From mboxrd@z Thu Jan 1 00:00:00 1970 From: akpm@linux-foundation.org Subject: - sysctl-remove-the-proc_dir_entry-member-for-the-sysctl-tables-fix-2.patch removed from -mm tree Date: Tue, 13 Feb 2007 23:02:26 -0800 Message-ID: <200702140702.l1E72QqX023951@shell0.pdx.osdl.net> Reply-To: linux-kernel@vger.kernel.org Return-path: Received: from smtp.osdl.org ([65.172.181.24]:44029 "EHLO smtp.osdl.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932170AbXBNHCa (ORCPT ); Wed, 14 Feb 2007 02:02:30 -0500 Sender: mm-commits-owner@vger.kernel.org List-Id: mm-commits@vger.kernel.org To: ebiederm@xmission.com, jmorris@namei.org, sds@tycho.nsa.gov, mm-commits@vger.kernel.org The patch titled sysctl: restore the selinux path based label lookup for sysctls has been removed from the -mm tree. Its filename was sysctl-remove-the-proc_dir_entry-member-for-the-sysctl-tables-fix-2.patch This patch was dropped because it was folded into sysctl-remove-the-proc_dir_entry-member-for-the-sysctl-tables.patch ------------------------------------------------------ Subject: sysctl: restore the selinux path based label lookup for sysctls From: Eric W. Biederman This time instead of generating the generating the paths from proc_dir_entries generate the labels from the names in the sysctl ctl_tables themselves. This removes an unnecessary layer of indirection, allows this to work even when procfs support is not compiled into the kernel, and especially allows it to work now that ctl_tables no longer have a proc_dir_entry field. I continue passing "proc" into genfs sid although that is complete nonsense to allow existing selinux policies to work without modification. Signed-off-by: Eric W. Biederman Cc: Stephen Smalley Cc: James Morris Signed-off-by: Andrew Morton --- security/selinux/hooks.c | 43 +++++++++++++++++++++++++++++++++++-- 1 file changed, 41 insertions(+), 2 deletions(-) diff -puN security/selinux/hooks.c~sysctl-remove-the-proc_dir_entry-member-for-the-sysctl-tables-fix-2 security/selinux/hooks.c --- a/security/selinux/hooks.c~sysctl-remove-the-proc_dir_entry-member-for-the-sysctl-tables-fix-2 +++ a/security/selinux/hooks.c @@ -1417,6 +1417,41 @@ static int selinux_capable(struct task_s return task_has_capability(tsk,cap); } +static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid) +{ + int buflen, rc; + char *buffer, *path, *end; + + rc = -ENOMEM; + buffer = (char*)__get_free_page(GFP_KERNEL); + if (!buffer) + goto out; + + buflen = PAGE_SIZE; + end = buffer+buflen; + *--end = '\0'; + buflen--; + path = end-1; + *path = '/'; + while (table) { + const char *name = table->procname; + size_t namelen = strlen(name); + buflen -= namelen + 1; + if (buflen < 0) + goto out_free; + end -= namelen; + memcpy(end, name, namelen); + *--end = '/'; + path = end; + table = table->parent; + } + rc = security_genfs_sid("proc", path, tclass, sid); +out_free: + free_page((unsigned long)buffer); +out: + return rc; +} + static int selinux_sysctl(ctl_table *table, int op) { int error = 0; @@ -1431,8 +1466,12 @@ static int selinux_sysctl(ctl_table *tab tsec = current->security; - /* Use the well-defined sysctl SID. */ - tsid = SECINITSID_SYSCTL; + rc = selinux_sysctl_get_sid(table, (op == 0001) ? + SECCLASS_DIR : SECCLASS_FILE, &tsid); + if (rc) { + /* Default to the well-defined sysctl SID. */ + tsid = SECINITSID_SYSCTL; + } /* The op values are "defined" in sysctl.c, thereby creating * a bad coupling between this module and sysctl.c */ _ Patches currently in -mm which might be from ebiederm@xmission.com are origin.patch sysctl-x25-remove-unnecessary-insert_at_head-from-register_sysctl_table.patch sysctl-move-ctl_sunrpc-to-sysctlh-where-it-belongs.patch sysctl-sunrpc-remove-unnecessary-insert_at_head-flag.patch sysctl-sunrpc-dont-unnecessarily-set-ctl_table-de.patch sysctl-rose-remove-unnecessary-insert_at_head-flag.patch sysctl-netrom-remove-unnecessary-insert_at_head-flag.patch sysctl-llc-remove-unnecessary-insert_at_head-flag.patch sysctl-ipx-remove-unnecessary-insert_at_head-flag.patch sysctl-decnet-remove-unnecessary-insert_at_head-flag.patch sysctl-dccp-remove-unnecessary-insert_at_head-flag.patch sysctl-ax25-remove-unnecessary-insert_at_head-flag.patch sysctl-atalk-remove-unnecessary-insert_at_head-flag.patch sysctl-scsi-remove-unnecessary-insert_at_head-flag.patch sysctl-md-remove-unnecessary-insert_at_head-flag.patch sysctl-mac_hid-remove-unnecessary-insert_at_head-flag.patch sysctl-ipmi-remove-unnecessary-insert_at_head-flag.patch sysctl-cdrom-remove-unnecessary-insert_at_head-flag.patch sysctl-cdrom-dont-set-de-owner.patch sysctl-move-ctl_pm-into-sysctlh-where-it-belongs.patch sysctl-frv-pm-remove-unnecessary-insert_at_head-flag.patch sysctl-move-ctl_frv-into-sysctlh-where-it-belongs.patch sysctl-frv-remove-unnecessary-insert_at_head-flag.patch sysctl-c99-convert-arch-frv-kernel-pmc.patch sysctl-c99-convert-arch-frv-kernel-sysctlc.patch sysctl-sn-remove-sysctl-abi-breakage.patch sysctl-c99-convert-arch-ia64-sn-kernel-xpc_mainc.patch sysctl-c99-convert-arch-ia64-kernel-perfmon-and-remove-abi-breakage.patch sysctl-mips-au1000-remove-sys_sysctl-support.patch sysctl-c99-convert-the-ctl_tables-in-arch-mips-au1000-common-powerc.patch sysctl-c99-convert-arch-mips-lasat-sysctlc-and-remove-abi-breakage.patch sysctl-s390-move-sysctl-definitions-to-sysctlh.patch sysctl-s390-remove-unnecessary-use-of-insert_at_head.patch sysctl-c99-convert-ctl_tables-in-arch-powerpc-kernel-idlec.patch sysctl-c99-convert-ctl_tables-entries-in-arch-ppc-kernel-ppc_htabc.patch sysctl-c99-convert-arch-sh64-kernel-trapsc-and-remove-abi-breakage.patch sysctl-x86_64-remove-unnecessary-use-of-insert_at_head.patch sysctl-c99-convert-ctl_tables-in-arch-x86_64-ia32-ia32_binfmtc.patch sysctl-c99-convert-ctl_tables-in-arch-x86_64-kernel-vsyscallc.patch sysctl-c99-convert-ctl_tables-in-arch-x86_64-mm-initc.patch sysctl-remove-sys_sysctl-support-from-the-hpet-timer-driver.patch sysctl-remove-sys_sysctl-support-from-drivers-char-rtcc.patch sysctl-register-the-sysctl-number-used-by-the-arlan-driver.patch sysctl-c99-convert-ctl_tables-in-drivers-parport-procfsc.patch sysctl-c99-convert-coda-ctl_tables-and-remove-binary-sysctls.patch sysctl-c99-convert-ctl_tables-in-ntfs-and-remove-sys_sysctl-support.patch sysctl-register-the-ocfs2-sysctl-numbers.patch sysctl-move-init_irq_proc-into-init-main-where-it-belongs.patch sysctl-move-utsname-sysctls-to-their-own-file.patch sysctl-move-utsname-sysctls-to-their-own-file-fix-2.patch sysctl-move-sysv-ipc-sysctls-to-their-own-file.patch sysctl-create-sys-fs-binfmt_misc-as-an-ordinary-sysctl-entry.patch sysctl-remove-support-for-ctl_any.patch sysctl-remove-support-for-directory-strategy-routines.patch sysctl-remove-insert_at_head-from-register_sysctl.patch sysctl-factor-out-sysctl_head_next-from-do_sysctl.patch sysctl-allow-sysctl_perm-to-be-called-from-outside-of-sysctlc.patch sysctl-reimplement-the-sysctl-proc-support.patch sysctl-add-a-parent-entry-to-ctl_table-and-set-the-parent-entry.patch sysctl-remove-the-proc_dir_entry-member-for-the-sysctl-tables.patch sysctl-remove-the-proc_dir_entry-member-for-the-sysctl-tables-fix-2.patch sysctl-remove-the-proc_dir_entry-member-for-the-sysctl-tables-ntfs-fix.patch sysctl-fix-the-selinux_sysctl_get_sid.patch selinux-enhance-selinux-to-always-ignore-private-inodes.patch sysctl-hide-the-sysctl-proc-inodes-from-selinux.patch vdso-print-fatal-signals-use-ctl_unnumbered.patch