Re: 2.6.24-rc6-mm1 - oddness with IPv4/v6 mapped sockets hanging...

2008-01-14 Thread Paul Moore
cycles, the kernel below should both have the clone/iif fix (it's in Linus' tree now) as well as some printks when errors occur so packet's are no longer silently dropped by SELinux. * git://git.infradead.org/users/pcmoore/lblnet-2.6_testing -- paul moore linux security @ hp -- To unsubscribe

Re: 2.6.24-rc6-mm1 - oddness with IPv4/v6 mapped sockets hanging...

2008-01-14 Thread Paul Moore
=02f1c89d6e36507476f78108a3dcc78538be460b -- paul moore linux security @ hp -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http

Re: 2.6.24-rc6-mm1 - oddness with IPv4/v6 mapped sockets hanging...

2008-01-14 Thread Paul Moore
On Monday 14 January 2008 6:04:28 pm [EMAIL PROTECTED] wrote: On Mon, 14 Jan 2008 14:07:46 EST, Paul Moore said: http://git.infradead.org/?p=users/pcmoore/lblnet-2.6_testing;a=commitdiff ;h=02f1c89d6e36507476f78108a3dcc78538be460b Initial testing indicates that 2.6.24-rc6-mm1 plus this one

Re: [TOMOYO #5 18/18] LSM expansion for TOMOYO Linux.

2007-11-16 Thread Paul Moore
no_packet; Two things. First you can probably just call kfree_skb() instead of skb_free_datagram(). Second, why not move the 'no_peek' code to just before 'no_packet'? -- paul moore linux security @ hp - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message

Re: [TOMOYO #5 18/18] LSM expansion for TOMOYO Linux.

2007-11-17 Thread Paul Moore
On Friday 16 November 2007 10:45:32 pm Tetsuo Handa wrote: Paul Moore wrote: I might be missing something here, but why do you need to do a skb_peek() again? You already have the skb and the sock, just do the unlink. The skb might be already dequeued by other thread while I slept inside

Re: [TOMOYO #5 18/18] LSM expansion for TOMOYO Linux.

2007-11-19 Thread Paul Moore
On Saturday 17 November 2007 11:00:20 pm Tetsuo Handa wrote: Hello. Hello. Paul Moore wrote: Okay, well if that is the case I think you are going to have another problem in that you could end up throwing away skbs that haven't been through your security_post_recv_datagram() hook because

Re: [TOMOYO #5 18/18] LSM expansion for TOMOYO Linux.

2007-11-19 Thread Paul Moore
On Monday 19 November 2007 9:29:52 am Tetsuo Handa wrote: Paul Moore wrote: If that is the case then the second call to skb_peek() will return a different skb then the one you passed to security_post_recv_datagram(). Yes. The second call to skb_peek() might return a different skb than

Re: [PATCH] net/netlabel/: Spelling fixes

2007-12-17 Thread Paul Moore
On Monday 17 December 2007 2:40:35 pm Joe Perches wrote: Signed-off-by: Joe Perches [EMAIL PROTECTED] Thanks Joe. Acked-by: Paul Moore [EMAIL PROTECTED] --- net/netlabel/netlabel_mgmt.c |2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/netlabel/netlabel_mgmt.c

Re: mm snapshot broken-out-2007-11-20-01-45.tar.gz uploaded

2007-11-20 Thread Paul Moore
in the selinux_xfrm_enabled() is called from security/selinux/hooks.c, depends on the extern atomic_tselinux_xfrm_refcount. The problem appears to be that the selinux_xfrm_refcount functionality is not properly protected by CONFIG_SECURITY_NETWORK_XFRM. I'm fixing that now. -- paul moore linux security @ hp

Re: mm snapshot broken-out-2007-11-20-01-45.tar.gz uploaded

2007-11-20 Thread Paul Moore
On Tuesday 20 November 2007 3:48:44 pm Paul Moore wrote: On Tuesday 20 November 2007 3:34:24 pm Kamalesh Babulal wrote: Hi Andrew, The kernel build fails, in selinux with following error CHK include/linux/compile.h UPD include/linux/compile.h CC init/version.o

Re: 2.6.24-rc6-mm1 - git-lblnet.patch and networking horkage

2007-12-26 Thread Paul Moore
untrained eye it looks like __netdev_alloc_skb() should be setting skb-iif (like it does for skb-dev) but it currently doesn't. Am I barking up the wrong tree here? . paul moore . linux security @ hp -Original Message- From: James Morris [EMAIL PROTECTED] Date: Wednesday, Dec 26, 2007 7

Re: 2.6.24-rc6-mm1 - git-lblnet.patch and networking horkage

2007-12-28 Thread Paul Moore
On Wednesday 26 December 2007 4:52:03 pm James Morris wrote: On Thu, 26 Dec 2007, Paul Moore wrote: As James said I'm away right now and computer access is limited. However, I'm stuck in the airport right now and spent some time looking at the code ... Based on what has been found so far I

Re: 2.6.24-rc6-mm1 - git-lblnet.patch and networking horkage

2007-12-31 Thread Paul Moore
On Wednesday 26 December 2007 4:52:03 pm James Morris wrote: On Thu, 26 Dec 2007, Paul Moore wrote: As James said I'm away right now and computer access is limited. However, I'm stuck in the airport right now and spent some time looking at the code ... Based on what has been found so far I

Re: 2.6.24-rc6-mm1 - git-lblnet.patch and networking horkage

2007-12-31 Thread Paul Moore
On Monday 31 December 2007 12:13:32 pm Paul Moore wrote: On Wednesday 26 December 2007 4:52:03 pm James Morris wrote: On Thu, 26 Dec 2007, Paul Moore wrote: As James said I'm away right now and computer access is limited. However, I'm stuck in the airport right now and spent some time

Re: 2.6.24-rc6-mm1 - git-lblnet.patch and networking horkage

2007-12-31 Thread Paul Moore
On Monday 31 December 2007 4:46:09 pm James Morris wrote: On Mon, 31 Dec 2007, Paul Moore wrote: I'm pretty certain this is an uninitialized value problem now and not a use-after-free issue. The invalid/garbage -iif value seems to only happen on packets that are generated locally and sent

Re: [PATCH] [RFC] Smack: unlabeled outgoing ambient packets - v2

2008-02-12 Thread Paul Moore
'; - rc = smack_netlabel(sk); + smack_netlabel(sk); Once more, but with feeling. } /** -- paul moore linux security @ hp -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http

Re: [2.6 patch] make secmark_tg_destroy() static

2008-02-13 Thread Paul Moore
On Wednesday 13 February 2008 4:29:40 pm Adrian Bunk wrote: This patch makes the needlessly global secmark_tg_destroy() static. Signed-off-by: Adrian Bunk [EMAIL PROTECTED] Thanks for catching this. Acked-by: Paul Moore [EMAIL PROTECTED] --- df66d8d74309b41298ae011532fd284aad3ed2ba diff

ANN: libseccomp 1.0.1 released

2012-11-12 Thread Paul Moore
with syscall arguments * Documentation corrections * Support for C++ in the header file Finally, thank you to everyone who has submitted suggestions, provided testing help, and contributed patches to the project. -- paul moore security and virtualization @ redhat -- To unsubscribe from this list

Re: [PATCH] Version 3 (2.6.23-rc8) Smack: Simplified Mandatory Access Control Kernel

2007-09-30 Thread Paul Moore
be able to elsewhere and I consider that a win. -- paul moore linux security @ hp - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http

Re: [PATCH] Version 3 (2.6.23-rc8) Smack: Simplified Mandatory Access Control Kernel

2007-09-30 Thread Paul Moore
On Sunday 30 September 2007 4:16:18 am Andrew Morton wrote: - hm, netlabels. Who might be a suitable person to review that code? Seems that Paul Moore is the man. Maybe he'd be interested in taking a look over it (please?) Yep, I've been tracking Casey's work on this since the first

Re: [PATCH] Version 4 (2.6.23-rc8-mm2) Smack: Simplified Mandatory Access Control Kernel

2007-10-03 Thread Paul Moore
, and other tasks. Smack is a kernel based scheme that requires an absolute minimum of application support and a very small amount of configuration data. {snip} This patch includes changes made by Paul Moore [EMAIL PROTECTED] in support of a more comfortable interface to initialize the CIPSO code

Re: [TOMOYO 15/15] LSM expansion for TOMOYO Linux.

2007-09-04 Thread Paul Moore
On Monday 03 September 2007 9:15:27 am Tetsuo Handa wrote: Hello. Hi. Paul Moore wrote: I apologize for not recognizing your approach from our earlier discussion on the LSM mailing list in July. Unfortunately, I have the same objections to these changes that I did back then and from

Re: [TOMOYO 15/15] LSM expansion for TOMOYO Linux.

2007-09-05 Thread Paul Moore
network design. [1]http://www.netfilter.org/projects/libnetfilter_queue/index.html -- paul moore linux security @ hp - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html

Re: [TOMOYO 15/15] LSM expansion for TOMOYO Linux.

2007-09-06 Thread Paul Moore
-accept() failed. I think socket_post_accept() should be able to fail. From my experience the community disapproves of approaches which go through the entire TCP handshake and then terminate the connection, which is what allowing security_socket_post_accept() to fail would do. -- paul

Re: [TOMOYO 15/15] LSM expansion for TOMOYO Linux.

2007-08-27 Thread Paul Moore
attempts. Please take a look at the existing LSM stream connection request hooks as well as how SELinux makes use of them. * post_recv_datagram is added in skb_recv_datagram. Can you explain to me why this is not possible using the existing security_socket_sock_rcv_skb() LSM hook? -- paul

Re: [TOMOYO 15/15] LSM expansion for TOMOYO Linux.

2007-08-28 Thread Paul Moore
On Tuesday, August 28 2007 6:39:13 am Tetsuo Handa wrote: Hello. Hello. Paul Moore wrote: * post_recv_datagram is added in skb_recv_datagram. Can you explain to me why this is not possible using the existing security_socket_sock_rcv_skb() LSM hook? socket_sock_rcv_skb() is a hook

Re: [NET]: Mark Paul Moore as maintainer of labelled networking.

2007-08-28 Thread Paul Moore
On Tuesday, August 28 2007 2:46:19 am Joe Perches wrote: On Tue, 2007-08-28 at 00:01 +, Linux Kernel Mailing List wrote: +NETWORKING [LABELED] (NetLabel, CIPSO, Labeled IPsec, SECMARK) +P: Paul Moore +M: [EMAIL PROTECTED] +L: [EMAIL PROTECTED] +S: Maintained + Aren't there now 2

Re: [NET]: Mark Paul Moore as maintainer of labelled networking.

2007-08-28 Thread Paul Moore
On Tuesday, August 28 2007 12:45:50 pm Joe Perches wrote: On Tue, 2007-08-28 at 08:46 -0400, Paul Moore wrote: If having both a labeled networking and NetLabel maintainer entry is a problem then how about the patch below? I don't think it is. -NETWORKING [LABELED] (NetLabel, CIPSO

Re: [PATCH] Version 7 (2.6.23) Smack: Simplified Mandatory Access Control Kernel

2007-10-15 Thread Paul Moore
options/labels. -- paul moore linux security @ hp - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/

Re: [PATCH] x86: remove the x32 syscall bitmask from syscall_get_nr()

2013-04-02 Thread Paul Moore
On Monday, March 25, 2013 04:55:17 PM Paul Moore wrote: On Friday, March 15, 2013 03:18:12 PM H.J. Lu wrote: On Fri, Mar 15, 2013 at 2:56 PM, H. Peter Anvin h...@zytor.com wrote: On 03/15/2013 02:15 PM, Paul Moore wrote: On Tuesday, February 26, 2013 03:58:23 PM Paul Moore wrote

Re: [PATCH] x86: remove the x32 syscall bitmask from syscall_get_nr()

2013-03-15 Thread Paul Moore
On Tuesday, February 26, 2013 03:58:23 PM Paul Moore wrote: On Friday, February 15, 2013 12:21:43 PM Paul Moore wrote: Commit fca460f95e928bae373daa8295877b6905bc62b8 simplified the x32 implementation by creating a syscall bitmask, equal to 0x4000, that could be applied to x32 syscalls

Re: [PATCH] x86: remove the x32 syscall bitmask from syscall_get_nr()

2013-03-25 Thread Paul Moore
On Friday, March 15, 2013 03:18:12 PM H.J. Lu wrote: On Fri, Mar 15, 2013 at 2:56 PM, H. Peter Anvin h...@zytor.com wrote: On 03/15/2013 02:15 PM, Paul Moore wrote: On Tuesday, February 26, 2013 03:58:23 PM Paul Moore wrote: On Friday, February 15, 2013 12:21:43 PM Paul Moore wrote

Re: linux-next: Tree for Nov 29 (netlabel)

2012-11-30 Thread Paul Moore
`netlbl_cipsov4_add_std': netlabel_cipso_v4.c:(.text+0x68535): undefined reference to `cipso_v4_doi_add' netlabel_cipso_v4.c:(.text+0x68575): undefined reference to `cipso_v4_doi_free' Full randconfig file is attached. -- paul moore www.paul-moore.com -- To unsubscribe from this list: send

Re: linux-next: Tree for Nov 29 (netlabel)

2012-11-30 Thread Paul Moore
On Friday, November 30, 2012 10:19:16 AM Paul Moore wrote: On Thursday, November 29, 2012 04:05:26 PM Randy Dunlap wrote: On 11/28/2012 10:40 PM, Stephen Rothwell wrote: Hi all, Changes since 20121128: (on i386:) If I had to guess it looks like CONFIG_NETLABEL needs

Re: [PATCH] Smack: Add missing depends on INET in Kconfig

2012-11-30 Thread Paul Moore
@@ -1,5 +1,6 @@ config SECURITY_SMACK bool Simplified Mandatory Access Control Kernel Support + depends on INET depends on NET depends on SECURITY select NETLABEL -- -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line

Re: [PATCH] x86: remove the x32 syscall bitmask from syscall_get_nr()

2013-02-26 Thread Paul Moore
On Friday, February 15, 2013 12:21:43 PM Paul Moore wrote: Commit fca460f95e928bae373daa8295877b6905bc62b8 simplified the x32 implementation by creating a syscall bitmask, equal to 0x4000, that could be applied to x32 syscalls such that the masked syscall number would be the same

ANN: libseccomp 2.0.0 released

2013-01-28 Thread Paul Moore
suggestions, provided testing help, and contributed patches to the project. -- paul moore security and virtualization @ redhat -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http

[PATCH] x86: remove the x32 syscall bitmask from syscall_get_nr()

2013-02-15 Thread Paul Moore
functionality on x32. I've tested this patch with the seccomp BPF filters as well as ftrace and everything looks reasonable to me; needless to say general usage seemed fine as well. Signed-off-by: Paul Moore pmo...@redhat.com Cc: sta...@vger.kernel.org Cc: Will Drewry w...@chromium.org Cc: H. Peter

Re: [PATCH] x86: remove the x32 syscall bitmask from syscall_get_nr()

2013-02-15 Thread Paul Moore
On Friday, February 15, 2013 11:02:49 AM H. Peter Anvin wrote: On 02/15/2013 09:21 AM, Paul Moore wrote: Commit fca460f95e928bae373daa8295877b6905bc62b8 simplified the x32 implementation by creating a syscall bitmask, equal to 0x4000, that could be applied to x32 syscalls

Re: selinux networking: sleeping functin called from invalid context in 2.6.20-rc[12]

2007-01-02 Thread Paul Moore
example you could send? -- paul moore linux security @ hp - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/

Re: selinux networking: sleeping functin called from invalid context in 2.6.20-rc[12]

2007-01-02 Thread Paul Moore
and send it out. Once again, sorry for the regression. -- paul moore linux security @ hp - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ

Re: selinux networking: sleeping functin called from invalid context in 2.6.20-rc[12]

2006-12-25 Thread Paul Moore
promise to do so as soon as I am able. . paul moore . linux security @ hp - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org

ANN: libseccomp 1.0.0 released

2012-07-31 Thread Paul Moore
, and contributed patches to the project. -- paul moore security and virtualization @ redhat -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ

Re: NULL pointer dereference in selinux_ip_postroute_compat

2012-08-07 Thread Paul Moore
different traces below. Config attached. -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http

Re: NULL pointer dereference in selinux_ip_postroute_compat

2012-08-07 Thread Paul Moore
On Tue, Aug 7, 2012 at 5:58 PM, John Stultz john.stu...@linaro.org wrote: On 08/07/2012 02:50 PM, Paul Moore wrote: On Tue, Aug 7, 2012 at 2:12 PM, John Stultz john.stu...@linaro.org wrote: Hi, With my kvm environment using 3.6-rc1+, I'm seeing NULL pointer dereferences

Re: NULL pointer dereference in selinux_ip_postroute_compat

2012-08-07 Thread Paul Moore
On Tuesday, August 07, 2012 10:17:32 PM Serge E. Hallyn wrote: Quoting Paul Moore (p...@paul-moore.com): On Tue, Aug 7, 2012 at 5:58 PM, John Stultz john.stu...@linaro.org wrote: On 08/07/2012 02:50 PM, Paul Moore wrote: On Tue, Aug 7, 2012 at 2:12 PM, John Stultz john.stu...@linaro.org

Re: NULL pointer dereference in selinux_ip_postroute_compat

2012-08-08 Thread Paul Moore
the LSM data properly initialized. I'll put together a patch shortly. -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html

Re: NULL pointer dereference in selinux_ip_postroute_compat

2012-08-08 Thread Paul Moore
On Wednesday, August 08, 2012 09:38:21 PM Eric Dumazet wrote: On Wed, 2012-08-08 at 15:26 -0400, Paul Moore wrote: On Wednesday, August 08, 2012 12:14:42 PM John Stultz wrote: So I bisected this down and it seems to be the following commit: commit

Re: NULL pointer dereference in selinux_ip_postroute_compat

2012-08-08 Thread Paul Moore
. -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/

Re: NULL pointer dereference in selinux_ip_postroute_compat

2012-08-08 Thread Paul Moore
) + return 0; + ssp = kzalloc(sizeof(struct socket_smack), gfp_flags); if (ssp == NULL) return -ENOMEM; In the case of Smack, when the kernel boolean is true I think the right solution is to use smack_net_ambient. -- paul moore www.paul-moore.com

Re: NULL pointer dereference in selinux_ip_postroute_compat

2012-08-08 Thread Paul Moore
On Wednesday, August 08, 2012 04:51:56 PM Eric Paris wrote: On Wed, Aug 8, 2012 at 4:35 PM, Paul Moore p...@paul-moore.com wrote: On Wednesday, August 08, 2012 10:09:38 PM Eric Dumazet wrote: Actually, the issue is that the shared socket doesn't have an init/alloc function to do the LSM

Re: NULL pointer dereference in selinux_ip_postroute_compat

2012-08-09 Thread Paul Moore
() and tcp_v4_timewait_ack(), any reason why we can't propagate the socket down to ip_send_unicast_reply()? -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http

Re: NULL pointer dereference in selinux_ip_postroute_compat

2012-08-09 Thread Paul Moore
On Thu, Aug 9, 2012 at 10:27 AM, Eric Dumazet eric.duma...@gmail.com wrote: On Thu, 2012-08-09 at 09:30 -0400, Paul Moore wrote: In the case of a TCP syn-recv and timewait ACK things are a little less clear. Eric (Dumazet), it looks like we have a socket in tcp_v4_reqsk_send_ack

Re: [PATCH] ipv4: tcp: security_sk_alloc() needed for unicast_sock

2012-08-09 Thread Paul Moore
() will populate sk-sk_security pointer, subsequent ones will reuse existing context. Reported-by: John Stultz johns...@us.ibm.com Bisected-by: John Stultz johns...@us.ibm.com Signed-off-by: Eric Dumazet eduma...@google.com Cc: Paul Moore p...@paul-moore.com Cc: Eric Paris epa...@parisplace.org Cc

Re: [PATCH] ipv4: tcp: security_sk_alloc() needed for unicast_sock

2012-08-09 Thread Paul Moore
On Thu, Aug 9, 2012 at 11:36 AM, Eric Dumazet eric.duma...@gmail.com wrote: On Thu, 2012-08-09 at 11:07 -0400, Paul Moore wrote: Is is possible to do the call to security_sk_alloc() in the ip_init() function or does the per-cpu nature of the socket make this a pain? Its a pain, if we want

Re: [PATCH] ipv4: tcp: security_sk_alloc() needed for unicast_sock

2012-08-09 Thread Paul Moore
this patch, or something like it, go in now to resolve the kernel panic, and fix the labeling later. -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org

Re: [PATCH] ipv4: tcp: security_sk_alloc() needed for unicast_sock

2012-08-09 Thread Paul Moore
mean by the above? I'm asking because I'm not convinced the labeling, either the old way or the new way, was 100% correct and I think we're going to need to change things regardless. I'm just not sure what the right solution is just yet. -- paul moore www.paul-moore.com -- To unsubscribe from

Re: Fix sel_netnode_insert suspicious rcu dereference.

2012-08-06 Thread Paul Moore
patches have been posted from different authors, all fixing the same thing ... Acked-by: Paul Moore p...@paul-moore.com -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info

Re: + smack-unlabeled-outgoing-ambient-packets.patch added to -mm tree

2008-02-07 Thread Paul Moore
On Thursday 07 February 2008 3:04:59 pm Andrew Morton wrote: On Thu, 7 Feb 2008 14:50:41 -0500 Paul Moore [EMAIL PROTECTED] wrote: On Thursday 07 February 2008 2:02:06 pm [EMAIL PROTECTED] wrote: The patch titled Smack: unlabeled outgoing ambient packets has been added

Re: + smack-unlabeled-outgoing-ambient-packets.patch added to -mm tree

2008-02-07 Thread Paul Moore
On Thursday 07 February 2008 8:34:02 pm David Miller wrote: From: Paul Moore [EMAIL PROTECTED] Date: Thu, 7 Feb 2008 15:14:34 -0500 My apologies, those mailing list postings there haven't hit my inbox yet. I had to remove you a few days ago, see my other reply to Andrew. You are back

Re: + smack-unlabeled-outgoing-ambient-packets.patch added to -mm tree

2008-02-07 Thread Paul Moore
On Thursday 07 February 2008 9:15:19 pm David Miller wrote: From: Paul Moore [EMAIL PROTECTED] Date: Thu, 7 Feb 2008 20:54:56 -0500 I have no idea what was causing the mail problem, probably somebody in our IT department playing around with some new knobs, oh well. I resubscribed

Re: + smack-unlabeled-outgoing-ambient-packets.patch added to -mm tree

2008-02-08 Thread Paul Moore
of IPv4 options causing SSH to reject the connection. It turns out that SSH is being a bit overzealous (rejecting all IPv4 options) in trying to reject source-routed packets. -- paul moore linux security @ hp -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body

Re: [2.6 patch] security/selinux/netlabel.c: fix double free

2008-01-28 Thread Paul Moore
; } /** * selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache * * Description: * Invalidate the NetLabel security attribute mapping cache. * */ -- paul moore linux security @ hp -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED

Re: [2.6 patch] security/selinux/netlabel.c: fix double free

2008-01-28 Thread Paul Moore
On Monday 28 January 2008 5:35:40 pm Adrian Bunk wrote: On Mon, Jan 28, 2008 at 05:23:46PM -0500, Paul Moore wrote: Thanks for finding this mistake, however, I'd rather see it fixed by removing the netlbl_secattr_destroy() call in security_netlbl_sid_to_secattr() as it really shouldn't

[PATCH] SELinux: Fix double free in selinux_netlbl_sock_setsid()

2008-01-28 Thread Paul Moore
in selinux_netlbl_sock_setsid(). Signed-off-by: Paul Moore [EMAIL PROTECTED] --- security/selinux/ss/services.c |1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 4bf715d..3a16aba 100644 --- a/security/selinux/ss

Re: [PATCH] SELinux: Fix double free in selinux_netlbl_sock_setsid()

2008-01-29 Thread Paul Moore
On Monday 28 January 2008 10:51:24 pm David Miller wrote: From: Paul Moore [EMAIL PROTECTED] Date: Mon, 28 Jan 2008 21:20:26 -0500 As pointed out by Adrian Bunk, commit 45c950e0f839fded922ebc0bfd59b1081cc71b70 caused a double-free when security_netlbl_sid_to_secattr() fails. This patch

Re: [PATCH 08/26] Add a secctx_to_secid() LSM hook to go along with the existing

2008-01-16 Thread Paul Moore
On Tuesday 15 January 2008 8:05:27 pm James Morris wrote: On Tue, 15 Jan 2008, David Howells wrote: secid_to_secctx() LSM hook. This patch also includes the SELinux implementation for this hook. Signed-off-by: Paul Moore [EMAIL PROTECTED] Acked-by: Stephen Smalley [EMAIL PROTECTED

Re: [PATCH 08/26] Add a secctx_to_secid() LSM hook to go along with the existing

2008-01-16 Thread Paul Moore
On Wednesday 16 January 2008 5:13:53 pm James Morris wrote: On Wed, 16 Jan 2008, Paul Moore wrote: On Tuesday 15 January 2008 8:05:27 pm James Morris wrote: On Tue, 15 Jan 2008, David Howells wrote: secid_to_secctx() LSM hook. This patch also includes the SELinux implementation

Re: [PATCH] (2.6.24-rc8-mm1) -mm v2 Smack socket label setting fix

2008-01-22 Thread Paul Moore
(secattr); + rc = smack_netlabel(sk); I haven't checked the latest SMACK bits, but I'm pretty sure you don't need to assign the return value of 'smack_netlabel()' to anything here since the function doesn't return a value. } /** -- paul moore linux security @ hp -- To unsubscribe from

Re: [PATCH] (02/14/08 Linus git) Smack unlabeled outgoing ambient packets - v3

2008-02-15 Thread Paul Moore
.git;a=commit;h=4c3a0a254e5d706d3fe01bf42261534858d05586 -- paul moore linux security @ hp -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ

Re: [PATCH] (02/14/08 Linus git) Smack unlabeled outgoing ambient packets - v3

2008-02-15 Thread Paul Moore
On Friday 15 February 2008 4:00:26 pm Casey Schaufler wrote: --- Paul Moore [EMAIL PROTECTED] wrote: On Friday 15 February 2008 12:38:49 am Casey Schaufler wrote: From: Casey Schaufler [EMAIL PROTECTED] Smack uses CIPSO labeling, but allows for unlabeled packets by specifying

Re: [PATCH] (02/14/08 Linus git) Smack unlabeled outgoing ambient packets - v3

2008-02-15 Thread Paul Moore
On Friday 15 February 2008 4:00:26 pm Casey Schaufler wrote: --- Paul Moore [EMAIL PROTECTED] wrote: On Friday 15 February 2008 12:38:49 am Casey Schaufler wrote: ... you shouldn't fix-up the return value from netlbl_sock_setattr(). It only returns an error when there really is an error

Re: [PATCH] (02/15/08 Linus git) Smack unlabeled outgoing ambient packets - v4

2008-02-15 Thread Paul Moore
security_secctx_to_secid() using existing underlying code. Fill in audit data for netlbl domain calls. Collapse unnecessary multiple assignments. Signed-off-by: Casey Schaufler [EMAIL PROTECTED] Looks good to me, thanks for making those changes. Acked-by: Paul Moore [EMAIL PROTECTED

Re: [2.6 patch] make smackfs.c:smk_unlbl_ambient() static

2008-02-22 Thread Paul Moore
On Friday 22 February 2008 2:58:07 pm Adrian Bunk wrote: This patch makes the needlessly global smk_unlbl_ambient() static. Signed-off-by: Adrian Bunk [EMAIL PROTECTED] Fine with me. Acked-by: Paul Moore [EMAIL PROTECTED] --- 60c7072cb922cdecdb8a4f08e5710c014e0e8a8c diff --git a/security

Re: [PATCH net-next 04/15] security: Add Linux Security Modules hook for AF_BUS sockets

2012-07-09 Thread Paul Moore
thoughts). I'm still reviewing the rest of the AF_BUS patches but wanted to ask this now in case I was missing something. -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo

Re: [PATCH net-next 05/15] security: selinux: Add AF_BUS socket SELinux hooks

2012-07-09 Thread Paul Moore
=selinux_socket_unix_may_send, + .bus_connect = selinux_socket_bus_connect, .socket_create =selinux_socket_create, .socket_post_create = selinux_socket_post_create, -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line

Re: [PATCH 1/3] seccomp: Add SECCOMP_RET_INFO return value

2012-12-19 Thread Paul Moore
in userspace just isn't practical in every case. Syslog might not be the answer, but RET_TRAP and the audit log aren't very good answers either. -- paul moore security and virtualization @ redhat -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message

Re: [PATCH] tuntap: fix ambigious multiqueue API

2012-12-14 Thread Paul Moore
out for re-discussion/review. -- paul moore security and virtualization @ redhat -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ

Re: [PATCH v2 1/3] seccomp: Add SECCOMP_RET_INFO return value

2013-01-14 Thread Paul Moore
. Signed-off-by: Corey Bryant cor...@linux.vnet.ibm.com Were do things currently stand with this patchset? It still seems like a reasonable addition to me. -- paul moore security and virtualization @ redhat -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body

Re: [GIT] SELinux changes for 2.6.23 (updated)

2007-07-13 Thread Paul Moore
PROTECTED], Paul Moore [EMAIL PROTECTED] On Fri, 13 Jul 2007, Michal Piotrowski wrote: My system is too secure, I can not login :) Do you have CONFIG_NETLABEL=y ? If so, please try disabling it. Disabling NetLabel should solve the problem. The recommended solution to this problem

Re: [bug] very high non-preempt latency in context_struct_compute_av()

2007-06-04 Thread Paul Moore
spinlock to a RCU locking mechanism would this solve the preemption problem (I'm not a lock expert either)? If so, can anyone think of any reasons why converting the policy lock to RCU is a bad idea (James, Stephen, the other James)? -- paul moore linux security @ hp - To unsubscribe from this list

Re: [bug] very high non-preempt latency in context_struct_compute_av()

2007-06-04 Thread Paul Moore
On Monday 04 June 2007 5:39:00 pm Stephen Smalley wrote: On Mon, 2007-06-04 at 17:11 -0400, Paul Moore wrote: I'm not an expert on the SELinux security server guts like the other people on the To/CC line of this thread, but here are my two cents on the issue above. From what I can tell

Re: The art of breaking userspace (was Re: [GIT] SELinux changes for 2.6.23 (updated))

2007-07-13 Thread Paul Moore
-Original Message- From: Stephen Smalley [EMAIL PROTECTED] Date: Friday, Jul 13, 2007 3:30 pm Subject: Re: The art of breaking userspace (was Re: [GIT] SELinux changes for 2.6.23 (updated)) To: Michal Piotrowski [EMAIL PROTECTED] CC: Paul Moore [EMAIL PROTECTED], [EMAIL PROTECTED

Re: The art of breaking userspace (was Re: [GIT] SELinux changes for 2.6.23 (updated))

2007-07-13 Thread Paul Moore
that Michal reported. -- paul moore linux security @ hp - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/

Re: [PATCH 0/2] SELinux Netlabel updates

2007-07-17 Thread Paul Moore
, since then the people involved would have seen the _correct_ example in the first version) Oh my. I'll fix this and get another version out to James and Michal tomorrow morning; I have to spend the rest of the night smacking myself in the forehead. -- paul moore linux security @ hp

[PATCH v3 1/2] NetLabel: enable dynamic activation/deactivation of NetLabel/SELinux enforcement

2007-07-18 Thread Paul Moore
into a single block to ease future review as recommended by Linus. Signed-off-by: Paul Moore [EMAIL PROTECTED] --- include/net/netlabel.h | 62 - net/netlabel/netlabel_cipso_v4.c |5 +++ net/netlabel/netlabel_kapi.c | 21 net/netlabel

[PATCH v3 0/2] The comedy of errors patchset (was: SELinux NetLabel updates)

2007-07-18 Thread Paul Moore
, thank you all for your patience. -- paul moore linux security @ hp - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org

[PATCH v3 2/2] SELinux: use SECINITSID_NETMSG instead of SECINITSID_UNLABELED for NetLabel

2007-07-18 Thread Paul Moore
will not notice any difference. Signed-off-by: Paul Moore [EMAIL PROTECTED] --- security/selinux/hooks.c| 21 +++-- security/selinux/netlabel.c | 41 - 2 files changed, 31 insertions(+), 31 deletions(-) Index: linux-2.6_netmsg_3/security

Re: [Patch net-next v2 8/8] selinux: use generic union inet_addr

2013-08-02 Thread Paul Moore
Paris epa...@parisplace.org Cc: Paul Moore pmo...@redhat.com Cc: linux-kernel@vger.kernel.org Cc: linux-security-mod...@vger.kernel.org Signed-off-by: Cong Wang amw...@redhat.com Perhaps I'm confusing this with another patch but I though DaveM said he wasn't going to merge these patches

Re: linux-next: build failure after merge of the lblnet tree

2013-07-26 Thread Paul Moore
in the SELinux tree so I've pruned them from the lblnet-next tree. Thanks for your understanding, -Paul -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http

Re: [PATCH v2 2/2] SELinux: Increase ebitmap_node size for 64-bit configuration

2013-07-10 Thread Paul Moore
majordomo info at http://vger.kernel.org/majordomo-info.html -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read

Re: linux-next: rebase of lblnet tree

2013-07-10 Thread Paul Moore
can't ever think of a time when I asked Linus' to pull a tree of mine directly. If this approach doesn't work for you, please let me know and preferably suggest an alternative. -Paul -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel

Re: [PATCH v14 5/6] LSM: SO_PEERSEC configuration options

2013-07-30 Thread Paul Moore
if PEERSEC_SECURITY_SELINUX + default (all) if PEERSEC_SECURITY_ALL + default (first) + help + The name of the LSM to use with Netlabel config SECURITY_PATH bool Security hooks for pathname based access control -- paul moore www.paul-moore.com -- To unsubscribe from this list

Re: [PATCH v14 3/6] LSM: Explicit individual LSM associations

2013-07-30 Thread Paul Moore
. You get the idea ... -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/

Re: [PATCH v14 5/6] LSM: SO_PEERSEC configuration options

2013-07-31 Thread Paul Moore
On Wednesday, July 31, 2013 08:45:52 AM Casey Schaufler wrote: On 7/30/2013 2:47 PM, Paul Moore wrote: On Thursday, July 25, 2013 11:32:23 AM Casey Schaufler wrote: Subject: [PATCH v14 5/6] LSM: SO_PEERSEC configuration options Refine the handling of SO_PEERSEC to enable legacy user

Re: [PATCH v14 3/6] LSM: Explicit individual LSM associations

2013-07-31 Thread Paul Moore
On Wednesday, July 31, 2013 09:22:23 AM Casey Schaufler wrote: On 7/30/2013 3:08 PM, Paul Moore wrote: On Thursday, July 25, 2013 11:32:11 AM Casey Schaufler wrote: Subject: [PATCH v14 3/6] LSM: Explicit individual LSM associations Expand the /proc/.../attr interface set to help include

Re: [PATCH v14 3/6] LSM: Explicit individual LSM associations

2013-08-01 Thread Paul Moore
On Wednesday, July 31, 2013 02:21:54 PM Casey Schaufler wrote: On 7/31/2013 12:39 PM, Paul Moore wrote: On Wednesday, July 31, 2013 09:22:23 AM Casey Schaufler wrote: On 7/30/2013 3:08 PM, Paul Moore wrote: On Thursday, July 25, 2013 11:32:11 AM Casey Schaufler wrote: Subject: [PATCH v14

Re: [PATCH v14 3/6] LSM: Explicit individual LSM associations

2013-08-01 Thread Paul Moore
On Thursday, August 01, 2013 11:52:14 AM Casey Schaufler wrote: On 8/1/2013 11:35 AM, Paul Moore wrote: Okay, so if I understand everything correctly, there are no new entries in /proc relating specifically to NetLabel, XFRM, or Secmark; although there are new LSM specific entries

Re: [PATCH v14 3/6] LSM: Explicit individual LSM associations

2013-08-01 Thread Paul Moore
On Thursday, August 01, 2013 03:15:00 PM Casey Schaufler wrote: On 8/1/2013 2:30 PM, Paul Moore wrote: On Thursday, August 01, 2013 11:52:14 AM Casey Schaufler wrote: On 8/1/2013 11:35 AM, Paul Moore wrote: Okay, so if I understand everything correctly, there are no new entries in /proc

Re: linux-next: error when fetching the selinux tree

2013-11-06 Thread Paul Moore
cleanup right now, it should be back up shortly. That said, it should be empty today so no worries if you want to skip it today. -Paul -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org

  1   2   3   4   5   6   7   8   >