| 2927 |
routines for parsing/printing IPv4/IPv6 address from kernel 3.0 into |
routines for parsing/printing IPv4/IPv6 address from kernel 3.0 into |
| 2928 |
TOMOYO 1.8.2. |
TOMOYO 1.8.2. |
| 2929 |
Now, IPv6 address accepts "::1" instead of "0:0:0:0:0:0:0:1". |
Now, IPv6 address accepts "::1" instead of "0:0:0:0:0:0:0:1". |
| 2930 |
|
|
| 2931 |
|
Fix 2011/09/03 |
| 2932 |
|
|
| 2933 |
|
@ Avoid race when retrying "file execute" permission check. |
| 2934 |
|
|
| 2935 |
|
There was a race window that the pathname which is subjected to |
| 2936 |
|
"file execute" permission check when retrying via supervisor's decision |
| 2937 |
|
because the pathname was recalculated upon retry. Though, there is an |
| 2938 |
|
inevitable race window even without supervisor, for we have to calculate |
| 2939 |
|
the symbolic link's pathname from "struct linux_binprm"->filename rather |
| 2940 |
|
than from "struct linux_binprm"->file because we cannot back calculate |
| 2941 |
|
the symbolic link's pathname from the dereferenced pathname. |
| 2942 |
|
|
| 2943 |
|
@ Remove unneeded daemonize(). |
| 2944 |
|
|
| 2945 |
|
Garbage collector thread is created using kthread_create() since 2.6.7. |
| 2946 |
|
Kernel threads created by kthread_create() does not need to call |
| 2947 |
|
daemonize(). |
| 2948 |
|
|
| 2949 |
|
Fix 2011/09/16 |
| 2950 |
|
|
| 2951 |
|
@ Allow specifying domain transition preference. |
| 2952 |
|
|
| 2953 |
|
I got an opinion that it is difficult to use exception policy's domain |
| 2954 |
|
transition control directives because they need to match the pathname |
| 2955 |
|
specified to "file execute" directives. For example, if "file execute |
| 2956 |
|
/bin/\*\-ls\-cat" is given, corresponding domain transition control |
| 2957 |
|
directive needs to be like "no_keep_domain /bin/\*\-ls\-cat from any". |
| 2958 |
|
|
| 2959 |
|
To solve this difficulty, I introduced optional argument that supersedes |
| 2960 |
|
exception policy's domain transition control directives. |
| 2961 |
|
|
| 2962 |
|
file execute /bin/ls keep exec.realpath="/bin/ls" exec.argv[0]="ls" |
| 2963 |
|
file execute /bin/cat keep exec.realpath="/bin/cat" exec.argv[0]="cat" |
| 2964 |
|
file execute /bin/\*\-ls\-cat child |
| 2965 |
|
file execute /usr/sbin/httpd <apache> exec.realpath="/usr/sbin/httpd" exec.argv[0]="/usr/sbin/httpd" |
| 2966 |
|
|
| 2967 |
|
This argument allows transition to different domains based on conditions. |
| 2968 |
|
|
| 2969 |
|
<kernel> /usr/sbin/sshd |
| 2970 |
|
file execute /bin/bash <kernel> /usr/sbin/sshd //batch-session exec.argc=2 exec.argv[1]="-c" |
| 2971 |
|
file execute /bin/bash <kernel> /usr/sbin/sshd //root-session task.uid=0 |
| 2972 |
|
file execute /bin/bash <kernel> /usr/sbin/sshd //nonroot-session task.uid!=0 |
| 2973 |
|
|
| 2974 |
|
Fix 2011/09/25 |
| 2975 |
|
|
| 2976 |
|
@ Simplify garbage collector. |
| 2977 |
|
|
| 2978 |
|
It turned out that use of batched processing tends to choke garbage |
| 2979 |
|
collector when certain pattern of entries are queued. Thus, I replaced it |
| 2980 |
|
with sequential processing. |
| 2981 |
|
|
| 2982 |
|
Version 1.8.3 2011/09/29 Usability enhancement release. |
| 2983 |
|
|
| 2984 |
|
Fix 2011/10/24 |
| 2985 |
|
|
| 2986 |
|
@ Fix incomplete read after seek. |
| 2987 |
|
|
| 2988 |
|
ccs_flush() tries to flush data to be read as soon as possible. |
| 2989 |
|
ccs_select_domain() (which is called by write()) enqueues data which |
| 2990 |
|
meant to be read by next read(), but previous read()'s read buffer's |
| 2991 |
|
size was not cleared. As a result, since 1.8.0, sequence like |
| 2992 |
|
|
| 2993 |
|
char *cp = "select global-pid=1\n"; |
| 2994 |
|
read(fd, buf1, sizeof(buf1)); |
| 2995 |
|
write(fd, cp, strlen(cp)); |
| 2996 |
|
read(fd, buf2, sizeof(buf2)); |
| 2997 |
|
|
| 2998 |
|
causes enqueued data to be flushed to buf1 rather than buf2. |
| 2999 |
|
|
| 3000 |
|
@ Use query id for reaching target process's domain policy. |
| 3001 |
|
|
| 3002 |
|
Use query id for reaching target process's domain policy rather than |
| 3003 |
|
target process's global PID. This is for synchronizing with TOMOYO 2.x, |
| 3004 |
|
but this change makes /usr/sbin/ccs-queryd more reliable because the |
| 3005 |
|
kernel will return empty domain policy when the query has expired before |
| 3006 |
|
ccs-queryd reaches target process's domain policy. |
| 3007 |
|
|
| 3008 |
|
@ Fix quota counting. |
| 3009 |
|
|
| 3010 |
|
"task manual_domain_transition" should not be counted for quota as with |
| 3011 |
|
"task auto_domain_transition"/"task auto_execute_handler"/ |
| 3012 |
|
"task denied_execute_handler" because these are not appended by learning |
| 3013 |
|
mode. |
| 3014 |
|
|
| 3015 |
|
Fix 2011/11/11 |
| 3016 |
|
|
| 3017 |
|
@ Optimize for object's size. |
| 3018 |
|
|
| 3019 |
|
I rearranged functions/variables into three groups in order to reduce |
| 3020 |
|
object's filesize. Also, I added kernel config options for reducing more |
| 3021 |
|
by excluding unnecessary functionality. |
| 3022 |
|
|
| 3023 |
|
Fix 2011/11/18 |
| 3024 |
|
|
| 3025 |
|
@ Fix kernel config mapping error. |
| 3026 |
|
|
| 3027 |
|
Due to a typo in ccs_p2mac definition, mode for CONFIG::file::execute was |
| 3028 |
|
by error used when checking "file getattr" permission. Most users will |
| 3029 |
|
not be affected by this error because CONFIG::file::execute and |
| 3030 |
|
CONFIG::file::getattr are by default configured to use CONFIG::file or |
| 3031 |
|
CONFIG settings. |
| 3032 |
|
|
| 3033 |
|
Fix 2011/12/08 |
| 3034 |
|
|
| 3035 |
|
@ Follow __d_path() behavior change. (Only 2.6.36 and later) |
| 3036 |
|
|
| 3037 |
|
The behavior of __d_path() has changed in 3.2-rc5. __d_path() now returns |
| 3038 |
|
NULL when the pathname cannot be calculated. You must update to this |
| 3039 |
|
version when using with 3.2-rc5 and later kernels, or the kernel will |
| 3040 |
|
panic because ccs_get_absolute_path() triggers NULL pointer dereference. |
| 3041 |
|
|
| 3042 |
|
The patch that changed the behavior of __d_path() might be backported to |
| 3043 |
|
2.6.36 to 3.1 kernels. You must update to this version if the patch was |
| 3044 |
|
backported, for you will experience the kernel panic as with 3.2-rc5. |
| 3045 |
|
|
| 3046 |
|
The patch that changed the behavior of __d_path() also changed the way of |
| 3047 |
|
handling pathnames under lazy-unmounted directory. Until now, TOMOYO was |
| 3048 |
|
using incomplete pathnames returned by __d_path() when the pathname is |
| 3049 |
|
under lazy-unmounted directory. But from now on, TOMOYO uses different |
| 3050 |
|
pathnames returned by ccs_get_local_path() when the pathname is under |
| 3051 |
|
lazy-unmounted directory (because __d_path() no longer returns it). |
| 3052 |
|
|
| 3053 |
|
Since applications unlikely do lazy unmounts, requesting pathnames under |
| 3054 |
|
lazy-unmounted directory should not happen unless the administrator |
| 3055 |
|
explicitly does lazy unmounts. But pathnames which is defined for such |
| 3056 |
|
conditions in the policy file (if any) will need to be rewritten. |
TOMOYO
Parent Directory
Revision Log
Patch