[BK PATCH][LSM] Early init for security modules and various cleanups

From: Chris Wright (chris@wirex.com)
Date: Mon Jun 02 2003 - 04:49:10 EST

Hi Linus,

Here is a batch of LSM updates. This patchset allows for statically
linked security modules to be initialized earlier in the boot sequence
to give consistent security labels to the earliest dynamically created
objects such as filesystems and kernel threads. This patch was acked
by nearly all the arch maintainers, then subsequently updated based on
Sam Ravnborg's feedback. The current version was floated passed arch
maintainers without much response, but it did at least get one ack
from DaveM.

Additional changes are removing two unused hooks, fixing a bug that Jakub
Jelinek reported in setfs[ug]id, and fixing some capability checks in
oom killer.

Please consider pulling from: bk://lsm.bkbits.net/linus-2.5

This will update these files:

 arch/alpha/vmlinux.lds.S | 3 +
 arch/arm/vmlinux-armo.lds.in | 1
 arch/arm/vmlinux-armv.lds.in | 1
 arch/cris/vmlinux.lds.S | 4 +-
 arch/h8300/platform/h8300h/generic/rom.ld | 1
 arch/i386/vmlinux.lds.S | 1
 arch/ia64/vmlinux.lds.S | 4 ++
 arch/m68k/vmlinux-std.lds | 1
 arch/m68k/vmlinux-sun3.lds | 1
 arch/m68knommu/vmlinux.lds.S | 4 --
 arch/mips/vmlinux.lds.S | 1
 arch/mips64/vmlinux.lds.S | 1
 arch/parisc/vmlinux.lds.S | 1
 arch/ppc/vmlinux.lds.S | 2 +
 arch/ppc64/vmlinux.lds.S | 1
 arch/s390/vmlinux.lds.S | 1
 arch/sh/vmlinux.lds.S | 1
 arch/sparc/vmlinux.lds.S | 1
 arch/sparc64/vmlinux.lds.S | 1
 arch/x86_64/vmlinux.lds.S | 1
 fs/namei.c | 2 -
 include/asm-generic/vmlinux.lds.h | 6 +++
 include/linux/init.h | 6 +++
 include/linux/security.h | 49 ++++++------------------------
 init/main.c | 2 -
 kernel/sys.c | 20 ++++--------
 mm/oom_kill.c | 7 ++--
 security/capability.c | 10 ------
 security/dummy.c | 12 -------
 security/root_plug.c | 3 -
 security/security.c | 13 +++++++
 31 files changed, 77 insertions(+), 85 deletions(-)

with these changes:

Chris Wright:
  o [LSM] early init for security modules. As discussed before, this allows
  for early initialization of security modules when compiled statically into
  the kernel. The standard do_initcalls is too late for complete coverage of
  all filesystems and threads, for example.
  o [LSM] Remove security_inode_permission_lite hook
  o [LSM] Remove task_kmod_set_label hook, it is no longer necessary

Jakub Jelínek:
  o [LSM] make sure setfsuid/setfsgid return values are right. Before
  include/linux/security.h was added, setfsuid/setfsgid always returned

Stephen D. Smalley:
  o [LSM] Replaced the direct capability bit tests with calls to the
  security_capable hook in mm/oom_kill.c

thanks,
-chris 

--
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

This archive was generated by hypermail 2b29 : Sat Jun 07 2003 - 22:00:16 EST