1. 22 Sep, 2017 6 commits
    • John Johansen's avatar
      apparmor: add mount mediation · 2ea3ffb7
      John Johansen authored
      Add basic mount mediation. That allows controlling based on basic
      mount parameters. It does not include special mount parameters for
      apparmor, super block labeling, or any triggers for apparmor namespace
      parameter modifications on pivot root.
      
      default userspace policy rules have the form of
        MOUNT RULE = ( MOUNT | REMOUNT | UMOUNT )
      
        MOUNT = [ QUALIFIERS ] 'mount' [ MOUNT CONDITIONS ] [ SOURCE FILEGLOB ]
                [ '->' MOUNTPOINT FILEGLOB ]
      
        REMOUNT = [ QUALIFIERS ] 'remount' [ MOUNT CONDITIONS ]
                  MOUNTPOINT FILEGLOB
      
        UMOUNT = [ QUALIFIERS ] 'umount' [ MOUNT CONDITIONS ] MOUNTPOINT FILEGLOB
      
        MOUNT CONDITIONS = [ ( 'fstype' | 'vfstype' ) ( '=' | 'in' )
                             MOUNT FSTYPE EXPRESSION ]
      		       [ 'options' ( '=' | 'in' ) MOUNT FLAGS EXPRESSION ]
      
        MOUNT FSTYPE EXPRESSION = ( MOUNT FSTYPE LIST | MOUNT EXPRESSION )
      
        MOUNT FSTYPE LIST = Comma separated list of valid filesystem and
                            virtual filesystem types (eg ext4, debugfs, etc)
      
        MOUNT FLAGS EXPRESSION = ( MOUNT FLAGS LIST | MOUNT EXPRESSION )
      
        MOUNT FLAGS LIST = Comma separated list of MOUNT FLAGS.
      
        MOUNT FLAGS = ( 'ro' | 'rw' | 'nosuid' | 'suid' | 'nodev' | 'dev' |
                        'noexec' | 'exec' | 'sync' | 'async' | 'remount' |
      		  'mand' | 'nomand' | 'dirsync' | 'noatime' | 'atime' |
      		  'nodiratime' | 'diratime' | 'bind' | 'rbind' | 'move' |
      		  'verbose' | 'silent' | 'loud' | 'acl' | 'noacl' |
      		  'unbindable' | 'runbindable' | 'private' | 'rprivate' |
      		  'slave' | 'rslave' | 'shared' | 'rshared' |
      		  'relatime' | 'norelatime' | 'iversion' | 'noiversion' |
      		  'strictatime' | 'nouser' | 'user' )
      
        MOUNT EXPRESSION = ( ALPHANUMERIC | AARE ) ...
      
        PIVOT ROOT RULE = [ QUALIFIERS ] pivot_root [ oldroot=OLD PUT FILEGLOB ]
                          [ NEW ROOT FILEGLOB ]
      
        SOURCE FILEGLOB = FILEGLOB
      
        MOUNTPOINT FILEGLOB = FILEGLOB
      
      eg.
        mount,
        mount /dev/foo,
        mount options=ro /dev/foo -> /mnt/,
        mount options in (ro,atime) /dev/foo -> /mnt/,
        mount options=ro options=atime,
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      Acked-by: default avatarSeth Arnold <seth.arnold@canonical.com>
      2ea3ffb7
    • John Johansen's avatar
      apparmor: add the ability to mediate signals · cd1dbf76
      John Johansen authored
      Add signal mediation where the signal can be mediated based on the
      signal, direction, or the label or the peer/target. The signal perms
      are verified on a cross check to ensure policy consistency in the case
      of incremental policy load/replacement.
      
      The optimization of skipping the cross check when policy is guaranteed
      to be consistent (single compile unit) remains to be done.
      
      policy rules have the form of
        SIGNAL_RULE = [ QUALIFIERS ] 'signal' [ SIGNAL ACCESS PERMISSIONS ]
                      [ SIGNAL SET ] [ SIGNAL PEER ]
      
        SIGNAL ACCESS PERMISSIONS = SIGNAL ACCESS | SIGNAL ACCESS LIST
      
        SIGNAL ACCESS LIST = '(' Comma or space separated list of SIGNAL
                                 ACCESS ')'
      
        SIGNAL ACCESS = ( 'r' | 'w' | 'rw' | 'read' | 'write' | 'send' |
                          'receive' )
      
        SIGNAL SET = 'set' '=' '(' SIGNAL LIST ')'
      
        SIGNAL LIST = Comma or space separated list of SIGNALS
      
        SIGNALS = ( 'hup' | 'int' | 'quit' | 'ill' | 'trap' | 'abrt' |
                    'bus' | 'fpe' | 'kill' | 'usr1' | 'segv' | 'usr2' |
      	      'pipe' | 'alrm' | 'term' | 'stkflt' | 'chld' | 'cont' |
      	      'stop' | 'stp' | 'ttin' | 'ttou' | 'urg' | 'xcpu' |
      	      'xfsz' | 'vtalrm' | 'prof' | 'winch' | 'io' | 'pwr' |
      	      'sys' | 'emt' | 'exists' | 'rtmin+0' ... 'rtmin+32'
                  )
      
        SIGNAL PEER = 'peer' '=' AARE
      
      eg.
        signal,                                 # allow all signals
        signal send set=(hup, kill) peer=foo,
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      Acked-by: default avatarSeth Arnold <seth.arnold@canonical.com>
      cd1dbf76
    • John Johansen's avatar
    • Dan Carpenter's avatar
      apparmor: Fix an error code in aafs_create() · 5d314a81
      Dan Carpenter authored
      We accidentally forgot to set the error code on this path.  It means we
      return NULL instead of an error pointer.  I looked through a bunch of
      callers and I don't think it really causes a big issue, but the
      documentation says we're supposed to return error pointers here.
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Acked-by: default avatarSerge Hallyn <serge@hallyn.com>
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      5d314a81
    • Christos Gkekas's avatar
      apparmor: Fix logical error in verify_header() · 86aea56f
      Christos Gkekas authored
      verify_header() is currently checking whether interface version is less
      than 5 *and* greater than 7, which always evaluates to false. Instead it
      should check whether it is less than 5 *or* greater than 7.
      Signed-off-by: default avatarChristos Gkekas <chris.gekas@gmail.com>
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      86aea56f
    • Geert Uytterhoeven's avatar
      apparmor: Fix shadowed local variable in unpack_trans_table() · 19fe43a5
      Geert Uytterhoeven authored
      with W=2:
      
          security/apparmor/policy_unpack.c: In function ‘unpack_trans_table’:
          security/apparmor/policy_unpack.c:469: warning: declaration of ‘pos’ shadows a previous local
          security/apparmor/policy_unpack.c:451: warning: shadowed declaration is here
      
      Rename the old "pos" to "saved_pos" to fix this.
      
      Fixes: 5379a331 ("apparmor: support v7 transition format compatible with label_parse")
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Reviewed-by: default avatarSerge Hallyn <serge@hallyn.com>
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      19fe43a5
  2. 23 Jul, 2017 8 commits
  3. 22 Jul, 2017 6 commits
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-linus-v4.13-rc2' of... · 4b162c53
      Linus Torvalds authored
      Merge tag 'hwmon-for-linus-v4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hwmon fix from Guenter Roeck:
       "Avoid buffer overruns in applesmc driver"
      
      * tag 'hwmon-for-linus-v4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (applesmc) Avoid buffer overruns
      4b162c53
    • Linus Torvalds's avatar
      Merge tag 'tty-4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · ae75d1ae
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are some small tty and serial driver fixes for 4.13-rc2. Nothing
        huge at all, a revert of a patch that turned out to break things, a
        fix up for a new tty ioctl we added in 4.13-rc1 to get the uapi
        definition correct, and a few minor serial driver fixes for reported
        issues.
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'tty-4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        tty: Fix TIOCGPTPEER ioctl definition
        tty: hide unused pty_get_peer function
        tty: serial: lpuart: Fix the logic for detecting the 32-bit type UART
        serial: imx: Prevent TX buffer PIO write when a DMA has been started
        Revert "serial: imx-serial - move DMA buffer configuration to DT"
        serial: sh-sci: Uninitialized variables in sysfs files
        serial: st-asc: Potential error pointer dereference
      ae75d1ae
    • Linus Torvalds's avatar
      Merge tag 'char-misc-4.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · dedaff2f
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some small char and misc driver fixes for 4.13-rc2. All fix
        reported problems with 4.13-rc1 or older kernels (like the binder
        fixes). Full details in the shortlog.
      
        All have been in linux-next with no reported issues"
      
      * tag 'char-misc-4.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        w1: omap-hdq: fix error return code in omap_hdq_probe()
        regmap: regmap-w1: Fix build troubles
        w1: Fix slave count on 1-Wire bus (resend)
        mux: mux-core: unregister mux_class in mux_exit()
        mux: remove the Kconfig question for the subsystem
        nvmem: rockchip-efuse: amend compatible rk322x-efuse to rk3228-efuse
        drivers/fsi: fix fsi_slave_mode prototype
        fsi: core: register with postcore_initcall
        thunderbolt: Correct access permissions for active NVM contents
        vmbus: re-enable channel tasklet
        spmi: pmic-arb: Always allocate ppid_to_apid table
        MAINTAINERS: Add entry for SPMI subsystem
        spmi: Include OF based modalias in device uevent
        binder: Use wake up hint for synchronous transactions.
        binder: use group leader instead of open thread
        Revert "android: binder: Sanity check at binder ioctl"
      dedaff2f
    • Linus Torvalds's avatar
      Merge tag 'usb-4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 55fd939e
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are some small USB fixes for 4.13-rc2.
      
        The usual batch, gadget fixes for reported issues, as well as xhci
        fixes, and a small random collection of other fixes for reported
        issues.
      
        All have been in linux-next with no reported issues"
      
      * tag 'usb-4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)
        xhci: fix memleak in xhci_run()
        usb: xhci: fix spinlock recursion for USB2 test mode
        xhci: fix 20000ms port resume timeout
        usb: xhci: Issue stop EP command only when the EP state is running
        xhci: Bad Ethernet performance plugged in ASM1042A host
        xhci: Fix NULL pointer dereference when cleaning up streams for removed host
        usb: renesas_usbhs: gadget: disable all eps when the driver stops
        usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
        usb: gadget: udc: renesas_usb3: protect usb3_ep->started in usb3_start_pipen()
        usb: gadget: udc: renesas_usb3: fix zlp transfer by the dmac
        usb: gadget: udc: renesas_usb3: fix free size in renesas_usb3_dma_free_prd()
        usb: gadget: f_uac2: endianness fixes.
        usb: gadget: f_uac1: endianness fixes.
        include: usb: audio: specify exact endiannes of descriptors
        usb: gadget: udc: start_udc() can be static
        usb: dwc2: gadget: On USB RESET reset device address to zero
        usb: storage: return on error to avoid a null pointer dereference
        usb: typec: include linux/device.h in ucsi.h
        USB: cdc-acm: add device-id for quirky printer
        usb: dwc3: gadget: only unmap requests from DMA if mapped
        ...
      55fd939e
    • Linus Torvalds's avatar
      Merge tag 'staging-4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · bcb53e57
      Linus Torvalds authored
      Pull staging driver fixes from Greg KH:
       "Here are some small staging driver fixes for reported issues for
        4.13-rc2.
      
        Also in here is a new driver, the virtualbox DRM driver. It's
        stand-alone and got acks from the DRM developers to go in through this
        tree. It's a new thing, but it should be fine for this point in the rc
        cycle due to it being independent.
      
        All of this has been in linux-next for a while with no reported
        issues"
      
      * tag 'staging-4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: rtl8188eu: add TL-WN722N v2 support
        staging: speakup: safely register and unregister ldisc
        staging: speakup: add functions to register and unregister ldisc
        staging: speakup: safely close tty
        staging: sm750fb: avoid conflicting vesafb
        staging: lustre: ko2iblnd: check copy_from_iter/copy_to_iter return code
        staging: vboxvideo: Add vboxvideo to drivers/staging
        staging: sm750fb: fixed a assignment typo
        staging: rtl8188eu: memory leak in rtw_free_cmd_obj()
        staging: vchiq_arm: fix error codes in probe
        staging: comedi: ni_mio_common: fix AO timer off-by-one regression
      bcb53e57
    • Randy Dunlap's avatar
      MAINTAINERS: fix alphabetical ordering · 82abbea7
      Randy Dunlap authored
      Fix major alphabetic errors.  No attempt to fix items that all begin
      with the same word (like ARM, BROADCOM, DRM, EDAC, FREESCALE, INTEL,
      OMAP, PCI, SAMSUNG, TI, USB, etc.).
      
      (diffstat +/- is different by one line because TI KEYSTONE MULTICORE
      had 2 blank lines after it.)
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Acked-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      82abbea7
  4. 21 Jul, 2017 20 commits