user/sven/linux.git/include/linux/security.h, branch v3.2.45

security: Fix security_old_inode_init_security() when CONFIG_SECURITY is not set

2012-01-04T00:12:19Z

Commit 1e39f384bb01 ("evm: fix build problems") makes the stub version of security_old_inode_init_security() return 0 when CONFIG_SECURITY is not set. But that makes callers such as reiserfs_security_init() assume that security_old_inode_init_security() has set name, value, and len arguments properly - but security_old_inode_init_security() left them uninitialized which then results in interesting failures. Revert security_old_inode_init_security() to the old behavior of returning EOPNOTSUPP since both callers (reiserfs and ocfs2) handle this just fine. [ Also fixed the S_PRIVATE(inode) case of the actual non-stub security_old_inode_init_security() function to return EOPNOTSUPP for the same reason, as pointed out by Mimi Zohar. It got incorrectly changed to match the new function in commit fb88c2b6cbb1: "evm: fix security/security_old_init_security return code". - Linus ] Reported-by: Jorge Bastos Acked-by: James Morris Acked-by: Mimi Zohar Signed-off-by: Jan Kara Signed-off-by: Linus Torvalds

security: sparse fix: Move security_fixup_op to security.h

2011-09-09T23:56:33Z

Fix sparse warning by moving declaraion to global header. Signed-off-by: James Morris

security: Fix a typo

2011-09-09T23:40:31Z

Fix a typo. Signed-off-by: Roy.Li Signed-off-by: James Morris

evm: fix build problems

2011-08-15T23:23:44Z

- Make the previously missing security_old_inode_init_security() stub function definition static inline. - The stub security_inode_init_security() function previously returned -EOPNOTSUPP and relied on the callers to change it to 0. The stub security/security_old_inode_init_security() functions now return 0. Reported-by: Stephen Rothwell Signed-off-by: Mimi Zohar Signed-off-by: James Morris

evm: building without EVM enabled fixes

2011-08-11T07:42:07Z

- Missing 'inline' on evm_inode_setattr() definition. Introduced by commit 817b54aa45db ("evm: add evm_inode_setattr to prevent updating an invalid security.evm"). - Missing security_old_inode_init_security() stub function definition. Caused by commit 9d8f13ba3f48 ("security: new security_inode_init_security API adds function callback"). Reported-by: Stephen Rothwell Signed-off-by: Mimi Zohar Signed-off-by: James Morris

Merge branch 'next-evm' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/ima-2.6 into next

2011-08-09T00:31:03Z

Conflicts: fs/attr.c Resolve conflict manually. Signed-off-by: James Morris

->permission() sanitizing: don't pass flags to exec_permission()

2011-07-20T05:43:29Z

pass mask instead; kill security_inode_exec_permission() since we can use security_inode_permission() instead. Signed-off-by: Al Viro

->permission() sanitizing: don't pass flags to ->inode_permission()

2011-07-20T05:43:26Z

pass that via mask instead. Signed-off-by: Al Viro

security: new security_inode_init_security API adds function callback

2011-07-18T16:29:38Z

This patch changes the security_inode_init_security API by adding a filesystem specific callback to write security extended attributes. This change is in preparation for supporting the initialization of multiple LSM xattrs and the EVM xattr. Initially the callback function walks an array of xattrs, writing each xattr separately, but could be optimized to write multiple xattrs at once. For existing security_inode_init_security() calls, which have not yet been converted to use the new callback function, such as those in reiserfs and ocfs2, this patch defines security_old_inode_init_security(). Signed-off-by: Mimi Zohar

SECURITY: Move exec_permission RCU checks into security modules

2011-04-22T23:17:29Z

Right now all RCU walks fall back to reference walk when CONFIG_SECURITY is enabled, even though just the standard capability module is active. This is because security_inode_exec_permission unconditionally fails RCU walks. Move this decision to the low level security module. This requires passing the RCU flags down the security hook. This way at least the capability module and a few easy cases in selinux/smack work with RCU walks with CONFIG_SECURITY=y Signed-off-by: Andi Kleen Acked-by: Eric Paris Signed-off-by: Linus Torvalds