summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* apparmor: fix replacement bug that adds new child to old parentJohn Johansen2016-07-121-1/+1
| | | | | | | | | | | | | | | When set atomic replacement is used and the parent is updated before the child, and the child did not exist in the old parent so there is no direct replacement then the new child is incorrectly added to the old parent. This results in the new parent not having the child(ren) that it should and the old parent when being destroyed asserting the following error. AppArmor: policy_destroy: internal error, policy '<profile/name>' still contains profiles Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
* apparmor: fix refcount bug in profile replacementJohn Johansen2016-07-121-2/+2
| | | | | Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
* Merge tag 'keys-misc-20160708' of ↵James Morris2016-07-094-11/+29
|\ | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into next
| * modsign: Make sign-file determine the format of the X.509 certDavid Howells2016-06-141-8/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sign-file determine the format of the X.509 certificate by reading the first two bytes and seeing if the first byte is 0x30 and the second 0x81-0x84. If this is the case, assume it's DER encoded, otherwise assume it to be PEM encoded. Without this, it gets awkward to deal with the error messages from d2i_X509_bio() when we want to call BIO_reset() and then PEM_read_bio() in case the certificate was PEM encoded rather than X.509 encoded. Reported-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Ben Hutchings <ben@decadent.org.uk> cc: David Woodhouse <dwmw2@infradead.org> cc: Juerg Haefliger <juerg.haefliger@hpe.com> cc: Ben Hutchings <ben@decadent.org.uk>
| * KEYS: Strip trailing spacesDavid Howells2016-06-143-3/+3
| | | | | | | | | | | | Strip some trailing spaces. Signed-off-by: David Howells <dhowells@redhat.com>
* | Merge branch 'smack-for-4.8' of https://github.com/cschaufler/smack-next ↵James Morris2016-07-082-1/+4
|\ \ | | | | | | | | | into next
| * | MAINTAINERS - Location of the Smack repositoryCasey Schaufler2016-07-071-1/+1
| | | | | | | | | | | | | | | | | | The Smack working tree has moved from gitorious to github. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
| * | Smack: ignore null signal in smack_task_killRafal Krypa2016-06-081-0/+3
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kill with signal number 0 is commonly used for checking PID existence. Smack treated such cases like any other kills, although no signal is actually delivered when sig == 0. Checking permissions when sig == 0 didn't prevent an unprivileged caller from learning whether PID exists or not. When it existed, kernel returned EPERM, when it didn't - ESRCH. The only effect of policy check in such case is noise in audit logs. This change lets Smack silently ignore kill() invocations with sig == 0. Signed-off-by: Rafal Krypa <r.krypa@samsung.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com>
* | samples/seccomp: Add standalone config optionOlof Johansson2016-07-072-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a separate Kconfig option for SAMPLES_SECCOMP. Main reason for this is that, just like other samples, it's forced to be a module. Without this, since the sample is a target only controlled by CONFIG_SECCOMP_FILTER, the samples will be built before include files are put in place properly. For example, from an arm64 allmodconfig built with "make -sk -j 32" (without specific target), the following happens: samples/seccomp/bpf-fancy.c:13:27: fatal error: linux/seccomp.h: No such file or directory samples/seccomp/bpf-helper.h:20:50: fatal error: linux/seccomp.h: No such file or directory samples/seccomp/dropper.c:20:27: fatal error: linux/seccomp.h: No such file or directory samples/seccomp/bpf-direct.c:21:27: fatal error: linux/seccomp.h: No such file or directory So, just stick to the same format as other samples. Signed-off-by: Olof Johansson <olof@lixom.net> Signed-off-by: Kees Cook <keescook@chromium.org>
* | Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/selinux ↵James Morris2016-07-0736-259/+3511
|\ \ | | | | | | | | | into next
| * | netlabel: Implement CALIPSO config functions for SMACK.Huw Davies2016-06-274-0/+238
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SMACK uses similar functions to control CIPSO, these are the equivalent functions for CALIPSO and follow exactly the same semantics. int netlbl_cfg_calipso_add(struct calipso_doi *doi_def, struct netlbl_audit *audit_info) Adds a CALIPSO doi. void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info) Removes a CALIPSO doi. int netlbl_cfg_calipso_map_add(u32 doi, const char *domain, const struct in6_addr *addr, const struct in6_addr *mask, struct netlbl_audit *audit_info) Creates a mapping between a domain and a CALIPSO doi. If addr and mask are non-NULL this creates an address-selector type mapping. This also extends netlbl_cfg_map_del() to remove IPv6 address-selector mappings. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | calipso: Add a label cache.Huw Davies2016-06-278-12/+360
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This works in exactly the same way as the CIPSO label cache. The idea is to allow the lsm to cache the result of a secattr lookup so that it doesn't need to perform the lookup for every skbuff. It introduces two sysctl controls: calipso_cache_enable - enables/disables the cache. calipso_cache_bucket_size - sets the size of a cache bucket. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | calipso: Add validation of CALIPSO option.Huw Davies2016-06-273-0/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Lengths, checksum and the DOI are checked. Checking of the level and categories are left for the socket layer. CRC validation is performed in the calipso module to avoid unconditionally linking crc_ccitt() into ipv6. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | netlabel: Pass a family parameter to netlbl_skbuff_err().Huw Davies2016-06-276-12/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This makes it possible to route the error to the appropriate labelling engine. CALIPSO is far less verbose than CIPSO when encountering a bogus packet, so there is no need for a CALIPSO error handler. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | calipso: Allow the lsm to label the skbuff directly.Huw Davies2016-06-276-4/+308
| | | | | | | | | | | | | | | | | | | | | | | | | | | In some cases, the lsm needs to add the label to the skbuff directly. A NF_INET_LOCAL_OUT IPv6 hook is added to selinux to match the IPv4 behaviour. This allows selinux to label the skbuffs that it requires. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | ipv6: constify the skb pointer of ipv6_find_tlv().Huw Davies2016-06-272-2/+2
| | | | | | | | | | | | | | | Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | calipso: Allow request sockets to be relabelled by the lsm.Huw Davies2016-06-276-8/+163
| | | | | | | | | | | | | | | | | | | | | | | | | | | Request sockets need to have a label that takes into account the incoming connection as well as their parent's label. This is used for the outgoing SYN-ACK and for their child full-socket. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | ipv6: Allow request socks to contain IPv6 options.Huw Davies2016-06-274-7/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If set, these will take precedence over the parent's options during both sending and child creation. If they're not set, the parent's options (if any) will be used. This is to allow the security_inet_conn_request() hook to modify the IPv6 options in just the same way that it already may do for IPv4. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | netlabel: Prevent setsockopt() from changing the hop-by-hop option.Huw Davies2016-06-271-1/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | If a socket has a netlabel in place then don't let setsockopt() alter the socket's IPv6 hop-by-hop option. This is in the same spirit as the existing check for IPv4. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | calipso: Set the calipso socket label to match the secattr.Huw Davies2016-06-2710-10/+728
| | | | | | | | | | | | | | | | | | | | | | | | | | | CALIPSO is a hop-by-hop IPv6 option. A lot of this patch is based on the equivalent CISPO code. The main difference is due to manipulating the options in the hop-by-hop header. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | netlabel: Move bitmap manipulation functions to the NetLabel core.Huw Davies2016-06-273-79/+85
| | | | | | | | | | | | | | | | | | | | | This is to allow the CALIPSO labelling engine to use these. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | ipv6: Add ipv6_renew_options_kern() that accepts a kernel mem pointer.Huw Davies2016-06-272-0/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The functionality is equivalent to ipv6_renew_options() except that the newopt pointer is in kernel, not user, memory The kernel memory implementation will be used by the CALIPSO network labelling engine, which needs to be able to set IPv6 hop-by-hop options. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | netlabel: Add support for removing a CALIPSO DOI.Huw Davies2016-06-274-0/+150
| | | | | | | | | | | | | | | | | | | | | | | | | | | Remove a specified DOI through the NLBL_CALIPSO_C_REMOVE command. It requires the attribute: NLBL_CALIPSO_A_DOI. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | netlabel: Add support for creating a CALIPSO protocol domain mapping.Huw Davies2016-06-274-5/+89
| | | | | | | | | | | | | | | | | | | | | | | | This extends the NLBL_MGMT_C_ADD and NLBL_MGMT_C_ADDDEF commands to accept CALIPSO protocol DOIs. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | netlabel: Add support for enumerating the CALIPSO DOI list.Huw Davies2016-06-274-0/+165
| | | | | | | | | | | | | | | | | | | | | | | | Enumerate the DOI list through the NLBL_CALIPSO_C_LISTALL command. It takes no attributes. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | netlabel: Add support for querying a CALIPSO DOI.Huw Davies2016-06-274-0/+193
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Query a specified DOI through the NLBL_CALIPSO_C_LIST command. It requires the attribute: NLBL_CALIPSO_A_DOI. The reply will contain: NLBL_CALIPSO_A_MTYPE Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | netlabel: Initial support for the CALIPSO netlink protocol.Huw Davies2016-06-2712-2/+604
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CALIPSO is a packet labelling protocol for IPv6 which is very similar to CIPSO. It is specified in RFC 5570. Much of the code is based on the current CIPSO code. This adds support for adding passthrough-type CALIPSO DOIs through the NLBL_CALIPSO_C_ADD command. It requires attributes: NLBL_CALIPSO_A_TYPE which must be CALIPSO_MAP_PASS. NLBL_CALIPSO_A_DOI. In passthrough mode the CALIPSO engine will map MLS secattr levels and categories directly to the packet label. At this stage, the major difference between this and the CIPSO code is that IPv6 may be compiled as a module. To allow for this the CALIPSO functions are registered at module init time. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | netlabel: Add an address family to domain hash entries.Huw Davies2016-06-276-58/+192
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The reason is to allow different labelling protocols for different address families with the same domain. This requires the addition of an address family attribute in the netlink communication protocol. It is used in several messages: NLBL_MGMT_C_ADD and NLBL_MGMT_C_ADDDEF take it as an optional attribute for the unlabelled protocol. It may be one of AF_INET, AF_INET6 or AF_UNSPEC (to specify both address families). If it is missing, it defaults to AF_UNSPEC. NLBL_MGMT_C_LISTALL and NLBL_MGMT_C_LISTDEF return it as part of the enumeration of each item. Addtionally, it may be sent to LISTDEF to specify which address family to return. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | netlabel: Mark rcu pointers with __rcu.Huw Davies2016-06-272-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | This fixes sparse errors of the form: incompatible types in comparison expression (different address spaces) Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | selinux: fix type mismatchHeinrich Schuchardt2016-06-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | avc_cache_threshold is of type unsigned int. Do not use a signed new_value in sscanf(page, "%u", &new_value). Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> [PM: subject prefix fix, description cleanup] Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | netlabel: handle sparse category maps in netlbl_catmap_getlong()Paul Moore2016-06-091-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In cases where the category bitmap is sparse enough that gaps exist between netlbl_lsm_catmap structs, callers to netlbl_catmap_getlong() could find themselves prematurely ending their search through the category bitmap. Further, the methods used to calculate the 'idx' and 'off' values were incorrect for bitmaps this large. This patch changes the netlbl_catmap_getlong() behavior so that it always skips over gaps and calculates the index and offset values correctly. Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | selinux: import NetLabel category bitmaps correctlyPaul Moore2016-06-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The existing ebitmap_netlbl_import() code didn't correctly handle the case where the ebitmap_node was not aligned/sized to a power of two, this patch fixes this (on x86_64 ebitmap_node contains six bitmaps making a range of 0..383). Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | iucv: properly clone LSM attributes to newly created child socketsPaul Moore2016-06-071-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | Much like we had to do for AF_BLUETOOTH and AF_ALG, make sure we properly clone the parent socket's LSM attributes to newly created child sockets. Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | netlabel: add address family checks to netlbl_{sock,req}_delattr()Paul Moore2016-06-061-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It seems risky to always rely on the caller to ensure the socket's address family is correct before passing it to the NetLabel kAPI, especially since we see at least one LSM which didn't. Add address family checks to the *_delattr() functions to help prevent future problems. Cc: <stable@vger.kernel.org> Reported-by: Maninder Singh <maninder1.s@samsung.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * | selinux: Only apply bounds checking to source typesStephen Smalley2016-05-311-48/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current bounds checking of both source and target types requires allowing any domain that has access to the child domain to also have the same permissions to the parent, which is undesirable. Drop the target bounds checking. KaiGai Kohei originally removed all use of target bounds in commit 7d52a155e38d ("selinux: remove dead code in type_attribute_bounds_av()") but this was reverted in commit 2ae3ba39389b ("selinux: libsepol: remove dead code in check_avtab_hierarchy_callback()") because it would have required explicitly allowing the parent any permissions to the child that the child is allowed to itself. This change in contrast retains the logic for the case where both source and target types are bounded, thereby allowing access if the parent of the source is allowed the corresponding permissions to the parent of the target. Further, this change reworks the logic such that we only perform a single computation for each case and there is no ambiguity as to how to resolve a bounds violation. Under the new logic, if the source type and target types are both bounded, then the parent of the source type must be allowed the same permissions to the parent of the target type. If only the source type is bounded, then the parent of the source type must be allowed the same permissions to the target type. Examples of the new logic and comparisons with the old logic: 1. If we have: typebounds A B; then: allow B self:process <permissions>; will satisfy the bounds constraint iff: allow A self:process <permissions>; is also allowed in policy. Under the old logic, the allow rule on B satisfies the bounds constraint if any of the following three are allowed: allow A B:process <permissions>; or allow B A:process <permissions>; or allow A self:process <permissions>; However, either of the first two ultimately require the third to satisfy the bounds constraint under the old logic, and therefore this degenerates to the same result (but is more efficient - we only need to perform one compute_av call). 2. If we have: typebounds A B; typebounds A_exec B_exec; then: allow B B_exec:file <permissions>; will satisfy the bounds constraint iff: allow A A_exec:file <permissions>; is also allowed in policy. This is essentially the same as #1; it is merely included as an example of dealing with object types related to a bounded domain in a manner that satisfies the bounds relationship. Note that this approach is preferable to leaving B_exec unbounded and having: allow A B_exec:file <permissions>; in policy because that would allow B's entrypoints to be used to enter A. Similarly for _tmp or other related types. 3. If we have: typebounds A B; and an unbounded type T, then: allow B T:file <permissions>; will satisfy the bounds constraint iff: allow A T:file <permissions>; is allowed in policy. The old logic would have been identical for this example. 4. If we have: typebounds A B; and an unbounded domain D, then: allow D B:unix_stream_socket <permissions>; is not subject to any bounds constraints under the new logic because D is not bounded. This is desirable so that we can allow a domain to e.g. connectto a child domain without having to allow it to do the same to its parent. The old logic would have required: allow D A:unix_stream_socket <permissions>; to also be allowed in policy. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> [PM: re-wrapped description to appease checkpatch.pl] Signed-off-by: Paul Moore <paul@paul-moore.com>
* | | ima: extend the measurement entry specific pcrEric Richter2016-06-301-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | Extend the PCR supplied as a parameter, instead of assuming that the measurement entry uses the default configured PCR. Signed-off-by: Eric Richter <erichte@linux.vnet.ibm.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* | | ima: change integrity cache to store measured pcrEric Richter2016-06-303-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IMA avoids re-measuring files by storing the current state as a flag in the integrity cache. It will then skip adding a new measurement log entry if the cache reports the file as already measured. If a policy measures an already measured file to a new PCR, the measurement will not be added to the list. This patch implements a new bitfield for specifying which PCR the file was measured into, rather than if it was measured. Signed-off-by: Eric Richter <erichte@linux.vnet.ibm.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* | | ima: redefine duplicate template entriesEric Richter2016-06-301-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Template entry duplicates are prevented from being added to the measurement list by checking a hash table that contains the template entry digests. However, the PCR value is not included in this comparison, so duplicate template entry digests with differing PCRs may be dropped. This patch redefines duplicate template entries as template entries with the same digest and same PCR values. Reported-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: Eric Richter <erichte@linux.vnet.ibm.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* | | ima: change ima_measurements_show() to display the entry specific pcrEric Richter2016-06-301-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | IMA assumes that the same default Kconfig PCR is extended for each entry. This patch replaces the default configured PCR with the policy defined PCR. Signed-off-by: Eric Richter <erichte@linux.vnet.ibm.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* | | ima: include pcr for each measurement log entryEric Richter2016-06-304-8/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | The IMA measurement list entries include the Kconfig defined PCR value. This patch defines a new ima_template_entry field for including the PCR as specified in the policy rule. Signed-off-by: Eric Richter <erichte@linux.vnet.ibm.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* | | ima: extend ima_get_action() to return the policy pcrEric Richter2016-06-305-7/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Different policy rules may extend different PCRs. This patch retrieves the specific PCR for the matched rule. Subsequent patches will include the rule specific PCR in the measurement list and extend the appropriate PCR. Signed-off-by: Eric Richter <erichte@linux.vnet.ibm.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* | | ima: add policy support for extending different pcrsEric Richter2016-06-301-1/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch defines a new IMA measurement policy rule option "pcr=", which allows extending different PCRs on a per rule basis. For example, the system independent files could extend the default IMA Kconfig specified PCR, while the system dependent files could extend a different PCR. The following is an example of this usage with an SELinux policy; the rule would extend PCR 11 with system configuration files: measure func=FILE_CHECK mask=MAY_READ obj_type=system_conf_t pcr=11 Changelog v3: - FIELD_SIZEOF returns bytes, not bits. Fixed INVALID_PCR Signed-off-by: Eric Richter <erichte@linux.vnet.ibm.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* | | integrity: add measured_pcrs field to integrity cacheEric Richter2016-06-302-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To keep track of which measurements have been extended to which PCRs, this patch defines a new integrity_iint_cache field named measured_pcrs. This field is a bitmask of the PCRs measured. Each bit corresponds to a PCR index. For example, bit 10 corresponds to PCR 10. Signed-off-by: Eric Richter <erichte@linux.vnet.ibm.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* | | tpm_crb: fix address space of the return pointer in crb_map_res()Jarkko Sakkinen2016-06-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When running make C=2 M=drivers/char/tpm/ CHECK drivers/char/tpm//tpm_crb.c drivers/char/tpm//tpm_crb.c:248:31: warning: incorrect type in return expression (different address spaces) drivers/char/tpm//tpm_crb.c:248:31: expected void [noderef] <asn:2>* drivers/char/tpm//tpm_crb.c:248:31: got void * CC: stable@vger.kernel.org Fixes: 1bd047be37d9 ("tpm_crb: Use devm_ioremap_resource") Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
* | | tpm_vtpm_proxy: fix address space of a user pointer in vtpmx_fops_ioctl()Jarkko Sakkinen2016-06-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When running make C=2 M=drivers/char/tpm/ CC [M] drivers/char/tpm//tpm_crb.o CHECK drivers/char/tpm//tpm_vtpm_proxy.c drivers/char/tpm//tpm_vtpm_proxy.c:552:32: warning: incorrect type in assignment (different address spaces) drivers/char/tpm//tpm_vtpm_proxy.c:552:32: expected struct vtpm_proxy_new_dev *vtpm_new_dev_p drivers/char/tpm//tpm_vtpm_proxy.c:552:32: got void [noderef] <asn:1>*argp drivers/char/tpm//tpm_vtpm_proxy.c:553:51: warning: incorrect type in argument 2 (different address spaces) drivers/char/tpm//tpm_vtpm_proxy.c:553:51: expected void const [noderef] <asn:1>*from drivers/char/tpm//tpm_vtpm_proxy.c:553:51: got struct vtpm_proxy_new_dev *vtpm_new_dev_p drivers/char/tpm//tpm_vtpm_proxy.c:559:34: warning: incorrect type in argument 1 (different address spaces) drivers/char/tpm//tpm_vtpm_proxy.c:559:34: expected void [noderef] <asn:1>*to drivers/char/tpm//tpm_vtpm_proxy.c:559:34: got struct vtpm_proxy_new_dev *vtpm_new_dev_p The __user annotation was missing from the corresponding variable. Fixes: 794c38e01358 ("tpm: Proxy driver for supporting multiple emulated TPMs") Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
* | | tpm/tpm_tis_spi: Add support for spi phyChristophe Ricard2016-06-254-0/+309
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Spi protocol standardized by the TCG is now supported by most of TPM vendors. It supports SPI Bit Protocol as describe in the TCG PTP specification (chapter 6.4.6 SPI Bit Protocol). Irq mode is not supported. This commit is based on the initial work by Peter Huewe. Signed-off-by: Peter Huewe <peter.huewe@infineon.com> Signed-off-by: Alexander Steffen <Alexander.Steffen@infineon.com> Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* | | tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phyChristophe Ricard2016-06-255-882/+958
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To avoid code duplication between the old tpm_tis and the new and future native tcg tis driver(ie: spi, i2c...), the tpm_tis driver was reworked, so that all common logic is extracted and can be reused from all drivers. The core methods can also be used from other TIS like drivers. itpm workaround is now managed with a specific tis flag TPM_TIS_ITPM_POSSIBLE. This commit is based on the initial work by Peter Huewe. Signed-off-by: Peter Huewe <peter.huewe@infineon.com> Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* | | devicetree: Add Trusted Computing Group to vendor-prefix.txtChristophe Ricard2016-06-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add missing vendor to vendor-prefix.txt. Trusted Computing Group design common specifications for TPM (Trusted Platform Module) vendors. TCG designates a TPM answering to a public specification. This commit is based on the initial work by Peter Huewe. Cc: devicetree@vger.kernel.org Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Acked-by: Rob Herring <robh@kernel.org> Acked-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* | | devicetree: Add infineon to vendor-prefix.txtChristophe Ricard2016-06-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add missing vendor to vendor-prefix.txt This commit is based on the initial work by Peter Huewe. Cc: devicetree@vger.kernel.org Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Acked-by: Rob Herring <robh@kernel.org> Acked-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* | | tpm_tis: Introduce intermediate layer for TPM accessChristophe Ricard2016-06-252-101/+270
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This splits tpm_tis in a high-level protocol part and a low-level interface for the actual TPM communication. The low-level interface can then be implemented by additional drivers to provide access to TPMs using other mechanisms, for example native I2C or SPI transfers, while still reusing the same TIS protocol implementation. Though the ioread/iowrite calls cannot fail, other implementations of this interface might want to return error codes if their communication fails. This follows the usual pattern of negative values representing errors and zero representing success. Positive values are not used (yet). Errors are passed back to the caller if possible. If the interface of a function does not allow that, it tries to do the most sensible thing it can, but this might also mean ignoring the error in this instance. This commit is based on the initial work by Peter Huewe. Signed-off-by: Alexander Steffen <Alexander.Steffen@infineon.com> Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-29 16:30:58 +0100