lkml.org 
[lkml]   [2012]   [Mar]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject[GIT] Security subsystem updates for 3.4
The main addition here is the new Yama security module from Kees Cook, 
which was discussed at the Linux Security Summit last year. Its purpose
is to collect miscellaneous DAC security enhancements in one place. This
also marks a departure in policy for LSM modules, which were previously
limited to being standalone access control systems. Chromium OS is using
Yama, and I believe there are plans for Ubuntu, at least.

This patchset also includes maintenance updates for AppArmor, TOMOYO and
others.

Please pull.

---
The following changes since commit c16fa4f2ad19908a47c63d8fa436a1178438c7e7:
Linus Torvalds (1):
Linux 3.3

are available in the git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next

Al Viro (2):
mm: collapse security_vm_enough_memory() variants into a single function
security: trim security.h

Dan Carpenter (1):
KEYS: testing wrong bit for KEY_FLAG_REVOKED

David Howells (1):
KEYS: Allow special keyrings to be cleared

Dmitry Kasatkin (2):
ima: policy for RAMFS
digsig: changed type of the timestamp

Eric Paris (1):
IMA: fix audit res field to indicate 1 for success and 0 for failure

Fabio Estevam (1):
ima: fix Kconfig dependencies

James Morris (4):
Merge branch 'linus-master'; commit 'v3.3-rc3' into next
Merge branch 'next-queue' into next
Merge branch 'for-security' of git://git.kernel.org/.../jj/linux-apparmor into next
Merge branch 'for-security' of git://git.kernel.org/.../jj/linux-apparmor into next

Jan Engelhardt (1):
AppArmor: add const qualifiers to string arrays

John Johansen (13):
AppArmor: Add mising end of structure test to caps unpacking
AppArmor: Fix dropping of allowed operations that are force audited
AppArmor: Fix underflow in xindex calculation
AppArmor: fix mapping of META_READ to audit and quiet flags
AppArmor: Fix the error case for chroot relative path name lookup
AppArmor: Fix error returned when a path lookup is disconnected
AppArmor: Fix oops in policy unpack auditing
AppArmor: Add const qualifiers to generated string tables
AppArmor: Retrieve the dentry_path for error reporting when path lookup fails
AppArmor: Minor cleanup of d_namespace_path to consolidate error handling
AppArmor: Update dfa matching routines.
AppArmor: Move path failure information into aa_get_name and rename
AppArmor: Add ability to load extended policy

Kees Cook (7):
security: create task_free security callback
security: Yama LSM
Yama: add PR_SET_PTRACER_ANY
AppArmor: refactor securityfs to use structures
AppArmor: add initial "features" directory to securityfs
AppArmor: add "file" details to securityfs
AppArmor: export known rlimit names/value mappings in securityfs

Randy Dunlap (1):
security: fix ima kconfig warning

Stefan Berger (2):
tpm_tis: Only probe iTPMs
tpm_tis: Clean up after module_param cleanup

Tetsuo Handa (4):
TOMOYO: Fix mount flags checking order.
TOMOYO: Return appropriate value to poll().
TOMOYO: Return error if fails to delete a domain
AppArmor: Fix location of const qualifier on generated string tables

Tim Gardner (1):
TPM: Zero buffer whole after copying to userspace

Documentation/networking/dns_resolver.txt | 4 +
Documentation/security/00-INDEX | 2 +
Documentation/security/Yama.txt | 65 ++++++
Documentation/security/keys.txt | 4 +
drivers/char/tpm/Kconfig | 1 -
drivers/char/tpm/tpm.c | 3 +-
drivers/char/tpm/tpm.h | 2 +
drivers/char/tpm/tpm_tis.c | 17 +-
drivers/net/macvtap.c | 1 +
drivers/target/iscsi/iscsi_target.c | 1 +
drivers/target/iscsi/iscsi_target_login.c | 1 +
fs/cifs/cifsacl.c | 1 +
fs/nfs/client.c | 1 +
fs/nfs/idmap.c | 1 +
fs/proc/proc_sysctl.c | 2 +
fs/quota/dquot.c | 1 +
fs/super.c | 1 +
include/linux/digsig.h | 4 +-
include/linux/key.h | 1 +
include/linux/prctl.h | 7 +
include/linux/security.h | 80 ++++----
include/net/sock.h | 2 +
ipc/msgutil.c | 2 +
kernel/cred.c | 1 +
kernel/exit.c | 1 +
kernel/fork.c | 3 +-
kernel/sched/core.c | 1 +
kernel/sysctl.c | 1 +
mm/mmap.c | 17 ++-
mm/mprotect.c | 2 +-
mm/mremap.c | 2 +-
mm/shmem.c | 4 +-
mm/swapfile.c | 4 +-
net/dns_resolver/dns_key.c | 1 +
security/Kconfig | 6 +
security/Makefile | 2 +
security/apparmor/Makefile | 27 ++-
security/apparmor/apparmorfs.c | 195 ++++++++++++++----
security/apparmor/audit.c | 7 +-
security/apparmor/domain.c | 5 +-
security/apparmor/file.c | 21 +--
security/apparmor/include/apparmor.h | 15 ++-
security/apparmor/include/apparmorfs.h | 44 ++++
security/apparmor/include/audit.h | 9 +-
security/apparmor/include/file.h | 2 +-
security/apparmor/include/match.h | 3 +
security/apparmor/include/path.h | 3 +-
security/apparmor/include/policy.h | 15 ++-
security/apparmor/include/resource.h | 4 +
security/apparmor/match.c | 80 +++++++-
security/apparmor/path.c | 56 +++--
security/apparmor/policy.c | 3 +-
security/apparmor/policy_unpack.c | 31 +++-
security/apparmor/resource.c | 5 +
security/capability.c | 5 +
security/commoncap.c | 1 +
security/integrity/ima/Kconfig | 4 +-
security/integrity/ima/ima_audit.c | 2 +-
security/integrity/ima/ima_policy.c | 3 +-
security/keys/keyctl.c | 15 ++-
security/keys/process_keys.c | 3 +-
security/security.c | 21 +--
security/selinux/hooks.c | 2 +
security/smack/smack_lsm.c | 3 +
security/tomoyo/audit.c | 4 +-
security/tomoyo/common.c | 63 ++----
security/tomoyo/common.h | 6 +-
security/tomoyo/mount.c | 38 ++--
security/tomoyo/securityfs_if.c | 5 +-
security/yama/Kconfig | 13 ++
security/yama/Makefile | 3 +
security/yama/yama_lsm.c | 323 +++++++++++++++++++++++++++++
72 files changed, 1036 insertions(+), 252 deletions(-)
create mode 100644 Documentation/security/Yama.txt
create mode 100644 security/yama/Kconfig
create mode 100644 security/yama/Makefile
create mode 100644 security/yama/yama_lsm.c

\
 
 \ /
  Last update: 2012-03-21 03:25    [from the cache]
©2003-2011 Jasper Spaans