Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6 (19b5b517) · Commits · 戴 / test

security/selinux/avc.c

+29 −29

Original line number	Diff line number	Diff line
		@@ -426,7 +426,7 @@ static int avc_latest_notif_update(int seqno, int is_insert)
		spin_lock_irqsave(&notif_lock, flag);
		if (is_insert) {
		if (seqno < avc_cache.latest_notif) {
		printk(KERN_WARNING "avc: seqno %d < latest_notif %d\n",
		printk(KERN_WARNING "SELinux: avc: seqno %d < latest_notif %d\n",
		seqno, avc_cache.latest_notif);
		ret = -EAGAIN;
		}

security/selinux/hooks.c

+254 −258

Original line number	Diff line number	Diff line
		@@ -99,7 +99,7 @@ extern struct security_operations *security_ops;
		atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);

		#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
		int selinux_enforcing = 0;
		int selinux_enforcing;

		static int __init enforcing_setup(char *str)
		{
		@@ -123,13 +123,13 @@ int selinux_enabled = 1;
		#endif

		/* Original (dummy) security module. */
		static struct security_operations *original_ops = NULL;
		static struct security_operations *original_ops;

		/* Minimal support for a secondary security module,
		just to allow the use of the dummy or capability modules.
		The owlsm module can alternatively be used as a secondary
		module as long as CONFIG_OWLSM_FD is not enabled. */
		static struct security_operations *secondary_ops = NULL;
		static struct security_operations *secondary_ops;

		/* Lists of inode and superblock security structures initialized
		before the policy was loaded. */
		@@ -575,8 +575,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
		goto out;
		}
		rc = -EINVAL;
		printk(KERN_WARNING "Unable to set superblock options before "
		"the security server is initialized\n");
		printk(KERN_WARNING "SELinux: Unable to set superblock options "
		"before the security server is initialized\n");
		goto out;
		}

		@@ -1135,7 +1135,7 @@ static int inode_doinit_with_dentry(struct inode inode, struct dentry opt_dent
		dentry = d_find_alias(inode);
		}
		if (!dentry) {
		printk(KERN_WARNING "%s: no dentry for dev=%s "
		printk(KERN_WARNING "SELinux: %s: no dentry for dev=%s "
		"ino=%ld\n", __func__, inode->i_sb->s_id,
		inode->i_ino);
		goto out_unlock;
		@@ -1173,7 +1173,7 @@ static int inode_doinit_with_dentry(struct inode inode, struct dentry opt_dent
		dput(dentry);
		if (rc < 0) {
		if (rc != -ENODATA) {
		printk(KERN_WARNING "%s: getxattr returned "
		printk(KERN_WARNING "SELinux: %s: getxattr returned "
		"%d for dev=%s ino=%ld\n", __func__,
		-rc, inode->i_sb->s_id, inode->i_ino);
		kfree(context);
		@@ -1187,7 +1187,7 @@ static int inode_doinit_with_dentry(struct inode inode, struct dentry opt_dent
		sbsec->def_sid,
		GFP_NOFS);
		if (rc) {
		printk(KERN_WARNING "%s: context_to_sid(%s) "
		printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
		"returned %d for dev=%s ino=%ld\n",
		__func__, context, -rc,
		inode->i_sb->s_id, inode->i_ino);
		@@ -1510,7 +1510,8 @@ static int may_link(struct inode *dir,
		av = DIR__RMDIR;
		break;
		default:
		printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
		printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
		__func__, kind);
		return 0;
		}

		@@ -1640,8 +1641,8 @@ static inline u32 open_file_mask_to_av(int mode, int mask)
		else if (S_ISDIR(mode))
		av \|= DIR__OPEN;
		else
		printk(KERN_ERR "SELinux: WARNING: inside open_file_to_av "
		"with unknown mode:%x\n", mode);
		printk(KERN_ERR "SELinux: WARNING: inside %s with "
		"unknown mode:%x\n", __func__, mode);
		}
		return av;
		}
		@@ -1817,16 +1818,14 @@ static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
		case Q_QUOTAOFF:
		case Q_SETINFO:
		case Q_SETQUOTA:
		rc = superblock_has_perm(current,
		sb,
		FILESYSTEM__QUOTAMOD, NULL);
		rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAMOD,
		NULL);
		break;
		case Q_GETFMT:
		case Q_GETINFO:
		case Q_GETQUOTA:
		rc = superblock_has_perm(current,
		sb,
		FILESYSTEM__QUOTAGET, NULL);
		rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAGET,
		NULL);
		break;
		default:
		rc = 0; /* let the kernel handle invalid cmds */
		@@ -2314,8 +2313,7 @@ static inline void take_selinux_option(char *to, char from, int *first,
		if (!*first) {
		**to = '\|';
		*to += 1;
		}
		else
		} else
		*first = 0;

		while (current_size < len) {
		@@ -2893,7 +2891,6 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
		*/
		default:
		error = file_has_perm(current, file, FILE__IOCTL);

		}
		return error;
		}
		@@ -5218,8 +5215,7 @@ static int selinux_setprocattr(struct task_struct *p,
		tsec->sid = sid;
		task_unlock(p);
		}
		}
		else
		} else
		return -EINVAL;

		return size;
		@@ -5523,11 +5519,10 @@ static __init int selinux_init(void)
		if (register_security(&selinux_ops))
		panic("SELinux: Unable to register with kernel.\n");

		if (selinux_enforcing) {
		if (selinux_enforcing)
		printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
		} else {
		else
		printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
		}

		#ifdef CONFIG_KEYS
		/* Add security information to initial keyrings */
		@@ -5672,10 +5667,11 @@ static void selinux_nf_ip_exit(void)
		#endif /* CONFIG_NETFILTER */

		#ifdef CONFIG_SECURITY_SELINUX_DISABLE
		static int selinux_disabled;

		int selinux_disable(void)
		{
		extern void exit_sel_fs(void);
		static int selinux_disabled = 0;

		if (ss_initialized) {
		/* Not permitted after initial policy load. */

security/selinux/netif.c

+9 −10

Original line number	Diff line number	Diff line
		@@ -31,8 +31,7 @@
		#define SEL_NETIF_HASH_SIZE 64
		#define SEL_NETIF_HASH_MAX 1024

		struct sel_netif
		{
		struct sel_netif {
		struct list_head list;
		struct netif_security_struct nsec;
		struct rcu_head rcu_head;

security/selinux/nlmsgtab.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -23,8 +23,7 @@
		#include "flask.h"
		#include "av_permissions.h"

		struct nlmsg_perm
		{
		struct nlmsg_perm {
		u16 nlmsg_type;
		u32 perm;
		};

security/selinux/selinuxfs.c

+65 −62

Original line number	Diff line number	Diff line
		@@ -73,17 +73,17 @@ __setup("selinux_compat_net=", selinux_compat_net_setup);
		static DEFINE_MUTEX(sel_mutex);

		/* global data for booleans */
		static struct dentry *bool_dir = NULL;
		static int bool_num = 0;
		static struct dentry *bool_dir;
		static int bool_num;
		static char **bool_pending_names;
		static int *bool_pending_values = NULL;
		static int *bool_pending_values;

		/* global data for classes */
		static struct dentry *class_dir = NULL;
		static struct dentry *class_dir;
		static unsigned long last_class_ino;

		/* global data for policy capabilities */
		static struct dentry *policycap_dir = NULL;
		static struct dentry *policycap_dir;

		extern void selnl_notify_setenforce(int val);

		@@ -390,8 +390,8 @@ static ssize_t sel_write_context(struct file * file, char *buf, size_t size)
		return length;

		if (len > SIMPLE_TRANSACTION_LIMIT) {
		printk(KERN_ERR "%s: context size (%u) exceeds payload "
		"max\n", __func__, len);
		printk(KERN_ERR "SELinux: %s: context size (%u) exceeds "
		"payload max\n", __func__, len);
		length = -ERANGE;
		goto out;
		}
		@@ -643,8 +643,8 @@ static ssize_t sel_write_create(struct file * file, char *buf, size_t size)
		goto out2;

		if (len > SIMPLE_TRANSACTION_LIMIT) {
		printk(KERN_ERR "%s: context size (%u) exceeds payload "
		"max\n", __func__, len);
		printk(KERN_ERR "SELinux: %s: context size (%u) exceeds "
		"payload max\n", __func__, len);
		length = -ERANGE;
		goto out3;
		}
		@@ -820,8 +820,8 @@ static ssize_t sel_write_member(struct file * file, char *buf, size_t size)
		goto out2;

		if (len > SIMPLE_TRANSACTION_LIMIT) {
		printk(KERN_ERR "%s: context size (%u) exceeds payload "
		"max\n", __func__, len);
		printk(KERN_ERR "SELinux: %s: context size (%u) exceeds "
		"payload max\n", __func__, len);
		length = -ERANGE;
		goto out3;
		}
		@@ -872,7 +872,8 @@ static ssize_t sel_read_bool(struct file filep, char __user buf,
		ret = -EINVAL;
		goto out;
		}
		if (!(page = (char*)get_zeroed_page(GFP_KERNEL))) {
		page = (char *)get_zeroed_page(GFP_KERNEL);
		if (!page) {
		ret = -ENOMEM;
		goto out;
		}
		@@ -991,9 +992,8 @@ static ssize_t sel_commit_bools_write(struct file *filep,
		if (sscanf(page, "%d", &new_value) != 1)
		goto out;

		if (new_value && bool_pending_values) {
		if (new_value && bool_pending_values)
		security_set_bools(bool_num, bool_pending_values);
		}

		length = count;

		@@ -1055,7 +1055,8 @@ static int sel_make_bools(void)

		sel_remove_entries(dir);

		if (!(page = (char*)get_zeroed_page(GFP_KERNEL)))
		page = (char *)get_zeroed_page(GFP_KERNEL);
		if (!page)
		return -ENOMEM;

		ret = security_get_bools(&num, &names, &values);
		@@ -1083,7 +1084,8 @@ static int sel_make_bools(void)
		goto err;
		}
		isec = (struct inode_security_struct *)inode->i_security;
		if ((ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid)))
		ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid);
		if (ret)
		goto err;
		isec->sid = sid;
		isec->initialized = 1;
		@@ -1111,7 +1113,7 @@ err:

		#define NULL_FILE_NAME "null"

		struct dentry *selinux_null = NULL;
		struct dentry *selinux_null;

		static ssize_t sel_read_avc_cache_threshold(struct file filp, char __user buf,
		size_t count, loff_t *ppos)
		@@ -1760,7 +1762,8 @@ static int sel_fill_super(struct super_block * sb, void * data, int silent)
		out:
		return ret;
		err:
		printk(KERN_ERR "%s: failed while creating inodes\n", __func__);
		printk(KERN_ERR "SELinux: %s: failed while creating inodes\n",
		__func__);
		goto out;
		}

Admin message