TOMOYO Linux
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest8 patches 16 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/8 | Introduce new LSM hooks where vfsmount is available.fs/ fs/ include/ +4 more | +352 | 0 replies | |
| 2/8 | Add in_execve flag into task_struct.fs/ fs/ include/ | +8 | 0 replies | |
| 3/8 | LSM adapter functions.security/ security/ | +425 | 2 replies | |
| 4/8 | Memory and pathname management functions.security/ security/ | +783 | 2 replies | |
| 5/8 | Common functions for TOMOYO Linux.security/ security/ | +2573 | 0 replies | |
| 6/8 | Domain transition handler.security/ | +854 | 0 replies | |
| 7/8 | File operation restriction part.security/ | +1149 | 12 replies | |
| 8/8 | Kconfig and Makefilesecurity/ security/ security/ +1 more | +15 | 0 replies |
Reviews trailers per patch
1 of 8 patches has a Reviewed-by or Acked-by.
| Patch | Paul E. McKenney |
|---|---|
| 1/8 | |
| 2/8 | |
| 3/8 | |
| 4/8 | |
| 5/8 | |
| 6/8 | |
| 7/8 | R-b |
| 8/8 |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [TOMOYO #10 (linux-next) 0/8] TOMOYO Linux
TOMOYO Linux is a pathname-based MAC extension (LSM module) for the Linux kernel.
Since the latest mmotm (2008-10-02-16-17) lacks CRED patchset by David Howells, we used linux-next (-next-20080919) which includes CRED patchset.
Diffrences from previous version are as follows.
*about LSM interfaces:
-added a new LSM hook security_path_clear() for clearing hash
table after VFS helper functions. It is needed to perform DAC before MAC.
-added a new config option CONFIG_SECURITY_PATH for new LSM hooks.
*about task_struct:
-added in_execve flag to allow LSM modules to determine whether
current process is in an execve operation or not so that they can behave differently while an execve operation is in progress.
*about TOMOYO body:
-made security_inode_*() return result of security_path_*() and
removed code clone of DAC.
-modified to check permisson of interpreter using
bprm->cred->security and current->in_execve flag.
-modified to use get_task_cred() for reading objective LSM context
of a task.
-modified to use bprm->cred->security to know the first call of
security_bprm_check() .
-modified to pass current->cred->security or bprm->cred->security as
parameter.
Thanks to Serge for sugguesting DAC-before-MAC workaround. Thanks to David for patiently reviewing in_execve patch.
Stephen, James, Chris, please review and respond (hopefully Ack).
Regards,
--