Index: linux-2.6.11-rsbac-v1.2.4/kernel/sys.c =================================================================== --- linux-2.6.11-rsbac-v1.2.4/kernel/sys.c (Revision 200) +++ linux-2.6.11-rsbac-v1.2.4/kernel/sys.c (Arbeitskopie) @@ -620,7 +620,7 @@ #endif rsbac_target_id.process = current->pid; rsbac_attribute_value.long_dummy = 0; - rsbac_attribute_value.group = rgid; + rsbac_attribute_value.group = egid; #endif if (((old_rgid == egid) || @@ -634,6 +634,12 @@ rsbac_target_id, A_group, rsbac_attribute_value) + && rsbac_adf_request(R_CHANGE_DAC_FS_GROUP, + current->pid, + T_PROCESS, + rsbac_target_id, + A_group, + rsbac_attribute_value) #endif ) new_egid = egid; @@ -844,6 +850,13 @@ A_owner, rsbac_attribute_value)) return -EPERM; + if(!rsbac_adf_request(R_CHANGE_DAC_FS_OWNER, + current->pid, + T_PROCESS, + rsbac_target_id, + A_owner, + rsbac_attribute_value)) + return -EPERM; } #endif #endif @@ -922,6 +935,18 @@ printk(KERN_WARNING "sys_setreuid(): rsbac_adf_set_attr() for euid returned error"); } + if (rsbac_adf_set_attr(R_CHANGE_DAC_FS_OWNER, + current->pid, + T_PROCESS, + rsbac_target_id, + T_NONE, + rsbac_new_target_id, + A_owner, + rsbac_attribute_value)) + { + printk(KERN_WARNING + "sys_setreuid(): rsbac_adf_set_attr() for fsuid returned error"); + } } #endif #endif @@ -1299,6 +1324,30 @@ #endif if (egid != (gid_t) -1) { + /* RSBAC */ + #ifdef CONFIG_RSBAC_DAC_GROUP +#ifdef CONFIG_RSBAC_DEBUG + if (rsbac_debug_aef) + printk(KERN_DEBUG "sys_setresgid(): calling ADF\n"); +#endif + rsbac_target_id.process = current->pid; + rsbac_attribute_value.group = egid; + if(!rsbac_adf_request(R_CHANGE_DAC_EFF_GROUP, + current->pid, + T_PROCESS, + rsbac_target_id, + A_group, + rsbac_attribute_value)) + return -EPERM; + if(!rsbac_adf_request(R_CHANGE_DAC_FS_GROUP, + current->pid, + T_PROCESS, + rsbac_target_id, + A_group, + rsbac_attribute_value)) + return -EPERM; + #endif + if (egid != current->egid) { current->mm->dumpable = 0; @@ -1410,10 +1459,33 @@ { int old_fsgid; + /* RSBAC */ + #ifdef CONFIG_RSBAC_DAC_GROUP + union rsbac_target_id_t rsbac_target_id; + union rsbac_attribute_value_t rsbac_attribute_value; + #endif + old_fsgid = current->fsgid; if (security_task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_FS)) return old_fsgid; + /* RSBAC */ + #ifdef CONFIG_RSBAC_DAC_GROUP +#ifdef CONFIG_RSBAC_DEBUG + if (rsbac_debug_aef) + printk(KERN_DEBUG "sys_setfsgid(): calling ADF\n"); +#endif + rsbac_target_id.process = current->pid; + rsbac_attribute_value.group = gid; + if (!rsbac_adf_request(R_CHANGE_DAC_FS_GROUP, + current->pid, + T_PROCESS, + rsbac_target_id, + A_owner, + rsbac_attribute_value)) + return old_fsgid; + #endif + if (gid == current->gid || gid == current->egid || gid == current->sgid || gid == current->fsgid || capable(CAP_SETGID)) Index: linux-2.6.11-rsbac-v1.2.4/include/rsbac/acl_data_structures.h =================================================================== --- linux-2.6.11-rsbac-v1.2.4/include/rsbac/acl_data_structures.h (Revision 200) +++ linux-2.6.11-rsbac-v1.2.4/include/rsbac/acl_data_structures.h (Arbeitskopie) @@ -222,7 +222,9 @@ #define RSBAC_ACL_ACMAN_G_ENTRY \ { ACLS_USER, \ RSBAC_SECOFF_UID, \ - RSBAC_GROUP_REQUEST_VECTOR } + ( RSBAC_GROUP_REQUEST_VECTOR & \ + ( RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR ) ) \ + | RSBAC_ACL_ACMAN_RIGHTS_VECTOR } #define RSBAC_ACL_SYSADM_G_ENTRY \ { ACLS_USER, \ Index: linux-2.6.11-rsbac-v1.2.4/rsbac/help/debug.c =================================================================== --- linux-2.6.11-rsbac-v1.2.4/rsbac/help/debug.c (Revision 200) +++ linux-2.6.11-rsbac-v1.2.4/rsbac/help/debug.c (Arbeitskopie) @@ -6,7 +6,7 @@ /* */ /* Debug and logging functions for all parts */ /* */ -/* Last modified: 09/Feb/2005 */ +/* Last modified: 11/Mar/2005 */ /************************************ */ #include @@ -1928,7 +1928,7 @@ static ssize_t log_levels_proc_write(struct file * file, const char * buf, u_long count, void *ppos) { - ssize_t err = -EINVAL; + ssize_t err; char * k_buf; char * p; unsigned int log_level; @@ -1948,6 +1948,7 @@ if(err < 0) return err; + err = count; if(count < 15 || strncmp("log_levels", k_buf, 10)) { goto out; @@ -2780,7 +2781,7 @@ static ssize_t debug_proc_write(struct file * file, const char * buf, u_long count, void *ppos) { - ssize_t err = -EINVAL; + ssize_t err; char * k_buf; char * p; unsigned int debug_level; @@ -2794,6 +2795,8 @@ if(count > PROC_BLOCK_SIZE) { return(-EOVERFLOW); } + if(count < 10) + return -EINVAL; if (!(k_buf = (char *) __get_free_page(GFP_KERNEL))) return(-ENOMEM); @@ -2801,8 +2804,8 @@ if(err < 0) return err; - if(count < 10) - goto out; + err = count; + if(!strncmp("debug", k_buf, 5)) { p = k_buf + 6; @@ -2915,6 +2918,7 @@ #endif printk(KERN_INFO "debug_proc_write(): rejecting invalid ind_softmode value (should be 0 or 1)\n"); + err =-EINVAL; goto out; } } @@ -3000,6 +3004,7 @@ #endif printk(KERN_INFO "debug_proc_write(): rejecting invalid softmode_prohibit value (should be 0 or 1)\n"); + err =-EINVAL; goto out; } } @@ -3083,6 +3088,7 @@ #endif printk(KERN_INFO "debug_proc_write(): rejecting invalid softmode value (should be 0 or 1)\n"); + err =-EINVAL; goto out; } } @@ -3155,6 +3161,7 @@ #endif printk(KERN_INFO "debug_proc_write(): rejecting invalid dac_disabled value (should be 0 or 1)\n"); + err =-EINVAL; goto out; } } @@ -3242,6 +3249,7 @@ #endif printk(KERN_INFO "debug_proc_write(): rejecting invalid freeze value (should be 0 or 1)\n"); + err =-EINVAL; goto out; } } @@ -3420,6 +3428,7 @@ tmp); rsbac_kfree(tmp); } + err =-EINVAL; goto out; } } @@ -3545,6 +3554,7 @@ #endif printk(KERN_INFO "debug_proc_write(): rejecting invalid nosyslog value (should be 0 or 1)\n"); + err =-EINVAL; goto out; } } @@ -4980,6 +4990,7 @@ #endif printk(KERN_INFO "debug_proc_write(): rejecting invalid debug level (should be 0 or 1)\n"); + err = -EINVAL; goto out; } #endif /* defined(CONFIG_RSBAC_PROC) && defined(CONFIG_PROC_FS) */ @@ -5368,7 +5379,7 @@ #if defined(CONFIG_RSBAC_RMSG) tmp_entry_p = create_proc_entry("rmsg", - S_IFREG | S_IRUGO | S_IWUGO, + S_IFREG | S_IRUGO, proc_rsbac_root_p); if(tmp_entry_p) { Index: linux-2.6.11-rsbac-v1.2.4/rsbac/help/syscalls.c =================================================================== --- linux-2.6.11-rsbac-v1.2.4/rsbac/help/syscalls.c (Revision 200) +++ linux-2.6.11-rsbac-v1.2.4/rsbac/help/syscalls.c (Arbeitskopie) @@ -6154,7 +6154,7 @@ if(!new_pass) return -RSBAC_EINVALIDPOINTER; - if(old_pass) + if(old_pass && (uid == current->uid)) { char * k_old_pass; Index: linux-2.6.11-rsbac-v1.2.4/rsbac/adf/adf_main.c =================================================================== --- linux-2.6.11-rsbac-v1.2.4/rsbac/adf/adf_main.c (Revision 200) +++ linux-2.6.11-rsbac-v1.2.4/rsbac/adf/adf_main.c (Arbeitskopie) @@ -1315,14 +1315,12 @@ struct vm_area_struct * vma; struct dentry * dentry_p = NULL; - task_lock(current); mm = current->mm; if(mm) - atomic_inc(&mm->mm_users); - task_unlock(current); - if(mm) { - down_read(&mm->mmap_sem); + atomic_inc(&mm->mm_users); + if(!down_read_trylock(&mm->mmap_sem)) + goto down_failed; vma = mm->mmap; while (vma) { @@ -1350,6 +1348,7 @@ #endif dput(dentry_p); } +down_failed: mmput(mm); } } Index: linux-2.6.11-rsbac-v1.2.4/rsbac/adf/rc/rc_main.c =================================================================== --- linux-2.6.11-rsbac-v1.2.4/rsbac/adf/rc/rc_main.c (Revision 200) +++ linux-2.6.11-rsbac-v1.2.4/rsbac/adf/rc/rc_main.c (Arbeitskopie) @@ -1434,15 +1434,15 @@ case T_FIFO: case T_SYMLINK: case T_IPC: +#if defined(CONFIG_RSBAC_RC_UM_PROT) + case T_USER: + case T_GROUP: +#endif return(check_comp_rc(target, tid, request, caller_pid)); case T_SCD: return(check_comp_rc_scd(tid.scd, request, caller_pid)); -#if defined(CONFIG_RSBAC_RC_UM_PROT) - case T_USER: - case T_GROUP: -#endif #ifdef CONFIG_RSBAC_ALLOW_DAC_DISABLE case T_NONE: /* may turn off Linux DAC, if compatible */ Index: linux-2.6.11-rsbac-v1.2.4/rsbac/data_structures/aci_data_structures.c =================================================================== --- linux-2.6.11-rsbac-v1.2.4/rsbac/data_structures/aci_data_structures.c (Revision 200) +++ linux-2.6.11-rsbac-v1.2.4/rsbac/data_structures/aci_data_structures.c (Arbeitskopie) @@ -5,7 +5,7 @@ /* (some smaller parts copied from fs/namei.c */ /* and others) */ /* */ -/* Last modified: 09/Feb/2005 */ +/* Last modified: 11/Mar/2005 */ /*************************************************** */ #include @@ -5278,7 +5278,7 @@ static ssize_t auto_write_proc_write(struct file * file, const char * buf, u_long count, void *ppos) { - ssize_t err = -EINVAL; + ssize_t err; char * k_buf; char * p; @@ -5295,6 +5295,7 @@ if(err < 0) return err; + err = count; if(count < 13 || strncmp("auto", k_buf, 4)) { goto out; Index: linux-2.6.11-rsbac-v1.2.4/rsbac/data_structures/um_data_structures.c =================================================================== --- linux-2.6.11-rsbac-v1.2.4/rsbac/data_structures/um_data_structures.c (Revision 200) +++ linux-2.6.11-rsbac-v1.2.4/rsbac/data_structures/um_data_structures.c (Arbeitskopie) @@ -463,7 +463,9 @@ static inline void new_salt(__u32 * salt_p) { - get_random_bytes(salt_p, sizeof(*salt_p)); + *salt_p = 0; + while(!*salt_p) + get_random_bytes(salt_p, sizeof(*salt_p)); } int rsbac_um_hash(char * pass, __u32 salt) @@ -1674,7 +1676,9 @@ #endif /* check whether account or password has expired */ curdays = RSBAC_CURRENT_TIME / 86400; - if(!entry_p->lastchange) + if( *((__u32*) entry_p->pass) + && !entry_p->lastchange + ) { err = -RSBAC_EMUSTCHANGE; #ifdef CONFIG_RSBAC_DEBUG Index: linux-2.6.11-rsbac-v1.2.4/rsbac/data_structures/auth_data_structures.c =================================================================== --- linux-2.6.11-rsbac-v1.2.4/rsbac/data_structures/auth_data_structures.c (Revision 200) +++ linux-2.6.11-rsbac-v1.2.4/rsbac/data_structures/auth_data_structures.c (Arbeitskopie) @@ -3,7 +3,7 @@ /* Implementation of AUTH data structures */ /* Author and (c) 1999-2005: Amon Ott */ /* */ -/* Last modified: 09/Feb/2005 */ +/* Last modified: 11/Mar/2005 */ /*************************************************** */ #include @@ -2729,7 +2729,7 @@ #if defined(CONFIG_RSBAC_PROC) && defined(CONFIG_PROC_FS) tmp_entry_p = create_proc_entry("auth_devices", - S_IFREG | S_IRUGO | S_IWUGO, + S_IFREG | S_IRUGO, proc_rsbac_root_p); if(tmp_entry_p) { Index: linux-2.6.11-rsbac-v1.2.4/arch/x86_64/kernel/ioport.c =================================================================== --- linux-2.6.11-rsbac-v1.2.4/arch/x86_64/kernel/ioport.c (Revision 200) +++ linux-2.6.11-rsbac-v1.2.4/arch/x86_64/kernel/ioport.c (Arbeitskopie) @@ -16,6 +16,11 @@ #include #include +/* RSBAC */ +#ifdef CONFIG_RSBAC +#include +#endif + /* Set EXTENT bits starting at BASE in BITMAP to value TURN_ON. */ static void set_bitmap(unsigned long *bitmap, unsigned int base, unsigned int extent, int new_value) { @@ -38,11 +43,35 @@ struct tss_struct * tss; unsigned long *bitmap; + /* RSBAC */ + #ifdef CONFIG_RSBAC + union rsbac_target_id_t rsbac_target_id; + union rsbac_attribute_value_t rsbac_attribute_value; + #endif + if ((from + num <= from) || (from + num > IO_BITMAP_BITS)) return -EINVAL; if (turn_on && !capable(CAP_SYS_RAWIO)) return -EPERM; + /* RSBAC */ + #ifdef CONFIG_RSBAC +#ifdef CONFIG_RSBAC_DEBUG + if (rsbac_debug_aef) printk(KERN_DEBUG "sys_ioperm(): calling ADF\n"); +#endif + rsbac_target_id.scd = ST_ioports; + rsbac_attribute_value.dummy = 0; + if (!rsbac_adf_request(R_MODIFY_PERMISSIONS_DATA, + current->pid, + T_SCD, + rsbac_target_id, + A_none, + rsbac_attribute_value)) + { + return -EPERM; + } + #endif + /* * If it's the first ioperm() call in this thread's lifetime, set the * IO bitmap up. ioperm() is much less timing critical than clone(), @@ -105,12 +134,36 @@ { unsigned int old = (regs->eflags >> 12) & 3; + /* RSBAC */ + #ifdef CONFIG_RSBAC + union rsbac_target_id_t rsbac_target_id; + union rsbac_attribute_value_t rsbac_attribute_value; + #endif + if (level > 3) return -EINVAL; /* Trying to gain more privileges? */ if (level > old) { if (!capable(CAP_SYS_RAWIO)) return -EPERM; + + /* RSBAC */ + #ifdef CONFIG_RSBAC +#ifdef CONFIG_RSBAC_DEBUG + if (rsbac_debug_aef) printk(KERN_DEBUG "sys_iopl(): calling ADF\n"); +#endif + rsbac_target_id.scd = ST_ioports; + rsbac_attribute_value.dummy = 0; + if (!rsbac_adf_request(R_MODIFY_PERMISSIONS_DATA, + current->pid, + T_SCD, + rsbac_target_id, + A_none, + rsbac_attribute_value)) + { + return -EPERM; + } + #endif } regs->eflags = (regs->eflags &~ 0x3000UL) | (level << 12); return 0;