iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'fixes-v5.1-a' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Browse Source 
Pull security layer fixes from James Morris:
 "Yama and LSM config fixes"

* 'fixes-v5.1-a' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  LSM: Revive CONFIG_DEFAULT_SECURITY_* for "make oldconfig"
  Yama: mark local symbols as static
This commit is contained in:
Linus Torvalds
2019-03-30 09:19:09 -07:00
parent 922c010cf2 2623c4fbe2
commit 12195302ee
2 changed files with 42 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
security/Kconfig
View File

@@ -239,8 +239,46 @@ source "security/safesetid/Kconfig"
source "security/integrity/Kconfig" source "security/integrity/Kconfig"
choice
prompt "First legacy 'major LSM' to be initialized"
default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
default DEFAULT_SECURITY_DAC
help
This choice is there only for converting CONFIG_DEFAULT_SECURITY
in old kernel configs to CONFIG_LSM in new kernel configs. Don't
change this choice unless you are creating a fresh kernel config,
for this choice will be ignored after CONFIG_LSM has been set.
Selects the legacy "major security module" that will be
initialized first. Overridden by non-default CONFIG_LSM.
config DEFAULT_SECURITY_SELINUX
bool "SELinux" if SECURITY_SELINUX=y
config DEFAULT_SECURITY_SMACK
bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
config DEFAULT_SECURITY_TOMOYO
bool "TOMOYO" if SECURITY_TOMOYO=y
config DEFAULT_SECURITY_APPARMOR
bool "AppArmor" if SECURITY_APPARMOR=y
config DEFAULT_SECURITY_DAC
bool "Unix Discretionary Access Controls"
endchoice
config LSM config LSM
string "Ordered list of enabled LSMs" string "Ordered list of enabled LSMs"
default "yama,loadpin,safesetid,integrity,smack,selinux,tomoyo,apparmor" if DEFAULT_SECURITY_SMACK
default "yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo" if DEFAULT_SECURITY_APPARMOR
default "yama,loadpin,safesetid,integrity,tomoyo" if DEFAULT_SECURITY_TOMOYO
default "yama,loadpin,safesetid,integrity" if DEFAULT_SECURITY_DAC
default "yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor" default "yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor"
help help
A comma-separated list of LSMs, in initialization order. A comma-separated list of LSMs, in initialization order.

8
security/yama/yama_lsm.c
View File

@@ -206,7 +206,7 @@ static void yama_ptracer_del(struct task_struct *tracer,
* yama_task_free - check for task_pid to remove from exception list * yama_task_free - check for task_pid to remove from exception list
* @task: task being removed * @task: task being removed
*/ */
void yama_task_free(struct task_struct *task) static void yama_task_free(struct task_struct *task)
{ {
yama_ptracer_del(task, task); yama_ptracer_del(task, task);
} }
@@ -222,7 +222,7 @@ void yama_task_free(struct task_struct *task)
* Return 0 on success, -ve on error. -ENOSYS is returned when Yama * Return 0 on success, -ve on error. -ENOSYS is returned when Yama
* does not handle the given option. * does not handle the given option.
*/ */
int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3, static int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,
unsigned long arg4, unsigned long arg5) unsigned long arg4, unsigned long arg5)
{ {
int rc = -ENOSYS; int rc = -ENOSYS;
@@ -401,7 +401,7 @@ static int yama_ptrace_access_check(struct task_struct *child,
* *
* Returns 0 if following the ptrace is allowed, -ve on error. * Returns 0 if following the ptrace is allowed, -ve on error.
*/ */
int yama_ptrace_traceme(struct task_struct *parent) static int yama_ptrace_traceme(struct task_struct *parent)
{ {
int rc = 0; int rc = 0;
@@ -452,7 +452,7 @@ static int yama_dointvec_minmax(struct ctl_table *table, int write,
static int zero; static int zero;
static int max_scope = YAMA_SCOPE_NO_ATTACH; static int max_scope = YAMA_SCOPE_NO_ATTACH;
struct ctl_path yama_sysctl_path[] = { static struct ctl_path yama_sysctl_path[] = {
{ .procname = "kernel", }, { .procname = "kernel", },
{ .procname = "yama", }, { .procname = "yama", },
{ } { }