lkml.org 
[lkml]   [2012]   [Mar]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    Subject[GIT] Security subsystem updates for 3.4
    The main addition here is the new Yama security module from Kees Cook, 
    which was discussed at the Linux Security Summit last year. Its purpose
    is to collect miscellaneous DAC security enhancements in one place. This
    also marks a departure in policy for LSM modules, which were previously
    limited to being standalone access control systems. Chromium OS is using
    Yama, and I believe there are plans for Ubuntu, at least.

    This patchset also includes maintenance updates for AppArmor, TOMOYO and
    others.

    Please pull.

    ---

    The following changes since commit c16fa4f2ad19908a47c63d8fa436a1178438c7e7:
    Linus Torvalds (1):
    Linux 3.3

    are available in the git repository at:

    git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next

    Al Viro (2):
    mm: collapse security_vm_enough_memory() variants into a single function
    security: trim security.h

    Dan Carpenter (1):
    KEYS: testing wrong bit for KEY_FLAG_REVOKED

    David Howells (1):
    KEYS: Allow special keyrings to be cleared

    Dmitry Kasatkin (2):
    ima: policy for RAMFS
    digsig: changed type of the timestamp

    Eric Paris (1):
    IMA: fix audit res field to indicate 1 for success and 0 for failure

    Fabio Estevam (1):
    ima: fix Kconfig dependencies

    James Morris (4):
    Merge branch 'linus-master'; commit 'v3.3-rc3' into next
    Merge branch 'next-queue' into next
    Merge branch 'for-security' of git://git.kernel.org/.../jj/linux-apparmor into next
    Merge branch 'for-security' of git://git.kernel.org/.../jj/linux-apparmor into next

    Jan Engelhardt (1):
    AppArmor: add const qualifiers to string arrays

    John Johansen (13):
    AppArmor: Add mising end of structure test to caps unpacking
    AppArmor: Fix dropping of allowed operations that are force audited
    AppArmor: Fix underflow in xindex calculation
    AppArmor: fix mapping of META_READ to audit and quiet flags
    AppArmor: Fix the error case for chroot relative path name lookup
    AppArmor: Fix error returned when a path lookup is disconnected
    AppArmor: Fix oops in policy unpack auditing
    AppArmor: Add const qualifiers to generated string tables
    AppArmor: Retrieve the dentry_path for error reporting when path lookup fails
    AppArmor: Minor cleanup of d_namespace_path to consolidate error handling
    AppArmor: Update dfa matching routines.
    AppArmor: Move path failure information into aa_get_name and rename
    AppArmor: Add ability to load extended policy

    Kees Cook (7):
    security: create task_free security callback
    security: Yama LSM
    Yama: add PR_SET_PTRACER_ANY
    AppArmor: refactor securityfs to use structures
    AppArmor: add initial "features" directory to securityfs
    AppArmor: add "file" details to securityfs
    AppArmor: export known rlimit names/value mappings in securityfs

    Randy Dunlap (1):
    security: fix ima kconfig warning

    Stefan Berger (2):
    tpm_tis: Only probe iTPMs
    tpm_tis: Clean up after module_param cleanup

    Tetsuo Handa (4):
    TOMOYO: Fix mount flags checking order.
    TOMOYO: Return appropriate value to poll().
    TOMOYO: Return error if fails to delete a domain
    AppArmor: Fix location of const qualifier on generated string tables

    Tim Gardner (1):
    TPM: Zero buffer whole after copying to userspace

    Documentation/networking/dns_resolver.txt | 4 +
    Documentation/security/00-INDEX | 2 +
    Documentation/security/Yama.txt | 65 ++++++
    Documentation/security/keys.txt | 4 +
    drivers/char/tpm/Kconfig | 1 -
    drivers/char/tpm/tpm.c | 3 +-
    drivers/char/tpm/tpm.h | 2 +
    drivers/char/tpm/tpm_tis.c | 17 +-
    drivers/net/macvtap.c | 1 +
    drivers/target/iscsi/iscsi_target.c | 1 +
    drivers/target/iscsi/iscsi_target_login.c | 1 +
    fs/cifs/cifsacl.c | 1 +
    fs/nfs/client.c | 1 +
    fs/nfs/idmap.c | 1 +
    fs/proc/proc_sysctl.c | 2 +
    fs/quota/dquot.c | 1 +
    fs/super.c | 1 +
    include/linux/digsig.h | 4 +-
    include/linux/key.h | 1 +
    include/linux/prctl.h | 7 +
    include/linux/security.h | 80 ++++----
    include/net/sock.h | 2 +
    ipc/msgutil.c | 2 +
    kernel/cred.c | 1 +
    kernel/exit.c | 1 +
    kernel/fork.c | 3 +-
    kernel/sched/core.c | 1 +
    kernel/sysctl.c | 1 +
    mm/mmap.c | 17 ++-
    mm/mprotect.c | 2 +-
    mm/mremap.c | 2 +-
    mm/shmem.c | 4 +-
    mm/swapfile.c | 4 +-
    net/dns_resolver/dns_key.c | 1 +
    security/Kconfig | 6 +
    security/Makefile | 2 +
    security/apparmor/Makefile | 27 ++-
    security/apparmor/apparmorfs.c | 195 ++++++++++++++----
    security/apparmor/audit.c | 7 +-
    security/apparmor/domain.c | 5 +-
    security/apparmor/file.c | 21 +--
    security/apparmor/include/apparmor.h | 15 ++-
    security/apparmor/include/apparmorfs.h | 44 ++++
    security/apparmor/include/audit.h | 9 +-
    security/apparmor/include/file.h | 2 +-
    security/apparmor/include/match.h | 3 +
    security/apparmor/include/path.h | 3 +-
    security/apparmor/include/policy.h | 15 ++-
    security/apparmor/include/resource.h | 4 +
    security/apparmor/match.c | 80 +++++++-
    security/apparmor/path.c | 56 +++--
    security/apparmor/policy.c | 3 +-
    security/apparmor/policy_unpack.c | 31 +++-
    security/apparmor/resource.c | 5 +
    security/capability.c | 5 +
    security/commoncap.c | 1 +
    security/integrity/ima/Kconfig | 4 +-
    security/integrity/ima/ima_audit.c | 2 +-
    security/integrity/ima/ima_policy.c | 3 +-
    security/keys/keyctl.c | 15 ++-
    security/keys/process_keys.c | 3 +-
    security/security.c | 21 +--
    security/selinux/hooks.c | 2 +
    security/smack/smack_lsm.c | 3 +
    security/tomoyo/audit.c | 4 +-
    security/tomoyo/common.c | 63 ++----
    security/tomoyo/common.h | 6 +-
    security/tomoyo/mount.c | 38 ++--
    security/tomoyo/securityfs_if.c | 5 +-
    security/yama/Kconfig | 13 ++
    security/yama/Makefile | 3 +
    security/yama/yama_lsm.c | 323 +++++++++++++++++++++++++++++
    72 files changed, 1036 insertions(+), 252 deletions(-)
    create mode 100644 Documentation/security/Yama.txt
    create mode 100644 security/yama/Kconfig
    create mode 100644 security/yama/Makefile
    create mode 100644 security/yama/yama_lsm.c


    \
     
     \ /
      Last update: 2012-03-21 03:25    [W:0.030 / U:59.216 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site