Re: [PATCH 0/3] KEYS: Fixes

2017-02-09 Thread James Morris
) Explicitly zero-out secret data before freeing it in case gcc > optimises memset() away in future. > Applied. -- James Morris

Re: [PATCH 0/3] KEYS: Fixes

2017-02-09 Thread James Morris
ells/linux-fs.git keys-fixes-20170209 fatal: Couldn't find remote ref keys-fixes-20170209 -- James Morris

[GIT PULL][SECURITY] selinux: fix off-by-one in setprocattr

2017-02-07 Thread James Morris
the commit description] Cc: sta...@vger.kernel.org # 3.5: d6ea83ec6864e Signed-off-by: Paul Moore Signed-off-by: James Morris diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index c7c6619..d98550a 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hook

Re: [GIT PULL] tpmdd updates for Linux 4.11

2017-02-03 Thread James Morris
27 14:17:21 -0500) > > are available in the git repository at: > > git://git.infradead.org/users/jjs/linux-tpmdd.git tags/tpmdd-next-20170204 > Pulled, thanks! -- James Morris

Re: [RFC/PATCH 2/3] security: Add the Timgad module

2017-02-02 Thread James Morris
load and unload only netdev aliased modules, this is currently not > supported. Other checks for real root without CAP_SYS_MODULE ? ... > > (This should be improved) > > 2 - Modules can not be loaded nor unloaded. Once set, this sysctl value > cannot be changed. How is this different to just using CAP_SYS_MODULE? -- James Morris

Re: Fwd: Re: [tpmdd-devel] [PATCH v9 2/2] tpm: add securityfs support,for TPM 2.0 firmware event log

2017-01-31 Thread James Morris
I just want a second opinion before putting > them into pull request. > I'll take this for 4.11. IMA + TPM 2.0 is still developmental and not in wide use, afaik. -- James Morris

Re: [PATCH 3/3] ima_fs: Move three error code assignments in ima_write_policy()

2017-01-29 Thread James Morris
mail-archive.com/linux-kernel@vger.kernel.org/msg1254425.html - James -- James Morris

Re: [GIT PULL] tpmdd updates for Linux 4.11

2017-01-23 Thread James Morris
gt; > seccomp: dump core when using SECCOMP_RET_KILL (2017-01-23 21:42:42 +1100) > > are available in the git repository at: > > git://git.infradead.org/users/jjs/linux-tpmdd.git tags/tpmdd-next-20170123 > Pulled, thanks! -- James Morris

Re: [PATCH] seccomp: dump core when using SECCOMP_RET_KILL

2017-01-23 Thread James Morris
On Mon, 23 Jan 2017, Mike Frysinger wrote: > On Sun, Jan 22, 2017 at 4:10 PM, James Morris wrote: > > On Fri, 20 Jan 2017, Kees Cook wrote: > > > Yup, I think this is fine. The additional kernel code executed before > > > the do_exit() is relatively limited, a

Re: [PATCH] seccomp: dump core when using SECCOMP_RET_KILL

2017-01-22 Thread James Morris
e generation, so really paranoid > environments can still do that. > > The forwarded ack stands: > > Acked-by: Kees Cook > > James, can you add this to your tree? Mike, please resend the patch, I don't have it. -- James Morris

Re: [PATCH v2] LSM: Add /sys/kernel/security/lsm

2017-01-18 Thread James Morris
sen > Acked-by: Paul Moore > Acked-by: Kees Cook Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next -- James Morris

Re: [PATCH] LSM: Add /sys/kernel/security/lsm

2017-01-18 Thread James Morris
rated > list of the active secuirty modules. No more groping around > in /proc/filesystems or other clever hacks. > > Unchanged from previous versions except for being updated > to the latest security next branch. > This doesn't apply cleanly to my tree. -- James Morris

Re: [PATCH] LSM: Add /sys/kernel/security/lsm

2017-01-18 Thread James Morris
On Wed, 18 Jan 2017, Kees Cook wrote: > On Wed, Jan 18, 2017 at 11:22 AM, Paul Moore wrote: > > On Wed, Jan 18, 2017 at 7:43 AM, James Morris wrote: > >> On Tue, 17 Jan 2017, Casey Schaufler wrote: > >> > >>> Subject: [PATCH] LSM: Add /sys/kernel/secur

Re: [PATCH] LSM: Add /sys/kernel/security/lsm

2017-01-18 Thread James Morris
rated > list of the active secuirty modules. No more groping around > in /proc/filesystems or other clever hacks. > > Unchanged from previous versions except for being updated > to the latest security next branch. > Any objections to merging this? -- James Morris

Re: [GIT PULL] AppArmor fixes for 4.11

2017-01-16 Thread James Morris
; > are available in the git repository at: > > git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor for-security > > for you to fetch changes up to 3ccb76c5dfe0d25c1d0168d5b726d0b43d19a485: > > apparmor: fix undefined reference to `aa_g_hash_policy' (2017-01-16 > 13:21:27 -0800) Pulled, thanks. -- James Morris

Re: [v2 2/2] vfio iommu type1: fix the testing of capability for remote task

2017-01-12 Thread James Morris
> Cc: Gerd Hoffmann > Signed-off-by: Jike Song Reviewed-by: James Morris > --- > drivers/vfio/vfio_iommu_type1.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c > index 926627

Re: [v2 1/2] capability: export has_capability

2017-01-12 Thread James Morris
On Thu, 12 Jan 2017, Jike Song wrote: > has_capability() is sometimes needed by modules to test capability > for specified task other than current, so export it. > > Cc: Alex Williamson > Cc: Kirti Wankhede > Acked-by: Serge Hallyn > Signed-off-by: Jike Song A

Re: [PATCH v1] security: Fix inode_getattr documentation

2017-01-09 Thread James Morris
On Thu, 22 Dec 2016, Mickaël Salaün wrote: > Replace arguments @mnt and @dentry with @path. > > Signed-off-by: Mickaël Salaün > Cc: James Morris > Cc: Serge E. Hallyn > --- > include/linux/lsm_hooks.h | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) Applied

Re: [PATCH] samples/seccomp: fix 64-bit comparison macros

2017-01-08 Thread James Morris
Röttger > > Signed-off-by: Mathias Svensson > > Signed-off-by: Kees Cook > > Cc: sta...@vger.kernel.org > > Oops, the in-body "From:" got stripped. This patch is authored by Mathias: > > From: Mathias Svensson > Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next -- James Morris

[GIT PULL] SELinux fix for 4.10

2016-12-21 Thread James Morris
andling (2016-12-21 10:59:34 -0800) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git for-linus James Morris (1): Merge branch 'stable-4.10' of git://git.infradead.org/users/pcmoore/selinux into for-linus Paul M

Re: [PATCH 1/2] crypto: asymmetric_keys: set error code on failure

2016-12-12 Thread James Morris
_key_verify_signature(const struct public_key > *pkey, > if (ret) > goto error_free_req; > > + ret = -ENOMEM; > outlen = crypto_akcipher_maxsize(tfm); > output = kmalloc(outlen, GFP_KERNEL); > if (!output) > -- James Morris

[GIT PULL] Security subsystem updates for 4.10

2016-12-11 Thread James Morris
smack: parse mnt opts after privileges check SMACK: Do not apply star label in smack_setprocattr hook SMACK: Fix the memory leak in smack_cred_prepare() hook James Morris (5): Merge tag 'seccomp-v4.9-rc4' of git://git.kernel.org/.../kees/linux into ra-next Merge

Re: [PATCH] Yama: allow access for the current ptrace parent

2016-12-04 Thread James Morris
On Fri, 2 Dec 2016, Kees Cook wrote: > James, can you pull this into your -next tree? I made a tiny fix to the > comment style, but it is otherwise identical to what Josh sent originally. Applied, thanks! -- James Morris

Re: [GIT PULL] tpmdd updates for Linux 4.10

2016-11-27 Thread James Morris
able to add event log for TPM 2.0. > Pulled, thanks. -- James Morris

Re: [PATCH 0/2] KEYS: Fixes

2016-11-24 Thread James Morris
On Thu, 24 Nov 2016, David Howells wrote: > James Morris wrote: > > > $ git pull > > git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git > > keys-fixes-20161124-3 > > fatal: Couldn't find remote ref keys-fixes-20161124-3 > > Ummm...

[GIT PULL] Keys fixes

2016-11-24 Thread James Morris
Please pull these fixes for the keys code. >From David: " (1) Fix mpi_powm()'s handling of a number with a zero exponent [CVE-2016-8650]. (2) Fix double free in X.509 error handling. Ver #3: - Integrate my and Andrey's patches for mpi_powm() and use mpi_resize() instead of RESIZE_IF_NEED

Re: [PATCH 0/2] KEYS: Fixes

2016-11-24 Thread James Morris
On Thu, 24 Nov 2016, David Howells wrote: > James Morris wrote: > > > $ git pull > > git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git > > keys-fixes-20161124 > > fatal: Couldn't find remote ref keys-fixes-20161124 > > I've p

Re: [PATCH 0/2] KEYS: Fixes

2016-11-24 Thread James Morris
; keys-fixes-20161124 $ git pull git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git keys-fixes-20161124 fatal: Couldn't find remote ref keys-fixes-20161124 -- James Morris

[GIT PULL][SECURITY] Apparmor bugfix

2016-11-20 Thread James Morris
Fixes: 01e2b670aa898a39259bc85c78e3d74820f4d3b6 (failure to find hat) Fixes: 898127c34ec03291c86f4ff3856d79e9e18952bc (stale policy being applied) Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1000287 Cc: sta...@vger.kernel.org Signed-off-by: John Johansen Signed-

Re: [PATCH 1/1 V2] mqueue: Implment generic xattr support

2016-11-07 Thread James Morris
x named type transition on file inodes created within > the filesystem. The implementation and LSM call back function are based > off tmpfs/shmem. > > Signed-off-by: David Graziano Acked-by: James Morris -- James Morris

Re: [PATCH 3/3] tpm: move documentation under Documentation/security

2016-11-04 Thread James Morris
ntation/security. > > > > FWIW I like this. > > Thx. I just realized that I should have CC'd to linux-security-module > to get say from James as this makes path for the whole security tree. > > James, sorry about that. Can you share your opinion? Looks like a good idea to me. -- James Morris

Re: [GIT PULL] seccomp fixes for v4.9-rc4

2016-11-04 Thread James Morris
On Tue, 1 Nov 2016, Kees Cook wrote: > > How about we queue this up for 4.10? > > Okay, sounds good to me. Thanks! Pulled to -next. -- James Morris

Re: [GIT PULL] seccomp fixes for v4.9-rc4

2016-11-01 Thread James Morris
le truncation > - fix samples hostprogs variable in Makefile > > These fixes don't seem very critical, and Linus was talking yesterday at KS about too much churn in the -rc series with non-critical fixes. How about we

[GIT PULL] TPM bugfix

2016-10-31 Thread James Morris
tpm_do_selftest() Removal of this check was not properly amended to the original commit. Cc: sta...@vger.kernel.org Fixes: 0c541332231e ("tpm: use tpm_pcr_read_dev() in tpm_do_selftest()") Signed-off-by: Jarkko Sakkinen Signed-off-by: James Morris diff --git a/dr

Re: [PATCH v6 0/3] LSM: security module information improvements

2016-10-28 Thread James Morris
eculative infrastructure to the kernel. There is no consensus that we need major module stacking, and some of the technical issues (network secids, for example) are also as yet unresolved. - James -- James Morris

Re: [PATCH v6 0/3] LSM: security module information improvements

2016-10-27 Thread James Morris
ne requested this, or is likely to adopt it into a distro? -- James Morris

[GIT PULL] Keys fixes

2016-10-26 Thread James Morris
Please pull these fixes from David Howells: (1) Fix a buffer overflow when displaying /proc/keys [CVE-2016-7042]. (2) Fix broken initialisation in the big_key implementation that can result in an oops. (3) Make big_key depend on having a random number generator available in Kconfig

Re: [PATCH 0/8] CaitSith LSM module

2016-10-23 Thread James Morris
rmor will be gaining more support for security labels. JJ: is that correct? -- James Morris

[GIT PULL] Security subsystem updates for 4.9

2016-10-04 Thread James Morris
changes up to 1306d8e1c09fdc8ecb9ef235e2116352f810f9c5: Merge tag 'tpmdd-next-20160927' of git://git.infradead.org/users/jjs/linux-tpmdd into ra-next (2016-09-27 19:21:37 +1000) Casey Schaufler (1): Smack: Signal delivery as an append op

Re: [GIT PULL] tpmdd reverts for Linux 4.9

2016-09-27 Thread James Morris
t.infradead.org/users/jjs/linux-tpmdd.git tags/tpmdd-next-20160927 > Pulled, thanks. -- James Morris

Re: [GIT PULL] tpmdd updates for Linux 4.9

2016-09-18 Thread James Morris
ux-tpmdd.git master > > for you to fetch changes up to ebfd7532e985818a327906e011f3e43c8ddfdd74: > > tpm: add check for minimum buffer size in tpm_transmit() (2016-09-15 > 16:04:21 +0300) Pulled, thanks. -- James Morris

Re: [GIT PULL] seccomp fixes for v4.8-rc6

2016-09-07 Thread James Morris
Actually I asked if you could send them to me... On 08/09/16 02:29, Kees Cook wrote: Hi, Please pull these seccomp fixes for v4.8-rc6. These got accidentally put in James's -next tree, but they're needed for v4.8. He asked me to forward them directly to you. Thanks! -Kees The following chan

[GIT PULL] TPM bugfix

2016-09-02 Thread James Morris
2016 +0300 tpm: invalid self test error message The driver emits invalid self test error message even though the init succeeds. Signed-off-by: Jarkko Sakkinen Fixes: cae8b441fc20 ("tpm: Factor out common startup code") Reviewed-by: James Morris di

Re: [PATCH] tpm: invalid self test error message

2016-09-01 Thread James Morris
On Fri, 2 Sep 2016, Jarkko Sakkinen wrote: > The driver emits invalid self test error message even though the init > succeeds. > > Signed-off-by: Jarkko Sakkinen Reviewed-by: James Morris -- James Morris

Re: [GIT PULL] seccomp fix for v4.8-rc4

2016-08-30 Thread James Morris
On 30/08/16 15:28, Kees Cook wrote: Hi James, Are you able to forward this up to Linus, or would it be better for me to send this to him directly? You can send it to him directly. Acked-by: James Morris Thanks! -Kees On Tue, Aug 23, 2016 at 3:34 PM, Kees Cook wrote: Hi, Please

Re: [PATCH v2 0/3] Fix seccomp for UM (next)

2016-08-08 Thread James Morris
nel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next -- James Morris

Re: [PATCH v1] module: Fully remove the kernel_module_from_file hook

2016-08-01 Thread James Morris
On Sun, 31 Jul 2016, Mimi Zohar wrote: > On Do, 2016-07-28 at 11:30 -0700, Kees Cook wrote: > > On Tue, Jul 12, 2016 at 5:48 AM, James Morris wrote: > > > On Sat, 9 Jul 2016, Mickaël Salaün wrote: > > > > > >> Fixes: a1db74209483 ("module: replace cop

Re: [PATCH v1 0/3] Fix seccomp for UM (next)

2016-07-31 Thread James Morris
Cook > > James, can you take these fixes for v4.8? We'll need them for um to > work correctly again. (They appear to still be missing from -next.) > I'm pretty sure I don't have these patches, can you or the author send them to me? -- James Morris

Re: [GIT PULL] Security subsystem updates for 4.8

2016-07-27 Thread James Morris
On Wed, 27 Jul 2016, David Miller wrote: > From: Linus Torvalds > Date: Wed, 27 Jul 2016 11:50:46 -0700 > > > On Wed, Jul 27, 2016 at 4:04 AM, James Morris wrote: > >> > >> Highlights: > >> > >> - TPM core and driver updates/fixes > >>

[GIT PULL] Security subsystem updates for 4.8

2016-07-27 Thread James Morris
e lsm to label the skbuff directly. netlabel: Pass a family parameter to netlbl_skbuff_err(). calipso: Add validation of CALIPSO option. calipso: Add a label cache. netlabel: Implement CALIPSO config functions for SMACK. James Morris (3): Merge branch 'stable-4.8&

Re: [PATCH] apparmor: fix SECURITY_APPARMOR_HASH_DEFAULT parameter handling

2016-07-26 Thread James Morris
used") > Signed-off-by: John Johansen Please rebase this against current Linus. -- James Morris

Re: [RFC PATCH 0/9][V3] Overlayfs SELinux Support

2016-07-21 Thread James Morris
On Thu, 21 Jul 2016, Paul Moore wrote: > James, assuming the overlayfs-next branch is pulled during the merge > window, can you rebase your linux-security#next branch to v4.8-rc1 > once Linus tags it? Yep. -- James Morris

Re: [RFC][PATCH 2/2 v3] security: Add task_settimerslack/task_gettimerslack LSM hook

2016-07-21 Thread James Morris
On Wed, 20 Jul 2016, John Stultz wrote: > On Tue, Jul 19, 2016 at 11:12 PM, James Morris wrote: > > On Mon, 18 Jul 2016, John Stultz wrote: > > > >> As requested, this patch implements a task_settimerslack and > >> task_gettimerslack LSM hooks so that the /proc/

Re: [RFC][PATCH 2/2 v3] security: Add task_settimerslack/task_gettimerslack LSM hook

2016-07-19 Thread James Morris
YS_NICE check in the timerslack_ns_write/show > functions, as hiding it in the LSM hook seems too opaque, and doesn't > seem like a widely enough adopted practice. > I may have missed something in the earlier discussion, but why do we need new LSM hooks here vs. calling the existing set/getscheduler hooks? -- James Morris

Re: [GIT PULL] tpmdd fixes for Linux 4.8

2016-07-19 Thread James Morris
ext-20160719 > > for you to fetch changes up to 82cc1a49b6358394938e759dc4c22b2be773bbad: > > tpm: Add TPM 2.0 support to the Nuvoton i2c driver (NPCT6xx family) > (2016-07-19 17:43:38 +0300) > Pulled, thanks. -- James Morris

[GIT PULL] KEYS fixes

2016-07-17 Thread James Morris
Please pull these fixes for the keys code. >From David Howells: " Here are three miscellaneous fixes: (1) Fix a panic in some debugging code in PKCS#7. This can only happen by explicitly inserting a #define DEBUG into the code. (2) Fix the calculation of the digest length in the PE fil

Re: [PATCH v1] module: Fully remove the kernel_module_from_file hook

2016-07-12 Thread James Morris
us Torvalds > Cc: Greg Kroah-Hartman Acked-by: James Morris -- James Morris

Re: [PATCH v5 0/3] LSM: security module information improvements - Acked

2016-07-08 Thread James Morris
ter the 4.8 merge window closes. -- James Morris

[GIT PULL] Fix for AppArmor oops in apparmor_setprocattr()

2016-07-07 Thread James Morris
o Cc: John Johansen Cc: Paul Moore Cc: Stephen Smalley Cc: Eric Paris Cc: Casey Schaufler Cc: sta...@kernel.org Signed-off-by: John Johansen Reviewed-by: Tyler Hicks Signed-off-by: James Morris diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.

Re: [PULL] seccomp update (next)

2016-07-07 Thread James Morris
On Thu, 7 Jul 2016, Kees Cook wrote: > Hi, > > Please pull these seccomp changes for next. Pulled, thanks. -- James Morris

Re: [GIT PULL] tpmdd updates for Linux 4.8

2016-06-26 Thread James Morris
small fixes and cleanups. > Pulled, thanks. -- James Morris

Re: [PULL] seccomp update (next)

2016-06-17 Thread James Morris
On Tue, 14 Jun 2016, Kees Cook wrote: > Hi, > > Please pull these seccomp changes for next. These have been tested by > myself and Andy, and close a long-standing issue with seccomp where tracers > could change the syscall out from under seccomp. Pulled to security -next. -- James Morris

Re: [PATCH] security: tomoyo: simplify the gc kthread creation

2016-06-06 Thread James Morris
On Fri, 20 May 2016, Tetsuo Handa wrote: > Mike Danese wrote: > > The code is doing the equivalent of the kthread_run macro. > > > > Signed-off-by: Mike Danese > > Acked-by: Tetsuo Handa Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-se

Re: [PATCH RESEND 2/2] net: Use ns_capable_noaudit() when determining net sysctl permissions

2016-06-06 Thread James Morris
ttps://launchpad.net/bugs/1465724 > > Signed-off-by: Tyler Hicks > Acked-by: Serge E. Hallyn Both applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next -- James Morris

Re: [PATCH] LSM: Fix for security_inode_getsecurity and -EOPNOTSUPP

2016-06-06 Thread James Morris
Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next -- James Morris

[GIT PULL] Keys keyctl placeholder

2016-06-02 Thread James Morris
d Howells Signed-off-by: James Morris diff --git a/Documentation/security/keys.txt b/Documentation/security/keys.txt index 20d0571..3849814 100644 --- a/Documentation/security/keys.txt +++ b/Documentation/security/keys.txt @@ -826,7 +826,8 @@ The keyctl syscall functions are: (*) Comput

Re: [PATCH 0/2] Quiet noisy LSM denial when accessing net sysctl

2016-06-02 Thread James Morris
t; Hello - Just checking in again to see if you plan on taking these > through the security tree? Sure, please resend. -- James Morris

[GIT PULL][SECURITY] Yama locking fix

2016-05-25 Thread James Morris
ocation with no locks held. This patch is tested both for ptrace attach and ptrace traceme. Fixes: 8a56038c2aef ("Yama: consolidate error reporting") Signed-off-by: Jann Horn Acked-by: Kees Cook Signed-off-by: James Morris diff --git a/security/yama/yama_lsm.c b/secur

[GIT PULL] Security subsystem updates

2016-05-23 Thread James Morris
ository at: git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git for-linus David Howells (2): KEYS: The PKCS#7 test key type should use the secondary keyring MAINTAINERS: Update keyrings record and add asymmetric keys record James Morris (1): Merge tag

Re: [PATCH] doc: self-protection: provide initial details

2016-05-23 Thread James Morris
stems may need to either > +disable module loading entirely (e.g. monolithic kernel builds or > +modules_disabled sysctl), or provide signed modules (e.g. > +CONFIG_MODULE_SIG_FORCE, or dm-crypt with LoadPin), to keep from having > +oot load arbitrary kernel code via the module loader interface. Or utilize an appropriate MAC policy. -- James Morris

[GIT PULL] security subsystem updates for 4.7

2016-05-18 Thread James Morris
Merge branch 'keys-sig' into keys-next Merge branch 'keys-trust' into keys-next Dmitry Kasatkin (1): vfs: forbid write access when reading a file into memory James Morris (2): Merge tag 'keys-next-20160505' of git://git.kernel.org/.../dh

Re: 4.6 compilation error when making signing key

2016-05-16 Thread James Morris
CONFIG_MODULE_SIG_KEY="signing_key.pem" This should be 'certs/signing_key.pem', right? I'm not sure how it ended up like that -- perhaps something happened in my next branch (which shares the same .config generally). -- James Morris

Re: 4.6 compilation error when making signing key

2016-05-16 Thread James Morris
On Mon, 16 May 2016, David Howells wrote: > James Morris wrote: > > > I'm seeing this with the 4.6 kernel build: > > > > CHK include/generated/compile.h > > make[1]: *** No rule to make target `signing_key.pem', needed by > > `certs/signing_k

4.6 compilation error when making signing key

2016-05-16 Thread James Morris
I'm seeing this with the 4.6 kernel build: CHK include/generated/compile.h make[1]: *** No rule to make target `signing_key.pem', needed by `certs/signing_key.x509'. Stop. make: *** [certs] Error 2 -- James Morris

Re: [GIT PULL] KEYS: Keyring changes for security/next

2016-05-05 Thread James Morris
/linux-fs.git > tags/keys-next-20160505 > > for you to fetch changes up to d55201ce08bfae40ae0062be126f49471a55bcad: > > Merge branch 'keys-trust' into keys-next (2016-05-04 17:20:20 +0100) Pulled. -- James Morris

Re: [PULL] lsm-fixes update (next)

2016-05-04 Thread James Morris
se atomic allocations when reporting (2016-05-04 10:54:05 -0700) > Pulled to -next. -- James Morris

[GIT PULL] Security subsystem - IMA fix for v4.6

2016-05-04 Thread James Morris
ng the IMA policy. Fixes: d9ddf077bb85 ("ima: support for kexec image and initramfs") Signed-off-by: Mimi Zohar Tested-by: Eric Richter Signed-off-by: James Morris diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index be0

Re: [PATCH v4 17/21] capabilities: Allow privileged user in s_user_ns to set security.* xattrs

2016-04-27 Thread James Morris
Smack will deny the writes for > any user without global CAP_MAC_ADMIN, so loosening the > capability check in commoncap is safe in this respect as well. > > Signed-off-by: Seth Forshee > Acked-by: Serge Hallyn Acked-by: James Morris -- James Morris

Re: [PATCH] fs: fix over-zealous use of "const"

2016-04-27 Thread James Morris
fiers] > static inline const char * const kernel_read_file_id_str(enum > kernel_read_file_id id) > > Reported-by: Andy Shevchenko > Signed-off-by: Kees Cook > --- > This is for linux-security next > --- Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next -- James Morris

Re: [PATCH v5 0/6] LSM: LoadPin for kernel file loading restrictions

2016-04-20 Thread James Morris
nd firmware loading to the read-only crypto-verified dm-verity > partition so that kernel module signing is not needed. > Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next -- James Morris

[GIT PULL] Keys bugfixes for 4.6

2016-04-12 Thread James Morris
at: git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git for-linus Colin Ian King (1): ASN.1: fix open failure check on headername James Morris (1): Merge tag 'keys-fixes-20160412' of git://git.kernel.org/.../dhowells/linux-fs into for-linus

Re: [PATCH v3 0/6] LSM: LoadPin for kernel file loading restrictions

2016-04-12 Thread James Morris
nd firmware loading to the read-only crypto-verified dm-verity > partition so that kernel module signing is not needed. > This all looks good to me, just waiting now for the const fix suggested by Joe. -- James Morris

Re: [PATCH net-next] security: drop the unused hook skb_owned_by

2016-04-10 Thread James Morris
ernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next -- James Morris

[ANNOUNCE] Linux Security Summit 2016 - CFP

2016-03-24 Thread James Morris
t and operational practices * Emerging technologies, threats & techniques Proposals should be submitted via the event web site: http://events.linuxfoundation.org/events/linux-security-summit/program/cfp PROGRAM COMMITTEE The Linux Security Summit for 2016 is organized by:

[GIT PULL] Security subsystem updates for 4.6

2016-03-16 Thread James Morris
cy using path Harald Hoyer (1): tpm_eventlog.c: fix binary_bios_measurements James Morris (4): Merge branch 'smack-for-4.6' of https://github.com/cschaufler/smack-next into next Merge branch 'next' of git://git.kernel.org/.../zohar/linux-integrity

Re: [PATCH v2] sparc64: Add support for Application Data Integrity (ADI)

2016-03-08 Thread James Morris
On 03/08/2016 10:48 AM, James Morris wrote: On 03/08/2016 06:54 AM, Andy Lutomirski wrote: This makes sense, but I still think the design is poor. If the hacker gets code execution, then they can trivially brute force the ADI bits. ADI in this scenario is intended to prevent the attacker

Re: [PATCH v2] sparc64: Add support for Application Data Integrity (ADI)

2016-03-07 Thread James Morris
On 03/08/2016 06:54 AM, Andy Lutomirski wrote: This makes sense, but I still think the design is poor. If the hacker gets code execution, then they can trivially brute force the ADI bits. ADI in this scenario is intended to prevent the attacker from gaining code execution in the first place

Re: [PATCH v2] sparc64: Add support for Application Data Integrity (ADI)

2016-03-07 Thread James Morris
On 03/08/2016 07:58 AM, David Miller wrote: From: Khalid Aziz Date: Mon, 7 Mar 2016 13:41:39 -0700 Shared data may not always be backed by a file. My understanding is one of the use cases is for in-memory databases. This shared space could also be used to hand off transactions in flight to oth

Re: [GIT PULL] KEYS: Miscellaneous bits for security/next

2016-03-03 Thread James Morris
On Fri, 4 Mar 2016, David Howells wrote: > Hi James, > > Could you pull this into security/next, please? > Done. -- James Morris

Re: [PATCH] MAINTAINERS: update tpmdd urls

2016-03-01 Thread James Morris
On Tue, 1 Mar 2016, Jarkko Sakkinen wrote: > Updated GIT and patchwork location both of which were out-of-sync or > actually patchwork location was incorrect. > > Signed-off-by: Jarkko Sakkinen Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next

Re: log spammed with "loading xx failed with error -2" since commit e40ba6d56b [replace call to fw_read_file_contents() with kernel version]

2016-02-28 Thread James Morris
to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next -- James Morris

Re: [GIT PULL] tpmdd fix

2016-02-28 Thread James Morris
: > > tpm_tis: fix build warning with tpm_tis_resume (2016-02-26 11:32:07 +0200) > > > tpmdd fix > > > Jarkko Sakkinen (1): > tpm_tis: fix build warning with tpm_tis_resume > Pulled to -next. -- James Morris

[GIT PULL] SELinux fix for 4.5

2016-02-26 Thread James Morris
ailable in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git for-linus Andreas Gruenbacher (1): selinux: Don't sleep inside inode_getsecid hook James Morris (1): Merge branch 'stable-4.5' of git://git.infradead.org/users

Re: [GIT PULL] remaining tpmdd fixes for Linux 4.5

2016-02-25 Thread James Morris
things have worked well. > Send me a pull request just for the fix. I won't be pushing these changes to Linus for 4.5, they'll have to wait until the 4.6. -- James Morris

Re: [tpmdd-devel] [GIT PULL] remaining tpmdd fixes for Linux 4.5

2016-02-25 Thread James Morris
On Thu, 25 Feb 2016, Jerry Snitselaar wrote: > On Mon Feb 22 16, Jarkko Sakkinen wrote: > >On Mon, Feb 22, 2016 at 12:56:53PM +1100, James Morris wrote: > > > On Sat, 20 Feb 2016, Jarkko Sakkinen wrote: > > > > > > > Hi James, > > > > >

Re: [GIT PULL] remaining tpmdd fixes for Linux 4.5

2016-02-21 Thread James Morris
y fixes. It means the code was not ready to be merged in the first place. Also, any idea why I'm seeing this: drivers/char/tpm/tpm_tis.c:838: warning: ‘tpm_tis_resume’ defined but not used -- James Morris

Re: [GIT PULL] tpmdd fixes for Linux 4.5 (updated)

2016-02-14 Thread James Morris
The following changes since commit 388f7b1d6e8ca06762e2454d28d6c3c55ad0fe95: > > Linux 4.5-rc3 (2016-02-07 15:38:30 -0800) > > are available in the git repository at: > > https://github.com/jsakkine/linux-tpmdd.git tags/tpmdd-next-20160210 > > for you to fetch changes up to 8e0ee3c9faed7ca68807ea45141775856c438ac0: Pulled to next. -- James Morris

[GIT] EVM hmac security fix

2016-02-11 Thread James Morris
Signed-off-by: Mimi Zohar Signed-off-by: James Morris diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index f716025..e6ea9d4 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -23,6 +23,7 @@ #include #include

Re: Transferring applied X.509 patches from crypto/next to security/next

2016-02-08 Thread James Morris
at you'll > > fix it up later. Sorry for the misunderstanding. Do you want me to > > revert? > > If you can back them out, I'll apply them to my keys-next branch. Unless > James is willing to rebase security/next on top of your crypto branch? > I don't want to rebase my tree. -- James Morris

Re: [GIT PULL] tpmdd fixes for Linux 4.5

2016-02-08 Thread James Morris
se or do you want to pull this first? > > I could rebase that new pull request to -rc3 to which security/next is > now rebased. > The latter is probably best. -- James Morris

<    1   2   3   4   5   6   7   8   9   10   >