Re: [PATCH v3 5/5] firmware: add an extensible system data helpers
Hi Luis, [auto build test WARNING on v4.4-rc6] [also build test WARNING on next-20151223] url: https://github.com/0day-ci/linux/commits/Luis-R-Rodriguez/firmware_class-extensible-firmware-API/20151224-053852 reproduce: make htmldocs All warnings (new ones prefixed by >>): include/linux/init.h:1: warning: no structured comments found kernel/sys.c:1: warning: no structured comments found >> drivers/base/firmware_class.c:1336: warning: No description found for >> parameter 'sysdata' >> drivers/base/firmware_class.c:1336: warning: Excess function parameter >> 'sysdata_file' description in 'release_sysdata_file' drivers/dma-buf/seqno-fence.c:1: warning: no structured comments found drivers/dma-buf/reservation.c:1: warning: no structured comments found include/linux/reservation.h:1: warning: no structured comments found include/linux/hsi/hsi.h:150: warning: Excess struct/union/enum/typedef member 'e_handler' description in 'hsi_client' include/linux/hsi/hsi.h:150: warning: Excess struct/union/enum/typedef member 'pclaimed' description in 'hsi_client' include/linux/hsi/hsi.h:150: warning: Excess struct/union/enum/typedef member 'nb' description in 'hsi_client' vim +/sysdata +1336 drivers/base/firmware_class.c 1320 __func__); 1321 return -ENOMEM; 1322 } 1323 1324 ret = _request_firmware_prepare(&fw, name, device); 1325 if (ret >= 0) 1326 sysdata->priv = fw; 1327 1328 return ret; 1329 } 1330 1331 /** 1332 * release_sysdata_file: - release the resource associated with the sysdata file 1333 * @sysdata_file: sysdata resource to release 1334 **/ 1335 void release_sysdata_file(const struct sysdata_file *sysdata) > 1336 { 1337 struct firmware *fw; 1338 1339 if (sysdata) { 1340 if (sysdata->priv) { 1341 fw = sysdata->priv; 1342 release_firmware(fw); 1343 } 1344 } --- 0-DAY kernel test infrastructureOpen Source Technology Center https://lists.01.org/pipermail/kbuild-all Intel Corporation .config.gz Description: Binary data
[GIT PULL] SELinux patches for 4.5
Hi James, Nine patches for v4.5; there are a handful of minor fixes (constify parameters, warning rate-limits, etc.) but there are a couple of significant patches that invalidate/revalidate inode labels (needed for gfs2) and make validate_trans decisions visible via selinuxfs. All the patches pass the selinux-testsuite and have been included in the pcmoore/kernel-secnext Fedora COPR repository[1] for some time now, all looks good. As of about five minutes ago, selinux#upstream applied cleanly on top of linux-security#next so I don't expect you should have any problems merging the code. Happy holidays and merry merging, -Paul [1] https://copr.fedoraproject.org/coprs/pcmoore/kernel-secnext --- The following changes since commit ebd68df3f24b318d391d15c458d6f43f340ba36a: Sync to Linus v4.4-rc2 for LSM developers. (2015-11-23 22:46:28 +1100) are available in the git repository at: git://git.infradead.org/users/pcmoore/selinux upstream for you to fetch changes up to 76319946f321e30872dd72af7de867cb26e7a373: selinux: rate-limit netlink message warnings in selinux_nlmsg_perm() (2015-12-24 11:09:41 -0500) Andreas Gruenbacher (7): selinux: Remove unused variable in selinux_inode_init_security security: Make inode argument of inode_getsecurity non-const security: Make inode argument of inode_getsecid non-const selinux: Add accessor functions for inode->i_security security: Add hook to invalidate inode security labels selinux: Revalidate invalid inode security labels gfs2: Invalid security labels of inodes when they go invalid Andrew Perepechko (1): selinux: export validatetrans decisions Vladis Dronov (1): selinux: rate-limit netlink message warnings in selinux_nlmsg_perm() fs/gfs2/glops.c | 2 + include/linux/audit.h | 8 +- include/linux/lsm_hooks.h | 10 +- include/linux/security.h| 13 ++- kernel/audit.c | 2 +- kernel/audit.h | 2 +- kernel/auditsc.c| 6 +- security/security.c | 12 ++- security/selinux/hooks.c| 206 -- security/selinux/include/classmap.h | 2 +- security/selinux/include/objsec.h | 6 ++ security/selinux/include/security.h | 3 + security/selinux/selinuxfs.c| 80 ++ security/selinux/ss/services.c | 34 -- security/smack/smack_lsm.c | 4 +- 15 files changed, 302 insertions(+), 88 deletions(-) -- paul moore security @ redhat -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [Linux-ima-devel] [PATCH v2 4/7] ima: measure and appraise kexec image and initramfs
Hi, Mimi CCing kexec list, not all kexec people subscribed to IMA list. I just subscribed to it since Vivek CCed me last time about the V1 of this series. On 12/23/15 at 06:55pm, Mimi Zohar wrote: > This patch defines a new IMA hook ima_hash_and_process_file() for > measuring and appraising files read by the kernel. The caller loads > the file into memory before calling this function, which calculates > the hash followed by the normal IMA policy based processing. > > Two new IMA policy functions named KEXEC_CHECK and INITRAMFS_CHECK > are defined for measuring, appraising or auditing the kexec image > and initramfs. Could you help us understand why do we need it first. I think I do not really understand the purpose of the IMA handling about kexec kernel and initramfs. * Does the files in disk space have already contains some hash values and when kernel load it IMA functions will do some checking? But seems I do not see such handling.. * Does it try to calculate the hash of the file buffer after copying, and IMA will avoid future modification based on the hash calculated? If this is the purpose I think it should be wrong because kexe file buffers will be freed at the end of kexec_file_load syscall. > > Changelog v2: > - Calculate the file hash from the in memory buffer (suggested by Dave Young) > - Rename ima_read_and_process_file() to ima_hash_and_process_file() > - replace individual case statements with range: > KEXEC_CHECK ... IMA_MAX_READ_CHECK - 1 > v1: > - Instead of ima_read_and_process_file() allocating memory, the caller > allocates and frees the memory. > - Moved the kexec measurement/appraisal call to copy_file_from_fd(). The > same call now measures and appraises both the kexec image and initramfs. > > Signed-off-by: Mimi Zohar > --- > Documentation/ABI/testing/ima_policy | 2 +- > include/linux/ima.h | 16 ++ > kernel/kexec_file.c | 24 > security/integrity/iint.c | 1 + > security/integrity/ima/ima.h | 21 -- > security/integrity/ima/ima_api.c | 6 +++-- > security/integrity/ima/ima_appraise.c | 11 -- > security/integrity/ima/ima_main.c | 41 > --- > security/integrity/ima/ima_policy.c | 38 > security/integrity/integrity.h| 7 -- > 10 files changed, 127 insertions(+), 40 deletions(-) > > diff --git a/Documentation/ABI/testing/ima_policy > b/Documentation/ABI/testing/ima_policy > index 0a378a8..e80f767 100644 > --- a/Documentation/ABI/testing/ima_policy > +++ b/Documentation/ABI/testing/ima_policy > @@ -26,7 +26,7 @@ Description: > option: [[appraise_type=]] [permit_directio] > > base: func:= > [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK] > - [FIRMWARE_CHECK] > + [FIRMWARE_CHECK] [KEXEC_CHECK] [INITRAMFS_CHECK] > mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND] > [[^]MAY_EXEC] > fsmagic:= hex value > diff --git a/include/linux/ima.h b/include/linux/ima.h > index 120ccc5..020de0f 100644 > --- a/include/linux/ima.h > +++ b/include/linux/ima.h > @@ -13,6 +13,12 @@ > #include > struct linux_binprm; > > +enum ima_read_hooks { > + KEXEC_CHECK = 1, > + INITRAMFS_CHECK, > + IMA_MAX_READ_CHECK > +}; > + > #ifdef CONFIG_IMA > extern int ima_bprm_check(struct linux_binprm *bprm); > extern int ima_file_check(struct file *file, int mask, int opened); > @@ -20,6 +26,9 @@ extern void ima_file_free(struct file *file); > extern int ima_file_mmap(struct file *file, unsigned long prot); > extern int ima_module_check(struct file *file); > extern int ima_fw_from_file(struct file *file, char *buf, size_t size); > +extern int ima_hash_and_process_file(struct file *file, > + void *buf, size_t size, > + enum ima_read_hooks read_func); > > #else > static inline int ima_bprm_check(struct linux_binprm *bprm) > @@ -52,6 +61,13 @@ static inline int ima_fw_from_file(struct file *file, char > *buf, size_t size) > return 0; > } > > +static inline int ima_hash_and_process_file(struct file *file, > + void *buf, size_t size, > + enum ima_read_hooks read_func) > +{ > + return 0; > +} > + > #endif /* CONFIG_IMA */ > > #ifdef CONFIG_IMA_APPRAISE > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c > index b70ada0..1d0d998 100644 > --- a/kernel/kexec_file.c > +++ b/kernel/kexec_file.c > @@ -18,6 +18,7 @@ > #include > #include > #include > +#include > #include > #include > #include > @@ -33,7 +34,8 @@ size_t __weak kexec_purgatory_size = 0; > > static int kexec_calculate_store_digests(struct kimage *image); > > -static