Messages in this thread |  | | Date | Tue, 4 Oct 2016 19:37:04 +1100 (AEDT) | From | James Morris <> | Subject | [GIT PULL] Security subsystem updates for 4.9 |
| |
Summary:
o SELinux/LSM: overlayfs support, necessary for container filesystems o LSM: finally remove the kernel_module_from_file hook o Smack: treat signal delivery as an 'append' operation o TPM: lots of bugfixes & updates o Audit: new audit data type: LSM_AUDIT_DATA_FILE
Please pull.
---
The following changes since commit 29b4817d4018df78086157ea3a55c1d9424a7cfc:
Linux 4.8-rc1 (2016-08-07 18:18:00 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next
for you to fetch changes up to 1306d8e1c09fdc8ecb9ef235e2116352f810f9c5:
Merge tag 'tpmdd-next-20160927' of git://git.infradead.org/users/jjs/linux-tpmdd into ra-next (2016-09-27 19:21:37 +1000)
---------------------------------------------------------------- Casey Schaufler (1): Smack: Signal delivery as an append operation
James Morris (4): Merge branch 'smack-for-4.9' of http://github.com/cschaufler/smack-next into next Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/selinux into next Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/selinux into next Merge tag 'tpmdd-next-20160927' of git://git.infradead.org/users/jjs/linux-tpmdd into ra-next
Jarkko Sakkinen (15): tpm: invalid self test error message tpm: fix a race condition in tpm2_unseal_trusted() tpm: remove unnecessary externs from tpm.h tpm: replace tpm_gen_interrupt() with tpm_tis_gen_interrupt() tpm: use tpm_transmit_cmd() in tpm2_probe() tpm: use tpm_pcr_read_dev() in tpm_do_selftest() tpm_crb: fix crb_req_canceled behavior tpm_crb: remove wmb()'s tpm_crb: refine the naming of constants tpm_crb: fix incorrect values of cmdReady and goIdle bits tpm: add check for minimum buffer size in tpm_transmit() Revert "tmp/tpm_crb: implement runtime pm for tpm_crb" Revert "tpm/tpm_crb: open code the crb_init into acpi_add" Revert "tmp/tpm_crb: fix Intel PTT hw bug during idle state" Revert "tpm/tpm_crb: implement tpm crb idle state"
Jason Gunthorpe (1): tpm/st33zp24: Remove useless tpm_gen_interrupt
Javier Martinez Canillas (1): security: Use IS_ENABLED() instead of checking for built-in or module
Julia Lawall (1): tpm: constify TPM 1.x header structures
Markus Elfring (1): Smack: Use memdup_user() rather than duplicating its implementation
Mickaël Salaün (4): module: Fully remove the kernel_module_from_file hook um/ptrace: Fix the syscall_trace_leave call um/ptrace: Fix the syscall number update after a ptrace seccomp: Remove 2-phase API documentation
Tomas Winkler (5): tpm/tpm_tis: remove unused itpm variable tmp/tpm_crb: drop include to platform_device tpm/tpm_crb: cache cmd_size register value. tpm/tpm_crb: drop useless cpu_to_le32 when writing to registers tpm/tpm_crb: fix the over 80 characters checkpatch warring
Vivek Goyal (8): security, overlayfs: provide copy up security hook for unioned files selinux: Implementation for inode_copy_up() hook security,overlayfs: Provide security hook for copy up of xattrs for overlay file selinux: Implementation for inode_copy_up_xattr() hook selinux: Pass security pointer to determine_inode_label() security, overlayfs: Provide hook to correctly label newly created files selinux: Implement dentry_create_files_as() hook lsm,audit,selinux: Introduce a new audit data type LSM_AUDIT_DATA_FILE
Wei Yongjun (1): selinux: fix error return code in policydb_read()
William Roberts (5): selinux: print leading 0x on ioctlcmd audits selinux: drop SECURITY_SELINUX_POLICYDB_VERSION_MAX selinux: detect invalid ebitmap selinux: initialize structures selinux: fix overflow and 0 length allocations
Winkler, Tomas (4): tpm/tpm_crb: implement tpm crb idle state tmp/tpm_crb: fix Intel PTT hw bug during idle state tpm/tpm_crb: open code the crb_init into acpi_add tmp/tpm_crb: implement runtime pm for tpm_crb
arch/Kconfig | 11 ---- arch/um/kernel/skas/syscall.c | 10 +-- arch/x86/um/ptrace_32.c | 3 + arch/x86/um/ptrace_64.c | 4 ++ drivers/char/tpm/st33zp24/st33zp24.c | 2 - drivers/char/tpm/tpm-dev.c | 2 +- drivers/char/tpm/tpm-interface.c | 84 +++++++++++------------- drivers/char/tpm/tpm-sysfs.c | 4 +- drivers/char/tpm/tpm.h | 46 ++++++------- drivers/char/tpm/tpm2-cmd.c | 124 +++++++++++++++++++---------------- drivers/char/tpm/tpm_crb.c | 50 +++++++------- drivers/char/tpm/tpm_tis_core.c | 24 ++++--- fs/overlayfs/copy_up.c | 22 +++++++ fs/overlayfs/dir.c | 10 +++ include/linux/lsm_audit.h | 2 + include/linux/lsm_hooks.h | 37 ++++++++++- include/linux/security.h | 25 ++++++- security/lsm_audit.c | 17 ++++- security/security.c | 27 ++++++++ security/selinux/Kconfig | 38 ----------- security/selinux/hooks.c | 106 +++++++++++++++++++++++------- security/selinux/include/security.h | 4 -- security/selinux/ss/conditional.c | 2 + security/selinux/ss/ebitmap.c | 3 + security/selinux/ss/policydb.c | 12 ++-- security/smack/Kconfig | 12 ++++ security/smack/smack.h | 10 +++ security/smack/smack_lsm.c | 14 ++-- security/smack/smack_netfilter.c | 4 +- security/smack/smackfs.c | 11 +--- 30 files changed, 447 insertions(+), 273 deletions(-) |  |