1. 01 Aug, 2016 9 commits
  2. 31 Jul, 2016 26 commits
  3. 30 Jul, 2016 2 commits
    • Linus Torvalds's avatar
      Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit · 797cee98
      Linus Torvalds authored
      Pull audit updates from Paul Moore:
       "Six audit patches for 4.8.
      
        There are a couple of style and minor whitespace tweaks for the logs,
        as well as a minor fixup to catch errors on user filter rules, however
        the major improvements are a fix to the s390 syscall argument masking
        code (reviewed by the nice s390 folks), some consolidation around the
        exclude filtering (less code, always a win), and a double-fetch fix
        for recording the execve arguments"
      
      * 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit:
        audit: fix a double fetch in audit_log_single_execve_arg()
        audit: fix whitespace in CWD record
        audit: add fields to exclude filter by reusing user filter
        s390: ensure that syscall arguments are properly masked on s390
        audit: fix some horrible switch statement style crimes
        audit: fixup: log on errors from filter user rules
      797cee98
    • Linus Torvalds's avatar
      Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security · 7a1e8b80
      Linus Torvalds authored
      Pull security subsystem updates from James Morris:
       "Highlights:
      
         - TPM core and driver updates/fixes
         - IPv6 security labeling (CALIPSO)
         - Lots of Apparmor fixes
         - Seccomp: remove 2-phase API, close hole where ptrace can change
           syscall #"
      
      * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (156 commits)
        apparmor: fix SECURITY_APPARMOR_HASH_DEFAULT parameter handling
        tpm: Add TPM 2.0 support to the Nuvoton i2c driver (NPCT6xx family)
        tpm: Factor out common startup code
        tpm: use devm_add_action_or_reset
        tpm2_i2c_nuvoton: add irq validity check
        tpm: read burstcount from TPM_STS in one 32-bit transaction
        tpm: fix byte-order for the value read by tpm2_get_tpm_pt
        tpm_tis_core: convert max timeouts from msec to jiffies
        apparmor: fix arg_size computation for when setprocattr is null terminated
        apparmor: fix oops, validate buffer size in apparmor_setprocattr()
        apparmor: do not expose kernel stack
        apparmor: fix module parameters can be changed after policy is locked
        apparmor: fix oops in profile_unpack() when policy_db is not present
        apparmor: don't check for vmalloc_addr if kvzalloc() failed
        apparmor: add missing id bounds check on dfa verification
        apparmor: allow SYS_CAP_RESOURCE to be sufficient to prlimit another task
        apparmor: use list_next_entry instead of list_entry_next
        apparmor: fix refcount race when finding a child profile
        apparmor: fix ref count leak when profile sha1 hash is read
        apparmor: check that xindex is in trans_table bounds
        ...
      7a1e8b80
  4. 29 Jul, 2016 3 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace · a867d734
      Linus Torvalds authored
      Pull userns vfs updates from Eric Biederman:
       "This tree contains some very long awaited work on generalizing the
        user namespace support for mounting filesystems to include filesystems
        with a backing store.  The real world target is fuse but the goal is
        to update the vfs to allow any filesystem to be supported.  This
        patchset is based on a lot of code review and testing to approach that
        goal.
      
        While looking at what is needed to support the fuse filesystem it
        became clear that there were things like xattrs for security modules
        that needed special treatment.  That the resolution of those concerns
        would not be fuse specific.  That sorting out these general issues
        made most sense at the generic level, where the right people could be
        drawn into the conversation, and the issues could be solved for
        everyone.
      
        At a high level what this patchset does a couple of simple things:
      
         - Add a user namespace owner (s_user_ns) to struct super_block.
      
         - Teach the vfs to handle filesystem uids and gids not mapping into
           to kuids and kgids and being reported as INVALID_UID and
           INVALID_GID in vfs data structures.
      
        By assigning a user namespace owner filesystems that are mounted with
        only user namespace privilege can be detected.  This allows security
        modules and the like to know which mounts may not be trusted.  This
        also allows the set of uids and gids that are communicated to the
        filesystem to be capped at the set of kuids and kgids that are in the
        owning user namespace of the filesystem.
      
        One of the crazier corner casees this handles is the case of inodes
        whose i_uid or i_gid are not mapped into the vfs.  Most of the code
        simply doesn't care but it is easy to confuse the inode writeback path
        so no operation that could cause an inode write-back is permitted for
        such inodes (aka only reads are allowed).
      
        This set of changes starts out by cleaning up the code paths involved
        in user namespace permirted mounts.  Then when things are clean enough
        adds code that cleanly sets s_user_ns.  Then additional restrictions
        are added that are possible now that the filesystem superblock
        contains owner information.
      
        These changes should not affect anyone in practice, but there are some
        parts of these restrictions that are changes in behavior.
      
         - Andy's restriction on suid executables that does not honor the
           suid bit when the path is from another mount namespace (think
           /proc/[pid]/fd/) or when the filesystem was mounted by a less
           privileged user.
      
         - The replacement of the user namespace implicit setting of MNT_NODEV
           with implicitly setting SB_I_NODEV on the filesystem superblock
           instead.
      
           Using SB_I_NODEV is a stronger form that happens to make this state
           user invisible.  The user visibility can be managed but it caused
           problems when it was introduced from applications reasonably
           expecting mount flags to be what they were set to.
      
        There is a little bit of work remaining before it is safe to support
        mounting filesystems with backing store in user namespaces, beyond
        what is in this set of changes.
      
         - Verifying the mounter has permission to read/write the block device
           during mount.
      
         - Teaching the integrity modules IMA and EVM to handle filesystems
           mounted with only user namespace root and to reduce trust in their
           security xattrs accordingly.
      
         - Capturing the mounters credentials and using that for permission
           checks in d_automount and the like.  (Given that overlayfs already
           does this, and we need the work in d_automount it make sense to
           generalize this case).
      
        Furthermore there are a few changes that are on the wishlist:
      
         - Get all filesystems supporting posix acls using the generic posix
           acls so that posix_acl_fix_xattr_from_user and
           posix_acl_fix_xattr_to_user may be removed.  [Maintainability]
      
         - Reducing the permission checks in places such as remount to allow
           the superblock owner to perform them.
      
         - Allowing the superblock owner to chown files with unmapped uids and
           gids to something that is mapped so the files may be treated
           normally.
      
        I am not considering even obvious relaxations of permission checks
        until it is clear there are no more corner cases that need to be
        locked down and handled generically.
      
        Many thanks to Seth Forshee who kept this code alive, and putting up
        with me rewriting substantial portions of what he did to handle more
        corner cases, and for his diligent testing and reviewing of my
        changes"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (30 commits)
        fs: Call d_automount with the filesystems creds
        fs: Update i_[ug]id_(read|write) to translate relative to s_user_ns
        evm: Translate user/group ids relative to s_user_ns when computing HMAC
        dquot: For now explicitly don't support filesystems outside of init_user_ns
        quota: Handle quota data stored in s_user_ns in quota_setxquota
        quota: Ensure qids map to the filesystem
        vfs: Don't create inodes with a uid or gid unknown to the vfs
        vfs: Don't modify inodes with a uid or gid unknown to the vfs
        cred: Reject inodes with invalid ids in set_create_file_as()
        fs: Check for invalid i_uid in may_follow_link()
        vfs: Verify acls are valid within superblock's s_user_ns.
        userns: Handle -1 in k[ug]id_has_mapping when !CONFIG_USER_NS
        fs: Refuse uid/gid changes which don't map into s_user_ns
        selinux: Add support for unprivileged mounts from user namespaces
        Smack: Handle labels consistently in untrusted mounts
        Smack: Add support for unprivileged mounts from user namespaces
        fs: Treat foreign mounts as nosuid
        fs: Limit file caps to the user namespace of the super block
        userns: Remove the now unnecessary FS_USERNS_DEV_MOUNT flag
        userns: Remove implicit MNT_NODEV fragility.
        ...
      a867d734
    • Linus Torvalds's avatar
      Merge tag 'pm-urgent-4.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 601f887d
      Linus Torvalds authored
      Pull power management fix from Rafael Wysocki:
       "Fix a nasty (and really hard to debug) memory corruption during resume
        from hibernation on x86-64 (that leads to a kernel panic most of the
        time) due to the use of a stale stack pointer value in FRAME_BEGIN
        (Josh Poimboeuf)"
      
      * tag 'pm-urgent-4.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        x86/power/64: Fix hibernation return address corruption
      601f887d
    • Linus Torvalds's avatar
      Merge branch 'for-4.7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup · 574c7e23
      Linus Torvalds authored
      Pull more cgroup updates from Tejun Heo:
       "I forgot to include the patches which got applied to for-4.7-fixes
        late during last cycle.
      
        Eric's three patches fix bugs introduced with the namespace support"
      
      * 'for-4.7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
        cgroupns: Only allow creation of hierarchies in the initial cgroup namespace
        cgroupns: Close race between cgroup_post_fork and copy_cgroup_ns
        cgroupns: Fix the locking in copy_cgroup_ns
      574c7e23