, "message": "selinux: netlink: Move away from NLMSG_PUT().\n\nAnd use nlmsg_data() while we\u0027re here too.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "66dd07b88a1c9d446f32253da606b87324fa620e", "tree": "4e0971bdd543585c7ab46716ae808a7fd82f9c35", "parents": [ "f52c44cd27b4a0be37ef97f0466e4095ebebef3f", "cfaf025112d3856637ff34a767ef785ef5cf2ca9" ], "author": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Sun Jun 10 22:52:10 2012 +1000" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Sun Jun 10 22:52:10 2012 +1000" }, "message": "Merge commit \u0027v3.5-rc2\u0027 into next\n" }, { "commit": "2597a8344ce051d0afe331706bcb4660bbdb9861", "tree": "f0ab9af632909f4afea1a162370a94583d91ba78", "parents": [ "4c809d630c17af0e8112d5362367ced9b44b009b" ], "author": { "name": "Alban Crequy", "email": "alban.crequy@collabora.co.uk", "time": "Mon May 14 03:56:39 2012 +0000" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Thu Jun 07 14:58:43 2012 +0200" }, "message": "netfilter: selinux: switch hook PFs to nfproto\n\nThis patch is a cleanup. Use NFPROTO_* for consistency with other\nnetfilter code.\n\nSigned-off-by: Alban Crequy \u003calban.crequy@collabora.co.uk\u003e\nReviewed-by: Javier Martinez Canillas \u003cjavier.martinez@collabora.co.uk\u003e\nReviewed-by: Vincent Sanders \u003cvincent.sanders@collabora.co.uk\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "1193755ac6328ad240ba987e6ec41d5e8baf0680", "tree": "40bf847d7e3ebaa57b107151d14e6cd1d280cc6d", "parents": [ "4edebed86690eb8db9af3ab85baf4a34e73266cc", "0ef97dcfce4179a2eba046b855ee2f91d6f1b414" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 01 10:34:35 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 01 10:34:35 2012 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull vfs changes from Al Viro.\n \"A lot of misc stuff. The obvious groups:\n * Miklos\u0027 atomic_open series; kills the damn abuse of\n -\u003ed_revalidate() by NFS, which was the major stumbling block for\n all work in that area.\n * ripping security_file_mmap() and dealing with deadlocks in the\n area; sanitizing the neighborhood of vm_mmap()/vm_munmap() in\n general.\n * -\u003eencode_fh() switched to saner API; insane fake dentry in\n mm/cleancache.c gone.\n * assorted annotations in fs (endianness, __user)\n * parts of Artem\u0027s -\u003es_dirty work (jff2 and reiserfs parts)\n * -\u003eupdate_time() work from Josef.\n * other bits and pieces all over the place.\n\n Normally it would\u0027ve been in two or three pull requests, but\n signal.git stuff had eaten a lot of time during this cycle ;-/\"\n\nFix up trivial conflicts in Documentation/filesystems/vfs.txt (the\n\u0027truncate_range\u0027 inode method was removed by the VM changes, the VFS\nupdate adds an \u0027update_time()\u0027 method), and in fs/btrfs/ulist.[ch] (due\nto sparse fix added twice, with other changes nearby).\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (95 commits)\n nfs: don\u0027t open in -\u003ed_revalidate\n vfs: retry last component if opening stale dentry\n vfs: nameidata_to_filp(): don\u0027t throw away file on error\n vfs: nameidata_to_filp(): inline __dentry_open()\n vfs: do_dentry_open(): don\u0027t put filp\n vfs: split __dentry_open()\n vfs: do_last() common post lookup\n vfs: do_last(): add audit_inode before open\n vfs: do_last(): only return EISDIR for O_CREAT\n vfs: do_last(): check LOOKUP_DIRECTORY\n vfs: do_last(): make ENOENT exit RCU safe\n vfs: make follow_link check RCU safe\n vfs: do_last(): use inode variable\n vfs: do_last(): inline walk_component()\n vfs: do_last(): make exit RCU safe\n vfs: split do_lookup()\n Btrfs: move over to use -\u003eupdate_time\n fs: introduce inode operation -\u003eupdate_time\n reiserfs: get rid of resierfs_sync_super\n reiserfs: mark the superblock as dirty a bit later\n ...\n" }, { "commit": "98de59bfe4b2ff6344d9ad8e5296f80de5dcc5b6", "tree": "f2baf4a8eec3299d5e55dd3899812407cd6d52a7", "parents": [ "9ac4ed4bd0adec75db13a4b08a39a3918ec0e3c9" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed May 30 19:58:30 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Jun 01 10:37:17 2012 -0400" }, "message": "take calculation of final prot in security_mmap_file() into a helper\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "8b3ec6814c83d76b85bd13badc48552836c24839", "tree": "2430a4511c7ea41f67b0d841f4c42eac43828db3", "parents": [ "e5467859f7f79b69fc49004403009dfdba3bec53" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed May 30 17:11:23 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Jun 01 10:37:01 2012 -0400" }, "message": "take security_mmap_file() outside of -\u003emmap_sem\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "fb21affa49204acd409328415b49bfe90136653c", "tree": "3535dbe0c0aad049a38cadfcffe78409397a1b32", "parents": [ "a00b6151a2ae4c52576c35d3998e144a993d50b8", "f23ca335462e3c84f13270b9e65f83936068ec2c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 31 18:47:30 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 31 18:47:30 2012 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal\n\nPull second pile of signal handling patches from Al Viro:\n \"This one is just task_work_add() series + remaining prereqs for it.\n\n There probably will be another pull request from that tree this\n cycle - at least for helpers, to get them out of the way for per-arch\n fixes remaining in the tree.\"\n\nFix trivial conflict in kernel/irq/manage.c: the merge of Andrew\u0027s pile\nhad brought in commit 97fd75b7b8e0 (\"kernel/irq/manage.c: use the\npr_foo() infrastructure to prefix printks\") which changed one of the\npr_err() calls that this merge moves around.\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal:\n keys: kill task_struct-\u003ereplacement_session_keyring\n keys: kill the dummy key_replace_session_keyring()\n keys: change keyctl_session_to_parent() to use task_work_add()\n genirq: reimplement exit_irq_thread() hook via task_work_add()\n task_work_add: generic process-context callbacks\n avr32: missed _TIF_NOTIFY_RESUME on one of do_notify_resume callers\n parisc: need to check NOTIFY_RESUME when exiting from syscall\n move key_repace_session_keyring() into tracehook_notify_resume()\n TIF_NOTIFY_RESUME is defined on all targets now\n" }, { "commit": "ac34ebb3a67e699edcb5ac72f19d31679369dfaa", "tree": "21785208005952128545c0d7804c2dddf177766f", "parents": [ "ee62c6b2dc93c09585b51fad18449dc5edb9977f" ], "author": { "name": "Christopher Yeoh", "email": "cyeoh@au1.ibm.com", "time": "Thu May 31 16:26:42 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 31 17:49:32 2012 -0700" }, "message": "aio/vfs: cleanup of rw_copy_check_uvector() and compat_rw_copy_check_uvector()\n\nA cleanup of rw_copy_check_uvector and compat_rw_copy_check_uvector after\nchanges made to support CMA in an earlier patch.\n\nRather than having an additional check_access parameter to these\nfunctions, the first paramater type is overloaded to allow the caller to\nspecify CHECK_IOVEC_ONLY which means check that the contents of the iovec\nare valid, but do not check the memory that they point to. This is used\nby process_vm_readv/writev where we need to validate that a iovec passed\nto the syscall is valid but do not want to check the memory that it points\nto at this point because it refers to an address space in another process.\n\nSigned-off-by: Chris Yeoh \u003cyeohc@au1.ibm.com\u003e\nReviewed-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "81ab6e7b26b453a795d46f2616ed0e31d97f05b9", "tree": "a8d50eb5b35ad93b793450bfef4d90df34494a2c", "parents": [ "ae3cef7300e9fddc35ad251dd5f27c5b88c8594a" ], "author": { "name": "Boaz Harrosh", "email": "bharrosh@panasas.com", "time": "Thu May 31 16:26:15 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 31 17:49:28 2012 -0700" }, "message": "kmod: convert two call sites to call_usermodehelper_fns()\n\nBoth kernel/sys.c \u0026\u0026 security/keys/request_key.c where inlining the exact\nsame code as call_usermodehelper_fns(); So simply convert these sites to\ndirectly use call_usermodehelper_fns().\n\nSigned-off-by: Boaz Harrosh \u003cbharrosh@panasas.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4f1c28d241d0882f25112d494885cd6084db225b", "tree": "4332c441b47b3ce6f29b424d24923aebdc44d7eb", "parents": [ "ecb41a77411358d385e3fde5b4e98a5f3d9cfdd5" ], "author": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 31 16:26:02 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 31 17:49:26 2012 -0700" }, "message": "security/keys/keyctl.c: suppress memory allocation failure warning\n\nThis allocation may be large. The code is probing to see if it will\nsucceed and if not, it falls back to vmalloc(). We should suppress any\npage-allocation failure messages when the fallback happens.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e5467859f7f79b69fc49004403009dfdba3bec53", "tree": "73b011daf79eeddd61bbcaf65cd197b5e5f6f149", "parents": [ "d007794a182bc072a7b7479909dbd0d67ba341be" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed May 30 13:30:51 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu May 31 13:11:54 2012 -0400" }, "message": "split -\u003efile_mmap() into -\u003emmap_addr()/-\u003emmap_file()\n\n... i.e. file-dependent and address-dependent checks.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "d007794a182bc072a7b7479909dbd0d67ba341be", "tree": "75aa7ccd563a0fe8b60391824c92f64098674dda", "parents": [ "cf74d14c4fbce9bcc9eb62f52d721d3399a2b87f" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed May 30 13:11:37 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu May 31 13:10:54 2012 -0400" }, "message": "split cap_mmap_addr() out of cap_file_mmap()\n\n... switch callers.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "cc1dad7183e4cb7f5d313b6942f2059fc0eabab6", "tree": "372614e5c981ff868682af2babdd8d0fec356952", "parents": [ "c862868bb455694704c255481369c40d7185eb25" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Apr 02 19:40:47 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue May 29 23:28:33 2012 -0400" }, "message": "selinuxfs snprintf() misuses\n\na) %d does _not_ produce a page worth of output\nb) snprintf() doesn\u0027t return negatives - it used to in old glibc, but\nthat\u0027s the kernel...\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "423b9788023263364ea5de04189f02bd9b6a12db", "tree": "fc3ee4814aa8322fb2abb01c50d96568aa51bd9b", "parents": [ "ff2bb047c4bce9742e94911eeb44b4d6ff4734ab" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Mon May 21 12:32:13 2012 +0100" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Fri May 25 20:51:42 2012 +1000" }, "message": "KEYS: Fix some sparse warnings\n\nFix some sparse warnings in the keyrings code:\n\n (1) compat_keyctl_instantiate_key_iov() should be static.\n\n (2) There were a couple of places where a pointer was being compared against\n integer 0 rather than NULL.\n\n (3) keyctl_instantiate_key_common() should not take a __user-labelled iovec\n pointer as the caller must have copied the iovec to kernel space.\n\n (4) __key_link_begin() takes and __key_link_end() releases\n keyring_serialise_link_sem under some circumstances and so this should be\n declared.\n\n Note that adding __acquires() and __releases() for this doesn\u0027t help cure\n the warnings messages - something only commenting out both helps.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "413cd3d9abeaef590e5ce00564f7a443165db238", "tree": "fc7d254053793a95d1470f7c9eafb782d8cf91d6", "parents": [ "4d1d61a6b203d957777d73fcebf19d90b038b5b2" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Fri May 11 10:59:08 2012 +1000" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed May 23 22:11:23 2012 -0400" }, "message": "keys: change keyctl_session_to_parent() to use task_work_add()\n\nChange keyctl_session_to_parent() to use task_work_add() and move\nkey_replace_session_keyring() logic into task_work-\u003efunc().\n\nNote that we do task_work_cancel() before task_work_add() to ensure that\nonly one work can be pending at any time. This is important, we must not\nallow user-space to abuse the parent\u0027s -\u003etask_works list.\n\nThe callback, replace_session_keyring(), checks PF_EXITING. I guess this\nis not really needed but looks better.\n\nAs a side effect, this fixes the (unlikely) race. The callers of\nkey_replace_session_keyring() and keyctl_session_to_parent() lack the\nnecessary barriers, the parent can miss the request.\n\nNow we can remove task_struct-\u003ereplacement_session_keyring and related\ncode.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Richard Kuo \u003crkuo@codeaurora.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Alexander Gordeev \u003cagordeev@redhat.com\u003e\nCc: Chris Zankel \u003cchris@zankel.net\u003e\nCc: David Smith \u003cdsmith@redhat.com\u003e\nCc: \"Frank Ch. Eigler\" \u003cfche@redhat.com\u003e\nCc: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nCc: Larry Woodman \u003clwoodman@redhat.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "1227dd773d8d4e3983b4b751f9ffa0f41402fb7c", "tree": "8fb48e099710fa179c6ca7dd4c5298513dcd5659", "parents": [ "f9369910a6225b8d4892c3f20ae740a711cd5ace" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Apr 24 02:44:49 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed May 23 22:09:19 2012 -0400" }, "message": "TIF_NOTIFY_RESUME is defined on all targets now\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "644473e9c60c1ff4f6351fed637a6e5551e3dce7", "tree": "10316518bedc735a2c6552886658d69dfd9f1eb0", "parents": [ "fb827ec68446c83e9e8754fa9b55aed27ecc4661", "4b06a81f1daee668fbd6de85557bfb36dd36078f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 23 17:42:39 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 23 17:42:39 2012 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace\n\nPull user namespace enhancements from Eric Biederman:\n \"This is a course correction for the user namespace, so that we can\n reach an inexpensive, maintainable, and reasonably complete\n implementation.\n\n Highlights:\n - Config guards make it impossible to enable the user namespace and\n code that has not been converted to be user namespace safe.\n\n - Use of the new kuid_t type ensures the if you somehow get past the\n config guards the kernel will encounter type errors if you enable\n user namespaces and attempt to compile in code whose permission\n checks have not been updated to be user namespace safe.\n\n - All uids from child user namespaces are mapped into the initial\n user namespace before they are processed. Removing the need to add\n an additional check to see if the user namespace of the compared\n uids remains the same.\n\n - With the user namespaces compiled out the performance is as good or\n better than it is today.\n\n - For most operations absolutely nothing changes performance or\n operationally with the user namespace enabled.\n\n - The worst case performance I could come up with was timing 1\n billion cache cold stat operations with the user namespace code\n enabled. This went from 156s to 164s on my laptop (or 156ns to\n 164ns per stat operation).\n\n - (uid_t)-1 and (gid_t)-1 are reserved as an internal error value.\n Most uid/gid setting system calls treat these value specially\n anyway so attempting to use -1 as a uid would likely cause\n entertaining failures in userspace.\n\n - If setuid is called with a uid that can not be mapped setuid fails.\n I have looked at sendmail, login, ssh and every other program I\n could think of that would call setuid and they all check for and\n handle the case where setuid fails.\n\n - If stat or a similar system call is called from a context in which\n we can not map a uid we lie and return overflowuid. The LFS\n experience suggests not lying and returning an error code might be\n better, but the historical precedent with uids is different and I\n can not think of anything that would break by lying about a uid we\n can\u0027t map.\n\n - Capabilities are localized to the current user namespace making it\n safe to give the initial user in a user namespace all capabilities.\n\n My git tree covers all of the modifications needed to convert the core\n kernel and enough changes to make a system bootable to runlevel 1.\"\n\nFix up trivial conflicts due to nearby independent changes in fs/stat.c\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (46 commits)\n userns: Silence silly gcc warning.\n cred: use correct cred accessor with regards to rcu read lock\n userns: Convert the move_pages, and migrate_pages permission checks to use uid_eq\n userns: Convert cgroup permission checks to use uid_eq\n userns: Convert tmpfs to use kuid and kgid where appropriate\n userns: Convert sysfs to use kgid/kuid where appropriate\n userns: Convert sysctl permission checks to use kuid and kgids.\n userns: Convert proc to use kuid/kgid where appropriate\n userns: Convert ext4 to user kuid/kgid where appropriate\n userns: Convert ext3 to use kuid/kgid where appropriate\n userns: Convert ext2 to use kuid/kgid where appropriate.\n userns: Convert devpts to use kuid/kgid where appropriate\n userns: Convert binary formats to use kuid/kgid where appropriate\n userns: Add negative depends on entries to avoid building code that is userns unsafe\n userns: signal remove unnecessary map_cred_ns\n userns: Teach inode_capable to understand inodes whose uids map to other namespaces.\n userns: Fail exec for suid and sgid binaries with ids outside our user namespace.\n userns: Convert stat to return values mapped from kuids and kgids\n userns: Convert user specfied uids and gids in chown into kuids and kgid\n userns: Use uid_eq gid_eq helpers when comparing kuids and kgids in the vfs\n ...\n" }, { "commit": "88d6ae8dc33af12fe1c7941b1fae2767374046fd", "tree": "8f17415c0722b0a4d7511ac170cfb4e3802e1ad2", "parents": [ "f5c101892fbd3d2f6d2729bc7eb7b3f6c31dbddd", "0d4dde1ac9a5af74ac76c6ab90557d1ae7b8f5d8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 22 17:40:19 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 22 17:40:19 2012 -0700" }, "message": "Merge branch \u0027for-3.5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup updates from Tejun Heo:\n \"cgroup file type addition / removal is updated so that file types are\n added and removed instead of individual files so that dynamic file\n type addition / removal can be implemented by cgroup and used by\n controllers. blkio controller changes which will come through block\n tree are dependent on this. Other changes include res_counter cleanup\n and disallowing kthread / PF_THREAD_BOUND threads to be attached to\n non-root cgroups.\n\n There\u0027s a reported bug with the file type addition / removal handling\n which can lead to oops on cgroup umount. The issue is being looked\n into. It shouldn\u0027t cause problems for most setups and isn\u0027t a\n security concern.\"\n\nFix up trivial conflict in Documentation/feature-removal-schedule.txt\n\n* \u0027for-3.5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (21 commits)\n res_counter: Account max_usage when calling res_counter_charge_nofail()\n res_counter: Merge res_counter_charge and res_counter_charge_nofail\n cgroups: disallow attaching kthreadd or PF_THREAD_BOUND threads\n cgroup: remove cgroup_subsys-\u003epopulate()\n cgroup: get rid of populate for memcg\n cgroup: pass struct mem_cgroup instead of struct cgroup to socket memcg\n cgroup: make css-\u003erefcnt clearing on cgroup removal optional\n cgroup: use negative bias on css-\u003erefcnt to block css_tryget()\n cgroup: implement cgroup_rm_cftypes()\n cgroup: introduce struct cfent\n cgroup: relocate __d_cgrp() and __d_cft()\n cgroup: remove cgroup_add_file[s]()\n cgroup: convert memcg controller to the new cftype interface\n memcg: always create memsw files if CONFIG_CGROUP_MEM_RES_CTLR_SWAP\n cgroup: convert all non-memcg controllers to the new cftype interface\n cgroup: relocate cftype and cgroup_subsys definitions in controllers\n cgroup: merge cft_release_agent cftype array into the base files array\n cgroup: implement cgroup_add_cftypes() and friends\n cgroup: build list of all cgroups under a given cgroupfs_root\n cgroup: move cgroup_clear_directory() call out of cgroup_populate_dir()\n ...\n" }, { "commit": "cb60e3e65c1b96a4d6444a7a13dc7dd48bc15a2b", "tree": "4322be35db678f6299348a76ad60a2023954af7d", "parents": [ "99262a3dafa3290866512ddfb32609198f8973e9", "ff2bb047c4bce9742e94911eeb44b4d6ff4734ab" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 20:27:36 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 20:27:36 2012 -0700" }, "message": "Merge branch \u0027next\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security\n\nPull security subsystem updates from James Morris:\n \"New notable features:\n - The seccomp work from Will Drewry\n - PR_{GET,SET}_NO_NEW_PRIVS from Andy Lutomirski\n - Longer security labels for Smack from Casey Schaufler\n - Additional ptrace restriction modes for Yama by Kees Cook\"\n\nFix up trivial context conflicts in arch/x86/Kconfig and include/linux/filter.h\n\n* \u0027next\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (65 commits)\n apparmor: fix long path failure due to disconnected path\n apparmor: fix profile lookup for unconfined\n ima: fix filename hint to reflect script interpreter name\n KEYS: Don\u0027t check for NULL key pointer in key_validate()\n Smack: allow for significantly longer Smack labels v4\n gfp flags for security_inode_alloc()?\n Smack: recursive tramsmute\n Yama: replace capable() with ns_capable()\n TOMOYO: Accept manager programs which do not start with / .\n KEYS: Add invalidation support\n KEYS: Do LRU discard in full keyrings\n KEYS: Permit in-place link replacement in keyring list\n KEYS: Perform RCU synchronisation on keys prior to key destruction\n KEYS: Announce key type (un)registration\n KEYS: Reorganise keys Makefile\n KEYS: Move the key config into security/keys/Kconfig\n KEYS: Use the compat keyctl() syscall wrapper on Sparc64 for Sparc32 compat\n Yama: remove an unused variable\n samples/seccomp: fix dependencies on arch macros\n Yama: add additional ptrace scopes\n ...\n" }, { "commit": "ff2bb047c4bce9742e94911eeb44b4d6ff4734ab", "tree": "9d9b1cfa3fc17f0cc13f34ca697306cb1f46b05f", "parents": [ "cffee16e8b997ab947de661e8820e486b0830c94", "c737f8284cac91428f8fcc8281e69117fa16e887" ], "author": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Tue May 22 11:21:06 2012 +1000" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Tue May 22 11:21:06 2012 +1000" }, "message": "Merge branch \u0027master\u0027 of git://git.infradead.org/users/eparis/selinux into next\n\nPer pull request, for 3.5.\n" }, { "commit": "cffee16e8b997ab947de661e8820e486b0830c94", "tree": "f71adb789f6d850367d35b34955f038239f739b3", "parents": [ "bf83208e0b7f5938f5a7f6d9dfa9960bf04692fa" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Wed May 16 11:01:05 2012 -0700" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Fri May 18 11:09:52 2012 -0700" }, "message": "apparmor: fix long path failure due to disconnected path\n\nBugLink: http://bugs.launchpad.net/bugs/955892\n\nAll failures from __d_path where being treated as disconnected paths,\nhowever __d_path can also fail when the generated pathname is too long.\n\nThe initial ENAMETOOLONG error was being lost, and ENAMETOOLONG was only\nreturned if the subsequent dentry_path call resulted in that error. Other\nwise if the path was split across a mount point such that the dentry_path\nfit within the buffer when the __d_path did not the failure was treated\nas a disconnected path.\n\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "bf83208e0b7f5938f5a7f6d9dfa9960bf04692fa", "tree": "6c3d31ea4f48a684c87504c229c7db474119437a", "parents": [ "fbbb456347b21279a379b42eeb31151c33d8dd49" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Wed May 16 11:00:05 2012 -0700" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Fri May 18 11:09:28 2012 -0700" }, "message": "apparmor: fix profile lookup for unconfined\n\nBugLink: http://bugs.launchpad.net/bugs/978038\n\nalso affects apparmor portion of\nBugLink: http://bugs.launchpad.net/bugs/987371\n\nThe unconfined profile is not stored in the regular profile list, but\nchange_profile and exec transitions may want access to it when setting\nup specialized transitions like switch to the unconfined profile of a\nnew policy namespace.\n\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "fbbb456347b21279a379b42eeb31151c33d8dd49", "tree": "d1d5debe01e000fd38f2af8232d342a054b754a4", "parents": [ "12fa8a2732e6d0bb42c311f76250f7871d042df8" ], "author": { "name": "Mimi Zohar", "email": "zohar@us.ibm.com", "time": "Mon May 14 21:50:11 2012 -0400" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Wed May 16 10:36:41 2012 +1000" }, "message": "ima: fix filename hint to reflect script interpreter name\n\nWhen IMA was first upstreamed, the bprm filename and interp were\nalways the same. Currently, the bprm-\u003efilename and bprm-\u003einterp\nare the same, except for when only bprm-\u003einterp contains the\ninterpreter name. So instead of using the bprm-\u003efilename as\nthe IMA filename hint in the measurement list, we could replace\nit with bprm-\u003einterp, but this feels too fragil.\n\nThe following patch is not much better, but at least there is some\nindication that sometimes we\u0027re passing the filename and other times\nthe interpreter name.\n\nReported-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "12fa8a2732e6d0bb42c311f76250f7871d042df8", "tree": "87a8ec37c94d068fb100cdb962af9ba5881e23b4", "parents": [ "b404aef72fdafb601c945c714164c0ee2b04c364", "f7112e6c9abf1c70f001dcf097c1d6e218a93f5c" ], "author": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Wed May 16 01:11:29 2012 +1000" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Wed May 16 01:11:29 2012 +1000" }, "message": "Merge branch \u0027for-1205\u0027 of http://git.gitorious.org/smack-next/kernel into next\n\nPull request from Casey.\n" }, { "commit": "b404aef72fdafb601c945c714164c0ee2b04c364", "tree": "46efed0307e7c208a254614361bbe08ed160ef52", "parents": [ "2cc8a71641b4460783ea3bd7a3476043fdf85397" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue May 15 14:11:11 2012 +0100" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Wed May 16 00:54:33 2012 +1000" }, "message": "KEYS: Don\u0027t check for NULL key pointer in key_validate()\n\nDon\u0027t bother checking for NULL key pointer in key_validate() as all of the\nplaces that call it will crash anyway if the relevant key pointer is NULL by\nthe time they call key_validate(). Therefore, the checking must be done prior\nto calling here.\n\nWhilst we\u0027re at it, simplify the key_validate() function a bit and mark its\nargument const.\n\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "f7112e6c9abf1c70f001dcf097c1d6e218a93f5c", "tree": "8ddcab31388e3f220f3ef911f4ec9dce8ac4be92", "parents": [ "ceffec5541cc22486d3ff492e3d76a33a68fbfa3" ], "author": { "name": "Casey Schaufler", "email": "casey@schaufler-ca.com", "time": "Sun May 06 15:22:02 2012 -0700" }, "committer": { "name": "Casey Schaufler", "email": "cschaufler@vaio-ubuntu.(none)", "time": "Mon May 14 22:48:38 2012 -0700" }, "message": "Smack: allow for significantly longer Smack labels v4\n\nV4 updated to current linux-security#next\nTargeted for git://gitorious.org/smack-next/kernel.git\n\nModern application runtime environments like to use\nnaming schemes that are structured and generated without\nhuman intervention. Even though the Smack limit of 23\ncharacters for a label name is perfectly rational for\nhuman use there have been complaints that the limit is\na problem in environments where names are composed from\na set or sources, including vendor, author, distribution\nchannel and application name. Names like\n\n\tsoftwarehouse-pgwodehouse-coolappstore-mellowmuskrats\n\nare becoming harder to avoid. This patch introduces long\nlabel support in Smack. Labels are now limited to 255\ncharacters instead of the old 23.\n\nThe primary reason for limiting the labels to 23 characters\nwas so they could be directly contained in CIPSO category sets.\nThis is still done were possible, but for labels that are too\nlarge a mapping is required. This is perfectly safe for communication\nthat stays \"on the box\" and doesn\u0027t require much coordination\nbetween boxes beyond what would have been required to keep label\nnames consistent.\n\nThe bulk of this patch is in smackfs, adding and updating\nadministrative interfaces. Because existing APIs can\u0027t be\nchanged new ones that do much the same things as old ones\nhave been introduced.\n\nThe Smack specific CIPSO data representation has been removed\nand replaced with the data format used by netlabel. The CIPSO\nheader is now computed when a label is imported rather than\non use. This results in improved IP performance. The smack\nlabel is now allocated separately from the containing structure,\nallowing for larger strings.\n\nFour new /smack interfaces have been introduced as four\nof the old interfaces strictly required labels be specified\nin fixed length arrays.\n\nThe access interface is supplemented with the check interface:\n\taccess \"Subject Object rwxat\"\n\taccess2 \"Subject Object rwaxt\"\n\nThe load interface is supplemented with the rules interface:\n\tload \"Subject Object rwxat\"\n\tload2 \"Subject Object rwaxt\"\n\nThe load-self interface is supplemented with the self-rules interface:\n\tload-self \"Subject Object rwxat\"\n\tload-self2 \"Subject Object rwaxt\"\n\nThe cipso interface is supplemented with the wire interface:\n\tcipso \"Subject lvl cnt c1 c2 ...\"\n\tcipso2 \"Subject lvl cnt c1 c2 ...\"\n\nThe old interfaces are maintained for compatibility.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n" }, { "commit": "ceffec5541cc22486d3ff492e3d76a33a68fbfa3", "tree": "d1eaebc1b1894ed9391959cc9f5846543a4b4e42", "parents": [ "2267b13a7cad1f9dfe0073c1f902d45953f9faff" ], "author": { "name": "Tetsuo Handa", "email": "penguin-kernel@I-love.SAKURA.ne.jp", "time": "Thu Mar 29 16:19:05 2012 +0900" }, "committer": { "name": "Casey Schaufler", "email": "cschaufler@vaio-ubuntu.(none)", "time": "Mon May 14 22:47:44 2012 -0700" }, "message": "gfp flags for security_inode_alloc()?\n\nDave Chinner wrote:\n\u003e Yes, because you have no idea what the calling context is except\n\u003e for the fact that is from somewhere inside filesystem code and the\n\u003e filesystem could be holding locks. Therefore, GFP_NOFS is really the\n\u003e only really safe way to allocate memory here.\n\nI see. Thank you.\n\nI\u0027m not sure, but can call trace happen where somewhere inside network\nfilesystem or stackable filesystem code with locks held invokes operations that\ninvolves GFP_KENREL memory allocation outside that filesystem?\n----------\n[PATCH] SMACK: Fix incorrect GFP_KERNEL usage.\n\nnew_inode_smack() which can be called from smack_inode_alloc_security() needs\nto use GFP_NOFS like SELinux\u0027s inode_alloc_security() does, for\nsecurity_inode_alloc() is called from inode_init_always() and\ninode_init_always() is called from xfs_inode_alloc() which is using GFP_NOFS.\n\nsmack_inode_init_security() needs to use GFP_NOFS like\nselinux_inode_init_security() does, for initxattrs() callback function (e.g.\nbtrfs_initxattrs()) which is called from security_inode_init_security() is\nusing GFP_NOFS.\n\nsmack_audit_rule_match() needs to use GFP_ATOMIC, for\nsecurity_audit_rule_match() can be called from audit_filter_user_rules() and\naudit_filter_user_rules() is called from audit_filter_user() with RCU read lock\nheld.\n\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nSigned-off-by: Casey Schaufler \u003ccschaufler@cschaufler-intel.(none)\u003e\n" }, { "commit": "2267b13a7cad1f9dfe0073c1f902d45953f9faff", "tree": "c0797ecce868fe590ac46a5d511a2f3812de15d1", "parents": [ "2cc8a71641b4460783ea3bd7a3476043fdf85397" ], "author": { "name": "Casey Schaufler", "email": "casey@schaufler-ca.com", "time": "Tue Mar 13 19:14:19 2012 -0700" }, "committer": { "name": "Casey Schaufler", "email": "cschaufler@vaio-ubuntu.(none)", "time": "Mon May 14 22:45:17 2012 -0700" }, "message": "Smack: recursive tramsmute\n\nThe transmuting directory feature of Smack requires that\nthe transmuting attribute be explicitly set in all cases.\nIt seems the users of this facility would expect that the\ntransmuting attribute be inherited by subdirectories that\nare created in a transmuting directory. This does not seem\nto add any additional complexity to the understanding of\nhow the system works.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n" }, { "commit": "2cc8a71641b4460783ea3bd7a3476043fdf85397", "tree": "fe8a39bbedc403306c3a0c2f773a4499d6ae99ec", "parents": [ "77b513dda90fd99bd1225410b25e745b74779c1c" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Mon May 14 10:19:28 2012 -0700" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Tue May 15 10:27:57 2012 +1000" }, "message": "Yama: replace capable() with ns_capable()\n\nWhen checking capabilities, the question we want to be asking is \"does\ncurrent() have the capability in the child\u0027s namespace?\"\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "77b513dda90fd99bd1225410b25e745b74779c1c", "tree": "5555c83725ac407d2e1c3d020061580918524ceb", "parents": [ "fd75815f727f157a05f4c96b5294a4617c0557da" ], "author": { "name": "Tetsuo Handa", "email": "penguin-kernel@I-love.SAKURA.ne.jp", "time": "Sun May 13 23:03:23 2012 +0900" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Tue May 15 10:24:29 2012 +1000" }, "message": "TOMOYO: Accept manager programs which do not start with / .\n\nThe pathname of /usr/sbin/tomoyo-editpolicy seen from Ubuntu 12.04 Live CD is\nsquashfs:/usr/sbin/tomoyo-editpolicy rather than /usr/sbin/tomoyo-editpolicy .\nTherefore, we need to accept manager programs which do not start with / .\n\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "fd75815f727f157a05f4c96b5294a4617c0557da", "tree": "b2e76abf176d37b5d810b0c813b8c0219754b88c", "parents": [ "31d5a79d7f3d436da176a78ebc12d53c06da402e" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "committer": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "message": "KEYS: Add invalidation support\n\nAdd support for invalidating a key - which renders it immediately invisible to\nfurther searches and causes the garbage collector to immediately wake up,\nremove it from keyrings and then destroy it when it\u0027s no longer referenced.\n\nIt\u0027s better not to do this with keyctl_revoke() as that marks the key to start\nreturning -EKEYREVOKED to searches when what is actually desired is to have the\nkey refetched.\n\nTo invalidate a key the caller must be granted SEARCH permission by the key.\nThis may be too strict. It may be better to also permit invalidation if the\ncaller has any of READ, WRITE or SETATTR permission.\n\nThe primary use for this is to evict keys that are cached in special keyrings,\nsuch as the DNS resolver or an ID mapper.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\n" }, { "commit": "31d5a79d7f3d436da176a78ebc12d53c06da402e", "tree": "d39a75d7d0d0e85102ff8ce5e55e5d6ab7db7262", "parents": [ "233e4735f2a45d9e641c2488b8d7afeb1f377dac" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "committer": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "message": "KEYS: Do LRU discard in full keyrings\n\nDo an LRU discard in keyrings that are full rather than returning ENFILE. To\nperform this, a time_t is added to the key struct and updated by the creation\nof a link to a key and by a key being found as the result of a search. At the\ncompletion of a successful search, the keyrings in the path between the root of\nthe search and the first found link to it also have their last-used times\nupdated.\n\nNote that discarding a link to a key from a keyring does not necessarily\ndestroy the key as there may be references held by other places.\n\nAn alternate discard method that might suffice is to perform FIFO discard from\nthe keyring, using the spare 2-byte hole in the keylist header as the index of\nthe next link to be discarded.\n\nThis is useful when using a keyring as a cache for DNS results or foreign\nfilesystem IDs.\n\n\nThis can be tested by the following. As root do:\n\n\techo 1000 \u003e/proc/sys/kernel/keys/root_maxkeys\n\n\tkr\u003d`keyctl newring foo @s`\n\tfor ((i\u003d0; i\u003c2000; i++)); do keyctl add user a$i a $kr; done\n\nWithout this patch ENFILE should be reported when the keyring fills up. With\nthis patch, the keyring discards keys in an LRU fashion. Note that the stored\nLRU time has a granularity of 1s.\n\nAfter doing this, /proc/key-users can be observed and should show that most of\nthe 2000 keys have been discarded:\n\n\t[root@andromeda ~]# cat /proc/key-users\n\t 0: 517 516/516 513/1000 5249/20000\n\nThe \"513/1000\" here is the number of quota-accounted keys present for this user\nout of the maximum permitted.\n\nIn /proc/keys, the keyring shows the number of keys it has and the number of\nslots it has allocated:\n\n\t[root@andromeda ~]# grep foo /proc/keys\n\t200c64c4 I--Q-- 1 perm 3b3f0000 0 0 keyring foo: 509/509\n\nThe maximum is (PAGE_SIZE - header) / key pointer size. That\u0027s typically 509\non a 64-bit system and 1020 on a 32-bit system.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\n" }, { "commit": "233e4735f2a45d9e641c2488b8d7afeb1f377dac", "tree": "d273536aaea91cf4817dd305450f327ebb37059f", "parents": [ "65d87fe68abf2fc226a9e96be61160f65d6b4680" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "committer": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "message": "KEYS: Permit in-place link replacement in keyring list\n\nMake use of the previous patch that makes the garbage collector perform RCU\nsynchronisation before destroying defunct keys. Key pointers can now be\nreplaced in-place without creating a new keyring payload and replacing the\nwhole thing as the discarded keys will not be destroyed until all currently\nheld RCU read locks are released.\n\nIf the keyring payload space needs to be expanded or contracted, then a\nreplacement will still need allocating, and the original will still have to be\nfreed by RCU.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\n" }, { "commit": "65d87fe68abf2fc226a9e96be61160f65d6b4680", "tree": "23881b6daf54c7522178363f0ae32ddb6c836784", "parents": [ "1eb1bcf5bfad001128293b86d891c9d6f2f27333" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "committer": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "message": "KEYS: Perform RCU synchronisation on keys prior to key destruction\n\nMake the keys garbage collector invoke synchronize_rcu() prior to destroying\nkeys with a zero usage count. This means that a key can be examined under the\nRCU read lock in the safe knowledge that it won\u0027t get deallocated until after\nthe lock is released - even if its usage count becomes zero whilst we\u0027re\nlooking at it.\n\nThis is useful in keyring search vs key link. Consider a keyring containing a\nlink to a key. That link can be replaced in-place in the keyring without\nrequiring an RCU copy-and-replace on the keyring contents without breaking a\nsearch underway on that keyring when the displaced key is released, provided\nthe key is actually destroyed only after the RCU read lock held by the search\nalgorithm is released.\n\nThis permits __key_link() to replace a key without having to reallocate the key\npayload. A key gets replaced if a new key being linked into a keyring has the\nsame type and description.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Jeff Layton \u003cjlayton@redhat.com\u003e\n" }, { "commit": "1eb1bcf5bfad001128293b86d891c9d6f2f27333", "tree": "af7fce4f0dae5bad37335b0fcf8b2e0d27342a9b", "parents": [ "9f7ce8e249ab761c7ed753059cb16319ede41762" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "committer": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "message": "KEYS: Announce key type (un)registration\n\nAnnounce the (un)registration of a key type in the core key code rather than\nin the callers.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Mimi Zohar \u003czohar@us.ibm.com\u003e\n" }, { "commit": "9f7ce8e249ab761c7ed753059cb16319ede41762", "tree": "2116852f541464dc8591fd201ae479c27b889bf3", "parents": [ "f0894940aed13b21f363a411c7ec57358827ad87" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "committer": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "message": "KEYS: Reorganise keys Makefile\n\nReorganise the keys directory Makefile to put all the core bits together and\nthe type-specific bits after.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Mimi Zohar \u003czohar@us.ibm.com\u003e\n" }, { "commit": "f0894940aed13b21f363a411c7ec57358827ad87", "tree": "43b1fcfc6e9ff2912943b2b2789559b36e7a192d", "parents": [ "45de6767dc51358a188f75dc4ad9dfddb7fb9480" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "committer": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri May 11 10:56:56 2012 +0100" }, "message": "KEYS: Move the key config into security/keys/Kconfig\n\nMove the key config into security/keys/Kconfig as there are going to be a lot\nof key-related options.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Mimi Zohar \u003czohar@us.ibm.com\u003e\n" }, { "commit": "d16cf20e2f2f13411eece7f7fb72c17d141c4a84", "tree": "8154b3db8cdbb4b8d9f35d4c407cfe961253f0b4", "parents": [ "6714cf5465d2803a21c6a46c1ea747795a8889fa" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue May 08 19:45:28 2012 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue May 08 20:25:42 2012 +0200" }, "message": "netfilter: remove ip_queue support\n\nThis patch removes ip_queue support which was marked as obsolete\nyears ago. The nfnetlink_queue modules provides more advanced\nuser-space packet queueing mechanism.\n\nThis patch also removes capability code included in SELinux that\nrefers to ip_queue. Otherwise, we break compilation.\n\nSeveral warning has been sent regarding this to the mailing list\nin the past month without anyone rising the hand to stop this\nwith some strong argument.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "898bfc1d46bd76f8ea2a0fbd239dd2073efe2aa3", "tree": "e6e666085abe674dbf6292555961fe0a0f2e2d2f", "parents": [ "08162e6a23d476544adfe1164afe9ea8b34ab859", "69964ea4c7b68c9399f7977aa5b9aa6539a6a98a" ], "author": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Fri May 04 12:46:40 2012 +1000" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Fri May 04 12:46:40 2012 +1000" }, "message": "Merge tag \u0027v3.4-rc5\u0027 into next\n\nLinux 3.4-rc5\n\nMerge to pull in prerequisite change for Smack:\n86812bb0de1a3758dc6c7aa01a763158a7c0638a\n\nRequested by Casey.\n" }, { "commit": "18815a18085364d8514c0d0c4c986776cb74272c", "tree": "a931fb2eee31aee6f8d83ef4493071b9827b1b9f", "parents": [ "9c806aa06f8e121c6058db8e8073798aa5c4355b" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Tue Feb 07 16:45:47 2012 -0800" }, "committer": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Thu May 03 03:28:40 2012 -0700" }, "message": "userns: Convert capabilities related permsion checks\n\n- Use uid_eq when comparing kuids\n Use gid_eq when comparing kgids\n- Use make_kuid(user_ns, 0) to talk about the user_namespace root uid\n\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n" }, { "commit": "078de5f706ece36afd73bb4b8283314132d2dfdf", "tree": "0dee00713f9cb5e2516260a66b8df99ef7d03e4d", "parents": [ "ae2975bc3476243b45a1e2344236d7920c268f38" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Wed Feb 08 07:00:08 2012 -0800" }, "committer": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Thu May 03 03:28:38 2012 -0700" }, "message": "userns: Store uid and gid values in struct cred with kuid_t and kgid_t types\n\ncred.h and a few trivial users of struct cred are changed. The rest of the users\nof struct cred are left for other patches as there are too many changes to make\nin one go and leave the change reviewable. If the user namespace is disabled and\nCONFIG_UIDGID_STRICT_TYPE_CHECKS are disabled the code will contiue to compile\nand behave correctly.\n\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n" }, { "commit": "ae2975bc3476243b45a1e2344236d7920c268f38", "tree": "e4b2a8472f6047734b6e7e2bdc994375b2790323", "parents": [ "22d917d80e842829d0ca0a561967d728eb1d6303" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Mon Nov 14 15:56:38 2011 -0800" }, "committer": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Thu May 03 03:27:21 2012 -0700" }, "message": "userns: Convert group_info values from gid_t to kgid_t.\n\nAs a first step to converting struct cred to be all kuid_t and kgid_t\nvalues convert the group values stored in group_info to always be\nkgid_t values. Unless user namespaces are used this change should\nhave no effect.\n\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n" }, { "commit": "783291e6900292521a3895583785e0c04a56c5b3", "tree": "9dd368a25ea61b5913646b1d93ec99e865c058ba", "parents": [ "7b44ab978b77a91b327058a0f4db7e6fcdb90b92" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Thu Nov 17 01:32:59 2011 -0800" }, "committer": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Thu Apr 26 02:00:59 2012 -0700" }, "message": "userns: Simplify the user_namespace by making userns-\u003ecreator a kuid.\n\n- Transform userns-\u003ecreator from a user_struct reference to a simple\n kuid_t, kgid_t pair.\n\n In cap_capable this allows the check to see if we are the creator of\n a namespace to become the classic suser style euid permission check.\n\n This allows us to remove the need for a struct cred in the mapping\n functions and still be able to dispaly the user namespace creators\n uid and gid as 0.\n\n- Remove the now unnecessary delayed_work in free_user_ns.\n\n All that is left for free_user_ns to do is to call kmem_cache_free\n and put_user_ns. Those functions can be called in any context\n so call them directly from free_user_ns removing the need for delayed work.\n\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n" }, { "commit": "08162e6a23d476544adfe1164afe9ea8b34ab859", "tree": "ace0b15f2f0aa6106d42191c8edaecc91f0322cc", "parents": [ "561381a146a31ff91d7a2370c10871b02ac7343c" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Fri Apr 20 16:35:24 2012 +0300" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Mon Apr 23 17:20:22 2012 +1000" }, "message": "Yama: remove an unused variable\n\nGCC complains that we don\u0027t use \"one\" any more after 389da25f93 \"Yama:\nadd additional ptrace scopes\".\n\nsecurity/yama/yama_lsm.c:322:12: warning: ?one? defined but not used\n\t[-Wunused-variable]\n\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "389da25f93eea8ff64181ae7e3e87da68acaef2e", "tree": "09277860746b3372cbb49ea82868709cbae99ec3", "parents": [ "8156b451f37898d3c3652b4e988a4d62ae16eaac" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Mon Apr 16 11:56:45 2012 -0700" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Thu Apr 19 13:39:56 2012 +1000" }, "message": "Yama: add additional ptrace scopes\n\nThis expands the available Yama ptrace restrictions to include two more\nmodes. Mode 2 requires CAP_SYS_PTRACE for PTRACE_ATTACH, and mode 3\ncompletely disables PTRACE_ATTACH (and locks the sysctl).\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "51b79bee627d526199b2f6a6bef8ee0c0739b6d1", "tree": "f75bc36f3915284e335f3f69eb039ae88e91f513", "parents": [ "b6a89584c36f307f2c2bbb136ea50985ca4bc7b4" ], "author": { "name": "Jonghwan Choi", "email": "jhbird.choi@samsung.com", "time": "Wed Apr 18 17:23:04 2012 -0400" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Thu Apr 19 12:56:39 2012 +1000" }, "message": "security: fix compile error in commoncap.c\n\nAdd missing \"personality.h\"\nsecurity/commoncap.c: In function \u0027cap_bprm_set_creds\u0027:\nsecurity/commoncap.c:510: error: \u0027PER_CLEAR_ON_SETID\u0027 undeclared (first use in this function)\nsecurity/commoncap.c:510: error: (Each undeclared identifier is reported only once\nsecurity/commoncap.c:510: error: for each function it appears in.)\n\nSigned-off-by: Jonghwan Choi \u003cjhbird.choi@samsung.com\u003e\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "d52fc5dde171f030170a6cb78034d166b13c9445", "tree": "f982d0bdab54d5ab31cdd3e69cb88a1376797d1f", "parents": [ "09c79b60960bdd4b00916219402eabfa5e479c5a" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Tue Apr 17 16:26:54 2012 -0400" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Wed Apr 18 12:37:56 2012 +1000" }, "message": "fcaps: clear the same personality flags as suid when fcaps are used\n\nIf a process increases permissions using fcaps all of the dangerous\npersonality flags which are cleared for suid apps should also be cleared.\nThus programs given priviledge with fcaps will continue to have address space\nrandomization enabled even if the parent tried to disable it to make it\neasier to attack.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nReviewed-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "86812bb0de1a3758dc6c7aa01a763158a7c0638a", "tree": "41cb41cd7fe52730a3fe8c88ca298c2494f9040a", "parents": [ "592fe8980688e7cba46897685d014c7fb3018a67" ], "author": { "name": "Casey Schaufler", "email": "casey@schaufler-ca.com", "time": "Tue Apr 17 18:55:46 2012 -0700" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Wed Apr 18 12:02:28 2012 +1000" }, "message": "Smack: move label list initialization\n\nA kernel with Smack enabled will fail if tmpfs has xattr support.\n\nMove the initialization of predefined Smack label\nlist entries to the LSM initialization from the\nsmackfs setup. This became an issue when tmpfs\nacquired xattr support, but was never correct.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "c29bceb3967398cf2ac8bf8edf9634fdb722df7d", "tree": "9feaa5a8b78812e48fa9b4e9b8b939f06390bee8", "parents": [ "259e5e6c75a910f3b5e656151dc602f53f9d7548" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Thu Apr 12 16:47:51 2012 -0500" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Sat Apr 14 11:13:18 2012 +1000" }, "message": "Fix execve behavior apparmor for PR_{GET,SET}_NO_NEW_PRIVS\n\nAdd support for AppArmor to explicitly fail requested domain transitions\nif NO_NEW_PRIVS is set and the task is not unconfined.\n\nTransitions from unconfined are still allowed because this always results\nin a reduction of privileges.\n\nAcked-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Will Drewry \u003cwad@chromium.org\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\n\nv18: new acked-by, new description\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "259e5e6c75a910f3b5e656151dc602f53f9d7548", "tree": "4405fdf68238f2e33f27b04e8c37c9e29a2493d8", "parents": [ "9ccf010f8172b699ea80178860e8ea228f7dce56" ], "author": { "name": "Andy Lutomirski", "email": "luto@amacapital.net", "time": "Thu Apr 12 16:47:50 2012 -0500" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Sat Apr 14 11:13:18 2012 +1000" }, "message": "Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs\n\nWith this change, calling\n prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)\ndisables privilege granting operations at execve-time. For example, a\nprocess will not be able to execute a setuid binary to change their uid\nor gid if this bit is set. The same is true for file capabilities.\n\nAdditionally, LSM_UNSAFE_NO_NEW_PRIVS is defined to ensure that\nLSMs respect the requested behavior.\n\nTo determine if the NO_NEW_PRIVS bit is set, a task may call\n prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);\nIt returns 1 if set and 0 if it is not set. If any of the arguments are\nnon-zero, it will return -1 and set errno to -EINVAL.\n(PR_SET_NO_NEW_PRIVS behaves similarly.)\n\nThis functionality is desired for the proposed seccomp filter patch\nseries. By using PR_SET_NO_NEW_PRIVS, it allows a task to modify the\nsystem call behavior for itself and its child tasks without being\nable to impact the behavior of a more privileged task.\n\nAnother potential use is making certain privileged operations\nunprivileged. For example, chroot may be considered \"safe\" if it cannot\naffect privileged tasks.\n\nNote, this patch causes execve to fail when PR_SET_NO_NEW_PRIVS is\nset and AppArmor is in use. It is fixed in a subsequent patch.\n\nSigned-off-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\nSigned-off-by: Will Drewry \u003cwad@chromium.org\u003e\nAcked-by: Eric Paris \u003ceparis@redhat.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\n\nv18: updated change desc\nv17: using new define values as per 3.4\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "923e9a1399b620d063cd88537c64561bc3d5f905", "tree": "5d7aec3e06664c7f96726b9439a42a565bcc86ab", "parents": [ "94fb175c0414902ad9dbd956addf3a5feafbc85b" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Tue Apr 10 13:26:44 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 10 16:14:40 2012 -0700" }, "message": "Smack: build when CONFIG_AUDIT not defined\n\nThis fixes builds where CONFIG_AUDIT is not defined and\nCONFIG_SECURITY_SMACK\u003dy.\n\nThis got introduced by the stack-usage reducation commit 48c62af68a40\n(\"LSM: shrink the common_audit_data data union\").\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nAcked-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c737f8284cac91428f8fcc8281e69117fa16e887", "tree": "7cb4cd77df9786925aa2c7cad919c4881651638b", "parents": [ "562c99f20d989f222138dddfd71e275bfb3665de" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Thu Apr 05 13:51:53 2012 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:23:57 2012 -0400" }, "message": "SELinux: remove unused common_audit_data in flush_unauthorized_files\n\nWe don\u0027t need this variable and it just eats stack space. Remove it.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "562c99f20d989f222138dddfd71e275bfb3665de", "tree": "47743a88f3aed8b77f79899f45409a597ab77263", "parents": [ "0b36e44cc680b355f0d1b34002b2a10c9e1cae60" ], "author": { "name": "Wanlong Gao", "email": "gaowanlong@cn.fujitsu.com", "time": "Wed Mar 07 22:17:14 2012 +0800" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:23:44 2012 -0400" }, "message": "SELinux: avc: remove the useless fields in avc_add_callback\n\navc_add_callback now just used for registering reset functions\nin initcalls, and the callback functions just did reset operations.\nSo, reducing the arguments to only one event is enough now.\n\nSigned-off-by: Wanlong Gao \u003cgaowanlong@cn.fujitsu.com\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "0b36e44cc680b355f0d1b34002b2a10c9e1cae60", "tree": "60e6a2800af2980b1b83206d2b6f6fd20baf4165", "parents": [ "899838b25f063a94594b1df6e0100aea1ec57fac" ], "author": { "name": "Wanlong Gao", "email": "gaowanlong@cn.fujitsu.com", "time": "Wed Mar 07 22:17:13 2012 +0800" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:23:07 2012 -0400" }, "message": "SELinux: replace weak GFP_ATOMIC to GFP_KERNEL in avc_add_callback\n\navc_add_callback now only called from initcalls, so replace the\nweak GFP_ATOMIC to GFP_KERNEL, and mark this function __init\nto make a warning when not been called from initcalls.\n\nSigned-off-by: Wanlong Gao \u003cgaowanlong@cn.fujitsu.com\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "899838b25f063a94594b1df6e0100aea1ec57fac", "tree": "ce22a1fca876195237ba92051cb12b34aa957447", "parents": [ "1d3492927118d0ce1ea1ff3e007746699cba8f3e" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Wed Apr 04 15:01:43 2012 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:23:06 2012 -0400" }, "message": "SELinux: unify the selinux_audit_data and selinux_late_audit_data\n\nWe no longer need the distinction. We only need data after we decide to do an\naudit. So turn the \"late\" audit data into just \"data\" and remove what we\ncurrently have as \"data\".\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "1d3492927118d0ce1ea1ff3e007746699cba8f3e", "tree": "16f50a33be365548a77dfb199337031779af86eb", "parents": [ "50c205f5e5c2e2af002fd4ef537ded79b90b1b56" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Wed Apr 04 15:01:43 2012 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:23:05 2012 -0400" }, "message": "SELinux: remove auditdeny from selinux_audit_data\n\nIt\u0027s just takin\u0027 up space.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "50c205f5e5c2e2af002fd4ef537ded79b90b1b56", "tree": "9965a7746aa8c5e982357d5b8c46850f3283206c", "parents": [ "07f62eb66c6626aa5653a0fcb34c9c040d0bd032" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Wed Apr 04 15:01:43 2012 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:23:04 2012 -0400" }, "message": "LSM: do not initialize common_audit_data to 0\n\nIt isn\u0027t needed. If you don\u0027t set the type of the data associated with\nthat type it is a pretty obvious programming bug. So why waste the cycles?\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "07f62eb66c6626aa5653a0fcb34c9c040d0bd032", "tree": "a928c034e2f08ef3f7fd6af450d75f3d52a261db", "parents": [ "b466066f9b648ccb6aa1e174f0389b7433e460fd" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Wed Apr 04 15:01:43 2012 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:23:03 2012 -0400" }, "message": "LSM: BUILD_BUG_ON if the common_audit_data union ever grows\n\nWe did a lot of work to shrink the common_audit_data. Add a BUILD_BUG_ON\nso future programers (let\u0027s be honest, probably me) won\u0027t do something\nfoolish like make it large again!\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "b466066f9b648ccb6aa1e174f0389b7433e460fd", "tree": "beaec41a751db3ceeb55e4c428bb7e1fe995d880", "parents": [ "0972c74ecba4878baa5f97bb78b242c0eefacfb6" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Wed Apr 04 15:01:43 2012 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:23:03 2012 -0400" }, "message": "LSM: remove the task field from common_audit_data\n\nThere are no legitimate users. Always use current and get back some stack\nspace for the common_audit_data.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "0972c74ecba4878baa5f97bb78b242c0eefacfb6", "tree": "1ea472908798d38ab940f617a494786efe75f380", "parents": [ "bd5e50f9c1c71daac273fa586424f07205f6b13b" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Wed Apr 04 15:01:42 2012 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:23:02 2012 -0400" }, "message": "apparmor: move task from common_audit_data to apparmor_audit_data\n\napparmor is the only LSM that uses the common_audit_data tsk field.\nInstead of making all LSMs pay for the stack space move the aa usage into\nthe apparmor_audit_data.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "bd5e50f9c1c71daac273fa586424f07205f6b13b", "tree": "57331d7e1941077cd55d33e7f12e6f8a07cdd80e", "parents": [ "d4cf970d0732628d514405c5a975024b9e205b0b" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Wed Apr 04 15:01:42 2012 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:23:01 2012 -0400" }, "message": "LSM: remove the COMMON_AUDIT_DATA_INIT type expansion\n\nJust open code it so grep on the source code works better.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "d4cf970d0732628d514405c5a975024b9e205b0b", "tree": "481f90ea13b2cbc8dd77bc934aa91024c1df6587", "parents": [ "602a8dd6ea6abd463bc26310c4a1b44919f88e68" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Wed Apr 04 15:01:42 2012 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:23:00 2012 -0400" }, "message": "SELinux: move common_audit_data to a noinline slow path function\n\nselinux_inode_has_perm is a hot path. Instead of declaring the\ncommon_audit_data on the stack move it to a noinline function only used in\nthe rare case we need to send an audit message.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "602a8dd6ea6abd463bc26310c4a1b44919f88e68", "tree": "426df8399ff298942a7e30c3a360a666e51ba920", "parents": [ "2e33405785d3eaec303c54b4a10afdebf3729da7" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Wed Apr 04 15:01:42 2012 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:23:00 2012 -0400" }, "message": "SELinux: remove inode_has_perm_noadp\n\nBoth callers could better be using file_has_perm() to get better audit\nresults.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "2e33405785d3eaec303c54b4a10afdebf3729da7", "tree": "f4c0d114503796e9f958341393e336f76a7eb6dd", "parents": [ "154c50ca4eb9ae472f50b6a481213e21ead4457d" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Wed Apr 04 15:01:42 2012 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:22:59 2012 -0400" }, "message": "SELinux: delay initialization of audit data in selinux_inode_permission\n\nWe pay a rather large overhead initializing the common_audit_data.\nSince we only need this information if we actually emit an audit\nmessage there is little need to set it up in the hot path. This patch\nsplits the functionality of avc_has_perm() into avc_has_perm_noaudit(),\navc_audit_required() and slow_avc_audit(). But we take care of setting\nup to audit between required() and the actual audit call. Thus saving\nmeasurable time in a hot path.\n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n" }, { "commit": "154c50ca4eb9ae472f50b6a481213e21ead4457d", "tree": "8f496c340514e7041c50e212aa1d45a18ca7476c", "parents": [ "92ae9e82d9a2c4b9b388d6a9e7a4b2ccb0b4452f" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Wed Apr 04 13:47:11 2012 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Mon Apr 09 12:22:58 2012 -0400" }, "message": "SELinux: if sel_make_bools errors don\u0027t leave inconsistent state\n\nWe reset the bool names and values array to NULL, but do not reset the\nnumber of entries in these arrays to 0. If we error out and then get back\ninto this function we will walk these NULL pointers based on the belief\nthat they are non-zero length.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\ncc: stable@kernel.org\n" } ], "next": "92ae9e82d9a2c4b9b388d6a9e7a4b2ccb0b4452f" }