)]}'
{
  "log": [
    {
      "commit": "644473e9c60c1ff4f6351fed637a6e5551e3dce7",
      "tree": "10316518bedc735a2c6552886658d69dfd9f1eb0",
      "parents": [
        "fb827ec68446c83e9e8754fa9b55aed27ecc4661",
        "4b06a81f1daee668fbd6de85557bfb36dd36078f"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed May 23 17:42:39 2012 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed May 23 17:42:39 2012 -0700"
      },
      "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace\n\nPull user namespace enhancements from Eric Biederman:\n \"This is a course correction for the user namespace, so that we can\n  reach an inexpensive, maintainable, and reasonably complete\n  implementation.\n\n  Highlights:\n   - Config guards make it impossible to enable the user namespace and\n     code that has not been converted to be user namespace safe.\n\n   - Use of the new kuid_t type ensures the if you somehow get past the\n     config guards the kernel will encounter type errors if you enable\n     user namespaces and attempt to compile in code whose permission\n     checks have not been updated to be user namespace safe.\n\n   - All uids from child user namespaces are mapped into the initial\n     user namespace before they are processed.  Removing the need to add\n     an additional check to see if the user namespace of the compared\n     uids remains the same.\n\n   - With the user namespaces compiled out the performance is as good or\n     better than it is today.\n\n   - For most operations absolutely nothing changes performance or\n     operationally with the user namespace enabled.\n\n   - The worst case performance I could come up with was timing 1\n     billion cache cold stat operations with the user namespace code\n     enabled.  This went from 156s to 164s on my laptop (or 156ns to\n     164ns per stat operation).\n\n   - (uid_t)-1 and (gid_t)-1 are reserved as an internal error value.\n     Most uid/gid setting system calls treat these value specially\n     anyway so attempting to use -1 as a uid would likely cause\n     entertaining failures in userspace.\n\n   - If setuid is called with a uid that can not be mapped setuid fails.\n     I have looked at sendmail, login, ssh and every other program I\n     could think of that would call setuid and they all check for and\n     handle the case where setuid fails.\n\n   - If stat or a similar system call is called from a context in which\n     we can not map a uid we lie and return overflowuid.  The LFS\n     experience suggests not lying and returning an error code might be\n     better, but the historical precedent with uids is different and I\n     can not think of anything that would break by lying about a uid we\n     can\u0027t map.\n\n   - Capabilities are localized to the current user namespace making it\n     safe to give the initial user in a user namespace all capabilities.\n\n  My git tree covers all of the modifications needed to convert the core\n  kernel and enough changes to make a system bootable to runlevel 1.\"\n\nFix up trivial conflicts due to nearby independent changes in fs/stat.c\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (46 commits)\n  userns:  Silence silly gcc warning.\n  cred: use correct cred accessor with regards to rcu read lock\n  userns: Convert the move_pages, and migrate_pages permission checks to use uid_eq\n  userns: Convert cgroup permission checks to use uid_eq\n  userns: Convert tmpfs to use kuid and kgid where appropriate\n  userns: Convert sysfs to use kgid/kuid where appropriate\n  userns: Convert sysctl permission checks to use kuid and kgids.\n  userns: Convert proc to use kuid/kgid where appropriate\n  userns: Convert ext4 to user kuid/kgid where appropriate\n  userns: Convert ext3 to use kuid/kgid where appropriate\n  userns: Convert ext2 to use kuid/kgid where appropriate.\n  userns: Convert devpts to use kuid/kgid where appropriate\n  userns: Convert binary formats to use kuid/kgid where appropriate\n  userns: Add negative depends on entries to avoid building code that is userns unsafe\n  userns: signal remove unnecessary map_cred_ns\n  userns: Teach inode_capable to understand inodes whose uids map to other namespaces.\n  userns: Fail exec for suid and sgid binaries with ids outside our user namespace.\n  userns: Convert stat to return values mapped from kuids and kgids\n  userns: Convert user specfied uids and gids in chown into kuids and kgid\n  userns: Use uid_eq gid_eq helpers when comparing kuids and kgids in the vfs\n  ...\n"
    },
    {
      "commit": "b404aef72fdafb601c945c714164c0ee2b04c364",
      "tree": "46efed0307e7c208a254614361bbe08ed160ef52",
      "parents": [
        "2cc8a71641b4460783ea3bd7a3476043fdf85397"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Tue May 15 14:11:11 2012 +0100"
      },
      "committer": {
        "name": "James Morris",
        "email": "james.l.morris@oracle.com",
        "time": "Wed May 16 00:54:33 2012 +1000"
      },
      "message": "KEYS: Don\u0027t check for NULL key pointer in key_validate()\n\nDon\u0027t bother checking for NULL key pointer in key_validate() as all of the\nplaces that call it will crash anyway if the relevant key pointer is NULL by\nthe time they call key_validate().  Therefore, the checking must be done prior\nto calling here.\n\nWhilst we\u0027re at it, simplify the key_validate() function a bit and mark its\nargument const.\n\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n"
    },
    {
      "commit": "fd75815f727f157a05f4c96b5294a4617c0557da",
      "tree": "b2e76abf176d37b5d810b0c813b8c0219754b88c",
      "parents": [
        "31d5a79d7f3d436da176a78ebc12d53c06da402e"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Fri May 11 10:56:56 2012 +0100"
      },
      "committer": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Fri May 11 10:56:56 2012 +0100"
      },
      "message": "KEYS: Add invalidation support\n\nAdd support for invalidating a key - which renders it immediately invisible to\nfurther searches and causes the garbage collector to immediately wake up,\nremove it from keyrings and then destroy it when it\u0027s no longer referenced.\n\nIt\u0027s better not to do this with keyctl_revoke() as that marks the key to start\nreturning -EKEYREVOKED to searches when what is actually desired is to have the\nkey refetched.\n\nTo invalidate a key the caller must be granted SEARCH permission by the key.\nThis may be too strict.  It may be better to also permit invalidation if the\ncaller has any of READ, WRITE or SETATTR permission.\n\nThe primary use for this is to evict keys that are cached in special keyrings,\nsuch as the DNS resolver or an ID mapper.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\n"
    },
    {
      "commit": "ae2975bc3476243b45a1e2344236d7920c268f38",
      "tree": "e4b2a8472f6047734b6e7e2bdc994375b2790323",
      "parents": [
        "22d917d80e842829d0ca0a561967d728eb1d6303"
      ],
      "author": {
        "name": "Eric W. Biederman",
        "email": "ebiederm@xmission.com",
        "time": "Mon Nov 14 15:56:38 2011 -0800"
      },
      "committer": {
        "name": "Eric W. Biederman",
        "email": "ebiederm@xmission.com",
        "time": "Thu May 03 03:27:21 2012 -0700"
      },
      "message": "userns: Convert group_info values from gid_t to kgid_t.\n\nAs a first step to converting struct cred to be all kuid_t and kgid_t\nvalues convert the group values stored in group_info to always be\nkgid_t values.   Unless user namespaces are used this change should\nhave no effect.\n\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n"
    },
    {
      "commit": "c4a4d603796c727b9555867571f89483be9c565e",
      "tree": "ae3b47a7b8b35c866df53cb4b4a051d49a28904a",
      "parents": [
        "7e6bd8fadd1216f50468f965d0308f45e5109ced"
      ],
      "author": {
        "name": "Eric W. Biederman",
        "email": "ebiederm@xmission.com",
        "time": "Wed Nov 16 23:15:31 2011 -0800"
      },
      "committer": {
        "name": "Eric W. Biederman",
        "email": "ebiederm@xmission.com",
        "time": "Sat Apr 07 16:55:51 2012 -0700"
      },
      "message": "userns: Use cred-\u003euser_ns instead of cred-\u003euser-\u003euser_ns\n\nOptimize performance and prepare for the removal of the user_ns reference\nfrom user_struct.  Remove the slow long walk through cred-\u003euser-\u003euser_ns and\ninstead go straight to cred-\u003euser_ns.\n\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n"
    },
    {
      "commit": "973c9f4f49ca96a53bcf6384c4c59ccd26c33906",
      "tree": "e3535a43c1e5cb5f0c06c040f58bc25c9b869fd1",
      "parents": [
        "a8b17ed019bd40d3bfa20439d9c36a99f9be9180"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Thu Jan 20 16:38:33 2011 +0000"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jan 21 14:59:30 2011 -0800"
      },
      "message": "KEYS: Fix up comments in key management code\n\nFix up comments in the key management code.  No functional changes.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "a8b17ed019bd40d3bfa20439d9c36a99f9be9180",
      "tree": "beb3b08575aa01c7ebb24939b678d533b1f59adf",
      "parents": [
        "9093ba53b7f26dbb5210de1157769e59e34bbe23"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Thu Jan 20 16:38:27 2011 +0000"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jan 21 14:59:29 2011 -0800"
      },
      "message": "KEYS: Do some style cleanup in the key management code.\n\nDo a bit of a style clean up in the key management code.  No functional\nchanges.\n\nDone using:\n\n  perl -p -i -e \u0027s!^/[*]*/\\n!!\u0027 security/keys/*.c\n  perl -p -i -e \u0027s!} /[*] end [a-z0-9_]*[(][)] [*]/\\n!}\\n!\u0027 security/keys/*.c\n  sed -i -s -e \": next\" -e N -e \u0027s/^\\n[}]$/}/\u0027 -e t -e P -e \u0027s/^.*\\n//\u0027 -e \"b next\" security/keys/*.c\n\nTo remove /*****/ lines, remove comments on the closing brace of a\nfunction to name the function and remove blank lines before the closing\nbrace of a function.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "c5b60b5e67af8be4c58d3ffcc36894f69c4fbdc1",
      "tree": "5ca471fad635ee8d91a24c7b5448dbcad3de74ef",
      "parents": [
        "822cceec7248013821d655545ea45d1c6a9d15b3"
      ],
      "author": {
        "name": "Justin P. Mattock",
        "email": "justinmattock@gmail.com",
        "time": "Wed Apr 21 00:02:11 2010 -0700"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Fri Apr 23 10:10:23 2010 +1000"
      },
      "message": "security: whitespace coding style fixes\n\nWhitespace coding style fixes.\n\nSigned-off-by: Justin P. Mattock \u003cjustinmattock@gmail.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "8ff3bc3138a400294ee9e126ac75fc9a9fae4e0b",
      "tree": "f1e2f21f17268cb9a88446da2f1ced9dbccd5138",
      "parents": [
        "1d1e97562e5e2ac60fb7b25437ba619f95f67fab"
      ],
      "author": {
        "name": "Serge E. Hallyn",
        "email": "serue@us.ibm.com",
        "time": "Thu Feb 26 18:27:47 2009 -0600"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Fri Feb 27 12:35:09 2009 +1100"
      },
      "message": "keys: consider user namespace in key_permission\n\nIf a key is owned by another user namespace, then treat the\nkey as though it is owned by both another uid and gid.\n\nSigned-off-by: Serge E. Hallyn \u003cserue@us.ibm.com\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "d84f4f992cbd76e8f39c488cf0c5d123843923b1",
      "tree": "fc4a0349c42995715b93d0f7a3c78e9ea9b3f36e",
      "parents": [
        "745ca2475a6ac596e3d8d37c2759c0fbe2586227"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Fri Nov 14 10:39:23 2008 +1100"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Fri Nov 14 10:39:23 2008 +1100"
      },
      "message": "CRED: Inaugurate COW credentials\n\nInaugurate copy-on-write credentials management.  This uses RCU to manage the\ncredentials pointer in the task_struct with respect to accesses by other tasks.\nA process may only modify its own credentials, and so does not need locking to\naccess or modify its own credentials.\n\nA mutex (cred_replace_mutex) is added to the task_struct to control the effect\nof PTRACE_ATTACHED on credential calculations, particularly with respect to\nexecve().\n\nWith this patch, the contents of an active credentials struct may not be\nchanged directly; rather a new set of credentials must be prepared, modified\nand committed using something like the following sequence of events:\n\n\tstruct cred *new \u003d prepare_creds();\n\tint ret \u003d blah(new);\n\tif (ret \u003c 0) {\n\t\tabort_creds(new);\n\t\treturn ret;\n\t}\n\treturn commit_creds(new);\n\nThere are some exceptions to this rule: the keyrings pointed to by the active\ncredentials may be instantiated - keyrings violate the COW rule as managing\nCOW keyrings is tricky, given that it is possible for a task to directly alter\nthe keys in a keyring in use by another task.\n\nTo help enforce this, various pointers to sets of credentials, such as those in\nthe task_struct, are declared const.  The purpose of this is compile-time\ndiscouragement of altering credentials through those pointers.  Once a set of\ncredentials has been made public through one of these pointers, it may not be\nmodified, except under special circumstances:\n\n  (1) Its reference count may incremented and decremented.\n\n  (2) The keyrings to which it points may be modified, but not replaced.\n\nThe only safe way to modify anything else is to create a replacement and commit\nusing the functions described in Documentation/credentials.txt (which will be\nadded by a later patch).\n\nThis patch and the preceding patches have been tested with the LTP SELinux\ntestsuite.\n\nThis patch makes several logical sets of alteration:\n\n (1) execve().\n\n     This now prepares and commits credentials in various places in the\n     security code rather than altering the current creds directly.\n\n (2) Temporary credential overrides.\n\n     do_coredump() and sys_faccessat() now prepare their own credentials and\n     temporarily override the ones currently on the acting thread, whilst\n     preventing interference from other threads by holding cred_replace_mutex\n     on the thread being dumped.\n\n     This will be replaced in a future patch by something that hands down the\n     credentials directly to the functions being called, rather than altering\n     the task\u0027s objective credentials.\n\n (3) LSM interface.\n\n     A number of functions have been changed, added or removed:\n\n     (*) security_capset_check(), -\u003ecapset_check()\n     (*) security_capset_set(), -\u003ecapset_set()\n\n     \t Removed in favour of security_capset().\n\n     (*) security_capset(), -\u003ecapset()\n\n     \t New.  This is passed a pointer to the new creds, a pointer to the old\n     \t creds and the proposed capability sets.  It should fill in the new\n     \t creds or return an error.  All pointers, barring the pointer to the\n     \t new creds, are now const.\n\n     (*) security_bprm_apply_creds(), -\u003ebprm_apply_creds()\n\n     \t Changed; now returns a value, which will cause the process to be\n     \t killed if it\u0027s an error.\n\n     (*) security_task_alloc(), -\u003etask_alloc_security()\n\n     \t Removed in favour of security_prepare_creds().\n\n     (*) security_cred_free(), -\u003ecred_free()\n\n     \t New.  Free security data attached to cred-\u003esecurity.\n\n     (*) security_prepare_creds(), -\u003ecred_prepare()\n\n     \t New. Duplicate any security data attached to cred-\u003esecurity.\n\n     (*) security_commit_creds(), -\u003ecred_commit()\n\n     \t New. Apply any security effects for the upcoming installation of new\n     \t security by commit_creds().\n\n     (*) security_task_post_setuid(), -\u003etask_post_setuid()\n\n     \t Removed in favour of security_task_fix_setuid().\n\n     (*) security_task_fix_setuid(), -\u003etask_fix_setuid()\n\n     \t Fix up the proposed new credentials for setuid().  This is used by\n     \t cap_set_fix_setuid() to implicitly adjust capabilities in line with\n     \t setuid() changes.  Changes are made to the new credentials, rather\n     \t than the task itself as in security_task_post_setuid().\n\n     (*) security_task_reparent_to_init(), -\u003etask_reparent_to_init()\n\n     \t Removed.  Instead the task being reparented to init is referred\n     \t directly to init\u0027s credentials.\n\n\t NOTE!  This results in the loss of some state: SELinux\u0027s osid no\n\t longer records the sid of the thread that forked it.\n\n     (*) security_key_alloc(), -\u003ekey_alloc()\n     (*) security_key_permission(), -\u003ekey_permission()\n\n     \t Changed.  These now take cred pointers rather than task pointers to\n     \t refer to the security context.\n\n (4) sys_capset().\n\n     This has been simplified and uses less locking.  The LSM functions it\n     calls have been merged.\n\n (5) reparent_to_kthreadd().\n\n     This gives the current thread the same credentials as init by simply using\n     commit_thread() to point that way.\n\n (6) __sigqueue_alloc() and switch_uid()\n\n     __sigqueue_alloc() can\u0027t stop the target task from changing its creds\n     beneath it, so this function gets a reference to the currently applicable\n     user_struct which it then passes into the sigqueue struct it returns if\n     successful.\n\n     switch_uid() is now called from commit_creds(), and possibly should be\n     folded into that.  commit_creds() should take care of protecting\n     __sigqueue_alloc().\n\n (7) [sg]et[ug]id() and co and [sg]et_current_groups.\n\n     The set functions now all use prepare_creds(), commit_creds() and\n     abort_creds() to build and check a new set of credentials before applying\n     it.\n\n     security_task_set[ug]id() is called inside the prepared section.  This\n     guarantees that nothing else will affect the creds until we\u0027ve finished.\n\n     The calling of set_dumpable() has been moved into commit_creds().\n\n     Much of the functionality of set_user() has been moved into\n     commit_creds().\n\n     The get functions all simply access the data directly.\n\n (8) security_task_prctl() and cap_task_prctl().\n\n     security_task_prctl() has been modified to return -ENOSYS if it doesn\u0027t\n     want to handle a function, or otherwise return the return value directly\n     rather than through an argument.\n\n     Additionally, cap_task_prctl() now prepares a new set of credentials, even\n     if it doesn\u0027t end up using it.\n\n (9) Keyrings.\n\n     A number of changes have been made to the keyrings code:\n\n     (a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have\n     \t all been dropped and built in to the credentials functions directly.\n     \t They may want separating out again later.\n\n     (b) key_alloc() and search_process_keyrings() now take a cred pointer\n     \t rather than a task pointer to specify the security context.\n\n     (c) copy_creds() gives a new thread within the same thread group a new\n     \t thread keyring if its parent had one, otherwise it discards the thread\n     \t keyring.\n\n     (d) The authorisation key now points directly to the credentials to extend\n     \t the search into rather pointing to the task that carries them.\n\n     (e) Installing thread, process or session keyrings causes a new set of\n     \t credentials to be created, even though it\u0027s not strictly necessary for\n     \t process or session keyrings (they\u0027re shared).\n\n(10) Usermode helper.\n\n     The usermode helper code now carries a cred struct pointer in its\n     subprocess_info struct instead of a new session keyring pointer.  This set\n     of credentials is derived from init_cred and installed on the new process\n     after it has been cloned.\n\n     call_usermodehelper_setup() allocates the new credentials and\n     call_usermodehelper_freeinfo() discards them if they haven\u0027t been used.  A\n     special cred function (prepare_usermodeinfo_creds()) is provided\n     specifically for call_usermodehelper_setup() to call.\n\n     call_usermodehelper_setkeys() adjusts the credentials to sport the\n     supplied keyring as the new session keyring.\n\n(11) SELinux.\n\n     SELinux has a number of changes, in addition to those to support the LSM\n     interface changes mentioned above:\n\n     (a) selinux_setprocattr() no longer does its check for whether the\n     \t current ptracer can access processes with the new SID inside the lock\n     \t that covers getting the ptracer\u0027s SID.  Whilst this lock ensures that\n     \t the check is done with the ptracer pinned, the result is only valid\n     \t until the lock is released, so there\u0027s no point doing it inside the\n     \t lock.\n\n(12) is_single_threaded().\n\n     This function has been extracted from selinux_setprocattr() and put into\n     a file of its own in the lib/ directory as join_session_keyring() now\n     wants to use it too.\n\n     The code in SELinux just checked to see whether a task shared mm_structs\n     with other tasks (CLONE_VM), but that isn\u0027t good enough.  We really want\n     to know if they\u0027re part of the same thread group (CLONE_THREAD).\n\n(13) nfsd.\n\n     The NFS server daemon now has to use the COW credentials to set the\n     credentials it is going to use.  It really needs to pass the credentials\n     down to the functions it calls, but it can\u0027t do that until other patches\n     in this series have been applied.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "c69e8d9c01db2adc503464993c358901c9af9de4",
      "tree": "bed94aaa9aeb7a7834d1c880f72b62a11a752c78",
      "parents": [
        "86a264abe542cfececb4df129bc45a0338d8cdb9"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Fri Nov 14 10:39:19 2008 +1100"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Fri Nov 14 10:39:19 2008 +1100"
      },
      "message": "CRED: Use RCU to access another task\u0027s creds and to release a task\u0027s own creds\n\nUse RCU to access another task\u0027s creds and to release a task\u0027s own creds.\nThis means that it will be possible for the credentials of a task to be\nreplaced without another task (a) requiring a full lock to read them, and (b)\nseeing deallocated memory.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "b6dff3ec5e116e3af6f537d4caedcad6b9e5082a",
      "tree": "9e76f972eb7ce9b84e0146c8e4126a3f86acb428",
      "parents": [
        "15a2460ed0af7538ca8e6c610fe607a2cd9da142"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Fri Nov 14 10:39:16 2008 +1100"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Fri Nov 14 10:39:16 2008 +1100"
      },
      "message": "CRED: Separate task security context from task_struct\n\nSeparate the task security context from task_struct.  At this point, the\nsecurity data is temporarily embedded in the task_struct with two pointers\npointing to it.\n\nNote that the Alpha arch is altered as it refers to (E)UID and (E)GID in\nentry.S via asm-offsets.\n\nWith comment fixes Signed-off-by: Marc Dionne \u003cmarc.c.dionne@gmail.com\u003e\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "b5f545c880a2a47947ba2118b2509644ab7a2969",
      "tree": "8720e02262b0ff6309ae79603f6c63965296d378",
      "parents": [
        "cab8eb594e84b434d20412fc5a3985b0bee3ab9f"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Sun Jan 08 01:02:47 2006 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Sun Jan 08 20:13:53 2006 -0800"
      },
      "message": "[PATCH] keys: Permit running process to instantiate keys\n\nMake it possible for a running process (such as gssapid) to be able to\ninstantiate a key, as was requested by Trond Myklebust for NFS4.\n\nThe patch makes the following changes:\n\n (1) A new, optional key type method has been added. This permits a key type\n     to intercept requests at the point /sbin/request-key is about to be\n     spawned and do something else with them - passing them over the\n     rpc_pipefs files or netlink sockets for instance.\n\n     The uninstantiated key, the authorisation key and the intended operation\n     name are passed to the method.\n\n (2) The callout_info is no longer passed as an argument to /sbin/request-key\n     to prevent unauthorised viewing of this data using ps or by looking in\n     /proc/pid/cmdline.\n\n     This means that the old /sbin/request-key program will not work with the\n     patched kernel as it will expect to see an extra argument that is no\n     longer there.\n\n     A revised keyutils package will be made available tomorrow.\n\n (3) The callout_info is now attached to the authorisation key. Reading this\n     key will retrieve the information.\n\n (4) A new field has been added to the task_struct. This holds the\n     authorisation key currently active for a thread. Searches now look here\n     for the caller\u0027s set of keys rather than looking for an auth key in the\n     lowest level of the session keyring.\n\n     This permits a thread to be servicing multiple requests at once and to\n     switch between them. Note that this is per-thread, not per-process, and\n     so is usable in multithreaded programs.\n\n     The setting of this field is inherited across fork and exec.\n\n (5) A new keyctl function (KEYCTL_ASSUME_AUTHORITY) has been added that\n     permits a thread to assume the authority to deal with an uninstantiated\n     key. Assumption is only permitted if the authorisation key associated\n     with the uninstantiated key is somewhere in the thread\u0027s keyrings.\n\n     This function can also clear the assumption.\n\n (6) A new magic key specifier has been added to refer to the currently\n     assumed authorisation key (KEY_SPEC_REQKEY_AUTH_KEY).\n\n (7) Instantiation will only proceed if the appropriate authorisation key is\n     assumed first. The assumed authorisation key is discarded if\n     instantiation is successful.\n\n (8) key_validate() is moved from the file of request_key functions to the\n     file of permissions functions.\n\n (9) The documentation is updated.\n\nFrom: \u003cValdis.Kletnieks@vt.edu\u003e\n\n    Build fix.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: Trond Myklebust \u003ctrond.myklebust@fys.uio.no\u003e\nCc: Alexander Zangerl \u003caz@bond.edu.au\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n"
    },
    {
      "commit": "29db9190634067c5a328ee5fcc2890251b836b4b",
      "tree": "07ec242789230824f1fa8bcbbe681fd5bf166fa8",
      "parents": [
        "2aa349f6e37ce030060c994d3aebbff4ab703565"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Sun Oct 30 15:02:44 2005 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Sun Oct 30 17:37:23 2005 -0800"
      },
      "message": "[PATCH] Keys: Add LSM hooks for key management [try #3]\n\nThe attached patch adds LSM hooks for key management facilities. The notable\nchanges are:\n\n (1) The key struct now supports a security pointer for the use of security\n     modules. This will permit key labelling and restrictions on which\n     programs may access a key.\n\n (2) Security modules get a chance to note (or abort) the allocation of a key.\n\n (3) The key permission checking can now be enhanced by the security modules;\n     the permissions check consults LSM if all other checks bear out.\n\n (4) The key permissions checking functions now return an error code rather\n     than a boolean value.\n\n (5) An extra permission has been added to govern the modification of\n     attributes (UID, GID, permissions).\n\nNote that there isn\u0027t an LSM hook specifically for each keyctl() operation,\nbut rather the permissions hook allows control of individual operations based\non the permission request bits.\n\nKey management access control through LSM is enabled by automatically if both\nCONFIG_KEYS and CONFIG_SECURITY are enabled.\n\nThis should be applied on top of the patch ensubjected:\n\n\t[PATCH] Keys: Possessor permissions should be additive\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n"
    },
    {
      "commit": "7ab501db8cb6659efdf04034e0de6b44c059a51b",
      "tree": "cdcf34873ab91219e17b265610a83bea213ec3c4",
      "parents": [
        "468ed2b0c85ec4310b429e60358213b6d077289e"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Fri Oct 07 16:41:24 2005 +0100"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Sat Oct 08 14:54:48 2005 -0700"
      },
      "message": "[PATCH] Keys: Possessor permissions should be additive\n\nThis patch makes the possessor permissions on a key additive with\nuser/group/other permissions on the same key.\n\nThis permits extra rights to be granted to the possessor of a key without\ntaking away any rights conferred by them owning the key or having common group\nmembership.\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n"
    },
    {
      "commit": "468ed2b0c85ec4310b429e60358213b6d077289e",
      "tree": "d1f570c1b89df450753cbec8768b1c1cfac6d9a2",
      "parents": [
        "f1a9badcf6ecad9975240d94514721cb93932151"
      ],
      "author": {
        "name": "David Howells",
        "email": "dhowells@redhat.com",
        "time": "Fri Oct 07 15:07:38 2005 +0100"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Sat Oct 08 14:53:31 2005 -0700"
      },
      "message": "[PATCH] Keys: Split key permissions checking into a .c file\n\nThe attached patch splits key permissions checking out of key-ui.h and\nmoves it into a .c file.  It\u0027s quite large and called quite a lot, and\nit\u0027s about to get bigger with the addition of LSM support for keys...\n\nkey_any_permission() is also discarded as it\u0027s no longer used.\n\nSigned-Off-By: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n"
    }
  ]
}