linux.git/security/apparmor, branch v3.12-rc2

Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

2013-09-07T21:34:07+00:00

Pull security subsystem updates from James Morris:
 "Nothing major for this kernel, just maintenance updates"

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (21 commits)
  apparmor: add the ability to report a sha1 hash of loaded policy
  apparmor: export set of capabilities supported by the apparmor module
  apparmor: add the profile introspection file to interface
  apparmor: add an optional profile attachment string for profiles
  apparmor: add interface files for profiles and namespaces
  apparmor: allow setting any profile into the unconfined state
  apparmor: make free_profile available outside of policy.c
  apparmor: rework namespace free path
  apparmor: update how unconfined is handled
  apparmor: change how profile replacement update is done
  apparmor: convert profile lists to RCU based locking
  apparmor: provide base for multiple profiles to be replaced at once
  apparmor: add a features/policy dir to interface
  apparmor: enable users to query whether apparmor is enabled
  apparmor: remove minimum size check for vmalloc()
  Smack: parse multiple rules per write to load2, up to PAGE_SIZE-1 bytes
  Smack: network label match fix
  security: smack: add a hash table to quicken smk_find_entry()
  security: smack: fix memleak in smk_write_rules_list()
  xattr: Constify ->name member of "struct xattr".
  ...

module/lsm: Have apparmor module parameters work with no args

2013-08-20T06:07:44+00:00

The apparmor module parameters for param_ops_aabool and
param_ops_aalockpolicy are both based off of the param_ops_bool,
and can handle a NULL value passed in as val. Have it enable the
new KERNEL_PARAM_FL_NOARGS flag to allow the parameters to be set
without having to state "=y" or "=1".

Cc: John Johansen 
Signed-off-by: Steven Rostedt 
Signed-off-by: Rusty Russell

apparmor: add the ability to report a sha1 hash of loaded policy

2013-08-14T18:42:08+00:00

Provide userspace the ability to introspect a sha1 hash value for each
profile currently loaded.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: export set of capabilities supported by the apparmor module

2013-08-14T18:42:07+00:00

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: add the profile introspection file to interface

2013-08-14T18:42:07+00:00

Add the dynamic namespace relative profiles file to the interace, to allow
introspection of loaded profiles and their modes.

Signed-off-by: John Johansen 
Acked-by: Kees Cook

apparmor: add an optional profile attachment string for profiles

2013-08-14T18:42:07+00:00

Add the ability to take in and report a human readable profile attachment
string for profiles so that attachment specifications can be easily
inspected.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: add interface files for profiles and namespaces

2013-08-14T18:42:07+00:00

Add basic interface files to access namespace and profile information.
The interface files are created when a profile is loaded and removed
when the profile or namespace is removed.

Signed-off-by: John Johansen

apparmor: allow setting any profile into the unconfined state

2013-08-14T18:42:07+00:00

Allow emulating the default profile behavior from boot, by allowing
loading of a profile in the unconfined state into a new NS.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: make free_profile available outside of policy.c

2013-08-14T18:42:06+00:00

Signed-off-by: John Johansen

apparmor: rework namespace free path

2013-08-14T18:42:06+00:00

namespaces now completely use the unconfined profile to track the
refcount and rcu freeing cycle. So rework the code to simplify (track
everything through the profile path right up to the end), and move the
rcu_head from policy base to profile as the namespace no longer needs
it.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold