linux.git/security, branch v4.18.19

ima: fix showing large 'violations' or 'runtime_measurements_count'

2018-11-13T19:12:43+00:00

commit 1e4c8dafbb6bf72fb5eca035b861e39c5896c2b7 upstream.

The 12 character temporary buffer is not necessarily long enough to hold
a 'long' value.  Increase it.

Signed-off-by: Eric Biggers 
Cc: stable@vger.kernel.org
Signed-off-by: Mimi Zohar 
Signed-off-by: Greg Kroah-Hartman

selinux: fix mounting of cgroup2 under older policies

2018-11-13T19:12:40+00:00

commit 7bb185edb0306bb90029a5fa6b9cff900ffdbf4b upstream.

commit 901ef845fa2469c ("selinux: allow per-file labeling for cgroupfs")
broke mounting of cgroup2 under older SELinux policies which lacked
a genfscon rule for cgroup2.  This prevents mounting of cgroup2 even
when SELinux is permissive.

Change the handling when there is no genfscon rule in policy to
just mark the inode unlabeled and not return an error to the caller.
This permits mounting and access if allowed by policy, e.g. to
unconfined domains.

I also considered changing the behavior of security_genfs_sid() to
never return -ENOENT, but the current behavior is relied upon by
other callers to perform caller-specific handling.

Fixes: 901ef845fa2469c ("selinux: allow per-file labeling for cgroupfs")
CC: 
Reported-by: Dmitry Vyukov 
Reported-by: Waiman Long 
Signed-off-by: Stephen Smalley 
Tested-by: Waiman Long 
Signed-off-by: Paul Moore 
Signed-off-by: Greg Kroah-Hartman

Smack: ptrace capability use fixes

2018-11-13T19:12:33+00:00

[ Upstream commit dcb569cf6ac99ca899b8109c128b6ae52477a015 ]

This fixes a pair of problems in the Smack ptrace checks
related to checking capabilities. In both cases, as reported
by Lukasz Pawelczyk, the raw capability calls are used rather
than the Smack wrapper that check addition restrictions.
In one case, as reported by Jann Horn, the wrong task is being
checked for capabilities.

Signed-off-by: Casey Schaufler 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

Revert "uapi/linux/keyctl.h: don't use C++ reserved keyword as a struct member name"

2018-09-29T09:55:58+00:00

commit 8c0f9f5b309d627182d5da72a69246f58bde1026 upstream.

This changes UAPI, breaking iwd and libell:

  ell/key.c: In function 'kernel_dh_compute':
  ell/key.c:205:38: error: 'struct keyctl_dh_params' has no member named 'private'; did you mean 'dh_private'?
    struct keyctl_dh_params params = { .private = private,
                                        ^~~~~~~
                                        dh_private

This reverts commit 8a2336e549d385bb0b46880435b411df8d8200e8.

Fixes: 8a2336e549d3 ("uapi/linux/keyctl.h: don't use C++ reserved keyword as a struct member name")
Signed-off-by: Lubomir Rintel 
Signed-off-by: David Howells 
cc: Randy Dunlap 
cc: Mat Martineau 
cc: Stephan Mueller 
cc: James Morris 
cc: "Serge E. Hallyn" 
cc: Mat Martineau 
cc: Andrew Morton 
cc: Linus Torvalds 
cc: 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

security: check for kstrdup() failure in lsm_append()

2018-09-26T06:39:36+00:00

[ Upstream commit 87ea58433208d17295e200d56be5e2a4fe4ce7d6 ]

lsm_append() should return -ENOMEM if memory allocation failed.

Fixes: d69dece5f5b6 ("LSM: Add /sys/kernel/security/lsm")
Signed-off-by: Eric Biggers 
Signed-off-by: James Morris 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

evm: Don't deadlock if a crypto algorithm is unavailable

2018-09-26T06:39:36+00:00

[ Upstream commit e2861fa71641c6414831d628a1f4f793b6562580 ]

When EVM attempts to appraise a file signed with a crypto algorithm the
kernel doesn't have support for, it will cause the kernel to trigger a
module load. If the EVM policy includes appraisal of kernel modules this
will in turn call back into EVM - since EVM is holding a lock until the
crypto initialisation is complete, this triggers a deadlock. Add a
CRYPTO_NOLOAD flag and skip module loading if it's set, and add that flag
in the EVM case in order to fail gracefully with an error message
instead of deadlocking.

Signed-off-by: Matthew Garrett 
Acked-by: Herbert Xu 
Signed-off-by: Mimi Zohar 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

Smack: Fix handling of IPv4 traffic received by PF_INET6 sockets

2018-09-26T06:39:26+00:00

[ Upstream commit 129a99890936766f4b69b9da7ed88366313a9210 ]

A socket which has sk_family set to PF_INET6 is able to receive not
only IPv6 but also IPv4 traffic (IPv4-mapped IPv6 addresses).

Prior to this patch, the smk_skb_to_addr_ipv6() could have been
called for socket buffers containing IPv4 packets, in result such
traffic was allowed.

Signed-off-by: Piotr Sawicki 
Signed-off-by: Casey Schaufler 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

uapi/linux/keyctl.h: don't use C++ reserved keyword as a struct member name

2018-09-15T07:47:00+00:00

commit 8a2336e549d385bb0b46880435b411df8d8200e8 upstream.

Since this header is in "include/uapi/linux/", apparently people want to
use it in userspace programs -- even in C++ ones.  However, the header
uses a C++ reserved keyword ("private"), so change that to "dh_private"
instead to allow the header file to be used in C++ userspace.

Fixes https://bugzilla.kernel.org/show_bug.cgi?id=191051
Link: http://lkml.kernel.org/r/0db6c314-1ef4-9bfa-1baa-7214dd2ee061@infradead.org
Fixes: ddbb41148724 ("KEYS: Add KEYCTL_DH_COMPUTE command")
Signed-off-by: Randy Dunlap 
Reviewed-by: Andrew Morton 
Cc: David Howells 
Cc: James Morris 
Cc: "Serge E. Hallyn" 
Cc: Mat Martineau 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

selinux: cleanup dentry and inodes on error in selinuxfs

2018-09-15T07:46:53+00:00

[ Upstream commit 7e4237faa7213c1cc1d0aa65a44c67ba4729ce9f ]

If the resource requested by d_alloc_name is not added to the linked
list through d_add, then dput needs to be called to release the
subsequent abnormal branch to avoid resource leakage.

Add missing dput to selinuxfs.c

Signed-off-by: nixiaoming 
[PM: tweak the subject line]
Signed-off-by: Paul Moore 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

apparmor: fix an error code in __aa_create_ns()

2018-09-15T07:46:46+00:00

[ Upstream commit 0a6b29230ec336189bab32498df3f06c8a6944d8 ]

We should return error pointers in this function.  Returning NULL
results in a NULL dereference in the caller.

Fixes: 73688d1ed0b8 ("apparmor: refactor prepare_ns() and make usable from different views")
Signed-off-by: Dan Carpenter 
Signed-off-by: John Johansen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman