linux-stable.git/security, branch linux-2.6.39.y

KEYS: Fix error handling in construct_key_and_link()

2011-07-09T06:15:27+00:00

commit b1d7dd80aadb9042e83f9778b484a2f92e0b04d4 upstream.

Fix error handling in construct_key_and_link().

If construct_alloc_key() returns an error, it shouldn't pass out through
the normal path as the key_serial() called by the kleave() statement
will oops when it gets an error code in the pointer:

  BUG: unable to handle kernel paging request at ffffffffffffff84
  IP: [] request_key_and_link+0x4d7/0x52f
  ..
  Call Trace:
   [] request_key+0x41/0x75
   [] cifs_get_spnego_key+0x206/0x226 [cifs]
   [] CIFS_SessSetup+0x511/0x1234 [cifs]
   [] cifs_setup_session+0x90/0x1ae [cifs]
   [] cifs_get_smb_ses+0x34b/0x40f [cifs]
   [] cifs_mount+0x13f/0x504 [cifs]
   [] cifs_do_mount+0xc4/0x672 [cifs]
   [] mount_fs+0x69/0x155
   [] vfs_kern_mount+0x63/0xa0
   [] do_kern_mount+0x4d/0xdf
   [] do_mount+0x63c/0x69f
   [] sys_mount+0x88/0xc2
   [] system_call_fastpath+0x16/0x1b

Signed-off-by: David Howells 
Acked-by: Jeff Layton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

TOMOYO: Fix oops in tomoyo_mount_acl().

2011-06-23T22:05:40+00:00

commit 4e78c724d47e2342aa8fde61f6b8536f662f795f upstream.

In tomoyo_mount_acl() since 2.6.36, kern_path() was called without checking
dev_name != NULL. As a result, an unprivileged user can trigger oops by issuing
mount(NULL, "/", "ext3", 0, NULL) request.
Fix this by checking dev_name != NULL before calling kern_path(dev_name).

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

AppArmor: Fix sleep in invalid context from task_setrlimit

2011-06-23T22:05:38+00:00

commit 1780f2d3839a0d3eb85ee014a708f9e2c8f8ba0e upstream.

Affected kernels 2.6.36 - 3.0

AppArmor may do a GFP_KERNEL memory allocation with task_lock(tsk->group_leader);
held when called from security_task_setrlimit.  This will only occur when the
task's current policy has been replaced, and the task's creds have not been
updated before entering the LSM security_task_setrlimit() hook.

BUG: sleeping function called from invalid context at mm/slub.c:847
 in_atomic(): 1, irqs_disabled(): 0, pid: 1583, name: cupsd
 2 locks held by cupsd/1583:
  #0:  (tasklist_lock){.+.+.+}, at: [] do_prlimit+0x61/0x189
  #1:  (&(&p->alloc_lock)->rlock){+.+.+.}, at: []
do_prlimit+0x94/0x189
 Pid: 1583, comm: cupsd Not tainted 3.0.0-rc2-git1 #7
 Call Trace:
  [] __might_sleep+0x10d/0x112
  [] slab_pre_alloc_hook.isra.49+0x2d/0x33
  [] kmem_cache_alloc+0x22/0x132
  [] prepare_creds+0x35/0xe4
  [] aa_replace_current_profile+0x35/0xb2
  [] aa_current_profile+0x45/0x4c
  [] apparmor_task_setrlimit+0x19/0x3a
  [] security_task_setrlimit+0x11/0x13
  [] do_prlimit+0xd2/0x189
  [] sys_setrlimit+0x3b/0x48
  [] system_call_fastpath+0x16/0x1b

Signed-off-by: John Johansen 
Reported-by: Miles Lane 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

AppArmor: fix oops in apparmor_setprocattr

2011-06-03T00:32:51+00:00

commit a5b2c5b2ad5853591a6cac6134cd0f599a720865 upstream.

When invalid parameters are passed to apparmor_setprocattr a NULL deref
oops occurs when it tries to record an audit message. This is because
it is passing NULL for the profile parameter for aa_audit. But aa_audit
now requires that the profile passed is not NULL.

Fix this by passing the current profile on the task that is trying to
setprocattr.

Signed-off-by: Kees Cook 
Signed-off-by: John Johansen 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

Set cred->user_ns in key_replace_session_keyring

2011-06-03T00:32:33+00:00

commit f7285b5d631fd6096b11c6af0058ed3a2b30ef4e upstream.

Since this cred was not created with copy_creds(), it needs to get
initialized.  Otherwise use of syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT);
can lead to a NULL deref.  Thanks to Robert for finding this.

But introduced by commit 47a150edc2a ("Cache user_ns in struct cred").

Signed-off-by: Serge E. Hallyn 
Reported-by: Robert Święcki 
Cc: David Howells 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'for-linus' of git://git.infradead.org/users/eparis/selinux into for-linus

2011-05-12T23:52:16+00:00

SELinux: delete debugging printks from filename_trans rule processing

2011-05-12T20:02:42+00:00

The filename_trans rule processing has some printk(KERN_ERR ) messages
which were intended as debug aids in creating the code but weren't removed
before it was submitted.  Remove them.

Reported-by: Paul Bolle 
Signed-off-by: Eric Paris

Merge branch 'for-linus' of git://git.infradead.org/users/eparis/selinux into for-linus

2011-05-04T01:59:34+00:00

flex_array: flex_array_prealloc takes a number of elements, not an end

2011-04-28T20:12:47+00:00

Change flex_array_prealloc to take the number of elements for which space
should be allocated instead of the last (inclusive) element. Users
and documentation are updated accordingly.  flex_arrays got introduced before
they had users.  When folks started using it, they ended up needing a
different API than was coded up originally.  This swaps over to the API that
folks apparently need.

Based-on-patch-by: Steffen Klassert 
Signed-off-by: Eric Paris 
Tested-by: Chris Richards 
Acked-by: Dave Hansen 
Cc: stable@kernel.org [2.6.38+]

SELinux: pass last path component in may_create

2011-04-28T20:12:41+00:00

New inodes are created in a two stage process.  We first will compute the
label on a new inode in security_inode_create() and check if the
operation is allowed.  We will then actually re-compute that same label and
apply it in security_inode_init_security().  The change to do new label
calculations based in part on the last component of the path name only
passed the path component information all the way down the
security_inode_init_security hook.  Down the security_inode_create hook the
path information did not make it past may_create.  Thus the two calculations
came up differently and the permissions check might not actually be against
the label that is created.  Pass and use the same information in both places
to harmonize the calculations and checks.

Reported-by: Dominick Grift 
Signed-off-by: Eric Paris