kernel/git/stable/linux.git/security/selinux/nlmsgtab.c, branch linux-3.5.y

netfilter: remove ip_queue support

2012-05-08T18:25:42+00:00

This patch removes ip_queue support which was marked as obsolete years ago. The nfnetlink_queue modules provides more advanced user-space packet queueing mechanism. This patch also removes capability code included in SELinux that refers to ip_queue. Otherwise, we break compilation. Several warning has been sent regarding this to the mailing list in the past month without anyone rising the hand to stop this with some strong argument. Signed-off-by: Pablo Neira Ayuso

selinux: sparse fix: fix warnings in netlink code

2011-09-09T23:56:31+00:00

Fix sparse warnings in SELinux Netlink code. Signed-off-by: James Morris

SELinux: define permissions for DCB netlink messages

2010-12-16T17:50:17+00:00

Commit 2f90b865 added two new netlink message types to the netlink route socket. SELinux has hooks to define if netlink messages are allowed to be sent or received, but it did not know about these two new message types. By default we allow such actions so noone likely noticed. This patch adds the proper definitions and thus proper permissions enforcement. Signed-off-by: Eric Paris

Selinux: Remove unused headers skbuff.h in selinux/nlmsgtab.c

2010-03-03T21:51:06+00:00

skbuff.h is already included by netlink.h, so remove it. Signed-off-by: Zhitong Wang Signed-off-by: James Morris

SELinux: define audit permissions for audit tree netlink messages

2009-06-02T21:44:53+00:00

Audit trees defined 2 new netlink messages but the netlink mapping tables for selinux permissions were not set up. This patch maps these 2 new operations to AUDIT_WRITE. Signed-off-by: Eric Paris Signed-off-by: James Morris

SELinux: new permission between tty audit and audit socket

2009-03-05T21:50:21+00:00

New selinux permission to separate the ability to turn on tty auditing from the ability to set audit rules. Signed-off-by: Eric Paris Acked-by: Stephen Smalley Signed-off-by: James Morris

selinux: recognize netlink messages for 'ip addrlabel'

2008-11-05T23:08:36+00:00

In enforcing mode '/sbin/ip addrlabel' results in a SELinux error: type=SELINUX_ERR msg=audit(1225698822.073:42): SELinux: unrecognized netlink message type=74 for sclass=43 The problem is missing RTM_*ADDRLABEL entries in SELinux's netlink message types table. Reported in https://bugzilla.redhat.com/show_bug.cgi?id=469423 Signed-off-by: Michal Schmidt Acked-by: Stephen Smalley Signed-off-by: James Morris

SELinux: nlmsgtab.c whitespace, syntax, and static declaraction cleanups

2008-04-21T09:05:07+00:00

This patch changes nlmsgtab.c to fix whitespace and syntax issues. Things that are fixed may include (does not not have to include) whitespace at end of lines spaces followed by tabs spaces used instead of tabs spacing around parenthesis locateion of { around struct and else clauses location of * in pointer declarations removal of initialization of static data to keep it in the right section useless {} in if statemetns useless checking for NULL before kfree fixing of the indentation depth of switch statements and any number of other things I forgot to mention Signed-off-by: Eric Paris Signed-off-by: James Morris

Audit: add TTY input auditing

2007-07-16T16:05:47+00:00

Add TTY input auditing, used to audit system administrator's actions. This is required by various security standards such as DCID 6/3 and PCI to provide non-repudiation of administrator's actions and to allow a review of past actions if the administrator seems to overstep their duties or if the system becomes misconfigured for unknown reasons. These requirements do not make it necessary to audit TTY output as well. Compared to an user-space keylogger, this approach records TTY input using the audit subsystem, correlated with other audit events, and it is completely transparent to the user-space application (e.g. the console ioctls still work). TTY input auditing works on a higher level than auditing all system calls within the session, which would produce an overwhelming amount of mostly useless audit events. Add an "audit_tty" attribute, inherited across fork (). Data read from TTYs by process with the attribute is sent to the audit subsystem by the kernel. The audit netlink interface is extended to allow modifying the audit_tty attribute, and to allow sending explanatory audit events from user-space (for example, a shell might send an event containing the final command, after the interactive command-line editing and history expansion is performed, which might be difficult to decipher from the TTY input alone). Because the "audit_tty" attribute is inherited across fork (), it would be set e.g. for sshd restarted within an audited session. To prevent this, the audit_tty attribute is cleared when a process with no open TTY file descriptors (e.g. after daemon startup) opens a TTY. See https://www.redhat.com/archives/linux-audit/2007-June/msg00000.html for a more detailed rationale document for an older version of this patch. [akpm@linux-foundation.org: build fix] Signed-off-by: Miloslav Trmac Cc: Al Viro Cc: Alan Cox Cc: Paul Fulghum Cc: Casey Schaufler Cc: Steve Grubb Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[IPv6] prefix: Convert RTM_NEWPREFIX notifications to use the new netlink api

2006-12-03T05:22:45+00:00

RTM_GETPREFIX is completely unused and is thus removed. Signed-off-by: Thomas Graf Signed-off-by: David S. Miller