summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* | tpm: use tabs instead of whitespaces in KconfigPeter Huewe2013-10-221-8/+8
| | | | | | | | | | | | just like the other entries Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* | tpm: Fix module name description in Kconfig for tpm_i2c_infineonPeter Huewe2013-10-221-1/+1
| | | | | | | | | | | | | | This patch changes the displayed module name from tpm_tis_i2c_infineon to its actual name tpm_i2c_infineon. Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* | tpm: Add support for Atmel I2C TPMsJason Gunthorpe2013-10-224-0/+295
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is based on the work of Teddy Reed <teddy@prosauce.org> published on GitHub: https://github.com/theopolis/tpm-i2c-atmel.git 34894b988b67e0ae55088d6388e77b0dbf10c07d That driver was never merged, I have taken it as a starting port, forward ported, tested and revised the driver: - Make it broadly textually similar to the Infineon and Nuvoton I2C driver - Place everything in a format suitable for mainline inclusion - Use high level I2C functions i2c_master_send and i2c_master_recv for data xfer - Use the timeout system from the core code, by faking out a status register - Only I2C transfer the number of bytes in the reply, not a fixed message size. - checkpatch cleanups - Testing on ARM Kirkwood, with this device tree, using a AT97SC3204T-X1A180 tpm@29 { compatible = "atmel,at97sc3204t"; reg = <0x29>; }; Signed-off-by: Teddy Reed <teddy@prosauce.org> [jgg: revised and tested] Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> [phuewe: minor whitespace changes] Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* | tpm: Add support for the Nuvoton NPCT501 I2C TPMJason Gunthorpe2013-10-224-0/+723
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This chip is/was also branded as a Winbond WPCT301. Originally written by Dan Morav <dmorav@nuvoton.com> and posted to LKML: https://lkml.org/lkml/2011/9/7/206 The original posting was not merged, I have taken it as a starting point, forward ported, tested and revised the driver: - Rework interrupt handling to work properly with level triggered interrupts. The old version just locked up. - Synchronize various items with Peter Huewe's Infineon driver: * Add durations/timeouts sysfs calls * Remove I2C device auto-detection * Don't fiddle with chip->release * Call tpm_dev_vendor_release in the probe error path * Use MODULE_DEVICE_TABLE for the I2C ids * Provide OF compatible strings for DT support * Use SIMPLE_DEV_PM_OPS * Use module_i2c_driver - checkpatch cleanups - Testing on ARM Kirkwood with GPIO interrupts, with this device tree: tpm@57 { compatible = "nuvoton,npct501"; reg = <0x57>; interrupt-parent = <&gpio1>; interrupts = <6 IRQ_TYPE_LEVEL_LOW>; }; Signed-off-by: Dan Morav <dmorav@nuvoton.com> [jgg: revised and tested] Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> [phuewe: minor whitespace changes, fixed module name in kconfig] Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* | tpm: Merge the tpm-bios module with tpm.oJason Gunthorpe2013-10-223-11/+3Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that we can have multiple .c files in the tpm module there is no reason for tpm-bios. tpm-bios exported several functions: tpm_bios_log_setup, tpm_bios_log_teardown, tpm_add_ppi, and tpm_remove_ppi. They are only used by tpm, and if tpm-bios is built then tpm will unconditionally require them. Further, tpm-bios does nothing on its own, it has no module_init function. Thus we remove the exports and merge the modules to simplify things. The Makefile conditions are changed slightly to match the code, tpm_ppi is always required if CONFIG_ACPI is set. Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
* | tpm: Rename tpm.c to tpm-interface.cJason Gunthorpe2013-10-222-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | This is preparation for making the tpm module multi-file. kbuild does not like having a .c file with the same name as a module. We wish to keep the tpm module name so that userspace doesn't see this change. tpm-interface.c is chosen because the next several commits in the series migrate items into tpm-sysfs.c, tpm-dev.c and tpm-class.c. All that will be left is tpm command processing and interfacing code. Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
* | tpm: cleanup checkpatch warningsPeter Huewe2013-10-221-22/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | before we rename the file it might be a good idea to cleanup the long persisting checkpatch warnings. Since everything is really trivial, splitting the patch up would only result in noise. For the interested reader - here the checkpatch warnings: (regrouped for easer readability) ERROR: trailing whitespace + * Specifications at www.trustedcomputinggroup.org^I $ + * $ +^I/* $ +^I parameters (RSA 12->bytes: keybit, #primes, expbit) $ WARNING: unnecessary whitespace before a quoted newline + "invalid count value %x %zx \n", count, bufsiz); ERROR: do not use assignment in if condition + if ((rc = chip->vendor.send(chip, (u8 *) buf, count)) < 0) { ERROR: space required after that ',' (ctx:VxV) + len = tpm_transmit(chip,(u8 *) cmd, len); ^ ERROR: "foo * bar" should be "foo *bar" +ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr, +ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr, +ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr, +ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr, +ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr, +ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr, +ssize_t tpm_show_temp_deactivated(struct device * dev, + struct device_attribute * attr, char *buf) WARNING: please, no space before tabs + * @chip_num: ^Itpm idx # or ANY$ + * @res_buf: ^ITPM_PCR value$ + * ^I^Isize of res_buf is 20 bytes (or NULL if you don't care)$ + * @chip_num: ^Itpm idx # or AN&$ + * @hash: ^Ihash value used to extend pcr value$ ERROR: code indent should use tabs where possible +^I TPM_ORD_CONTINUE_SELFTEST);$ WARNING: line over 80 characters +static bool wait_for_tpm_stat_cond(struct tpm_chip *chip, u8 mask, bool check_cancel, ERROR: trailing whitespace + * Called from tpm_<specific>.c probe function only for devices $ total: 16 errors, 7 warnings, 1554 lines checked Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* | tpm: Remove tpm_show_caps_1_2Jason Gunthorpe2013-10-226-39/+27Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The version of the TPM should not depend on the bus it is connected through. 1.1, 1.2 and soon 2.0 TPMS will be all be able to use the same bus interfaces. Make tpm_show_caps try the 1.2 capability first. If that fails then fall back to the 1.1 capability. This effectively auto-detects what interface the TPM supports at run-time. Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Reviewed-by: Joel Schopp <jschopp@linux.vnet.ibm.com> Reviewed-by: Peter Huewe <peterhuewe@gmx.de> Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* | tpm: st33: Remove chip->data_buffer access from this driverJason Gunthorpe2013-10-221-8/+0Star
| | | | | | | | | | | | | | | | | | | | | | For some reason this driver thinks that chip->data_buffer needs to be set before it can call tpm_pm_*. This is not true. data_buffer is used only by /dev/tpmX, which is why it is managed exclusively by the fops functions. Cc: Mathias Leblanc <mathias.leblanc@st.com> Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Reviewed-by: Joel Schopp <jschopp@linux.vnet.ibm.com>
* | tpm: Remove redundant dev_set_drvdataJason Gunthorpe2013-10-223-6/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TPM drivers should not call dev_set_drvdata (or aliases), only the core code is allowed to call dev_set_drvdata, and it does it during tpm_register_hardware. These extra sets are harmless, but are an anti-pattern that many drivers have copied. Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Reviewed-by: Joel Schopp <jschopp@linux.vnet.ibm.com> Reviewed-by: Peter Huewe <peterhuewe@gmx.de> Acked-by: Ashley Lai <adlai@linux.vnet.ibm.com> Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* | tpm: Use container_of to locate the tpm_chip in tpm_openJason Gunthorpe2013-10-221-17/+4Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | misc_open sets the file->private_date to the misc_dev when calling open. We can use container_of to go from the misc_dev back to the tpm_chip. Future clean ups will move tpm_open into a new file and this change means we do not have to export the tpm_chip list. Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Reviewed-by: Joel Schopp <jschopp@linux.vnet.ibm.com> Reviewed-by: Peter Huewe <peterhuewe@gmx.de> Acked-by: Ashley Lai <adlai@linux.vnet.ibm.com> Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* | tpm: Store devname in the tpm_chipJason Gunthorpe2013-10-222-11/+7Star
| | | | | | | | | | | | | | | | | | | | | | Just put the memory directly in the chip structure, rather than in a 2nd dedicated kmalloc. Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Reviewed-by: Joel Schopp <jschopp@linux.vnet.ibm.com> Reviewed-by: Peter Huewe <peterhuewe@gmx.de> Signed-off-by: Peter Huewe <peterhuewe@gmx.de> Acked-by: Ashley Lai <adlai@linux.vnet.ibm.com>
* | tpm atmel: Call request_region with the correct baseJason Gunthorpe2013-10-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit e0dd03caf20d040a0a86 ("tpm: return chip from tpm_register_hardware") changed the code path here so that ateml_get_base_addr no longer directly altered the tpm_vendor_specific structure, and instead placed the base address on the stack. The commit missed updating the request_region call, which would have resulted in request_region being called with 0 as the base address. I don't know if request_region(0, ..) will fail, if so the driver has been broken since 2006 and we should remove it from the tree as it has no users. Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Reviewed-by: Joel Schopp <jschopp@linux.vnet.ibm.com> Reviewed-by: Peter Huewe <peterhuewe@gmx.de> Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* | tpm: ibmvtpm: Use %zd formatting for size_t format argumentsJason Gunthorpe2013-10-221-2/+2
| | | | | | | | | | | | | | | | | | | | This suppresses compile warnings on 32 bit builds. Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Reviewed-by: Joel Schopp <jschopp@linux.vnet.ibm.com> Reviewed-by: Peter Huewe <peterhuewe@gmx.de> Signed-off-by: Peter Huewe <peterhuewe@gmx.de> Acked-by: Ashley Lai <adlai@linux.vnet.ibm.com>
* | tpm: MAINTAINERS: Add myself as tpm maintainerPeter Huewe2013-10-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | Since I'm actively maintaining the tpm subsystem for a few months now, it's time to step up and be an official maintainer for the tpm subsystem, atleast until I hear something different from my company. The maintaining is done solely in my private time, out of private interest. Speaking only on behalf of myself, trying to be as vendor neutral as possible. Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* | Merge branch 'master' of git://git.infradead.org/users/pcmoore/selinux into ↵James Morris2013-10-2217-400/+450
|\ \ | | | | | | | | | ra-next
| * | selinux: correct locking in selinux_netlbl_socket_connect)Paul Moore2013-09-261-4/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SELinux/NetLabel glue code has a locking bug that affects systems with NetLabel enabled, see the kernel error message below. This patch corrects this problem by converting the bottom half socket lock to a more conventional, and correct for this call-path, lock_sock() call. =============================== [ INFO: suspicious RCU usage. ] 3.11.0-rc3+ #19 Not tainted ------------------------------- net/ipv4/cipso_ipv4.c:1928 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 2 locks held by ping/731: #0: (slock-AF_INET/1){+.-...}, at: [...] selinux_netlbl_socket_connect #1: (rcu_read_lock){.+.+..}, at: [<...>] netlbl_conn_setattr stack backtrace: CPU: 1 PID: 731 Comm: ping Not tainted 3.11.0-rc3+ #19 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 0000000000000001 ffff88006f659d28 ffffffff81726b6a ffff88003732c500 ffff88006f659d58 ffffffff810e4457 ffff88006b845a00 0000000000000000 000000000000000c ffff880075aa2f50 ffff88006f659d90 ffffffff8169bec7 Call Trace: [<ffffffff81726b6a>] dump_stack+0x54/0x74 [<ffffffff810e4457>] lockdep_rcu_suspicious+0xe7/0x120 [<ffffffff8169bec7>] cipso_v4_sock_setattr+0x187/0x1a0 [<ffffffff8170f317>] netlbl_conn_setattr+0x187/0x190 [<ffffffff8170f195>] ? netlbl_conn_setattr+0x5/0x190 [<ffffffff8131ac9e>] selinux_netlbl_socket_connect+0xae/0xc0 [<ffffffff81303025>] selinux_socket_connect+0x135/0x170 [<ffffffff8119d127>] ? might_fault+0x57/0xb0 [<ffffffff812fb146>] security_socket_connect+0x16/0x20 [<ffffffff815d3ad3>] SYSC_connect+0x73/0x130 [<ffffffff81739a85>] ? sysret_check+0x22/0x5d [<ffffffff810e5e2d>] ? trace_hardirqs_on_caller+0xfd/0x1c0 [<ffffffff81373d4e>] ? trace_hardirqs_on_thunk+0x3a/0x3f [<ffffffff815d52be>] SyS_connect+0xe/0x10 [<ffffffff81739a59>] system_call_fastpath+0x16/0x1b Cc: stable@vger.kernel.org Signed-off-by: Paul Moore <pmoore@redhat.com>
| * | selinux: Use kmemdup instead of kmalloc + memcpyDuan Jiong2013-09-261-2/+2
| | | | | | | | | | | | | | | | | | Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | selinux: add Paul Moore as a SELinux maintainerPaul Moore2013-09-181-1/+2
| | | | | | | | | | | | | | | Signed-off-by: Paul Moore <paul@paul-moore.com> Acked-by: Eric Paris <eparis@redhat.com>
| * | Merge git://git.infradead.org/users/eparis/selinuxPaul Moore2013-09-1816-396/+448
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: security/selinux/hooks.c Pull Eric's existing SELinux tree as there are a number of patches in there that are not yet upstream. There was some minor fixup needed to resolve a conflict in security/selinux/hooks.c:selinux_set_mnt_opts() between the labeled NFS patches and Eric's security_fs_use() simplification patch.
| | * | Revert "SELinux: do not handle seclabel as a special flag"Eric Paris2013-08-282-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 308ab70c465d97cf7e3168961dfd365535de21a6. It breaks my FC6 test box. /dev/pts is not mounted. dmesg says SELinux: mount invalid. Same superblock, different security settings for (dev devpts, type devpts) Cc: Peter Hurley <peter@hurleysoftware.com> Cc: Greg KH <greg@kroah.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | selinux: consider filesystem subtype in policiesAnand Avati2013-08-282-22/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Not considering sub filesystem has the following limitation. Support for SELinux in FUSE is dependent on the particular userspace filesystem, which is identified by the subtype. For e.g, GlusterFS, a FUSE based filesystem supports SELinux (by mounting and processing FUSE requests in different threads, avoiding the mount time deadlock), whereas other FUSE based filesystems (identified by a different subtype) have the mount time deadlock. By considering the subtype of the filesytem in the SELinux policies, allows us to specify a filesystem subtype, in the following way: fs_use_xattr fuse.glusterfs gen_context(system_u:object_r:fs_t,s0); This way not all FUSE filesystems are put in the same bucket and subjected to the limitations of the other subtypes. Signed-off-by: Anand Avati <avati@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | Add SELinux policy capability for always checking packet and peer classes.Chris PeBenito2013-07-254-6/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the packet class in SELinux is not checked if there are no SECMARK rules in the security or mangle netfilter tables. Some systems prefer that packets are always checked, for example, to protect the system should the netfilter rules fail to load or if the nefilter rules were maliciously flushed. Add the always_check_network policy capability which, when enabled, treats SECMARK as enabled, even if there are no netfilter SECMARK rules and treats peer labeling as enabled, even if there is no Netlabel or labeled IPSEC configuration. Includes definition of "redhat1" SELinux policy capability, which exists in the SELinux userpace library, to keep ordering correct. The SELinux userpace portion of this was merged last year, but this kernel change fell on the floor. Signed-off-by: Chris PeBenito <cpebenito@tresys.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | selinux: fix problems in netnode when BUG() is compiled outPaul Moore2013-07-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the BUG() macro is disabled at compile time it can cause some problems in the SELinux netnode code: invalid return codes and uninitialized variables. This patch fixes this by making sure we take some corrective action after the BUG() macro. Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: use a helper function to determine seclabelEric Paris2013-07-251-14/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a helper to determine if a superblock should have the seclabel flag rather than doing it in the function. I'm going to use this in the security server as well. Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: pass a superblock to security_fs_useEric Paris2013-07-253-15/+11Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rather than passing pointers to memory locations, strings, and other stuff just give up on the separation and give security_fs_use the superblock. It just makes the code easier to read (even if not easier to reuse on some other OS) Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: do not handle seclabel as a special flagEric Paris2013-07-252-4/+1Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of having special code around the 'non-mount' seclabel mount option just handle it like the mount options. Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: change sbsec->behavior to shortEric Paris2013-07-253-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We only have 6 options, so char is good enough, but use a short as that packs nicely. This shrinks the superblock_security_struct just a little bit. Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: renumber the superblock optionsEric Paris2013-07-252-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Just to make it clear that we have mount time options and flags, separate them. Since I decided to move the non-mount options above above 0x10, we need a short instead of a char. (x86 padding says this takes up no additional space as we have a 3byte whole in the structure) Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: do all flags twiddling in one placeEric Paris2013-07-251-7/+5Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently we set the initialize and seclabel flag in one place. Do some unrelated printk then we unset the seclabel flag. Eww. Instead do the flag twiddling in one place in the code not seperated by unrelated printk. Also don't set and unset the seclabel flag. Only set it if we need to. Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: rename SE_SBLABELSUPP to SBLABEL_MNTEric Paris2013-07-252-15/+15
| | | | | | | | | | | | | | | | | | | | | | | | Just a flag rename as we prepare to make it not so special. Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: use define for number of bits in the mnt flags maskEric Paris2013-07-251-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We had this random hard coded value of '8' in the code (I put it there) for the number of bits to check for mount options. This is stupid. Instead use the #define we already have which tells us the number of mount options. Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: make it harder to get the number of mnt opts wrongEric Paris2013-07-251-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | Instead of just hard coding a value, use the enum to out benefit. Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: remove crazy contortions around procEric Paris2013-07-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We check if the fsname is proc and if so set the proc superblock security struct flag. We then check if the flag is set and use the string 'proc' for the fsname instead of just using the fsname. What's the point? It's always proc... Get rid of the useless conditional. Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: fix selinuxfs policy file on big endian systemsEric Paris2013-07-251-2/+1Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The /sys/fs/selinux/policy file is not valid on big endian systems like ppc64 or s390. Let's see why: static int hashtab_cnt(void *key, void *data, void *ptr) { int *cnt = ptr; *cnt = *cnt + 1; return 0; } static int range_write(struct policydb *p, void *fp) { size_t nel; [...] /* count the number of entries in the hashtab */ nel = 0; rc = hashtab_map(p->range_tr, hashtab_cnt, &nel); if (rc) return rc; buf[0] = cpu_to_le32(nel); rc = put_entry(buf, sizeof(u32), 1, fp); So size_t is 64 bits. But then we pass a pointer to it as we do to hashtab_cnt. hashtab_cnt thinks it is a 32 bit int and only deals with the first 4 bytes. On x86_64 which is little endian, those first 4 bytes and the least significant, so this works out fine. On ppc64/s390 those first 4 bytes of memory are the high order bits. So at the end of the call to hashtab_map nel has a HUGE number. But the least significant 32 bits are all 0's. We then pass that 64 bit number to cpu_to_le32() which happily truncates it to a 32 bit number and does endian swapping. But the low 32 bits are all 0's. So no matter how many entries are in the hashtab, big endian systems always say there are 0 entries because I screwed up the counting. The fix is easy. Use a 32 bit int, as the hashtab_cnt expects, for nel. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
| | * | SELinux: Enable setting security contexts on rootfs inodes.Stephen Smalley2013-07-251-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rootfs (ramfs) can support setting of security contexts by userspace due to the vfs fallback behavior of calling the security module to set the in-core inode state for security.* attributes when the filesystem does not provide an xattr handler. No xattr handler required as the inodes are pinned in memory and have no backing store. This is useful in allowing early userspace to label individual files within a rootfs while still providing a policy-defined default via genfs. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: Increase ebitmap_node size for 64-bit configurationWaiman Long2013-07-251-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, the ebitmap_node structure has a fixed size of 32 bytes. On a 32-bit system, the overhead is 8 bytes, leaving 24 bytes for being used as bitmaps. The overhead ratio is 1/4. On a 64-bit system, the overhead is 16 bytes. Therefore, only 16 bytes are left for bitmap purpose and the overhead ratio is 1/2. With a 3.8.2 kernel, a boot-up operation will cause the ebitmap_get_bit() function to be called about 9 million times. The average number of ebitmap_node traversal is about 3.7. This patch increases the size of the ebitmap_node structure to 64 bytes for 64-bit system to keep the overhead ratio at 1/4. This may also improve performance a little bit by making node to node traversal less frequent (< 2) as more bits are available in each node. Signed-off-by: Waiman Long <Waiman.Long@hp.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | SELinux: Reduce overhead of mls_level_isvalid() function callWaiman Long2013-07-254-19/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While running the high_systime workload of the AIM7 benchmark on a 2-socket 12-core Westmere x86-64 machine running 3.10-rc4 kernel (with HT on), it was found that a pretty sizable amount of time was spent in the SELinux code. Below was the perf trace of the "perf record -a -s" of a test run at 1500 users: 5.04% ls [kernel.kallsyms] [k] ebitmap_get_bit 1.96% ls [kernel.kallsyms] [k] mls_level_isvalid 1.95% ls [kernel.kallsyms] [k] find_next_bit The ebitmap_get_bit() was the hottest function in the perf-report output. Both the ebitmap_get_bit() and find_next_bit() functions were, in fact, called by mls_level_isvalid(). As a result, the mls_level_isvalid() call consumed 8.95% of the total CPU time of all the 24 virtual CPUs which is quite a lot. The majority of the mls_level_isvalid() function invocations come from the socket creation system call. Looking at the mls_level_isvalid() function, it is checking to see if all the bits set in one of the ebitmap structure are also set in another one as well as the highest set bit is no bigger than the one specified by the given policydb data structure. It is doing it in a bit-by-bit manner. So if the ebitmap structure has many bits set, the iteration loop will be done many times. The current code can be rewritten to use a similar algorithm as the ebitmap_contains() function with an additional check for the highest set bit. The ebitmap_contains() function was extended to cover an optional additional check for the highest set bit, and the mls_level_isvalid() function was modified to call ebitmap_contains(). With that change, the perf trace showed that the used CPU time drop down to just 0.08% (ebitmap_contains + mls_level_isvalid) of the total which is about 100X less than before. 0.07% ls [kernel.kallsyms] [k] ebitmap_contains 0.05% ls [kernel.kallsyms] [k] ebitmap_get_bit 0.01% ls [kernel.kallsyms] [k] mls_level_isvalid 0.01% ls [kernel.kallsyms] [k] find_next_bit The remaining ebitmap_get_bit() and find_next_bit() functions calls are made by other kernel routines as the new mls_level_isvalid() function will not call them anymore. This patch also improves the high_systime AIM7 benchmark result, though the improvement is not as impressive as is suggested by the reduction in CPU time spent in the ebitmap functions. The table below shows the performance change on the 2-socket x86-64 system (with HT on) mentioned above. +--------------+---------------+----------------+-----------------+ | Workload | mean % change | mean % change | mean % change | | | 10-100 users | 200-1000 users | 1100-2000 users | +--------------+---------------+----------------+-----------------+ | high_systime | +0.1% | +0.9% | +2.6% | +--------------+---------------+----------------+-----------------+ Signed-off-by: Waiman Long <Waiman.Long@hp.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | selinux: remove the BUG_ON() from selinux_skb_xfrm_sid()Paul Moore2013-07-252-5/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the BUG_ON() from selinux_skb_xfrm_sid() and propogate the error code up to the caller. Also check the return values in the only caller function, selinux_skb_peerlbl_sid(). Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | selinux: cleanup the XFRM headerPaul Moore2013-07-251-14/+5Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the unused get_sock_isec() function and do some formatting fixes. Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | selinux: cleanup selinux_xfrm_decode_session()Paul Moore2013-07-251-11/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Some basic simplification. Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | selinux: cleanup some comment and whitespace issues in the XFRM codePaul Moore2013-07-251-13/+10Star
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | selinux: cleanup selinux_xfrm_sock_rcv_skb() and selinux_xfrm_postroute_last()Paul Moore2013-07-252-60/+42Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Some basic simplification and comment reformatting. Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | selinux: cleanup selinux_xfrm_policy_lookup() and ↵Paul Moore2013-07-251-36/+18Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | selinux_xfrm_state_pol_flow_match() Do some basic simplification and comment reformatting. Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | selinux: cleanup and consolidate the XFRM alloc/clone/delete/free codePaul Moore2013-07-251-31/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SELinux labeled IPsec code state management functions have been long neglected and could use some cleanup and consolidation. Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
| | * | lsm: split the xfrm_state_alloc_security() hook implementationPaul Moore2013-07-256-132/+128Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The xfrm_state_alloc_security() LSM hook implementation is really a multiplexed hook with two different behaviors depending on the arguments passed to it by the caller. This patch splits the LSM hook implementation into two new hook implementations, which match the LSM hooks in the rest of the kernel: * xfrm_state_alloc * xfrm_state_alloc_acquire Also included in this patch are the necessary changes to the SELinux code; no other LSMs are affected. Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
* | | | X.509: remove possible code fragility: enumeration values not handledAntonio Alecrim Jr2013-09-251-0/+2
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Antonio Alecrim Jr <antonio.alecrim@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* | | | X.509: add module description and licenseKonstantin Khlebnikov2013-09-251-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes lack of license, otherwise x509_key_parser.ko taints kernel. Signed-off-by: Konstantin Khlebnikov <khlebnikov@openvz.org> Signed-off-by: David Howells <dhowells@redhat.com>
* | | | MPILIB: add module description and licenseKonstantin Khlebnikov2013-09-251-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes lack of license, otherwise mpi.ko taints kernel. Signed-off-by: Konstantin Khlebnikov <khlebnikov@openvz.org> Signed-off-by: David Howells <dhowells@redhat.com>
* | | | KEYS: initialize root uid and session keyrings earlyMimi Zohar2013-09-251-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to create the integrity keyrings (eg. _evm, _ima), root's uid and session keyrings need to be initialized early. Signed-off-by: Mimi Zohar <zohar@us.ibm.com> Signed-off-by: David Howells <dhowells@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-07-17 02:24:22 +0200