)]}'
{
  "log": [
    {
      "commit": "ff2bb047c4bce9742e94911eeb44b4d6ff4734ab",
      "tree": "9d9b1cfa3fc17f0cc13f34ca697306cb1f46b05f",
      "parents": [
        "cffee16e8b997ab947de661e8820e486b0830c94",
        "c737f8284cac91428f8fcc8281e69117fa16e887"
      ],
      "author": {
        "name": "James Morris",
        "email": "james.l.morris@oracle.com",
        "time": "Tue May 22 11:21:06 2012 +1000"
      },
      "committer": {
        "name": "James Morris",
        "email": "james.l.morris@oracle.com",
        "time": "Tue May 22 11:21:06 2012 +1000"
      },
      "message": "Merge branch \u0027master\u0027 of git://git.infradead.org/users/eparis/selinux into next\n\nPer pull request, for 3.5.\n"
    },
    {
      "commit": "f7112e6c9abf1c70f001dcf097c1d6e218a93f5c",
      "tree": "8ddcab31388e3f220f3ef911f4ec9dce8ac4be92",
      "parents": [
        "ceffec5541cc22486d3ff492e3d76a33a68fbfa3"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Sun May 06 15:22:02 2012 -0700"
      },
      "committer": {
        "name": "Casey Schaufler",
        "email": "cschaufler@vaio-ubuntu.(none)",
        "time": "Mon May 14 22:48:38 2012 -0700"
      },
      "message": "Smack: allow for significantly longer Smack labels v4\n\nV4 updated to current linux-security#next\nTargeted for git://gitorious.org/smack-next/kernel.git\n\nModern application runtime environments like to use\nnaming schemes that are structured and generated without\nhuman intervention. Even though the Smack limit of 23\ncharacters for a label name is perfectly rational for\nhuman use there have been complaints that the limit is\na problem in environments where names are composed from\na set or sources, including vendor, author, distribution\nchannel and application name. Names like\n\n\tsoftwarehouse-pgwodehouse-coolappstore-mellowmuskrats\n\nare becoming harder to avoid. This patch introduces long\nlabel support in Smack. Labels are now limited to 255\ncharacters instead of the old 23.\n\nThe primary reason for limiting the labels to 23 characters\nwas so they could be directly contained in CIPSO category sets.\nThis is still done were possible, but for labels that are too\nlarge a mapping is required. This is perfectly safe for communication\nthat stays \"on the box\" and doesn\u0027t require much coordination\nbetween boxes beyond what would have been required to keep label\nnames consistent.\n\nThe bulk of this patch is in smackfs, adding and updating\nadministrative interfaces. Because existing APIs can\u0027t be\nchanged new ones that do much the same things as old ones\nhave been introduced.\n\nThe Smack specific CIPSO data representation has been removed\nand replaced with the data format used by netlabel. The CIPSO\nheader is now computed when a label is imported rather than\non use. This results in improved IP performance. The smack\nlabel is now allocated separately from the containing structure,\nallowing for larger strings.\n\nFour new /smack interfaces have been introduced as four\nof the old interfaces strictly required labels be specified\nin fixed length arrays.\n\nThe access interface is supplemented with the check interface:\n\taccess  \"Subject                 Object                  rwxat\"\n\taccess2 \"Subject Object rwaxt\"\n\nThe load interface is supplemented with the rules interface:\n\tload   \"Subject                 Object                  rwxat\"\n\tload2  \"Subject Object rwaxt\"\n\nThe load-self interface is supplemented with the self-rules interface:\n\tload-self   \"Subject                 Object                  rwxat\"\n\tload-self2  \"Subject Object rwaxt\"\n\nThe cipso interface is supplemented with the wire interface:\n\tcipso  \"Subject                  lvl cnt  c1  c2 ...\"\n\tcipso2 \"Subject lvl cnt  c1  c2 ...\"\n\nThe old interfaces are maintained for compatibility.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "2267b13a7cad1f9dfe0073c1f902d45953f9faff",
      "tree": "c0797ecce868fe590ac46a5d511a2f3812de15d1",
      "parents": [
        "2cc8a71641b4460783ea3bd7a3476043fdf85397"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Tue Mar 13 19:14:19 2012 -0700"
      },
      "committer": {
        "name": "Casey Schaufler",
        "email": "cschaufler@vaio-ubuntu.(none)",
        "time": "Mon May 14 22:45:17 2012 -0700"
      },
      "message": "Smack: recursive tramsmute\n\nThe transmuting directory feature of Smack requires that\nthe transmuting attribute be explicitly set in all cases.\nIt seems the users of this facility would expect that the\ntransmuting attribute be inherited by subdirectories that\nare created in a transmuting directory. This does not seem\nto add any additional complexity to the understanding of\nhow the system works.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "50c205f5e5c2e2af002fd4ef537ded79b90b1b56",
      "tree": "9965a7746aa8c5e982357d5b8c46850f3283206c",
      "parents": [
        "07f62eb66c6626aa5653a0fcb34c9c040d0bd032"
      ],
      "author": {
        "name": "Eric Paris",
        "email": "eparis@redhat.com",
        "time": "Wed Apr 04 15:01:43 2012 -0400"
      },
      "committer": {
        "name": "Eric Paris",
        "email": "eparis@redhat.com",
        "time": "Mon Apr 09 12:23:04 2012 -0400"
      },
      "message": "LSM: do not initialize common_audit_data to 0\n\nIt isn\u0027t needed.  If you don\u0027t set the type of the data associated with\nthat type it is a pretty obvious programming bug.  So why waste the cycles?\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n"
    },
    {
      "commit": "48c62af68a403ef1655546bd3e021070c8508573",
      "tree": "ba938e4fb45d5bdaad2dad44071d0625f8e36945",
      "parents": [
        "3b3b0e4fc15efa507b902d90cea39e496a523c3b"
      ],
      "author": {
        "name": "Eric Paris",
        "email": "eparis@redhat.com",
        "time": "Mon Apr 02 13:15:44 2012 -0400"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Apr 03 09:49:10 2012 -0700"
      },
      "message": "LSM: shrink the common_audit_data data union\n\nAfter shrinking the common_audit_data stack usage for private LSM data I\u0027m\nnot going to shrink the data union.  To do this I\u0027m going to move anything\nlarger than 2 void * ptrs to it\u0027s own structure and require it to be declared\nseparately on the calling stack.  Thus hot paths which don\u0027t need more than\na couple pointer don\u0027t have to declare space to hold large unneeded\nstructures.  I could get this down to one void * by dealing with the key\nstruct and the struct path.  We\u0027ll see if that is helpful after taking care of\nnetworking.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "3b3b0e4fc15efa507b902d90cea39e496a523c3b",
      "tree": "d7b91c21ad6c6f4ac21dd51297b74eec47c61684",
      "parents": [
        "95694129b43165911dc4e8a972f0d39ad98d86be"
      ],
      "author": {
        "name": "Eric Paris",
        "email": "eparis@redhat.com",
        "time": "Tue Apr 03 09:37:02 2012 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Apr 03 09:48:40 2012 -0700"
      },
      "message": "LSM: shrink sizeof LSM specific portion of common_audit_data\n\nLinus found that the gigantic size of the common audit data caused a big\nperf hit on something as simple as running stat() in a loop.  This patch\nrequires LSMs to declare the LSM specific portion separately rather than\ndoing it in a union.  Thus each LSM can be responsible for shrinking their\nportion and don\u0027t have to pay a penalty just because other LSMs have a\nbigger space requirement.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "0e94ae17c857b3835a2b8ea46ce44b5da4e2cc5d",
      "tree": "eac36ba696cf33bbbe3fcd490589ef453d9c8ef1",
      "parents": [
        "d86b2b61d4dea614d6f319772a90a8f98b55ed67"
      ],
      "author": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko.j.sakkinen@gmail.com",
        "time": "Tue Oct 18 21:21:36 2011 +0300"
      },
      "committer": {
        "name": "Casey Schaufler",
        "email": "cschaufler@cschaufler-intel.(none)",
        "time": "Thu Oct 20 16:07:31 2011 -0700"
      },
      "message": "Smack: allow to access /smack/access as normal user\n\nAllow query access as a normal user removing the need\nfor CAP_MAC_ADMIN. Give RW access to /smack/access\nfor UGO. Do not import smack labels in access check.\n\nSigned-off-by: Jarkko Sakkinen \u003cjarkko.j.sakkinen@gmail.com\u003e\nSigned-off-by: Casey Schaufler \u003ccschaufler@cschaufler-intel.(none)\u003e\n"
    },
    {
      "commit": "ce8a432197d9892689eb4896f690b9fe6b3de598",
      "tree": "09dff875df15be3a36f3e0dcb760d0064d4da935",
      "parents": [
        "531f1d453ed8a8acee4015bd64e7bcc2eab939e4"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Thu Sep 29 18:21:01 2011 -0700"
      },
      "committer": {
        "name": "Casey Schaufler",
        "email": "cschaufler@cschaufler-intel.(none)",
        "time": "Wed Oct 12 14:26:07 2011 -0700"
      },
      "message": "Smack: Clean up comments\n\nThere are a number of comments in the Smack code that\nare either malformed or include code. This patch cleans\nthem up.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "272cd7a8c67dd40a31ecff76a503bbb84707f757",
      "tree": "467f83c94eb14f8f34508efe891c0dcc62a7ac24",
      "parents": [
        "828716c28fe4aa232ea280ea8ed6fb103eefb6ac"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Tue Sep 20 12:24:36 2011 -0700"
      },
      "committer": {
        "name": "Casey Schaufler",
        "email": "cschaufler@cschaufler-intel.(none)",
        "time": "Wed Oct 12 14:23:13 2011 -0700"
      },
      "message": "Smack: Rule list lookup performance\n\nThis patch is targeted for the smack-next tree.\n\nSmack access checks suffer from two significant performance\nissues. In cases where there are large numbers of rules the\nsearch of the single list of rules is wasteful. Comparing the\nstring values of the smack labels is less efficient than a\nnumeric comparison would.\n\nThese changes take advantage of the Smack label list, which\nmaintains the mapping of Smack labels to secids and optional\nCIPSO labels. Because the labels are kept perpetually, an\naccess check can be done strictly based on the address of the\nlabel in the list without ever looking at the label itself.\nRather than keeping one global list of rules the rules with\na particular subject label can be based off of that label\nlist entry. The access check need never look at entries that\ndo not use the current subject label.\n\nThis requires that packets coming off the network with\nCIPSO direct Smack labels that have never been seen before\nbe treated carefully. The only case where they could be\ndelivered is where the receiving socket has an IPIN star\nlabel, so that case is explicitly addressed.\n\nOn a system with 39,800 rules (200 labels in all permutations)\na system with this patch runs an access speed test in 5% of\nthe time of the old version. That should be a best case\nimprovement. If all of the rules are associated with the\nsame subject label and all of the accesses are for processes\nwith that label (unlikely) the improvement is about 30%.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "a269434d2fb48a4d66c1d7bf821b7874b59c5b41",
      "tree": "9c84b5f3e9f3adb3dd4a7e9da2b72dd7fe7eec49",
      "parents": [
        "f48b7399840b453e7282b523f535561fe9638a2d"
      ],
      "author": {
        "name": "Eric Paris",
        "email": "eparis@redhat.com",
        "time": "Mon Apr 25 13:10:27 2011 -0400"
      },
      "committer": {
        "name": "Eric Paris",
        "email": "eparis@redhat.com",
        "time": "Mon Apr 25 18:14:07 2011 -0400"
      },
      "message": "LSM: separate LSM_AUDIT_DATA_DENTRY from LSM_AUDIT_DATA_PATH\n\nThis patch separates and audit message that only contains a dentry from\none that contains a full path.  This allows us to make it harder to\nmisuse the interfaces or for the interfaces to be implemented wrong.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "f48b7399840b453e7282b523f535561fe9638a2d",
      "tree": "29eed009469d35473367708ea60b9c5b01fc0c5f",
      "parents": [
        "0dc1ba24f7fff659725eecbba2c9ad679a0954cd"
      ],
      "author": {
        "name": "Eric Paris",
        "email": "eparis@redhat.com",
        "time": "Mon Apr 25 12:54:27 2011 -0400"
      },
      "committer": {
        "name": "Eric Paris",
        "email": "eparis@redhat.com",
        "time": "Mon Apr 25 18:13:15 2011 -0400"
      },
      "message": "LSM: split LSM_AUDIT_DATA_FS into _PATH and _INODE\n\nThe lsm common audit code has wacky contortions making sure which pieces\nof information are set based on if it was given a path, dentry, or\ninode.  Split this into path and inode to get rid of some of the code\ncomplexity.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "db904aa8147440b750a35d58befed38155a1abb9",
      "tree": "faaeea888a0ff5ca9c1e935bda15914a551458a2",
      "parents": [
        "0e0a070d3a47d279de66e08244769556deae2eee"
      ],
      "author": {
        "name": "Shan Wei",
        "email": "shanwei@cn.fujitsu.com",
        "time": "Wed Feb 09 19:58:11 2011 -0800"
      },
      "committer": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Wed Feb 09 19:58:11 2011 -0800"
      },
      "message": "security:smack: kill unused SMACK_LIST_MAX, MAY_ANY and MAY_ANYWRITE\n\nKill unused macros of SMACK_LIST_MAX, MAY_ANY and MAY_ANYWRITE.\nv2: As Casey Schaufler\u0027s advice, also remove MAY_ANY.\n\nSigned-off-by: Shan Wei \u003cshanwei@cn.fujitsu.com\u003e\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "7898e1f8e9eb1bee88c92d636e0ab93f2cbe31c6",
      "tree": "d4aaa367bb42d0ff9d1e4ba227f248b5b9cd7687",
      "parents": [
        "aeda4ac3efc29e4d55989abd0a73530453aa69ba"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Mon Jan 17 08:05:27 2011 -0800"
      },
      "committer": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Mon Jan 17 08:05:27 2011 -0800"
      },
      "message": "Subject: [PATCH] Smack: mmap controls for library containment\n\n  In the embedded world there are often situations\n  where libraries are updated from a variety of sources,\n  for a variety of reasons, and with any number of\n  security characteristics. These differences\n  might include privilege required for a given library\n  provided interface to function properly, as occurs\n  from time to time in graphics libraries. There are\n  also cases where it is important to limit use of\n  libraries based on the provider of the library and\n  the security aware application may make choices\n  based on that criteria.\n\n  These issues are addressed by providing an additional\n  Smack label that may optionally be assigned to an object,\n  the SMACK64MMAP attribute. An mmap operation is allowed\n  if there is no such attribute.\n\n  If there is a SMACK64MMAP attribute the mmap is permitted\n  only if a subject with that label has all of the access\n  permitted a subject with the current task label.\n\n  Security aware applications may from time to time\n  wish to reduce their \"privilege\" to avoid accidental use\n  of privilege. One case where this arises is the\n  environment in which multiple sources provide libraries\n  to perform the same functions. An application may know\n  that it should eschew services made available from a\n  particular vendor, or of a particular version.\n\n  In support of this a secondary list of Smack rules has\n  been added that is local to the task. This list is\n  consulted only in the case where the global list has\n  approved access. It can only further restrict access.\n  Unlike the global last, if no entry is found on the\n  local list access is granted. An application can add\n  entries to its own list by writing to /smack/load-self.\n\n  The changes appear large as they involve refactoring\n  the list handling to accomodate there being more\n  than one rule list.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "5c6d1125f8dbd1bfef39e38fbc2837003be78a59",
      "tree": "368d34e800bc5478442679323270d776b79501e8",
      "parents": [
        "fe27d4b012273640e033be80f143bdc54daa8e16"
      ],
      "author": {
        "name": "Jarkko Sakkinen",
        "email": "ext-jarkko.2.sakkinen@nokia.com",
        "time": "Tue Dec 07 13:34:01 2010 +0200"
      },
      "committer": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Tue Dec 07 14:04:02 2010 -0800"
      },
      "message": "Smack: Transmute labels on specified directories\n\nIn a situation where Smack access rules allow processes\nwith multiple labels to write to a directory it is easy\nto get into a situation where the directory gets cluttered\nwith files that the owner can\u0027t deal with because while\nthey could be written to the directory a process at the\nlabel of the directory can\u0027t write them. This is generally\nthe desired behavior, but when it isn\u0027t it is a real\nissue.\n\nThis patch introduces a new attribute SMACK64TRANSMUTE that\ninstructs Smack to create the file with the label of the directory\nunder certain circumstances.\n\nA new access mode, \"t\" for transmute, is made available to\nSmack access rules, which are expanded from \"rwxa\" to \"rwxat\".\nIf a file is created in a directory marked as transmutable\nand if access was granted to perform the operation by a rule\nthat included the transmute mode, then the file gets the\nSmack label of the directory instead of the Smack label of the\ncreating process.\n\nNote that this is equivalent to creating an empty file at the\nlabel of the directory and then having the other process write\nto it. The transmute scheme requires that both the access rule\nallows transmutation and that the directory be explicitly marked.\n\nSigned-off-by: Jarkko Sakkinen \u003cext-jarkko.2.sakkinen@nokia.com\u003e\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "676dac4b1bee0469d6932f698aeb77e8489f5861",
      "tree": "196b4cb35cf8dfdff0698dc4368cfd00acc7391a",
      "parents": [
        "93ae86e759299718c611bc543b9b1633bf32905a"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Thu Dec 02 06:43:39 2010 -0800"
      },
      "committer": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Thu Dec 02 06:43:39 2010 -0800"
      },
      "message": "This patch adds a new security attribute to Smack called\nSMACK64EXEC. It defines label that is used while task is\nrunning.\n\nException: in smack_task_wait() child task is checked\nfor write access to parent task using label inherited\nfrom the task that forked it.\n\nFixed issues from previous submit:\n- SMACK64EXEC was not read when SMACK64 was not set.\n- inode security blob was not updated after setting\n  SMACK64EXEC\n- inode security blob was not updated when removing\n  SMACK64EXEC\n"
    },
    {
      "commit": "af4f136056c984b0aa67feed7d3170b958370b2f",
      "tree": "30b62cd9174044cbdfdddc1fe5e0f21e7ddde85c",
      "parents": [
        "5ad18a0d59ba9e65b3c8b2b489fd23bc6b3daf94"
      ],
      "author": {
        "name": "Mimi Zohar",
        "email": "zohar@linux.vnet.ibm.com",
        "time": "Thu Jul 01 15:07:43 2010 -0400"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Mon Aug 02 15:34:57 2010 +1000"
      },
      "message": "security: move LSM xattrnames to xattr.h\n\nMake the security extended attributes names global. Updated to move\nthe remaining Smack xattrs.\n\nSigned-off-by: Mimi Zohar \u003czohar@us.ibm.com\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "d4131ded4d4c1a5c1363ddd93ca104ed97dd0458",
      "tree": "137da0f52d5928eeb461218ac8109d22e65d579b",
      "parents": [
        "ed5215a21460f63d6bdc118cb55a9e6d1b433f35"
      ],
      "author": {
        "name": "Thomas Liu",
        "email": "tliu@redhat.com",
        "time": "Thu Jul 09 10:00:30 2009 -0400"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Fri Jul 10 08:58:39 2009 +1000"
      },
      "message": "security: Make lsm_priv union in lsm_audit.h anonymous\n\nMade the lsm_priv union in include/linux/lsm_audit.h\nanonymous.\n\nSigned-off-by: Thomas Liu \u003ctliu@redhat.com\u003e\nAcked-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "ed5215a21460f63d6bdc118cb55a9e6d1b433f35",
      "tree": "8134723eb6a5d73162a7e5d9c11ac66440f11b82",
      "parents": [
        "ac7242142b03421c96b0a2f8d99f146d075614c2"
      ],
      "author": {
        "name": "Thomas Liu",
        "email": "tliu@redhat.com",
        "time": "Thu Jul 09 10:00:29 2009 -0400"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Fri Jul 10 08:54:14 2009 +1000"
      },
      "message": "Move variable function in lsm_audit.h into SMACK private space\n\nMoved variable function in include/linux/lsm_audit.h into the\nsmack_audit_data struct since it is never used outside of it.\n\nAlso removed setting of function in the COMMON_AUDIT_DATA_INIT\nmacro because that variable is now private to SMACK.\n\nSigned-off-by: Thomas Liu \u003ctliu@redhat.com\u003e\nAcked-by: Eric Paris \u003ceparis@redhat.com\u003e\nI-dont-see-any-problems-with-it: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "ecfcc53fef3c357574bb6143dce6631e6d56295c",
      "tree": "d7bee04b64c5ad2ba0ed273bff2c8c7c98b3eee5",
      "parents": [
        "6e837fb152410e571a81aaadbd9884f0bc46a55e"
      ],
      "author": {
        "name": "Etienne Basset",
        "email": "etienne.basset@numericable.fr",
        "time": "Wed Apr 08 20:40:06 2009 +0200"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Tue Apr 14 09:00:23 2009 +1000"
      },
      "message": "smack: implement logging V3\n\nthe following patch, add logging of Smack security decisions.\nThis is of course very useful to understand what your current smack policy does.\nAs suggested by Casey, it also now forbids labels with \u0027, \" or \\\n\nIt introduces a \u0027/smack/logging\u0027 switch :\n0: no logging\n1: log denied (default)\n2: log accepted\n3: log denied\u0026accepted\n\nSigned-off-by: Etienne Basset \u003cetienne.basset@numericable.fr\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nAcked-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "4303154e86597885bc3cbc178a48ccbc8213875f",
      "tree": "11989bcc2ec5d9cd5a1b7952f169ec5cbd8abb8e",
      "parents": [
        "07feee8f812f7327a46186f7604df312c8c81962"
      ],
      "author": {
        "name": "Etienne Basset",
        "email": "etienne.basset@numericable.fr",
        "time": "Fri Mar 27 17:11:01 2009 -0400"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Sat Mar 28 15:01:37 2009 +1100"
      },
      "message": "smack: Add a new \u0027-CIPSO\u0027 option to the network address label configuration\n\nThis patch adds a new special option \u0027-CIPSO\u0027 to the Smack subsystem. When used\nin the netlabel list, it means \"use CIPSO networking\". A use case is when your\nlocal network speaks CIPSO and you want also to connect to the unlabeled\nInternet. This patch also add some documentation describing that. The patch\nalso corrects an oops when setting a \u0027\u0027 SMACK64 xattr to a file.\n\nSigned-off-by: Etienne Basset \u003cetienne.basset@numericable.fr\u003e\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "07feee8f812f7327a46186f7604df312c8c81962",
      "tree": "73eac643b60532aa82d7680a7de193ba2b62eddd",
      "parents": [
        "8651d5c0b1f874c5b8307ae2b858bc40f9f02482"
      ],
      "author": {
        "name": "Paul Moore",
        "email": "paul.moore@hp.com",
        "time": "Fri Mar 27 17:10:54 2009 -0400"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Sat Mar 28 15:01:37 2009 +1100"
      },
      "message": "netlabel: Cleanup the Smack/NetLabel code to fix incoming TCP connections\n\nThis patch cleans up a lot of the Smack network access control code.  The\nlargest changes are to fix the labeling of incoming TCP connections in a\nmanner similar to the recent SELinux changes which use the\nsecurity_inet_conn_request() hook to label the request_sock and let the label\nmove to the child socket via the normal network stack mechanisms.  In addition\nto the incoming TCP connection fixes this patch also removes the smk_labled\nfield from the socket_smack struct as the minor optimization advantage was\noutweighed by the difficulty in maintaining it\u0027s proper state.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "7198e2eeb44b3fe7cc97f997824002da47a9c644",
      "tree": "4989ad0f9727ac4b861189217760517aa8beea43",
      "parents": [
        "703a3cd72817e99201cef84a8a7aecc60b2b3581"
      ],
      "author": {
        "name": "Etienne Basset",
        "email": "etienne.basset@numericable.fr",
        "time": "Tue Mar 24 20:53:24 2009 +0100"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Thu Mar 26 09:17:04 2009 +1100"
      },
      "message": "smack: convert smack to standard linux lists\n\nthe following patch (on top of 2.6.29) converts Smack lists to standard linux lists\nPlease review and consider for inclusion in 2.6.30-rc\n\nregards,\nEtienne\n\nSigned-off-by: Etienne Basset \u003cetienne.basset@numericable.fr\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\n"
    },
    {
      "commit": "6d3dc07cbb1e88deed2e8710e215f232a56b1dce",
      "tree": "4c294d1ddac8c9f417bcd406771993aa58106f6d",
      "parents": [
        "277d342fc423fca5e66e677fe629d1b2f8f1b9e2"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Wed Dec 31 12:54:12 2008 -0500"
      },
      "committer": {
        "name": "Paul Moore",
        "email": "paul.moore@hp.com",
        "time": "Wed Dec 31 12:54:12 2008 -0500"
      },
      "message": "smack: Add support for unlabeled network hosts and networks\n\nAdd support for unlabeled network hosts and networks.\nRelies heavily on Paul Moore\u0027s netlabel support.\n\nCreates a new entry in /smack called netlabel. Writes to /smack/netlabel\ntake the form:\n\n    A.B.C.D LABEL\nor\n    A.B.C.D/N LABEL\n\nwhere A.B.C.D is a network address, N is an integer between 0-32,\nand LABEL is the Smack label to be used. If /N is omitted /32 is\nassumed. N designates the netmask for the address. Entries are\nmatched by the most specific address/mask pair. 0.0.0.0/0 will\nmatch everything, while 192.168.1.117/32 will match exactly one\nhost.\n\nA new system label \"@\", pronounced \"web\", is defined. Processes\ncan not be assigned the web label. An address assigned the web\nlabel can be written to by any process, and packets coming from\na web address can be written to any socket. Use of the web label\nis a violation of any strict MAC policy, but the web label has\nbeen requested many times.\n\nThe nltype entry has been removed from /smack. It did not work right\nand the netlabel interface can be used to specify that all hosts\nbe treated as unlabeled.\n\nCIPSO labels on incoming packets will be honored, even from designated\nsingle label hosts. Single label hosts can only be written to by\nprocesses with labels that can write to the label of the host.\nPackets sent to single label hosts will always be unlabeled.\n\nOnce added a single label designation cannot be removed, however\nthe label may be changed.\n\nThe behavior of the ambient label remains unchanged.\n\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\n"
    },
    {
      "commit": "15446235367fa4a621ff5abfa4b6ebbe25b33763",
      "tree": "bc6823055afbef26560c63f8041caeadd4cef078",
      "parents": [
        "cf9481e289247fe9cf40f2e2481220d899132049"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Wed Jul 30 15:37:11 2008 -0700"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Tue Aug 05 10:55:53 2008 +1000"
      },
      "message": "smack: limit privilege by label\n\nThere have been a number of requests to make the Smack LSM\nenforce MAC even in the face of privilege, either capability\nbased or superuser based. This is not universally desired,\nhowever, so it seems desirable to make it optional. Further,\nat least one legacy OS implemented a scheme whereby only\nprocesses running with one particular label could be exempt\nfrom MAC. This patch supports these three cases.\n\nIf /smack/onlycap is empty (unset or null-string) privilege\nis enforced in the normal way.\n\nIf /smack/onlycap contains a label only processes running with\nthat label may be MAC exempt.\n\nIf the label in /smack/onlycap is the star label (\"*\") the\nsemantics of the star label combine with the privilege\nrestrictions to prevent any violations of MAC, even in the\npresence of privilege.\n\nAgain, this will be independent of the privilege scheme.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nReviewed-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "076c54c5bcaed2081c0cba94a6f77c4d470236ad",
      "tree": "5e8f05cab20a49922618bb3af697a6b46e610eee",
      "parents": [
        "04305e4aff8b0533dc05f9f6f1a34d0796bd985f"
      ],
      "author": {
        "name": "Ahmed S. Darwish",
        "email": "darwish.07@gmail.com",
        "time": "Thu Mar 06 18:09:10 2008 +0200"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Sat Apr 19 10:00:51 2008 +1000"
      },
      "message": "Security: Introduce security\u003d boot parameter\n\nAdd the security\u003d boot parameter. This is done to avoid LSM\nregistration clashes in case of more than one bult-in module.\n\nUser can choose a security module to enable at boot. If no\nsecurity\u003d boot parameter is specified, only the first LSM\nasking for registration will be loaded. An invalid security\nmodule name will be treated as if no module has been chosen.\n\nLSM modules must check now if they are allowed to register\nby calling security_module_enable(ops) first. Modify SELinux\nand SMACK to do so.\n\nDo not let SMACK register smackfs if it was not chosen on\nboot. Smackfs assumes that smack hooks are registered and\nthe initial task security setup (swapper-\u003esecurity) is done.\n\nSigned-off-by: Ahmed S. Darwish \u003cdarwish.07@gmail.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "b500ce8d24d1f14426643da5f6fada28c1f60533",
      "tree": "17b6084b29434a968f787e238548a843126e2ec3",
      "parents": [
        "93d74463d018ddf05c169ad399e62e90e0f82fc0"
      ],
      "author": {
        "name": "Ahmed S. Darwish",
        "email": "darwish.07@gmail.com",
        "time": "Thu Mar 13 12:32:34 2008 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 13 13:11:43 2008 -0700"
      },
      "message": "smackfs: do not trust `count\u0027 in inodes write()s\n\nSmackfs write() implementation does not put a higher bound on the number of\nbytes to copy from user-space.  This may lead to a DOS attack if a malicious\n`count\u0027 field is given.\n\nAssure that given `count\u0027 is exactly the length needed for a /smack/load rule.\n In case of /smack/cipso where the length is relative, assure that `count\u0027\ndoes not exceed the size needed for a buffer representing maximum possible\nnumber of CIPSO 2.2 categories.\n\nSigned-off-by: Ahmed S. Darwish \u003cdarwish.07@gmail.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
      "tree": "933b840f3ccac6860da56291c742094f9b5a20cb",
      "parents": [
        "eda61d32e8ad1d9102872f9a0abf3344bf9c5e67"
      ],
      "author": {
        "name": "Casey Schaufler",
        "email": "casey@schaufler-ca.com",
        "time": "Mon Feb 04 22:29:50 2008 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@woody.linux-foundation.org",
        "time": "Tue Feb 05 09:44:20 2008 -0800"
      },
      "message": "Smack: Simplified Mandatory Access Control Kernel\n\nSmack is the Simplified Mandatory Access Control Kernel.\n\nSmack implements mandatory access control (MAC) using labels\nattached to tasks and data containers, including files, SVIPC,\nand other tasks. Smack is a kernel based scheme that requires\nan absolute minimum of application support and a very small\namount of configuration data.\n\nSmack uses extended attributes and\nprovides a set of general mount options, borrowing technics used\nelsewhere. Smack uses netlabel for CIPSO labeling. Smack provides\na pseudo-filesystem smackfs that is used for manipulation of\nsystem Smack attributes.\n\nThe patch, patches for ls and sshd, a README, a startup script,\nand x86 binaries for ls and sshd are also available on\n\n    http://www.schaufler-ca.com\n\nDevelopment has been done using Fedora Core 7 in a virtual machine\nenvironment and on an old Sony laptop.\n\nSmack provides mandatory access controls based on the label attached\nto a task and the label attached to the object it is attempting to\naccess. Smack labels are deliberately short (1-23 characters) text\nstrings. Single character labels using special characters are reserved\nfor system use. The only operation applied to Smack labels is equality\ncomparison. No wildcards or expressions, regular or otherwise, are\nused. Smack labels are composed of printable characters and may not\ninclude \"/\".\n\nA file always gets the Smack label of the task that created it.\n\nSmack defines and uses these labels:\n\n    \"*\" - pronounced \"star\"\n    \"_\" - pronounced \"floor\"\n    \"^\" - pronounced \"hat\"\n    \"?\" - pronounced \"huh\"\n\nThe access rules enforced by Smack are, in order:\n\n1. Any access requested by a task labeled \"*\" is denied.\n2. A read or execute access requested by a task labeled \"^\"\n   is permitted.\n3. A read or execute access requested on an object labeled \"_\"\n   is permitted.\n4. Any access requested on an object labeled \"*\" is permitted.\n5. Any access requested by a task on an object with the same\n   label is permitted.\n6. Any access requested that is explicitly defined in the loaded\n   rule set is permitted.\n7. Any other access is denied.\n\nRules may be explicitly defined by writing subject,object,access\ntriples to /smack/load.\n\nSmack rule sets can be easily defined that describe Bell\u0026LaPadula\nsensitivity, Biba integrity, and a variety of interesting\nconfigurations. Smack rule sets can be modified on the fly to\naccommodate changes in the operating environment or even the time\nof day.\n\nSome practical use cases:\n\nHierarchical levels. The less common of the two usual uses\nfor MLS systems is to define hierarchical levels, often\nunclassified, confidential, secret, and so on. To set up smack\nto support this, these rules could be defined:\n\n   C        Unclass rx\n   S        C       rx\n   S        Unclass rx\n   TS       S       rx\n   TS       C       rx\n   TS       Unclass rx\n\nA TS process can read S, C, and Unclass data, but cannot write it.\nAn S process can read C and Unclass. Note that specifying that\nTS can read S and S can read C does not imply TS can read C, it\nhas to be explicitly stated.\n\nNon-hierarchical categories. This is the more common of the\nusual uses for an MLS system. Since the default rule is that a\nsubject cannot access an object with a different label no\naccess rules are required to implement compartmentalization.\n\nA case that the Bell \u0026 LaPadula policy does not allow is demonstrated\nwith this Smack access rule:\n\nA case that Bell\u0026LaPadula does not allow that Smack does:\n\n    ESPN    ABC   r\n    ABC     ESPN  r\n\nOn my portable video device I have two applications, one that\nshows ABC programming and the other ESPN programming. ESPN wants\nto show me sport stories that show up as news, and ABC will\nonly provide minimal information about a sports story if ESPN\nis covering it. Each side can look at the other\u0027s info, neither\ncan change the other. Neither can see what FOX is up to, which\nis just as well all things considered.\n\nAnother case that I especially like:\n\n    SatData Guard   w\n    Guard   Publish w\n\nA program running with the Guard label opens a UDP socket and\naccepts messages sent by a program running with a SatData label.\nThe Guard program inspects the message to ensure it is wholesome\nand if it is sends it to a program running with the Publish label.\nThis program then puts the information passed in an appropriate\nplace. Note that the Guard program cannot write to a Publish\nfile system object because file system semanitic require read as\nwell as write.\n\nThe four cases (categories, levels, mutual read, guardbox) here\nare all quite real, and problems I\u0027ve been asked to solve over\nthe years. The first two are easy to do with traditonal MLS systems\nwhile the last two you can\u0027t without invoking privilege, at least\nfor a while.\n\nSigned-off-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nCc: Joshua Brindle \u003cmethod@manicmethod.com\u003e\nCc: Paul Moore \u003cpaul.moore@hp.com\u003e\nCc: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nCc: Chris Wright \u003cchrisw@sous-sol.org\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: \"Ahmed S. Darwish\" \u003cdarwish.07@gmail.com\u003e\nCc: Andrew G. Morgan \u003cmorgan@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    }
  ]
}