summaryrefslogtreecommitdiffstats
path: root/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0015-smack-fix-allow-either-entry-be-missing-on-access-ac.patch
diff options
context:
space:
mode:
authorYannick GICQUEL <yannick.gicquel@iot.bzh>2015-10-19 15:57:07 +0200
committerGerrit Code Review <gerrit@172.30.200.200>2015-11-06 15:23:36 +0000
commitede19ea0c47fb23f3fc779833d1e57cf76f3371e (patch)
tree47d6fae2283c54def1871aaf2a73828ac68b1b34 /meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0015-smack-fix-allow-either-entry-be-missing-on-access-ac.patch
parent1cd8ab18abca96e4ee108f80225058d875b28347 (diff)
kernel: smack security backport from kernel 4
Here is the backport of all patches relating to smack support on kernel side. For more details, see file: meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/README Please note that patches are applied only if "smack" is in the ditro features. Here are the 2 lines to add in the local.conf OVERRIDES .= ":smack" DISTRO_FEATURES_append = " smack" Change-Id: I147a3532aec531f977d6ec34c576261835711f1e Signed-off-by: Yannick GICQUEL <yannick.gicquel@iot.bzh> Signed-off-by: José Bollo <jose.bollo@iot.bzh>
Diffstat (limited to 'meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0015-smack-fix-allow-either-entry-be-missing-on-access-ac.patch')
-rw-r--r--meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0015-smack-fix-allow-either-entry-be-missing-on-access-ac.patch107
1 files changed, 107 insertions, 0 deletions
diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0015-smack-fix-allow-either-entry-be-missing-on-access-ac.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0015-smack-fix-allow-either-entry-be-missing-on-access-ac.patch
new file mode 100644
index 0000000..bb01395
--- /dev/null
+++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0015-smack-fix-allow-either-entry-be-missing-on-access-ac.patch
@@ -0,0 +1,107 @@
+From ba7db93834a82cc1e8a1a91af549d7d40bd8d764 Mon Sep 17 00:00:00 2001
+From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Date: Thu, 28 Nov 2013 19:16:46 +0200
+Subject: [PATCH 15/54] smack: fix: allow either entry be missing on
+ access/access2 check (v2)
+
+This is a regression caused by f7112e6c. When either subject or
+object is not found the answer for access should be no. This
+patch fixes the situation. '0' is written back instead of failing
+with -EINVAL.
+
+v2: cosmetic style fixes
+
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+---
+ security/smack/smackfs.c | 29 +++++++++++++++--------------
+ 1 file changed, 15 insertions(+), 14 deletions(-)
+
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index 160aa08e..1c89ade 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -301,7 +301,8 @@ static int smk_perm_from_str(const char *string)
+ * @import: if non-zero, import labels
+ * @len: label length limit
+ *
+- * Returns 0 on success, -1 on failure
++ * Returns 0 on success, -EINVAL on failure and -ENOENT when either subject
++ * or object is missing.
+ */
+ static int smk_fill_rule(const char *subject, const char *object,
+ const char *access1, const char *access2,
+@@ -314,28 +315,28 @@ static int smk_fill_rule(const char *subject, const char *object,
+ if (import) {
+ rule->smk_subject = smk_import_entry(subject, len);
+ if (rule->smk_subject == NULL)
+- return -1;
++ return -EINVAL;
+
+ rule->smk_object = smk_import(object, len);
+ if (rule->smk_object == NULL)
+- return -1;
++ return -EINVAL;
+ } else {
+ cp = smk_parse_smack(subject, len);
+ if (cp == NULL)
+- return -1;
++ return -EINVAL;
+ skp = smk_find_entry(cp);
+ kfree(cp);
+ if (skp == NULL)
+- return -1;
++ return -ENOENT;
+ rule->smk_subject = skp;
+
+ cp = smk_parse_smack(object, len);
+ if (cp == NULL)
+- return -1;
++ return -EINVAL;
+ skp = smk_find_entry(cp);
+ kfree(cp);
+ if (skp == NULL)
+- return -1;
++ return -ENOENT;
+ rule->smk_object = skp->smk_known;
+ }
+
+@@ -381,6 +382,7 @@ static ssize_t smk_parse_long_rule(char *data, struct smack_parsed_rule *rule,
+ {
+ ssize_t cnt = 0;
+ char *tok[4];
++ int rc;
+ int i;
+
+ /*
+@@ -405,10 +407,8 @@ static ssize_t smk_parse_long_rule(char *data, struct smack_parsed_rule *rule,
+ while (i < 4)
+ tok[i++] = NULL;
+
+- if (smk_fill_rule(tok[0], tok[1], tok[2], tok[3], rule, import, 0))
+- return -1;
+-
+- return cnt;
++ rc = smk_fill_rule(tok[0], tok[1], tok[2], tok[3], rule, import, 0);
++ return rc == 0 ? cnt : rc;
+ }
+
+ #define SMK_FIXED24_FMT 0 /* Fixed 24byte label format */
+@@ -1856,11 +1856,12 @@ static ssize_t smk_user_access(struct file *file, const char __user *buf,
+ res = smk_parse_long_rule(data, &rule, 0, 3);
+ }
+
+- if (res < 0)
++ if (res >= 0)
++ res = smk_access(rule.smk_subject, rule.smk_object,
++ rule.smk_access1, NULL);
++ else if (res != -ENOENT)
+ return -EINVAL;
+
+- res = smk_access(rule.smk_subject, rule.smk_object,
+- rule.smk_access1, NULL);
+ data[0] = res == 0 ? '1' : '0';
+ data[1] = '\0';
+
+--
+2.1.4
+