797 |
I was using PAGE_SIZE (4096 in many environments) |
I was using PAGE_SIZE (4096 in many environments) |
798 |
as the max length of any string data. |
as the max length of any string data. |
799 |
But for environments that have larger PAGE_SIZE, |
But for environments that have larger PAGE_SIZE, |
800 |
doing memset(ptr, 0, PAGE_SIZE) everytime is too wasteful. |
doing memset(ptr, 0, PAGE_SIZE) every time is too wasteful. |
801 |
|
|
802 |
Fix 2007/01/29 |
Fix 2007/01/29 |
803 |
|
|
2854 |
"<kernel>" + "/foo/\" + "/bar" was by error checked when |
"<kernel>" + "/foo/\" + "/bar" was by error checked when |
2855 |
"<kernel> /foo/\* /bar" was given. As a result, legal domainnames like |
"<kernel> /foo/\* /bar" was given. As a result, legal domainnames like |
2856 |
"<kernel> /foo/\* /bar" are rejected. |
"<kernel> /foo/\* /bar" are rejected. |
2857 |
|
|
2858 |
|
Fix 2011/06/06 |
2859 |
|
|
2860 |
|
@ Add policy namespace support. |
2861 |
|
|
2862 |
|
To be able to use TOMOYO in LXC environments, I introduced policy |
2863 |
|
namespace. Each policy namespace has its own set of domain policy, |
2864 |
|
exception policy and profiles, which are all independent of other |
2865 |
|
namespaces. |
2866 |
|
|
2867 |
|
@ Remove CONFIG_CCSECURITY_BUILTIN_INITIALIZERS option. |
2868 |
|
|
2869 |
|
From now on, exception policy and manager need to be able to handle |
2870 |
|
policy namespace (which is a <$namespace> prefix added to each line). |
2871 |
|
Thus, space-separated list for CONFIG_CCSECURITY_BUILTIN_INITIALIZERS is |
2872 |
|
no longer suitable for handling policy namespace. |
2873 |
|
|
2874 |
|
Fix 2011/06/10 |
2875 |
|
|
2876 |
|
@ Allow specifying trigger for activation. |
2877 |
|
|
2878 |
|
To be able to use TOMOYO under systemd environments where init= parameter |
2879 |
|
is used, I changed to allow overriding the trigger for calling external |
2880 |
|
policy loader and activating MAC via kernel command line options. |
2881 |
|
|
2882 |
|
Fix 2011/06/14 |
2883 |
|
|
2884 |
|
@ Remove unused "struct inode *" parameter from ccs-patch-\*.diff . |
2885 |
|
|
2886 |
|
To follow changes I made on 2011/04/20, I removed "struct inode *" from |
2887 |
|
ccs_mknod_permission(), ccs_mkdir_permission(), ccs_rmdir_permission(), |
2888 |
|
ccs_unlink_permission(), ccs_symlink_permission(), ccs_link_permission(), |
2889 |
|
ccs_rename_permission() that are called from fs/namei.c |
2890 |
|
net/unix/af_unix.c include/linux/security.c security/security.c . |
2891 |
|
If you have your own ccs-patch-*.diff , please update accordingly. |
2892 |
|
|
2893 |
|
Version 1.8.2 2011/06/20 Usability enhancement release. |
2894 |
|
|
2895 |
|
Fix 2011/07/07 |
2896 |
|
|
2897 |
|
@ Remove /proc/ccs/.domain_status interface. |
2898 |
|
|
2899 |
|
Writing to /proc/ccs/.domain_status can be emulated by |
2900 |
|
|
2901 |
|
( echo "select " $domainname; echo "use_profile " $profile ) | |
2902 |
|
/usr/sbin/ccs-loadpolicy -d |
2903 |
|
|
2904 |
|
and reading from /proc/ccs/.domain_status can be emulated by |
2905 |
|
|
2906 |
|
grep -A 1 '^<' /proc/ccs/domain_policy | |
2907 |
|
awk ' { if ( domainname == "" ) { if ( substr($1, 1, 1) == "<" ) |
2908 |
|
domainname = $0; } else if ( $1 == "use_profile" ) { |
2909 |
|
print $2 " " domainname; domainname = ""; } } ; ' |
2910 |
|
|
2911 |
|
. Since this interface is used by only /usr/sbin/ccs-setprofile , |
2912 |
|
remove this interface by updating /usr/sbin/ccs-setprofile . |
2913 |
|
|
2914 |
|
Fix 2011/07/09 |
2915 |
|
|
2916 |
|
@ Fix /proc/ccs/stat parser. |
2917 |
|
|
2918 |
|
For optimization, I changed to use simple_strtoul() rather than sscanf() |
2919 |
|
in ccs_write_stat(). But it caused parsing failure if space is inserted |
2920 |
|
before value (e.g. "Memory used by policy: $value"). |
2921 |
|
|
2922 |
|
Fix 2011/07/13 |
2923 |
|
|
2924 |
|
@ Accept "::" notation for IPv6 address. |
2925 |
|
|
2926 |
|
In order to add network access restriction to TOMOYO 2.4, I backported |
2927 |
|
routines for parsing/printing IPv4/IPv6 address from kernel 3.0 into |
2928 |
|
TOMOYO 1.8.2. |
2929 |
|
Now, IPv6 address accepts "::1" instead of "0:0:0:0:0:0:0:1". |
2930 |
|
|
2931 |
|
Fix 2011/09/03 |
2932 |
|
|
2933 |
|
@ Avoid race when retrying "file execute" permission check. |
2934 |
|
|
2935 |
|
There was a race window that the pathname which is subjected to |
2936 |
|
"file execute" permission check when retrying via supervisor's decision |
2937 |
|
because the pathname was recalculated upon retry. Though, there is an |
2938 |
|
inevitable race window even without supervisor, for we have to calculate |
2939 |
|
the symbolic link's pathname from "struct linux_binprm"->filename rather |
2940 |
|
than from "struct linux_binprm"->file because we cannot back calculate |
2941 |
|
the symbolic link's pathname from the dereferenced pathname. |
2942 |
|
|
2943 |
|
@ Remove unneeded daemonize(). |
2944 |
|
|
2945 |
|
Garbage collector thread is created using kthread_create() since 2.6.7. |
2946 |
|
Kernel threads created by kthread_create() does not need to call |
2947 |
|
daemonize(). |
2948 |
|
|
2949 |
|
Fix 2011/09/16 |
2950 |
|
|
2951 |
|
@ Allow specifying domain transition preference. |
2952 |
|
|
2953 |
|
I got an opinion that it is difficult to use exception policy's domain |
2954 |
|
transition control directives because they need to match the pathname |
2955 |
|
specified to "file execute" directives. For example, if "file execute |
2956 |
|
/bin/\*\-ls\-cat" is given, corresponding domain transition control |
2957 |
|
directive needs to be like "no_keep_domain /bin/\*\-ls\-cat from any". |
2958 |
|
|
2959 |
|
To solve this difficulty, I introduced optional argument that supersedes |
2960 |
|
exception policy's domain transition control directives. |
2961 |
|
|
2962 |
|
file execute /bin/ls keep exec.realpath="/bin/ls" exec.argv[0]="ls" |
2963 |
|
file execute /bin/cat keep exec.realpath="/bin/cat" exec.argv[0]="cat" |
2964 |
|
file execute /bin/\*\-ls\-cat child |
2965 |
|
file execute /usr/sbin/httpd <apache> exec.realpath="/usr/sbin/httpd" exec.argv[0]="/usr/sbin/httpd" |
2966 |
|
|
2967 |
|
This argument allows transition to different domains based on conditions. |
2968 |
|
|
2969 |
|
<kernel> /usr/sbin/sshd |
2970 |
|
file execute /bin/bash <kernel> /usr/sbin/sshd //batch-session exec.argc=2 exec.argv[1]="-c" |
2971 |
|
file execute /bin/bash <kernel> /usr/sbin/sshd //root-session task.uid=0 |
2972 |
|
file execute /bin/bash <kernel> /usr/sbin/sshd //nonroot-session task.uid!=0 |
2973 |
|
|
2974 |
|
Fix 2011/09/25 |
2975 |
|
|
2976 |
|
@ Simplify garbage collector. |
2977 |
|
|
2978 |
|
It turned out that use of batched processing tends to choke garbage |
2979 |
|
collector when certain pattern of entries are queued. Thus, I replaced it |
2980 |
|
with sequential processing. |
2981 |
|
|
2982 |
|
Version 1.8.3 2011/09/29 Usability enhancement release. |
2983 |
|
|
2984 |
|
Fix 2011/10/24 |
2985 |
|
|
2986 |
|
@ Fix incomplete read after seek. |
2987 |
|
|
2988 |
|
ccs_flush() tries to flush data to be read as soon as possible. |
2989 |
|
ccs_select_domain() (which is called by write()) enqueues data which |
2990 |
|
meant to be read by next read(), but previous read()'s read buffer's |
2991 |
|
size was not cleared. As a result, since 1.8.0, sequence like |
2992 |
|
|
2993 |
|
char *cp = "select global-pid=1\n"; |
2994 |
|
read(fd, buf1, sizeof(buf1)); |
2995 |
|
write(fd, cp, strlen(cp)); |
2996 |
|
read(fd, buf2, sizeof(buf2)); |
2997 |
|
|
2998 |
|
causes enqueued data to be flushed to buf1 rather than buf2. |
2999 |
|
|
3000 |
|
@ Use query id for reaching target process's domain policy. |
3001 |
|
|
3002 |
|
Use query id for reaching target process's domain policy rather than |
3003 |
|
target process's global PID. This is for synchronizing with TOMOYO 2.x, |
3004 |
|
but this change makes /usr/sbin/ccs-queryd more reliable because the |
3005 |
|
kernel will return empty domain policy when the query has expired before |
3006 |
|
ccs-queryd reaches target process's domain policy. |
3007 |
|
|
3008 |
|
@ Fix quota counting. |
3009 |
|
|
3010 |
|
"task manual_domain_transition" should not be counted for quota as with |
3011 |
|
"task auto_domain_transition"/"task auto_execute_handler"/ |
3012 |
|
"task denied_execute_handler" because these are not appended by learning |
3013 |
|
mode. |
3014 |
|
|
3015 |
|
Fix 2011/11/11 |
3016 |
|
|
3017 |
|
@ Optimize for object's size. |
3018 |
|
|
3019 |
|
I rearranged functions/variables into three groups in order to reduce |
3020 |
|
object's filesize. Also, I added kernel config options for reducing more |
3021 |
|
by excluding unnecessary functionality. |
3022 |
|
|
3023 |
|
Fix 2011/11/18 |
3024 |
|
|
3025 |
|
@ Fix kernel config mapping error. |
3026 |
|
|
3027 |
|
Due to a typo in ccs_p2mac definition, mode for CONFIG::file::execute was |
3028 |
|
by error used when checking "file getattr" permission. Most users will |
3029 |
|
not be affected by this error because CONFIG::file::execute and |
3030 |
|
CONFIG::file::getattr are by default configured to use CONFIG::file or |
3031 |
|
CONFIG settings. |
3032 |
|
|
3033 |
|
Fix 2011/12/13 |
3034 |
|
|
3035 |
|
@ Follow __d_path() behavior change. (Only 2.6.36 and later) |
3036 |
|
|
3037 |
|
The behavior of __d_path() has changed in 3.2-rc5. __d_path() now returns |
3038 |
|
NULL when the pathname cannot be calculated. You must update to this |
3039 |
|
version when using with 3.2-rc5 and later kernels, or the kernel will |
3040 |
|
panic because ccs_get_absolute_path() triggers NULL pointer dereference. |
3041 |
|
|
3042 |
|
The patch that changed the behavior of __d_path() might be backported to |
3043 |
|
2.6.36 to 3.1 kernels. You must update to this version if the patch was |
3044 |
|
backported, or you will experience the kernel panic as with 3.2-rc5. |
3045 |
|
|
3046 |
|
The patch that changed the behavior of __d_path() also changed the way of |
3047 |
|
handling pathnames under lazy-unmounted directory. Until now, TOMOYO was |
3048 |
|
using incomplete pathnames returned by __d_path() when the pathname is |
3049 |
|
under lazy-unmounted directory. But from now on, TOMOYO uses different |
3050 |
|
pathnames returned by ccs_get_local_path() when the pathname is under |
3051 |
|
lazy-unmounted directory (because __d_path() no longer returns it). |
3052 |
|
|
3053 |
|
Since applications unlikely do lazy unmounts, requesting pathnames under |
3054 |
|
lazy-unmounted directory should not happen unless the administrator |
3055 |
|
explicitly does lazy unmounts. But pathnames which is defined for such |
3056 |
|
conditions in the policy file (if any) will need to be rewritten. |
3057 |
|
|
3058 |
|
Fix 2012/01/20 |
3059 |
|
|
3060 |
|
@ Follow changes in 3.3-rc1. |
3061 |
|
|
3062 |
|
Use umode_t rather than mode_t. |
3063 |
|
Remove ipv6_addr_copy() usage. |
3064 |
|
|
3065 |
|
Fix 2012/02/25 |
3066 |
|
|
3067 |
|
@ Follow changes in linux-next. |
3068 |
|
|
3069 |
|
UMH_WAIT_PROC constant (currently 1) is scheduled for renumbering in 3.4. |
3070 |
|
|
3071 |
|
Use UMH_WAIT_PROC constant instead of hardcoded constant in preparation |
3072 |
|
for backporting call_usermodehelper() related changes. If renumbering was |
3073 |
|
backported, you will start experiencing the kernel panic upon execution |
3074 |
|
of external policy loader (i.e. /sbin/ccs-init), for the kernel will no |
3075 |
|
longer wait for completion of external policy loader process. |
3076 |
|
|
3077 |
|
Although I changed to use UMH_WAIT_PROC constant, this change could fail |
3078 |
|
to detect renumbering in 2.6.22 and earlier kernels, for UMH_WAIT_PROC |
3079 |
|
constant is currently available to only 2.6.23 and later kernels. If you |
3080 |
|
started to experience the kernel panic, please check whether renumbering |
3081 |
|
was backported or not. |
3082 |
|
|
3083 |
|
Fix 2012/02/29 |
3084 |
|
|
3085 |
|
@ Fix mount flags checking order. |
3086 |
|
|
3087 |
|
Userspace can pass in arbitrary combinations of MS_* flags to mount(). |
3088 |
|
|
3089 |
|
If both MS_BIND and one of MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE |
3090 |
|
are passed, device name which should be checked for MS_BIND was not |
3091 |
|
checked because MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE had higher |
3092 |
|
priority than MS_BIND. |
3093 |
|
|
3094 |
|
If both one of MS_BIND/MS_MOVE and MS_REMOUNT are passed, device name |
3095 |
|
which should not be checked for MS_REMOUNT was checked because MS_BIND/ |
3096 |
|
MS_MOVE had higher priority than MS_REMOUNT. |
3097 |
|
|
3098 |
|
Fix these bugs by changing priority to MS_REMOUNT -> MS_BIND -> |
3099 |
|
MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE -> MS_MOVE as with do_mount() |
3100 |
|
does. Also, I changed to unconditionally return -EINVAL if more than one |
3101 |
|
of MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE is passed so that TOMOYO |
3102 |
|
will not generate inaccurate audit logs, for commit 7a2e8a8f "VFS: Sanity |
3103 |
|
check mount flags passed to change_mnt_propagation()" clarified that |
3104 |
|
these flags must be exclusively passed. |
3105 |
|
|
3106 |
|
Fix 2012/03/08 |
3107 |
|
|
3108 |
|
@ Allow returning other errors when ptrace permission cannot be checked. |
3109 |
|
|
3110 |
|
Currently -EPERM is returned when ccs_ptrace_permission() returned an |
3111 |
|
error code. I changed to return return value from ccs_ptrace_permission() |
3112 |
|
so that we can return -ESRCH when target process was not found. |
3113 |
|
|
3114 |
|
Fix 2012/03/16 |
3115 |
|
|
3116 |
|
@ Return appropriate value to poll(). |
3117 |
|
|
3118 |
|
Return POLLIN | POLLRDNORM | POLLOUT | POLLWRNORM if ready to read/write, |
3119 |
|
POLLOUT | POLLWRNORM otherwise. |
3120 |
|
|
3121 |
|
Fix 2012/04/22 |
3122 |
|
|
3123 |
|
@ Readd RHEL_MINOR/AX_MINOR checks. |
3124 |
|
|
3125 |
|
This check was added in revision 3741 and was removed in revision 4084. |
3126 |
|
|
3127 |
|
Add it back in order to support RHEL 5.0, 5.1, 5.2 kernels. |
3128 |
|
|
3129 |
|
@ Fix skb_kill_datagram() for kernels 2.6.0 - 2.6.11. |
3130 |
|
|
3131 |
|
Commit 208d8984 "[IPV4]: Fix BUG() in 2.6.x, udp_poll(), fragments + |
3132 |
|
CONFIG_HIGHMEM" clarified that skb_kill_datagram() should use |
3133 |
|
spin_lock_bh()/spin_unlock_bh() rather than |
3134 |
|
spin_lock_irq()/spin_unlock_irq(). |
3135 |
|
|
3136 |
|
RHEL 4.9 (2.6.9) kernel has that patch backported. So do I. |
3137 |
|
|
3138 |
|
@ Fix missing locks for RHEL 5.2-5.8 kernels. |
3139 |
|
|
3140 |
|
Since RHEL 5.2 and later kernels have backported commit 95766fff |
3141 |
|
"[UDP]: Add memory accounting." patch, TOMOYO needs to call |
3142 |
|
lock_sock()/release_sock() around skb_kill_datagram() call when UDP |
3143 |
|
packet was dropped by TOMOYO. |