Paul Moore
5dbbaf2de8
tun: fix LSM/SELinux labeling of tun/tap devices ...
This patch corrects some problems with LSM/SELinux that were introduced
with the multiqueue patchset. The problem stems from the fact that the
multiqueue work changed the relationship between the tun device and its
associated socket; before the socket persisted for the life of the
device, however after the multiqueue changes the socket only persisted
for the life of the userspace connection (fd open). For non-persistent
devices this is not an issue, but for persistent devices this can cause
the tun device to lose its SELinux label.
We correct this problem by adding an opaque LSM security blob to the
tun device struct which allows us to have the LSM security state, e.g.
SELinux labeling information, persist for the lifetime of the tun
device. In the process we tweak the LSM hooks to work with this new
approach to TUN device/socket labeling and introduce a new LSM hook,
security_tun_dev_attach_queue(), to approve requests to attach to a
TUN queue via TUNSETQUEUE.
The SELinux code has been adjusted to match the new LSM hooks, the
other LSMs do not make use of the LSM TUN controls. This patch makes
use of the recently added "tun_socket:attach_queue" permission to
restrict access to the TUNSETQUEUE operation. On older SELinux
policies which do not define the "tun_socket:attach_queue" permission
the access control decision for TUNSETQUEUE will be handled according
to the SELinux policy's unknown permission setting.
Signed-off-by: Paul Moore <pmoore@redhat.com>
Acked-by: Eric Paris <eparis@parisplace.org>
Tested-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-14 18:16:59 -05:00
Drivers: bcma: remove __dev* attributes.
2013-01-03 15:57:15 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client
2012-12-20 14:00:13 -08:00
ARM: arm-soc: Updates for Marvell mvebu/kirkwood
2012-12-14 14:54:26 -08:00
UAPI: Remove empty Kbuild files
2013-01-02 17:36:10 -08:00
Merge branch 'i2c-embedded/for-next' of git://git.pengutronix.de/git/wsa/linux
2012-12-18 16:51:10 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2012-12-18 12:46:37 -08:00
ARM: arm-soc: Device-tree updates, take 2
2012-12-14 14:42:53 -08:00
This is the MFD patch set for the 3.8 merge window.
2012-12-16 18:55:20 -08:00
mlx4_core: Allow choosing flow steering mode
2012-12-19 11:47:22 -08:00
MMC highlights for 3.8:
2012-12-11 11:19:09 -08:00
IOMMU Updates for Linux v3.8
2012-12-20 10:07:25 -08:00
Highlights:
2012-12-13 19:26:04 -08:00
UAPI: Remove empty Kbuild files
2013-01-02 17:36:10 -08:00
Merge remote-tracking branch 'regulator/topic/tol' into regulator-next
2012-12-10 12:43:22 +09:00
Linux 3.7-rc8
2012-12-07 17:02:47 +00:00
Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus
2012-12-14 14:27:45 -08:00
Merge branch 'for-3.8' of git://linux-nfs.org/~bfields/linux
2012-12-20 14:04:11 -08:00
UAPI: Remove empty Kbuild files
2013-01-02 17:36:10 -08:00
Merge branch 'x86-acpi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2012-12-14 10:03:23 -08:00
ASN.1: Define indefinite length marker constant
2012-12-14 13:06:41 +10:30
Revert "libata: check SATA_SETTINGS log with HW Feature Ctrl"
2012-12-14 09:34:01 -05:00
include: remove __dev* attributes.
2013-01-03 15:57:16 -08:00
ath9k: allow to load EEPROM content via firmware API
2012-12-10 15:49:57 -05:00
linux/audit.h: move ptrace.h include to kernel header
2013-01-11 14:54:56 -08:00
Revert "bdi: add a user-tunable cpu_list for the bdi flusher threads"
2012-12-17 11:29:09 -08:00
backlight: add of_find_backlight_by_node()
2012-12-17 17:15:16 -08:00
mm: introduce a common interface for balloon pages mobility
2012-12-11 17:22:26 -08:00
ssb/bcma: add common header for watchdog
2012-12-06 14:58:56 -05:00
Merge branch 'akpm' (Andrew's patch-bomb)
2012-12-20 20:00:43 -08:00
blk: avoid divide-by-zero with zero discard granularity
2012-12-19 07:18:35 -08:00
mm/bootmem.c: remove unused wrapper function reserve_bootmem_generic()
2012-12-12 17:38:35 -08:00
bsg: Remove unused function bsg_goose_queue()
2012-12-06 14:33:02 +01:00
The common clock framework changes for 3.8 are comprised of lots of
2012-12-11 11:25:08 -08:00
mm: compaction: partially revert capture of suitable high-order page
2013-01-11 14:54:56 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal
2012-12-20 18:05:28 -08:00
Nothing all that exciting; a new module-from-fd syscall for those who want
2012-12-19 07:55:08 -08:00
byteorder: allow arch to opt to use GCC intrinsics for byteswapping
2012-12-06 01:22:31 +00:00
Nothing all that exciting; a new module-from-fd syscall for those who want
2012-12-19 07:55:08 -08:00
lib: cpu_rmap: avoid flushing all workqueues
2013-01-11 14:54:54 -08:00
cpuset: use N_MEMORY instead N_HIGH_MEMORY
2012-12-12 17:38:32 -08:00
cred: Remove tgcred pointer from struct cred
2013-01-09 08:26:53 -08:00
vfs: remove DCACHE_NEED_LOOKUP
2012-12-20 13:57:36 -05:00
dm: remove map_info
2012-12-21 20:23:41 +00:00
Merge branch 'x86-ras-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2012-12-14 09:59:59 -08:00
dma-buf: remove fallback for !CONFIG_DMA_SHARED_BUFFER
2012-12-20 12:05:06 +05:30
drivers: cma: represent physical addresses as phys_addr_t
2012-12-11 09:28:09 +01:00
Revert "x86-64/efi: Use EFI to deal with platform wall clock (again)"
2012-12-15 15:20:41 -08:00
Merge branch 'for-3.8' of git://linux-nfs.org/~bfields/linux
2012-12-20 14:04:11 -08:00
f2fs: introduce accessor to retrieve number of dentry slots
2012-12-11 13:43:45 +09:00
Merge branch 'for-3.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2012-12-12 08:18:24 -08:00
Merge branch 'fscache' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into for-linus
2012-12-20 18:49:14 -05:00
FS-Cache: Mark cancellation of in-progress operation
2012-12-20 22:34:00 +00:00
FS-Cache: Provide proper invalidation
2012-12-20 22:04:07 +00:00
fsnotify: make fasync generic for both inotify and fanotify
2012-12-11 13:44:36 -05:00
lseek: the "whence" argument is called "whence"
2012-12-17 17:15:12 -08:00
mm: allocate kernel pages to the right memcg
2012-12-18 15:02:12 -08:00
propagate name change to comments in kernel source
2012-12-06 10:39:54 +01:00
HID: sensors: autodetect USB HID sensor hubs
2012-12-12 16:49:10 +01:00
Merge branches 'for-3.7/upstream-fixes', 'for-3.8/hidraw', 'for-3.8/i2c-hid', 'for-3.8/multitouch', 'for-3.8/roccat', 'for-3.8/sensors' and 'for-3.8/upstream' into for-linus
2012-12-12 21:41:55 +01:00
Automatic NUMA Balancing V11
2012-12-16 15:18:08 -08:00
Automatic NUMA Balancing V11
2012-12-16 15:18:08 -08:00
mm/hugetlb: create hugetlb cgroup file in hugetlb_init
2012-12-18 15:02:15 -08:00
wireless: fix VHT max AMPDU exponent definition
2012-12-06 14:02:51 +01:00
ima: support new kernel module syscall
2012-12-14 13:05:26 +10:30
netconf: advertise mc_forwarding status
2012-12-04 13:08:10 -05:00
Remove __dev* markings from init.h
2013-01-10 10:57:01 -08:00
lib: cpu_rmap: avoid flushing all workqueues
2013-01-11 14:54:54 -08:00
net: Add support for hardware-offloaded encapsulation
2012-12-09 00:20:28 -05:00
ipc: add sysctl to specify desired next object id
2013-01-04 16:11:45 -08:00
net: Add support for hardware-offloaded encapsulation
2012-12-09 00:20:28 -05:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
2012-12-13 14:20:19 -08:00
ext4: fix deadlock in journal_unmap_buffer()
2012-12-25 13:29:52 -05:00
linux/kernel.h: fix DIV_ROUND_CLOSEST with unsigned divisors
2012-12-20 17:40:20 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2012-12-16 15:40:50 -08:00
Merge tag 'kvm-3.8-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm
2012-12-13 15:31:08 -08:00
lockdep, rwsem: provide down_write_nest_lock()
2013-01-11 14:54:55 -08:00
Merge branch 'for-3.8/drivers' of git://git.kernel.dk/linux-block
2012-12-17 13:39:11 -08:00
memcg: add comments clarifying aspects of cache attribute propagation
2012-12-18 15:02:15 -08:00
hotplug: update nodemasks management
2012-12-12 17:38:33 -08:00
mm, memory-hotplug: dynamic configure movable memory and portion memory
2012-12-11 17:22:28 -08:00
mm: mempolicy: Convert shared_policy mutex to spinlock
2013-01-02 17:32:13 -08:00
Automatic NUMA Balancing V11
2012-12-16 15:18:08 -08:00
mm: compaction: partially revert capture of suitable high-order page
2013-01-11 14:54:56 -08:00
Merge branch 'slab/for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux
2012-12-18 10:56:07 -08:00
mm: fix zone_watermark_ok_safe() accounting of isolated pages
2013-01-04 16:11:46 -08:00
moduleparam: use __UNIQUE_ID()
2012-12-14 13:06:40 +10:30
selftests: IPC message queue copy feature test
2013-01-04 16:11:45 -08:00
namei.h: include errno.h
2012-12-25 18:45:06 -05:00
net, wireless: overwrite default_ethtool_ops
2013-01-11 15:55:48 -08:00
NFSv4.1: Move slot table and session struct definitions to nfs4session.h
2012-12-06 00:30:46 +01:00
NFSv4.1: Move the RPC timestamp out of the slot.
2012-12-15 15:21:52 -05:00
mm: cleanup register_node()
2012-12-11 17:22:27 -08:00
numa: add CONFIG_MOVABLE_NODE for movable-dedicated node
2012-12-12 17:38:34 -08:00
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
2012-12-18 09:58:09 -08:00
of/i2c: add dummy inline functions for when CONFIG_OF_I2C(_MODULE) isn't defined
2012-12-11 17:30:16 +00:00
of: define struct device in of_platform.h if !OF_DEVICE and !OF_ADDRESS
2012-12-19 16:15:17 +00:00
mm, oom: fix race when specifying a thread as the oom origin
2012-12-11 17:22:27 -08:00
mm: Fix PageHead when !CONFIG_PAGEFLAGS_EXTENDED
2012-12-26 14:57:34 -08:00
memory-hotplug: skip HWPoisoned page when offlining pages
2012-12-11 17:22:22 -08:00
mm: introduce a common interface for balloon pages mobility
2012-12-11 17:22:26 -08:00
PCI changes for the v3.8 merge window:
2012-12-13 12:14:47 -08:00
PCI: Reduce Ricoh 0xe822 SD card reader base clock frequency to 50MHz
2012-12-26 10:43:06 -07:00
percpu_rw_semaphore: add lockdep annotations
2012-12-17 17:15:18 -08:00
pidns: Stop pid allocation when init dies
2012-12-25 16:10:05 -08:00
pidns: Stop pid allocation when init dies
2012-12-25 16:10:05 -08:00
Merge branch 'akpm' (Andrew's patch-bomb)
2012-12-17 20:58:12 -08:00
pstore: remove __dev* attributes.
2013-01-03 15:57:14 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal
2012-12-20 18:05:28 -08:00
prandom: introduce prandom_bytes() and prandom_bytes_state()
2012-12-17 17:15:26 -08:00
lib/rbtree.c: avoid the use of non-static __always_inline
2013-01-11 14:54:56 -08:00
Merge remote-tracking branch 'regmap/topic/table' into regmap-next
2012-12-11 12:39:32 +09:00
res_counter: return amount of charges after res_counter_uncharge()
2012-12-18 15:02:12 -08:00
mm/rmap, migration: Make rmap_walk_anon() and try_to_unmap_anon() more scalable
2012-12-11 14:43:00 +00:00
lockdep, rwsem: provide down_write_nest_lock()
2013-01-11 14:54:55 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal
2012-12-20 18:05:28 -08:00
tun: fix LSM/SELinux labeling of tun/tap devices
2013-01-14 18:16:59 -05:00
mm: support more pagesizes for MAP_HUGETLB/SHM_HUGETLB
2012-12-11 17:22:25 -08:00
new helpers: __save_altstack/__compat_save_altstack, switch x86 and um to those
2012-12-19 18:07:41 -05:00
net: Add support for hardware-offloaded encapsulation
2012-12-09 00:20:28 -05:00
slab: propagate tunable values
2012-12-18 15:02:14 -08:00
slab/slub: struct memcg_params
2012-12-18 15:02:13 -08:00
slub: slub-specific propagation changes
2012-12-18 15:02:14 -08:00
net: phy: smsc: force all capable mode if the phy is started in powerdown mode
2012-12-07 12:48:00 -05:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2012-12-13 12:00:02 -08:00
string: introduce helper to get base file name from given path
2012-12-17 17:15:17 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal
2012-12-20 18:05:28 -08:00
net: Add support for hardware-offloaded encapsulation
2012-12-09 00:20:28 -05:00
Thermal: Fix DEFAULT_THERMAL_GOVERNOR
2012-12-12 15:34:48 +08:00
fork: protect architectures where THREAD_SIZE >= PAGE_SIZE against fork bombs
2012-12-18 15:02:13 -08:00
mm, oom: fix race when specifying a thread as the oom origin
2012-12-11 17:22:27 -08:00
net: Add support for hardware-offloaded encapsulation
2012-12-09 00:20:28 -05:00
virtio: add drv_to_virtio to make code clearly
2012-12-18 15:20:43 +10:30
Automatic NUMA Balancing V11
2012-12-16 15:18:08 -08:00
mm: numa: Add pte updates, hinting and migration stats
2012-12-11 14:42:48 +00:00
watchdog: WatchDog Timer Driver Core: fix comment
2012-12-19 22:24:55 +01:00
writeback: remove nr_pages_dirtied arg from balance_dirty_pages_ratelimited_nr()
2012-12-11 17:22:21 -08:00
