- 15 Feb, 2007 1 commit
-
-
Steve French authored
Thanks to Dirk for pointing this out. Signed-off-by:
Dirk Mueller <dmueller@suse.de> Signed-off-by:
Steve French <sfrench@us.ibm.com>
-
- 14 Feb, 2007 39 commits
-
-
Eric W. Biederman authored
Since the security checks are applied on each read and write of a sysctl file, just like they are applied when calling sys_sysctl, they are redundant on the standard VFS constructs. Since it is difficult to compute the security labels on the standard VFS constructs we just mark the sysctl inodes in proc private so selinux won't even bother with them. Signed-off-by:
Eric W. Biederman <ebiederm@xmission.com> Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
Stephen Smalley authored
Hmmm...turns out to not be quite enough, as the /proc/sys inodes aren't truly private to the fs, so we can run into them in a variety of security hooks beyond just the inode hooks, such as security_file_permission (when reading and writing them via the vfs helpers), security_sb_mount (when mounting other filesystems on directories in proc like binfmt_misc), and deeper within the security module itself (as in flush_unauthorized_files upon inheritance across execve). So I think we have to add an IS_PRIVATE() guard within SELinux, as below. Note however that the use of the private flag here could be confusing, as these inodes are _not_ private to the fs, are exposed to userspace, and security modules must implement the sysctl hook to get any access control over them. Signed-off-by:
Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by:
-
Eric W. Biederman authored
I goofed and when reenabling the fine grained selinux labels for sysctls and forgot to add the "/sys" prefix before consulting the policy database. When computing the same path using proc_dir_entries we got the "/sys" for free as it was part of the tree, but it isn't true for clt_table trees. Signed-off-by:
-
Eric W. Biederman authored
It isn't needed anymore, all of the users are gone, and all of the ctl_table initializers have been converted to use explicit names of the fields they are initializing. [akpm@osdl.org: NTFS fix] Signed-off-by:
-
Eric W. Biederman authored
Add a parent entry into the ctl_table so you can walk the list of parents and find the entire path to a ctl_table entry. Signed-off-by:
-
Eric W. Biederman authored
With this change the sysctl inodes can be cached and nothing needs to be done when removing a sysctl table. For a cost of 2K code we will save about 4K of static tables (when we remove de from ctl_table) and 70K in proc_dir_entries that we will not allocate, or about half that on a 32bit arch. The speed feels about the same, even though we can now cache the sysctl dentries :( We get the core advantage that we don't need to have a 1 to 1 mapping between ctl table entries and proc files. Making it possible to have /proc/sys vary depending on the namespace you are in. The currently merged namespaces don't have an issue here but the network namespace under /proc/sys/net needs to have different directories depending on which network adapters are visible. By simply being a cache different directories being visible depending on who you are is trivial to implement. [akpm@osdl.org: fix uninitialised var] [akpm@osdl.org: fix ARM build] [bunk@stusta.de: make things static] Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
The current logic to walk through the list of sysctl table headers is slightly painful and implement in a way it cannot be used by code outside sysctl.c I am in the process of implementing a version of the sysctl proc support that instead of using the proc generic non-caching monster, just uses the existing sysctl data structure as backing store for building the dcache entries and for doing directory reads. To use the existing data structures however I need a way to get at them. [akpm@osdl.org: warning fix] Signed-off-by:
-
Eric W. Biederman authored
The semantic effect of insert_at_head is that it would allow new registered sysctl entries to override existing sysctl entries of the same name. Which is pain for caching and the proc interface never implemented. I have done an audit and discovered that none of the current users of register_sysctl care as (excpet for directories) they do not register duplicate sysctl entries. So this patch simply removes the support for overriding existing entries in the sys_sysctl interface since no one uses it or cares and it makes future enhancments harder. Signed-off-by:
Ralf Baechle <ralf@linux-mips.org> Acked-by:
Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Russell King <rmk@arm.linux.org.uk> Cc: David Howells <dhowells@redhat.com> Cc: "Luck, Tony" <tony.luck@intel.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Andi Kleen <ak@muc.de> Cc: Jens Axboe <axboe@kernel.dk> Cc: Corey Minyard <minyard@acm.org> Cc: Neil Brown <neilb@suse.de> Cc: "John W. Linville" <linville@tuxdriver.com> Cc: James Bottomley <James.Bottomley@steeleye.com> Cc: Jan Kara <jack@ucw.cz> Cc: Trond Myklebust <trond.myklebust@fys.uio.no> Cc: Mark Fasheh <mark.fasheh@oracle.com> Cc: David Chinner <dgc@sgi.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Patrick McHardy <kaber@trash.net> Signed-off-by:
-
Eric W. Biederman authored
parse_table has support for calling a strategy routine when descending into a directory. To date no one has used this functionality and the /proc/sys interface has no analog to it. So no one is using this functionality kill it and make the binary sysctl code easier to follow. Signed-off-by:
-
Eric W. Biederman authored
There are currently no users in the kernel for CTL_ANY and it only has effect on the binary interface which is practically unused. So this complicates sysctl lookups for no good reason so just remove it. Signed-off-by:
-
Eric W. Biederman authored
binfmt_misc has a mount point in the middle of the sysctl and that mount point is created as a proc_generic directory. Doing it that way gets in the way of cleaning up the sysctl proc support as it continues the existence of a horrible hack. So instead simply create the directory as an ordinary sysctl directory. At least that removes the magic special case. [akpm@osdl.org: warning fix] Signed-off-by:
-
Eric W. Biederman authored
This is just a simple cleanup to keep kernel/sysctl.c from getting to crowded with special cases, and by keeping all of the ipc logic to together it makes the code a little more readable. [gcoady.lk@gmail.com: build fix] Signed-off-by:
Grant Coady <gcoady.lk@gmail.com> Signed-off-by:
-
Eric W. Biederman authored
This is just a simple cleanup to keep kernel/sysctl.c from getting to crowded with special cases, and by keeping all of the utsname logic to together it makes the code a little more readable. Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
ocfs2 was did not have the binary number it uses under CTL_FS registered in sysctl.h. Register it to avoid future conflicts, and change the name of the definition to be in line with the rest of the sysctl numbers. Signed-off-by:
Mark Fasheh <mark.fasheh@oracle.com> Signed-off-by:
-
Eric W. Biederman authored
Putting ntfs-debug under FS_NRINODE was not a kosher thing to do so don't give it any binary number. [akpm@osdl.org: build fix] Signed-off-by:
-
Eric W. Biederman authored
Will converting the coda sysctl initializers I discovered that it is yet another user of sysctl that was stomping CTL_KERN. So off with it's sys_sysctl support since it wasn't done in a supportable way. Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
The real time clock driver was using the binary number reserved for cdroms in the sysctl binary number interface, which is a no-no. So since the sysctl binary interface is wrong remove it. Signed-off-by:
-
Eric W. Biederman authored
In the binary sysctl interface the hpet driver was claiming to be the cdrom driver. This is a no-no so remove support for the binary interface. Signed-off-by:
Clemens Ladisch <clemens@ladisch.de> Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
Andi Kleen <ak@suse.de> Signed-off-by:
-
Eric W. Biederman authored
Basically everything was done but I removed all element initializers from the trailing entries to make it clear the entire last entry should be zero filled. Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
The only sysctl x86_64 provides are not provided elsewhere, so insert_at_head is unnecessary. Signed-off-by:
-
Eric W. Biederman authored
While doing the C99 conversion I notices that the top level sh64 directory was using the binary number for CTL_KERN. That is a no-no so I removed the support for the sysctl binary interface only leaving sysctl /proc support. At least the sysctl tables were placed at the end of the list so user space did not see this mistake. Signed-off-by:
Paul Mundt <lethal@linux-sh.org> Signed-off-by:
-
Eric W. Biederman authored
And make the mode of the kernel directory 0555 no one is allowed to write to sysctl directories. Signed-off-by:
Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Signed-off-by:
-
Eric W. Biederman authored
This was partially done already and there was no ABI breakage what a relief. Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
We need to have the the definition of all top level sysctl directories registers in sysctl.h so we don't conflict by accident and cause abi problems. Signed-off-by:
-
Eric W. Biederman authored
While C99 converting the ctl_table initializers I realized that the binary sysctl numbers were in conflict with the binary values under CTL_KERN. Including CTL_KERN KERN_VERSION as used by glibc. So I just removed the sysctl binary interface for these values, as it was unsupportable. Luckily these sysctl were inserted at the end of the sysctl list so this bug was not visible to userspace. Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
The assignment of binary numbers for sys_sysctl use was in shambles and despite requiring methods. Nothing was implemented on the sys_sysctl side. So this patch gives a mercy killing to the sys_sysctl support for powermanagment on mips/au1000. Signed-off-by:
-
Eric W. Biederman authored
This convters the sysctl ctl_tables to use C99 initializers. While I was looking at it I discovered it was using a portion of the sysctl binary addresses space under CTL_KERN KERN_OSTYPE which was completely inappropriate. So I completely removed all of the sysctl binary names, to remove and avoid the ABI conflict. Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
By not using the enumeration in sysctl.h (or even understanding it) the SN platform placed their arch specific xpc directory on top of CTL_KERN and only because they didn't have 4 entries in their xpc directory got lucky and didn't break glibc. This is totally irresponsible. So this patch entirely removes sys_sysctl support from their sysctl code. Hopefully they don't have ascii name conflicts as well. And now that they have no ABI numbers add them to the end instead of the sysctl list instead of the head so nothing else will be overridden. Cc: Tony Luck <tony.luck@intel.com> Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
David Howells <dhowells@redhat.com> Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
