Linux-Next Archive on lore.kernel.org
 help / color / Atom feed
* linux-next: manual merge of the selinux tree with the keys tree
@ 2020-02-11 23:35 Stephen Rothwell
  2020-02-12  2:03 ` Paul Moore
  2020-02-12 12:03 ` Richard Haines
  0 siblings, 2 replies; 8+ messages in thread
From: Stephen Rothwell @ 2020-02-11 23:35 UTC (permalink / raw)
  To: Paul Moore, David Howells
  Cc: Linux Next Mailing List, Linux Kernel Mailing List,
	Richard Haines, Christian Göttsche, Stephen Smalley

[-- Attachment #1: Type: text/plain, Size: 2453 bytes --]

Hi all,

Today's linux-next merge of the selinux tree got conflicts in:

  security/selinux/include/security.h
  security/selinux/ss/services.c

between commit:

  87b14da5b76a ("security/selinux: Add support for new key permissions")

from the keys tree and commit:

  7470d0d13fb6 ("selinux: allow kernfs symlinks to inherit parent directory context")

from the selinux tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

-- 
Cheers,
Stephen Rothwell

diff --cc security/selinux/include/security.h
index 5353cd346433,d6036c018cf2..000000000000
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@@ -79,7 -79,7 +79,8 @@@ enum 
  	POLICYDB_CAPABILITY_ALWAYSNETWORK,
  	POLICYDB_CAPABILITY_CGROUPSECLABEL,
  	POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION,
 +	POLICYDB_CAPABILITY_KEYPERMS,
+ 	POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS,
  	__POLICYDB_CAPABILITY_MAX
  };
  #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
@@@ -210,13 -214,13 +215,20 @@@ static inline bool selinux_policycap_nn
  	return state->policycap[POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION];
  }
  
 +static inline bool selinux_policycap_key_perms(void)
 +{
 +	struct selinux_state *state = &selinux_state;
 +
 +	return state->policycap[POLICYDB_CAPABILITY_KEYPERMS];
 +}
 +
+ static inline bool selinux_policycap_genfs_seclabel_symlinks(void)
+ {
+ 	struct selinux_state *state = &selinux_state;
+ 
+ 	return state->policycap[POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS];
+ }
+ 
  int security_mls_enabled(struct selinux_state *state);
  int security_load_policy(struct selinux_state *state,
  			 void *data, size_t len);
diff --cc security/selinux/ss/services.c
index 7527292fb31a,e310f8ee21a1..000000000000
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@@ -74,7 -73,7 +73,8 @@@ const char *selinux_policycap_names[__P
  	"always_check_network",
  	"cgroup_seclabel",
  	"nnp_nosuid_transition",
- 	"key_perms"
++	"key_perms",
+ 	"genfs_seclabel_symlinks"
  };
  
  static struct selinux_ss selinux_ss;

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: linux-next: manual merge of the selinux tree with the keys tree
  2020-02-11 23:35 linux-next: manual merge of the selinux tree with the keys tree Stephen Rothwell
@ 2020-02-12  2:03 ` Paul Moore
  2020-02-12 12:03 ` Richard Haines
  1 sibling, 0 replies; 8+ messages in thread
From: Paul Moore @ 2020-02-12  2:03 UTC (permalink / raw)
  To: Stephen Rothwell, David Howells, Richard Haines
  Cc: Linux Next Mailing List, Linux Kernel Mailing List,
	Christian Göttsche, Stephen Smalley

On Tue, Feb 11, 2020 at 6:35 PM Stephen Rothwell <sfr@canb.auug.org.au> wrote:
> Hi all,
>
> Today's linux-next merge of the selinux tree got conflicts in:
>
>   security/selinux/include/security.h
>   security/selinux/ss/services.c
>
> between commit:
>
>   87b14da5b76a ("security/selinux: Add support for new key permissions")
>
> from the keys tree and commit:
>
>   7470d0d13fb6 ("selinux: allow kernfs symlinks to inherit parent directory context")
>
> from the selinux tree.

Thanks for bringing this up Stephen, I wasn't aware that patch had hit
the keys tree.

Unless I missed a message in the SELinux mailing list thread regarding
the "security/selinux: Add support for new key permissions" patch, I
thought there were some outstanding questions (well, just a single big
one I guess) that needed to be resolved before this could go upstream;
did you put this in the keys tree David just for some additional
testing, or because you wanted to send it up to Linus via your tree?

If the latter, I would really prefer if this goes to Linus via SELinux
tree as it conflicts with some SELinux ABI changes and I would rather
we handle that in the SELinux tree instead of having to send manual
merge instructions up to Linus during the next merge window.

-- 
paul moore
www.paul-moore.com

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: linux-next: manual merge of the selinux tree with the keys tree
  2020-02-11 23:35 linux-next: manual merge of the selinux tree with the keys tree Stephen Rothwell
  2020-02-12  2:03 ` Paul Moore
@ 2020-02-12 12:03 ` Richard Haines
  2020-02-13 23:02   ` Paul Moore
  1 sibling, 1 reply; 8+ messages in thread
From: Richard Haines @ 2020-02-12 12:03 UTC (permalink / raw)
  To: Stephen Rothwell, Paul Moore, David Howells, sds
  Cc: Linux Next Mailing List, Linux Kernel Mailing List,
	Christian Göttsche, Stephen Smalley

On Wed, 2020-02-12 at 10:35 +1100, Stephen Rothwell wrote:
> Hi all,
> 
> Today's linux-next merge of the selinux tree got conflicts in:
> 
>   security/selinux/include/security.h
>   security/selinux/ss/services.c
> 
> between commit:
> 
>   87b14da5b76a ("security/selinux: Add support for new key
> permissions")
> 
> from the keys tree and commit:
> 
>   7470d0d13fb6 ("selinux: allow kernfs symlinks to inherit parent
> directory context")
> 
> from the selinux tree.
> 
> I fixed it up (see below) and can carry the fix as necessary. This
> is now fixed as far as linux-next is concerned, but any non trivial
> conflicts should be mentioned to your upstream maintainer when your
> tree
> is submitted for merging.  You may also want to consider cooperating
> with the maintainer of the conflicting tree to minimise any
> particularly
> complex conflicts.
> 

I think 87b14da5b76a ("security/selinux: Add support for new key
permissions") should be revoked and resubmitted via selinux as it was
never ack'ed there and produced before 7470d0d13fb6 ("selinux: allow
kernfs symlinks to inherit parent directory context"), that has been
ack'ed.

Because of this the policy capability ids are out of sync with what has
been committed in userspace libsepol.

Plus as Paul mentioned there is an outstanding query on the permission
loop that David needs to answer.




^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: linux-next: manual merge of the selinux tree with the keys tree
  2020-02-12 12:03 ` Richard Haines
@ 2020-02-13 23:02   ` Paul Moore
  0 siblings, 0 replies; 8+ messages in thread
From: Paul Moore @ 2020-02-13 23:02 UTC (permalink / raw)
  To: David Howells
  Cc: Richard Haines, Stephen Rothwell, Stephen Smalley,
	Linux Next Mailing List, Linux Kernel Mailing List,
	Christian Göttsche

On Wed, Feb 12, 2020 at 7:03 AM Richard Haines
<richard_c_haines@btinternet.com> wrote:
> On Wed, 2020-02-12 at 10:35 +1100, Stephen Rothwell wrote:
> > Hi all,
> >
> > Today's linux-next merge of the selinux tree got conflicts in:
> >
> >   security/selinux/include/security.h
> >   security/selinux/ss/services.c
> >
> > between commit:
> >
> >   87b14da5b76a ("security/selinux: Add support for new key
> > permissions")
> >
> > from the keys tree and commit:
> >
> >   7470d0d13fb6 ("selinux: allow kernfs symlinks to inherit parent
> > directory context")
> >
> > from the selinux tree.
> >
> > I fixed it up (see below) and can carry the fix as necessary. This
> > is now fixed as far as linux-next is concerned, but any non trivial
> > conflicts should be mentioned to your upstream maintainer when your
> > tree
> > is submitted for merging.  You may also want to consider cooperating
> > with the maintainer of the conflicting tree to minimise any
> > particularly
> > complex conflicts.
> >
>
> I think 87b14da5b76a ("security/selinux: Add support for new key
> permissions") should be revoked and resubmitted via selinux as it was
> never ack'ed there and produced before 7470d0d13fb6 ("selinux: allow
> kernfs symlinks to inherit parent directory context"), that has been
> ack'ed.
>
> Because of this the policy capability ids are out of sync with what has
> been committed in userspace libsepol.
>
> Plus as Paul mentioned there is an outstanding query on the permission
> loop that David needs to answer.

David, I see that this patch is still getting pulled into linux-next,
could you please revert it from your keys tree?

-- 
paul moore
www.paul-moore.com

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: linux-next: manual merge of the selinux tree with the keys tree
  2020-01-29  1:25 ` Stephen Rothwell
@ 2020-01-29  2:28   ` Paul Moore
  0 siblings, 0 replies; 8+ messages in thread
From: Paul Moore @ 2020-01-29  2:28 UTC (permalink / raw)
  To: Stephen Rothwell
  Cc: David Howells, Linux Next Mailing List,
	Linux Kernel Mailing List, Stephen Smalley, James Morris,
	Casey Schaufler

On Tue, Jan 28, 2020 at 8:25 PM Stephen Rothwell <sfr@canb.auug.org.au> wrote:
> Hi all,

Hello.

> > I fixed it up (see below) and can carry the fix as necessary. This
> > is now fixed as far as linux-next is concerned, but any non trivial
> > conflicts should be mentioned to your upstream maintainer when your tree
> > is submitted for merging.  You may also want to consider cooperating
> > with the maintainer of the conflicting tree to minimise any particularly
> > complex conflicts.
> >
> > --
> > Cheers,
> > Stephen Rothwell
> >
> > diff --cc include/linux/lsm_audit.h
> > index 734d67889826,99d629fd9944..000000000000
> > --- a/include/linux/lsm_audit.h
> > +++ b/include/linux/lsm_audit.h
> > @@@ -74,7 -74,7 +74,8 @@@ struct common_audit_data
> >   #define LSM_AUDIT_DATA_FILE 12
> >   #define LSM_AUDIT_DATA_IBPKEY       13
> >   #define LSM_AUDIT_DATA_IBENDPORT 14
> >  -#define LSM_AUDIT_DATA_LOCKDOWN 15
> >  +#define LSM_AUDIT_DATA_NOTIFICATION 15
> > ++#define LSM_AUDIT_DATA_LOCKDOWN 16
> >       union   {
> >               struct path path;
> >               struct dentry *dentry;
>
> This is now a conflict between the keys tree and Linus' tree.

Presumably it basically the same as above?  If so, it should be okay
to renumber the LSM_AUDIT_DATA_xxx defines as needed, they aren't
visible to userspace in any way, and really shouldn't be visible
outside of security/.

-- 
paul moore
www.paul-moore.com

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: linux-next: manual merge of the selinux tree with the keys tree
  2019-12-09 23:50 Stephen Rothwell
  2019-12-09 23:55 ` Paul Moore
@ 2020-01-29  1:25 ` Stephen Rothwell
  2020-01-29  2:28   ` Paul Moore
  1 sibling, 1 reply; 8+ messages in thread
From: Stephen Rothwell @ 2020-01-29  1:25 UTC (permalink / raw)
  To: David Howells
  Cc: Paul Moore, Linux Next Mailing List, Linux Kernel Mailing List,
	Stephen Smalley, James Morris, Casey Schaufler

[-- Attachment #1: Type: text/plain, Size: 1513 bytes --]

Hi all,

On Tue, 10 Dec 2019 10:50:37 +1100 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> Today's linux-next merge of the selinux tree got a conflict in:
> 
>   include/linux/lsm_audit.h
> 
> between commit:
> 
>   59336b0f8000 ("smack: Implement the watch_key and post_notification hooks")
> 
> from the keys tree and commit:
> 
>   59438b46471a ("security,lockdown,selinux: implement SELinux lockdown")
> 
> from the selinux tree.
> 
> I fixed it up (see below) and can carry the fix as necessary. This
> is now fixed as far as linux-next is concerned, but any non trivial
> conflicts should be mentioned to your upstream maintainer when your tree
> is submitted for merging.  You may also want to consider cooperating
> with the maintainer of the conflicting tree to minimise any particularly
> complex conflicts.
> 
> -- 
> Cheers,
> Stephen Rothwell
> 
> diff --cc include/linux/lsm_audit.h
> index 734d67889826,99d629fd9944..000000000000
> --- a/include/linux/lsm_audit.h
> +++ b/include/linux/lsm_audit.h
> @@@ -74,7 -74,7 +74,8 @@@ struct common_audit_data 
>   #define LSM_AUDIT_DATA_FILE	12
>   #define LSM_AUDIT_DATA_IBPKEY	13
>   #define LSM_AUDIT_DATA_IBENDPORT 14
>  -#define LSM_AUDIT_DATA_LOCKDOWN 15
>  +#define LSM_AUDIT_DATA_NOTIFICATION 15
> ++#define LSM_AUDIT_DATA_LOCKDOWN 16
>   	union 	{
>   		struct path path;
>   		struct dentry *dentry;

This is now a conflict between the keys tree and Linus' tree.

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: linux-next: manual merge of the selinux tree with the keys tree
  2019-12-09 23:50 Stephen Rothwell
@ 2019-12-09 23:55 ` Paul Moore
  2020-01-29  1:25 ` Stephen Rothwell
  1 sibling, 0 replies; 8+ messages in thread
From: Paul Moore @ 2019-12-09 23:55 UTC (permalink / raw)
  To: Stephen Rothwell
  Cc: David Howells, Linux Next Mailing List,
	Linux Kernel Mailing List, Stephen Smalley, James Morris,
	Casey Schaufler

On Mon, Dec 9, 2019 at 6:50 PM Stephen Rothwell <sfr@canb.auug.org.au> wrote:
> Hi all,
>
> Today's linux-next merge of the selinux tree got a conflict in:
>
>   include/linux/lsm_audit.h
>
> between commit:
>
>   59336b0f8000 ("smack: Implement the watch_key and post_notification hooks")
>
> from the keys tree and commit:
>
>   59438b46471a ("security,lockdown,selinux: implement SELinux lockdown")
>
> from the selinux tree.
>
> I fixed it up (see below) and can carry the fix as necessary. This
> is now fixed as far as linux-next is concerned, but any non trivial
> conflicts should be mentioned to your upstream maintainer when your tree
> is submitted for merging.  You may also want to consider cooperating
> with the maintainer of the conflicting tree to minimise any particularly
> complex conflicts.
>
> --
> Cheers,
> Stephen Rothwell
>
> diff --cc include/linux/lsm_audit.h
> index 734d67889826,99d629fd9944..000000000000
> --- a/include/linux/lsm_audit.h
> +++ b/include/linux/lsm_audit.h
> @@@ -74,7 -74,7 +74,8 @@@ struct common_audit_data
>   #define LSM_AUDIT_DATA_FILE   12
>   #define LSM_AUDIT_DATA_IBPKEY 13
>   #define LSM_AUDIT_DATA_IBENDPORT 14
>  -#define LSM_AUDIT_DATA_LOCKDOWN 15
>  +#define LSM_AUDIT_DATA_NOTIFICATION 15
> ++#define LSM_AUDIT_DATA_LOCKDOWN 16
>         union   {
>                 struct path path;
>                 struct dentry *dentry;

That should be fine, thanks.

-- 
paul moore
www.paul-moore.com

^ permalink raw reply	[flat|nested] 8+ messages in thread

* linux-next: manual merge of the selinux tree with the keys tree
@ 2019-12-09 23:50 Stephen Rothwell
  2019-12-09 23:55 ` Paul Moore
  2020-01-29  1:25 ` Stephen Rothwell
  0 siblings, 2 replies; 8+ messages in thread
From: Stephen Rothwell @ 2019-12-09 23:50 UTC (permalink / raw)
  To: Paul Moore, David Howells
  Cc: Linux Next Mailing List, Linux Kernel Mailing List,
	Stephen Smalley, James Morris, Casey Schaufler

[-- Attachment #1: Type: text/plain, Size: 1250 bytes --]

Hi all,

Today's linux-next merge of the selinux tree got a conflict in:

  include/linux/lsm_audit.h

between commit:

  59336b0f8000 ("smack: Implement the watch_key and post_notification hooks")

from the keys tree and commit:

  59438b46471a ("security,lockdown,selinux: implement SELinux lockdown")

from the selinux tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

-- 
Cheers,
Stephen Rothwell

diff --cc include/linux/lsm_audit.h
index 734d67889826,99d629fd9944..000000000000
--- a/include/linux/lsm_audit.h
+++ b/include/linux/lsm_audit.h
@@@ -74,7 -74,7 +74,8 @@@ struct common_audit_data 
  #define LSM_AUDIT_DATA_FILE	12
  #define LSM_AUDIT_DATA_IBPKEY	13
  #define LSM_AUDIT_DATA_IBENDPORT 14
 -#define LSM_AUDIT_DATA_LOCKDOWN 15
 +#define LSM_AUDIT_DATA_NOTIFICATION 15
++#define LSM_AUDIT_DATA_LOCKDOWN 16
  	union 	{
  		struct path path;
  		struct dentry *dentry;

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, back to index

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-02-11 23:35 linux-next: manual merge of the selinux tree with the keys tree Stephen Rothwell
2020-02-12  2:03 ` Paul Moore
2020-02-12 12:03 ` Richard Haines
2020-02-13 23:02   ` Paul Moore
  -- strict thread matches above, loose matches on Subject: below --
2019-12-09 23:50 Stephen Rothwell
2019-12-09 23:55 ` Paul Moore
2020-01-29  1:25 ` Stephen Rothwell
2020-01-29  2:28   ` Paul Moore

Linux-Next Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-next/0 linux-next/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-next linux-next/ https://lore.kernel.org/linux-next \
		linux-next@vger.kernel.org
	public-inbox-index linux-next

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-next


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git