Eric W. Biederman
90f8572b0f
vfs: Commit to never having exectuables on proc and sysfs. ...
Today proc and sysfs do not contain any executable files. Several
applications today mount proc or sysfs without noexec and nosuid and
then depend on there being no exectuables files on proc or sysfs.
Having any executable files show on proc or sysfs would cause
a user space visible regression, and most likely security problems.
Therefore commit to never allowing executables on proc and sysfs by
adding a new flag to mark them as filesystems without executables and
enforce that flag.
Test the flag where MNT_NOEXEC is tested today, so that the only user
visible effect will be that exectuables will be treated as if the
execute bit is cleared.
The filesystems proc and sysfs do not currently incoporate any
executable files so this does not result in any user visible effects.
This makes it unnecessary to vet changes to proc and sysfs tightly for
adding exectuable files or changes to chattr that would modify
existing files, as no matter what the individual file say they will
not be treated as exectuable files by the vfs.
Not having to vet changes to closely is important as without this we
are only one proc_create call (or another goof up in the
implementation of notify_change) from having problematic executables
on proc. Those mistakes are all too easy to make and would create
a situation where there are security issues or the assumptions of
some program having to be broken (and cause userspace regressions).
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2015-07-10 10:39:25 -05:00
ceph: pre-allocate data structure that tracks caps flushing
2015-06-25 11:49:31 +03:00
crush: sync up with userspace
2015-06-25 11:49:31 +03:00
fsl /bestcomm
Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds
2015-07-01 19:09:11 -07:00
mfd: twl4030-power: Fix pmic for boards that need AC charger disabled
2015-06-22 12:25:04 +01:00
Input: improve parsing OF parameters for touchscreens
2015-06-25 14:45:46 -07:00
Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus
2015-06-27 12:44:34 -07:00
Char/Misc driver patches for 4.2-rc1
2015-06-26 14:51:15 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2015-06-24 16:49:49 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2015-06-24 16:49:49 -07:00
mmc: mediatek: Add Mediatek MMC driver
2015-06-18 09:20:48 +02:00
netfilter: xtables: fix warnings on 32bit platforms
2015-06-18 21:14:33 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2015-06-23 14:08:54 -07:00
- remoteproc fixes/cleanups from Suman Anna
2015-07-03 14:57:50 -07:00
Merge remote-tracking branches 'regulator/topic/of', 'regulator/topic/pwm', 'regulator/topic/qcom' and 'regulator/topic/soft-start' into regulator-next
2015-06-22 11:19:56 +01:00
timer: Reduce timer migration overhead if disabled
2015-06-19 15:18:28 +02:00
MIPS: BCM47xx: Extract info about et2 interface
2015-06-21 21:52:24 +02:00
NFS client updates for Linux 4.2
2015-07-02 11:32:23 -07:00
Power management and ACPI fixes for v4.2-rc1
2015-07-01 14:17:44 -07:00
writeback: don't embed root bdi_writeback_congested in bdi_writeback
2015-07-02 08:46:00 -06:00
writeback: don't embed root bdi_writeback_congested in bdi_writeback
2015-07-02 08:46:00 -06:00
backlight: Change the return type of backlight_update_status() to int
2015-06-23 15:47:35 +01:00
MIPS: BCM47xx: Move NVRAM driver to the drivers/firmware/
2015-06-21 21:55:33 +02:00
Merge branch 'for-4.2/writeback' of git://git.kernel.dk/linux-block
2015-06-25 16:00:17 -07:00
Revert "block, dm: don't copy bios for request clones"
2015-06-26 10:11:58 -04:00
- Revert block and DM core changes the removed request-based DM's
2015-06-26 12:35:01 -07:00
mm: only define hashdist variable when needed
2015-06-24 17:49:41 -07:00
bpf: allow networking programs to use bpf_trace_printk() for debugging
2015-06-15 15:53:50 -07:00
net: phy: broadcom: define Broadcom pseudo-PHY address in brcmphy.h
2015-06-10 23:33:58 -07:00
cgroup: require write perm on common ancestor when moving processes on the default hierarchy
2015-06-18 16:54:28 -04:00
Merge branch 'for-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2015-06-26 19:50:04 -07:00
clk: tegra: Changes for v4.2-rc1
2015-06-20 13:29:48 -07:00
compiler-gcc: integrate the various compiler-gcc[345].h files
2015-06-25 17:00:38 -07:00
compiler-intel: fix wrong compiler barrier() macro
2015-06-25 17:00:38 -07:00
Minor merge needed, due to function move.
2015-07-01 10:49:25 -07:00
configfs: unexport/make static config_item_init()
2015-06-24 17:49:39 -07:00
printk: implement support for extended console drivers
2015-06-25 17:00:38 -07:00
Merge branches 'pm-sleep' and 'pm-runtime'
2015-06-19 01:18:02 +02:00
crypto: algif_aead - Temporarily disable all AEAD algorithms
2015-06-22 15:49:30 +08:00
make simple_positive() public
2015-06-23 18:02:01 -04:00
Replace module_platform_driver with builtin_platform driver in non modules.
2015-07-02 10:42:13 -07:00
Merge branch 'topic/xdmac' into for-linus
2015-06-25 09:21:49 +05:30
iommu: dmar: Provide helper to copy shared irte fields
2015-06-12 11:33:52 +02:00
firmware: dmi: struct dmi_header should be packed
2015-06-25 09:06:57 +02:00
The libnvdimm sub-system introduces, in addition to the libnvdimm-core,
2015-06-29 10:34:42 -07:00
cfq-iosched: fix the setting of IOPS mode on SSDs
2015-06-10 08:01:20 -06:00
extcon: Redefine the unique id of supported external connectors without 'enum extcon' type
2015-06-12 17:01:42 -07:00
fs/file.c: don't acquire files->file_lock in fd_install()
2015-07-01 02:30:09 -04:00
frontswap: allow multiple backends
2015-06-24 17:49:45 -07:00
vfs: Commit to never having exectuables on proc and sysfs.
2015-07-10 10:39:25 -05:00
fsnotify: remove obsolete documentation
2015-06-24 17:49:38 -07:00
genalloc: rename of_get_named_gen_pool() to of_gen_pool_get()
2015-06-30 19:45:01 -07:00
mm: meminit: finish initialisation of struct pages before basic setup
2015-06-30 19:44:56 -07:00
timer: Minimize nohz off overhead
2015-06-19 15:18:28 +02:00
net/core: Add reading VF statistics through the PF netdevice
2015-06-15 17:23:03 -07:00
macvtap: Increase limit of macvtap queues
2015-06-23 06:14:04 -07:00
sock_diag: specify info_size per inet protocol
2015-06-15 19:49:22 -07:00
net: ipv4 sysctl option to ignore routes when nexthop link is down
2015-06-24 02:15:54 -07:00
init: delete the __cpuinit related stubs
2015-06-16 14:12:23 -04:00
Merge branch 'for-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2015-06-26 19:50:04 -07:00
IOMMU Updates for Linux v4.2
2015-06-23 18:27:19 -07:00
iommu: Introduce iommu_request_dm_for_dev()
2015-06-11 09:01:55 +02:00
genirq: Clean up outdated comments related to include/linux/irqdesc.h
2015-06-25 12:06:34 +02:00
irqchip: Move IRQCHIP_DECLARE macro to include/linux/irqchip.h
2015-07-02 22:34:38 +02:00
genirq: Implement irq_set_handler_locked()/irq_set_chip_handler_name_locked()
2015-06-26 21:32:30 +02:00
genirq: Remove irq_node()
2015-06-25 12:06:45 +02:00
jbd2: fix ocfs2 corrupt when updating journal superblock fails
2015-06-15 14:36:01 -04:00
time: Allow gcc to fold usecs_to_jiffies(constant)
2015-06-10 11:31:14 +02:00
Merge branch 'akpm' (patches from Andrew)
2015-07-01 17:47:51 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2015-07-03 15:20:57 -07:00
mm: kmemleak_alloc_percpu() should follow the gfp from per_alloc()
2015-06-24 17:49:46 -07:00
sched/stop_machine: Fix deadlock between multiple stop_two_cpus()
2015-06-19 10:03:12 +02:00
Merge branch 'for-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata
2015-06-25 16:49:21 -07:00
libnvdimm: Add sysfs numa_node to NVDIMM devices
2015-06-26 11:23:38 -04:00
Merge branch 'sched-hrtimers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2015-06-24 15:09:40 -07:00
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2015-06-27 13:26:03 -07:00
mailbox: Add ability for clients to request channels by name
2015-06-11 22:19:45 +05:30
memblock: introduce a for_each_reserved_mem_region iterator
2015-06-30 19:44:55 -07:00
Merge branch 'for-4.2/writeback' of git://git.kernel.dk/linux-block
2015-06-25 16:00:17 -07:00
mm: new arch_remap() hook
2015-06-24 17:49:41 -07:00
mm: meminit: make __early_pfn_to_nid SMP-safe and introduce meminit_pfn_in_nid
2015-06-30 19:44:56 -07:00
mm: clarify that the function operates on hugepage pte
2015-06-24 17:49:44 -07:00
mm: meminit: initialise a subset of struct pages if CONFIG_DEFERRED_STRUCT_PAGE_INIT is set
2015-06-30 19:44:56 -07:00
USB patches for 4.2-rc1
2015-06-26 15:59:26 -07:00
Minor merge needed, due to function move.
2015-07-01 10:49:25 -07:00
Minor merge needed, due to function move.
2015-07-01 10:49:25 -07:00
MPILIB: add mpi_read_buf() and mpi_get_size() helpers
2015-06-16 14:35:06 +08:00
libnvdimm: infrastructure for btt devices
2015-06-25 04:20:04 -04:00
net/core: Add reading VF statistics through the PF netdevice
2015-06-15 17:23:03 -07:00
netfilter: don't pull include/linux/netfilter.h from netns headers
2015-06-18 21:14:31 +02:00
net: ip_fragment: remove BRIDGE_NETFILTER mtu special handling
2015-06-12 14:16:46 +02:00
netfilter: don't pull include/linux/netfilter.h from netns headers
2015-06-18 21:14:31 +02:00
netfilter: bridge: forward IPv6 fragmented packets
2015-06-12 14:10:12 +02:00
NFSv.2/pnfs Add a LAYOUTSTATS rpc function
2015-06-24 10:17:37 -04:00
nfs42: serialize LAYOUTSTATS calls of the same file
2015-06-24 10:53:11 -04:00
NFSv4.2: LAYOUTSTATS is optional to implement
2015-06-27 11:48:58 -04:00
NFS: Remove unused nfs_rw_ops->rw_release() function
2015-06-10 18:32:40 -04:00
NFSv.2/pnfs Add a LAYOUTSTATS rpc function
2015-06-24 10:17:37 -04:00
watchdog: add watchdog_cpumask sysctl to assist nohz
2015-06-24 17:49:40 -07:00
NTB: Add NTB hardware abstraction layer
2015-07-04 14:04:44 -04:00
NTB: Split ntb_hw_intel and ntb_transport drivers
2015-07-04 14:05:49 -04:00
Devicetree changes for v4.2
2015-07-01 19:40:18 -07:00
Devicetree changes for v4.2
2015-07-01 19:40:18 -07:00
of: fix a build error to of_graph_get_endpoint_by_regs function
2015-06-24 11:18:48 +10:00
mm: oom_kill: simplify OOM killer locking
2015-06-24 17:49:43 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2015-07-04 19:36:06 -07:00
Merge branches 'pci/aspm', 'pci/enumeration', 'pci/hotplug', 'pci/misc', 'pci/msi', 'pci/resource' and 'pci/virtualization' into next
2015-06-12 15:26:45 -05:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2015-06-24 16:49:49 -07:00
This patch series contains several clean ups and even a new trace clock
2015-06-26 14:02:43 -07:00
platform_device: better support builtin boilerplate avoidance
2015-06-16 14:12:37 -04:00
Merge branch 'pm-wakeirq'
2015-06-19 01:18:14 +02:00
The libnvdimm sub-system introduces, in addition to the libnvdimm-core,
2015-06-29 10:34:42 -07:00
power: Add devm_power_supply_get_by_phandle() helper function
2015-06-10 16:15:54 +02:00
sched, preempt_notifier: separate notifier registration from static_key inc/dec
2015-07-03 18:55:00 +02:00
printk: guard the amount written per line by devkmsg_read()
2015-06-25 17:00:38 -07:00
device property: Introduces device_dma_is_coherent()
2015-06-15 14:40:49 +02:00
pwm: Add pwmchip_add_with_polarity() API
2015-06-12 11:36:30 +02:00
random: Remove kernel blocking API
2015-06-10 19:14:04 +08:00
Minor merge needed, due to function move.
2015-07-01 10:49:25 -07:00
Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2015-06-22 18:57:44 -07:00
remoteproc: add a rproc ops for performing address translation
2015-06-17 09:57:12 +03:00
rtc: interface: Remove rtc_set_mmss()
2015-06-25 01:13:43 +02:00
switchdev; add VLAN support for port's bridge_getlink
2015-06-23 06:56:18 -07:00
drivers/scsi/scsi_debug.c: resolve sg buffer const-ness issue
2015-06-30 19:44:59 -07:00
Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2015-07-04 08:56:53 -07:00
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2015-06-27 13:26:03 -07:00
vfs: add seq_file_path() helper
2015-06-23 18:01:07 -04:00
Minor merge needed, due to function move.
2015-07-01 10:49:25 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2015-06-15 14:30:32 -07:00
Fix kmalloc slab creation sequence
2015-06-29 10:49:51 -07:00
smpboot: allow excluding cpus from the smpboot threads
2015-06-24 17:49:40 -07:00
sock_diag: define destruction multicast groups
2015-06-15 19:49:22 -07:00
stddef.h: move offsetofend inside #ifndef/#endif guard, neaten
2015-06-25 17:00:38 -07:00
lib/string.c: introduce strreplace()
2015-06-25 17:00:40 -07:00
This patch series contains several clean ups and even a new trace clock
2015-06-26 14:02:43 -07:00
sysctl: Allow creating permanently empty directories that serve as mountpoints.
2015-07-01 10:36:39 -05:00
sysfs: Add support for permanently empty directories to serve as mount points.
2015-07-01 10:36:45 -05:00
check_syslog_permissions() cleanup
2015-06-25 17:00:39 -07:00
Power management and ACPI material for v4.2-rc1
2015-06-23 14:18:07 -07:00
time: Prevent early expiry of hrtimers[CLOCK_REALTIME] at the leap second edge
2015-06-12 11:15:49 +02:00
time: Prevent early expiry of hrtimers[CLOCK_REALTIME] at the leap second edge
2015-06-12 11:15:49 +02:00
timer: Reduce timer migration overhead if disabled
2015-06-19 15:18:28 +02:00
net: make u64_stats_init() a function
2015-06-15 16:02:52 -07:00
vme: export vme_check_window()
2015-06-12 17:26:57 -07:00
md updates for 4.2
2015-06-29 11:10:56 -07:00
watchdog: watchdog_core: Add watchdog registration deferral mechanism
2015-06-29 11:51:06 +02:00
zpool: remove zpool_evict()
2015-06-25 17:00:37 -07:00
