[AppArmor 00/45] AppArmor security module overview

-- - To unsubscribe from this list: send the line unsubscribe linux-security-module in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html

[AppArmor 01/45] Pass struct vfsmount to the inode_create LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h |9 ++---

[AppArmor 02/45] Pass struct path down to remove_suid and children

Required by a later patch that adds a struct vfsmount parameter to notify_change(). Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ntfs/file.c |2 +- fs/splice.c

[AppArmor 03/45] Add a vfsmount parameter to notify_change()

The vfsmount parameter must be set appropriately for files visibile outside the kernel. Files that are only used in a filesystem (e.g., reiserfs xattr files) will have a NULL vfsmount. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by:

[AppArmor 05/45] Add struct vfsmount parameter to vfs_mkdir()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |5 - fs/namei.c|

[AppArmor 08/45] Pass struct vfsmount to the inode_mknod LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h |7 +--

[AppArmor 11/45] Pass struct vfsmount to the inode_readlink LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/stat.c|2 +- include/linux/security.h |8 +---

[AppArmor 43/45] Switch to vfs_permission() in do_path_lookup()

Switch from file_permission() to vfs_permission() in do_path_lookup(): this avoids calling permission() with a NULL nameidata here. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c | 13 ++--- 1 file changed, 6

[AppArmor 41/45] add simple network toggles to apparmor

Signed-off-by: John Johansen [EMAIL PROTECTED] Signed-off-by: Jesse Michael [EMAIL PROTECTED] --- security/apparmor/Makefile |7 + security/apparmor/apparmor.h |7 + security/apparmor/lsm.c | 147 ++-

[AppArmor 34/45] Factor out sysctl pathname code

Convert the selinux sysctl pathname computation code into a standalone function. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- include/linux/sysctl.h |2 ++ kernel/sysctl.c | 27 +++

[AppArmor 32/45] Enable LSM hooks to distinguish operations on file descriptors from operations on pathnames

Struct iattr already contains ia_file since commit cc4e69de from Miklos (which is related to commit befc649c). Use this to pass struct file down the setattr hooks. This allows LSMs to distinguish operations on file descriptors from operations on paths. Signed-off-by: Andreas Gruenbacher [EMAIL

[AppArmor 29/45] Fix __d_path() for lazy unmounts and make it unambiguous

First, when __d_path() hits a lazily unmounted mount point, it tries to prepend the name of the lazily unmounted dentry to the path name. It gets this wrong, and also overwrites the slash that separates the name from the following pathname component. This patch fixes that; if a process was in

[AppArmor 27/45] Add a struct vfsmount parameter to vfs_removexattr()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/nfsd/vfs.c |7 --- fs/xattr.c|

[AppArmor 21/45] Add a struct vfsmount parameter to vfs_setxattr()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/nfsd/vfs.c | 16 +++- fs/xattr.c

[AppArmor 12/45] Add struct vfsmount parameters to vfs_link()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |9 +++-- fs/namei.c |

[AppArmor 20/45] Pass struct vfsmount to the inode_rename LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |6 -- include/linux/security.h | 13 ++---

[AppArmor 15/45] Pass struct vfsmount to the inode_rmdir LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h | 10 +++---

[AppArmor 28/45] Pass struct vfsmount to the inode_removexattr LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c |2 +- include/linux/security.h | 14 +-

[AppArmor 13/45] Pass the struct vfsmounts to the inode_link LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |3 ++- include/linux/security.h | 16 +++-

[AppArmor 16/45] Call lsm hook before unhashing dentry in vfs_rmdir()

If we unhash the dentry before calling the security_inode_rmdir hook, we cannot compute the file's pathname in the hook anymore. AppArmor needs to know the filename in order to decide whether a file may be deleted, though. Signed-off-by: John Johansen [EMAIL PROTECTED] Signed-off-by: Andreas

[AppArmor 17/45] Add a struct vfsmount parameter to vfs_unlink()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |3 ++- fs/namei.c|4

[AppArmor 18/45] Pass struct vfsmount to the inode_unlink LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h | 10 +++---

[AppArmor 19/45] Add struct vfsmount parameters to vfs_rename()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |7 ++- fs/namei.c | 19

[AppArmor 22/45] Pass struct vfsmount to the inode_setxattr LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c |4 ++-- include/linux/security.h | 35

[AppArmor 23/45] Add a struct vfsmount parameter to vfs_getxattr()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/nfsd/nfs4xdr.c |2 +- fs/nfsd/vfs.c

[AppArmor 24/45] Pass struct vfsmount to the inode_getxattr LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c |2 +- include/linux/security.h | 11 +++

[AppArmor 25/45] Add a struct vfsmount parameter to vfs_listxattr()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c| 25 ++---

[AppArmor 26/45] Pass struct vfsmount to the inode_listxattr LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c |2 +- include/linux/security.h |9 +

[AppArmor 30/45] Make d_path() consistent across mount operations

The path that __d_path() computes can become slightly inconsistent when it races with mount operations: it grabs the vfsmount_lock when traversing mount points but immediately drops it again, only to re-grab it when it reaches the next mount point. The result is that the filename computed is not

[AppArmor 31/45] Add d_namespace_path() to compute namespace relative pathnames

In AppArmor, we are interested in pathnames relative to the namespace root. This is the same as d_path() except for the root where the search ends. Add a function for computing the namespace-relative path. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL

[AppArmor 35/45] Allow permission functions to tell between parent and leaf checks

Set the LOOKUP_CONTINUE flag when checking parent permissions. This allows permission functions to tell between parent and leaf checks. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |6 ++ 1 file changed, 6

[AppArmor 37/45] AppArmor: Main Part

The underlying functions by which the AppArmor LSM hooks are implemented. Signed-off-by: John Johansen [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] --- security/apparmor/main.c | 1361 +++ 1 file changed, 1361 insertions(+)

[AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching

Pathname matching, transition table loading, profile loading and manipulation. Signed-off-by: John Johansen [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] --- security/apparmor/match.c| 273 +++ security/apparmor/match.h| 85 +++

[AppArmor 40/45] AppArmor: all the rest

All the things that didn't nicely fit in a category on their own: kbuild code, declararions and inline functions, /sys/kernel/security/apparmor filesystem for controlling apparmor from user space, profile list functions, locking documentation, /proc/$pid/task/$tid/attr/current access.

[AppArmor 42/45] Add AppArmor LSM to security/Makefile

Signed-off-by: John Johansen [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] --- security/Kconfig |1 + security/Makefile |1 + security/apparmor/Kconfig | 21 +++-- 3 files changed, 21 insertions(+), 2 deletions(-) ---

[AppArmor 44/45] Switch to vfs_permission() in sys_fchdir()

Switch from file_permission() to vfs_permission() in sys_fchdir(): this avoids calling permission() with a NULL nameidata here. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/open.c | 16 +++- 1 file changed, 7

[AppArmor 06/45] Pass struct vfsmount to the inode_mkdir LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h |8 ++--

[AppArmor 00/44] AppArmor security module overview

This post contains patches to include the AppArmor application security framework, with request for inclusion into -mm for wider testing. These patches are currently against lkml but we will gladly rebase them against -mm so that they will apply cleanly. Any comments and feedback to improve

[AppArmor 03/44] Add a vfsmount parameter to notify_change()

The vfsmount parameter must be set appropriately for files visibile outside the kernel. Files that are only used in a filesystem (e.g., reiserfs xattr files) will have a NULL vfsmount. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by:

[AppArmor 01/44] Pass struct vfsmount to the inode_create LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h |9 ++---

[AppArmor 06/44] Pass struct vfsmount to the inode_mkdir LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h |8 ++--

[AppArmor 07/44] Add a struct vfsmount parameter to vfs_mknod()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |5 - fs/namei.c | 10

[AppArmor 10/44] Pass struct vfsmount to the inode_symlink LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h |9 ++---

[AppArmor 11/44] Pass struct vfsmount to the inode_readlink LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/stat.c|2 +- include/linux/security.h | 11 +++

[AppArmor 13/44] Pass the struct vfsmounts to the inode_link LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |3 ++- include/linux/security.h | 18 +-

[AppArmor 14/44] Add a struct vfsmount parameter to vfs_rmdir()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |4 +++- fs/namei.c|

[AppArmor 15/44] Pass struct vfsmount to the inode_rmdir LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h | 12

[AppArmor 17/44] Add a struct vfsmount parameter to vfs_unlink()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |3 ++- fs/namei.c|4

[AppArmor 18/44] Pass struct vfsmount to the inode_unlink LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h | 12

[AppArmor 16/44] Call lsm hook before unhashing dentry in vfs_rmdir()

If we unhash the dentry before calling the security_inode_rmdir hook, we cannot compute the file's pathname in the hook anymore. AppArmor needs to know the filename in order to decide whether a file may be deleted, though. Signed-off-by: John Johansen [EMAIL PROTECTED] Signed-off-by: Andreas

[AppArmor 23/44] Add a struct vfsmount parameter to vfs_getxattr()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/nfsd/nfs4xdr.c |2 +- fs/nfsd/vfs.c

[AppArmor 21/44] Add a struct vfsmount parameter to vfs_setxattr()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/nfsd/vfs.c | 16 +++- fs/xattr.c

[AppArmor 26/44] Pass struct vfsmount to the inode_listxattr LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c |2 +- include/linux/security.h | 12 +++-

[AppArmor 12/44] Add struct vfsmount parameters to vfs_link()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |9 +++-- fs/namei.c |

[AppArmor 29/44] Fix __d_path() for lazy unmounts and make it unambiguous

First, when __d_path() hits a lazily unmounted mount point, it tries to prepend the name of the lazily unmounted dentry to the path name. It gets this wrong, and also overwrites the slash that separates the name from the following pathname component. This patch fixes that; if a process was in

[AppArmor 33/44] Pass struct file down the inode_*xattr security LSM hooks

This allows LSMs to also distinguish between file descriptor and path access for the xattr operations. (The other relevant operations are covered by the setattr hook.) Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c

[AppArmor 36/44] Export audit subsystem for use by modules

Update kenel audit range comments to show AppArmor's registered range of 1500-1599. This range used to be reserved for LSPP but LSPP uses the SE Linux range and the range was given to AppArmor. Adds necessary export symbols for audit subsystem routines. Changes audit_log_vformat to be externally

[AppArmor 37/44] AppArmor: Main Part

The underlying functions by which the AppArmor LSM hooks are implemented. Signed-off-by: John Johansen [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] --- security/apparmor/main.c | 1255 +++ 1 file changed, 1255 insertions(+)

[AppArmor 38/44] AppArmor: Module and LSM hooks

Module parameters, LSM hooks, initialization and teardown. Signed-off-by: John Johansen [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] --- security/apparmor/lsm.c | 817 1 file changed, 817 insertions(+) --- /dev/null

[AppArmor 04/44] Pass struct vfsmount to the inode_setattr LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/attr.c|4 ++-- include/linux/security.h |8 ++--

[RFD 0/4] AppArmor - Don't pass NULL nameidata to vfs_create/lookup/permission IOPs

-- This post is a request for discussion on creating a second smaller nameidata struct to eliminate conditionally passing of vfsmounts to the LSM. It contains a series of patches that apply on top of the AppArmor patch series. These patches were previously post on May 14, but received no

[RFD 2/4] Never pass a NULL nameidata to vfs_create()

Create a nameidata2 struct in nfsd and mqueue so that vfs_create does need to conditionally pass the vfsmnt. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c|2 +- fs/nfsd/vfs.c | 42

[RFD 4/4] Pass nameidata2 to permission() from nfsd_permission()

Construct a nameidata object and pass it down to permission(), so that we can do the proper mount flag checks there. Note that confining nfsd with AppArmor makes no sense, and so this patch is not necessary for AppArmor alone. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by:

[AppArmor 24/44] Pass struct vfsmount to the inode_getxattr LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c |2 +- include/linux/security.h | 13 -

[AppArmor 10/45] Pass struct vfsmount to the inode_symlink LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h |9 ++---

[RFD Patch 3/4] Dont use a NULL nameidata in xattr_permission()

Create nameidata2 struct xattr_permission so that it does not pass NULL to permission. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] --- fs/xattr.c | 18 +- 1 file changed, 13 insertions(+), 5 deletions(-) --- a/fs/xattr.c +++ b/fs/xattr.c @@ -25,8 +25,16 @@ *

[AppArmor 32/45] Enable LSM hooks to distinguish operations on file descriptors from operations on pathnames

Struct iattr already contains ia_file since commit cc4e69de from Miklos (which is related to commit befc649c). Use this to pass struct file down the setattr hooks. This allows LSMs to distinguish operations on file descriptors from operations on paths. Signed-off-by: Andreas Gruenbacher [EMAIL

[RFD Patch 4/4] Pass nameidata2 to permission() from nfsd_permission()

Construct a nameidata object and pass it down to permission(), so that we can do the proper mount flag checks there. Note that confining nfsd with AppArmor makes no sense, and so this patch is not necessary for AppArmor alone. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] ---

[AppArmor 35/45] Allow permission functions to tell between parent and leaf checks

Set the LOOKUP_CONTINUE flag when checking parent permissions. This allows permission functions to tell between parent and leaf checks. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] --- fs/namei.c |6 ++ 1 file changed, 6 insertions(+) --- a/fs/namei.c +++ b/fs/namei.c @@

[AppArmor 06/45] Pass struct vfsmount to the inode_mkdir LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h |8 ++--

[AppArmor 24/45] Pass struct vfsmount to the inode_getxattr LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c |2 +- include/linux/security.h | 13 -

[AppArmor 11/45] Pass struct vfsmount to the inode_readlink LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/stat.c|2 +- include/linux/security.h | 11 +++

[AppArmor 20/45] Pass struct vfsmount to the inode_rename LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |6 -- include/linux/security.h | 18

[AppArmor 12/45] Add struct vfsmount parameters to vfs_link()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |9 +++-- fs/namei.c |

[AppArmor 09/45] Add a struct vfsmount parameter to vfs_symlink()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |4 +++- fs/namei.c |6

[AppArmor 22/45] Pass struct vfsmount to the inode_setxattr LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c |4 ++-- include/linux/security.h | 40

[AppArmor 16/45] Call lsm hook before unhashing dentry in vfs_rmdir()

If we unhash the dentry before calling the security_inode_rmdir hook, we cannot compute the file's pathname in the hook anymore. AppArmor needs to know the filename in order to decide whether a file may be deleted, though. Signed-off-by: John Johansen [EMAIL PROTECTED] Signed-off-by: Andreas

[RFD Patch 0/4] AppArmor - Don't pass NULL nameidata to vfs_create/lookup/permission IOPs

lkml-explanatory.txt -- - To unsubscribe from this list: send the line unsubscribe linux-security-module in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html

[AppArmor 19/45] Add struct vfsmount parameters to vfs_rename()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |7 ++- fs/namei.c | 19

[AppArmor 30/45] Make d_path() consistent across mount operations

The path that __d_path() computes can become slightly inconsistent when it races with mount operations: it grabs the vfsmount_lock when traversing mount points but immediately drops it again, only to re-grab it when it reaches the next mount point. The result is that the filename computed is not

[AppArmor 05/45] Add struct vfsmount parameter to vfs_mkdir()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |5 - fs/namei.c|

[AppArmor 01/45] Pass struct vfsmount to the inode_create LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h |9 ++---

[AppArmor 41/45] Add AppArmor LSM to security/Makefile

Signed-off-by: John Johansen [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] --- security/Kconfig |1 + security/Makefile |1 + security/apparmor/Kconfig |3 ++- 3 files changed, 4 insertions(+), 1 deletion(-) --- a/security/Kconfig +++

[AppArmor 33/45] Pass struct file down the inode_*xattr security LSM hooks

This allows LSMs to also distinguish between file descriptor and path access for the xattr operations. (The other relevant operations are covered by the setattr hook.) Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c

[AppArmor 15/45] Pass struct vfsmount to the inode_rmdir LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h | 12

[AppArmor 18/45] Pass struct vfsmount to the inode_unlink LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/namei.c |2 +- include/linux/security.h | 12

[AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching

Pathname matching, transition table loading, profile loading and manipulation. Signed-off-by: John Johansen [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] --- security/apparmor/match.c| 232 security/apparmor/match.h| 83

[AppArmor 27/45] Add a struct vfsmount parameter to vfs_removexattr()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/nfsd/vfs.c |7 --- fs/xattr.c|

[AppArmor 07/45] Add a struct vfsmount parameter to vfs_mknod()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ecryptfs/inode.c |5 - fs/namei.c | 10

[AppArmor 29/45] Fix __d_path() for lazy unmounts and make it unambiguous

First, when __d_path() hits a lazily unmounted mount point, it tries to prepend the name of the lazily unmounted dentry to the path name. It gets this wrong, and also overwrites the slash that separates the name from the following pathname component. This patch fixes that; if a process was in

[AppArmor 26/45] Pass struct vfsmount to the inode_listxattr LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c |2 +- include/linux/security.h | 12 +++-

[AppArmor 34/45] Factor out sysctl pathname code

Convert the selinux sysctl pathname computation code into a standalone function. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- include/linux/sysctl.h |2 ++ kernel/sysctl.c | 27 +++

[AppArmor 02/45] Pass struct path down to remove_suid and children

Required by a later patch that adds a struct vfsmount parameter to notify_change(). Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/ntfs/file.c |2 +- fs/reiserfs/file.c

[AppArmor 23/45] Add a struct vfsmount parameter to vfs_getxattr()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/nfsd/nfs4xdr.c |2 +- fs/nfsd/vfs.c

[RFD Patch 2/4] Never pass a NULL nameidata to vfs_create()

Create a nameidata2 struct in nfsd and mqueue so that vfs_create does need to conditionally pass the vfsmnt. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] --- fs/namei.c|2 +- fs/nfsd/vfs.c | 42 +- ipc/mqueue.c |7 ++- 3 files

[AppArmor 28/45] Pass struct vfsmount to the inode_removexattr LSM hook

This is needed for computing pathnames in the AppArmor LSM. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c |2 +- include/linux/security.h | 15 +--

[AppArmor 25/45] Add a struct vfsmount parameter to vfs_listxattr()

The vfsmount will be passed down to the LSM hook so that LSMs can compute pathnames. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by: John Johansen [EMAIL PROTECTED] --- fs/xattr.c| 25 ++---

[AppArmor 38/45] AppArmor: Module and LSM hooks

Module parameters, LSM hooks, initialization and teardown. Signed-off-by: John Johansen [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Index: b/security/apparmor/lsm.c === --- /dev/null +++

[AppArmor 31/45] Add d_namespace_path() to compute namespace relative pathnames

In AppArmor, we are interested in pathnames relative to the namespace root. This is the same as d_path() except for the root where the search ends. Add a function for computing the namespace-relative path. Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Reviewed-by: John Johansen [EMAIL

[AppArmor 03/45] Add a vfsmount parameter to notify_change()

The vfsmount parameter must be set appropriately for files visibile outside the kernel. Files that are only used in a filesystem (e.g., reiserfs xattr files) will have a NULL vfsmount. Signed-off-by: Tony Jones [EMAIL PROTECTED] Signed-off-by: Andreas Gruenbacher [EMAIL PROTECTED] Signed-off-by:

  1   2   >