From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751897AbdAPViE (ORCPT ); Mon, 16 Jan 2017 16:38:04 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:53115 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751447AbdAPVa6 (ORCPT ); Mon, 16 Jan 2017 16:30:58 -0500 Subject: Re: [GIT PULL] AppArmor fixes for 4.11 To: James Morris References: Cc: linux-security-module@vger.kernel.org, LKLM From: John Johansen Organization: Canonical Message-ID: Date: Mon, 16 Jan 2017 13:30:40 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="LS6WFNUtr5B7kotmPfxet19MiN0AFXSfh" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --LS6WFNUtr5B7kotmPfxet19MiN0AFXSfh Content-Type: multipart/mixed; boundary="NO5auFFwiIQObu2aslvQGrnb3w2Ws3dxr"; protected-headers="v1" From: John Johansen To: James Morris Cc: linux-security-module@vger.kernel.org, LKLM Message-ID: Subject: Re: [GIT PULL] AppArmor fixes for 4.11 References: In-Reply-To: --NO5auFFwiIQObu2aslvQGrnb3w2Ws3dxr Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sigh, kernel build bot turned up a missed a config combination that results in a build failure security/built-in.o: In function `aa_unpack': (.text+0x841e2): undefined reference to `aa_g_hash_policy' I have pushed the fix on top of the previous request. The pull request with the new patch added is --- The following changes since commit b8aa8453918ebfd93d78de56c2afd4b735e02e= 27: security: Fix inode_getattr documentation (2017-01-10 17:39:23 +1100) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor for-sec= urity for you to fetch changes up to 3ccb76c5dfe0d25c1d0168d5b726d0b43d19a485: apparmor: fix undefined reference to `aa_g_hash_policy' (2017-01-16 13:= 21:27 -0800) ---------------------------------------------------------------- John Johansen (57): apparmor: move lib definitions into separate lib include apparmor: split out shared policy_XXX fns to lib apparmor: split apparmor policy namespaces code into its own file apparmor: rename namespace to ns to improve code line lengths apparmor: rename sid to secid apparmor: rename PFLAG_INVALID to PFLAG_STALE apparmor: rename replacedby to proxy apparmor: add strn version of lookup_profile fn apparmor: add strn version of aa_find_ns apparmor: add lib fn to find the "split" for fqnames apparmor: add fn to lookup profiles by fqname apparmor: allow ns visibility question to consider subnses apparmor: add macro for bug asserts to check that a lock is held apparmor: add debug assert AA_BUG and Kconfig to control debug info= apparmor: rename mediated_filesystem() to path_mediated_fs() apparmor: rename hname_tail to basename apparmor: constify policy name and hname apparmor: pass gfp param into aa_policy_init() apparmor: update policy_destroy to use new debug asserts apparmor: refactor prepare_ns() and make usable from different view= s apparmor: pass gfp_t parameter into profile allocation apparmor: name null-XXX profiles after the executable apparmor: remove paranoid load switch apparmor: add support for force complain flag to support learning m= ode apparmor: prepare to support newer versions of policy apparmor: add get_dfa() fn apparmor: allow policydb to be used as the file dfa apparmor: add a default null dfa apparmor: provide userspace flag indicating binfmt_elf_mmap change apparmor: add special .null file used to "close" fds at exec apparmor: track ns level so it can be used to help in view checks apparmor: Make aa_remove_profile() callable from a different view apparmor: allow introspecting the policy namespace name apparmor: allow specifying the profile doing the management apparmor: add ns being viewed as a param to policy_view_capable() apparmor: add ns being viewed as a param to policy_admin_capable() apparmor: add profile and ns params to aa_may_manage_policy() apparmor: add ns name to the audit data for policy loads apparmor: allow introspecting the loaded policy pre internal transf= orm apparmor: audit policy ns specified in policy load apparmor: pass the subject profile into profile replace/remove apparmor: add per policy ns .load, .replace, .remove interface file= s apparmor: fail task profile update if current_cred isn't real_cred apparmor: rename context abreviation cxt to the more standard ctx apparmor: change op from int to const char * apparmor: change aad apparmor_audit_data macro to a fn macro apparmor: remove unused op parameter from simple_write_to_buffer() apparmor: fix change_hat debug output apparmor: convert change_profile to use fqname later to give better= control apparmor: make computing policy hashes conditional on kernel parame= ter apparmor: update cap audit to check SECURITY_CAP_NOAUDIT apparmor: add per cpu work buffers to avoid allocating buffers at e= very hook apparmor: add check for apparmor enabled in module parameters missi= ng it apparmor: fix restricted endian type warnings for dfa unpack apparmor: fix restricted endian type warnings for policy unpack apparmor: replace remaining BUG_ON() asserts with AA_BUG() apparmor: fix undefined reference to `aa_g_hash_policy' Kees Cook (1): apparmor: use designated initializers Tetsuo Handa (1): AppArmor: Use GFP_KERNEL for __aa_kvmalloc(). Tyler Hicks (1): apparmor: sysctl to enable unprivileged user ns AppArmor policy loa= ding William Hua (1): apparmor: support querying extended trusted helper extra data security/apparmor/Kconfig | 31 +- security/apparmor/Makefile | 2 +- security/apparmor/apparmorfs.c | 681 ++++++++++++++++++---= - security/apparmor/audit.c | 98 +--- security/apparmor/capability.c | 26 +- security/apparmor/context.c | 107 ++-- security/apparmor/crypto.c | 39 +- security/apparmor/domain.c | 137 ++--- security/apparmor/file.c | 80 +-- security/apparmor/include/apparmor.h | 82 +-- security/apparmor/include/apparmorfs.h | 21 +- security/apparmor/include/audit.h | 152 ++--- security/apparmor/include/context.h | 84 +-- security/apparmor/include/crypto.h | 5 + security/apparmor/include/domain.h | 4 +- security/apparmor/include/file.h | 9 +- security/apparmor/include/lib.h | 200 +++++++ security/apparmor/include/match.h | 26 +- security/apparmor/include/path.h | 53 ++ security/apparmor/include/policy.h | 199 ++----- security/apparmor/include/policy_ns.h | 147 +++++ security/apparmor/include/policy_unpack.h | 28 +- security/apparmor/include/{sid.h =3D> secid.h} | 18 +- security/apparmor/ipc.c | 18 +- security/apparmor/lib.c | 111 +++- security/apparmor/lsm.c | 317 +++++++---- security/apparmor/match.c | 47 +- security/apparmor/nulldfa.in | 1 + security/apparmor/policy.c | 824 ++++++++++-----------= ------ security/apparmor/policy_ns.c | 346 +++++++++++ security/apparmor/policy_unpack.c | 257 ++++++--- security/apparmor/procattr.c | 38 +- security/apparmor/resource.c | 19 +- security/apparmor/secid.c | 55 ++ security/apparmor/sid.c | 55 -- 35 files changed, 2796 insertions(+), 1521 deletions(-) create mode 100644 security/apparmor/include/lib.h create mode 100644 security/apparmor/include/policy_ns.h rename security/apparmor/include/{sid.h =3D> secid.h} (50%) create mode 100644 security/apparmor/nulldfa.in create mode 100644 security/apparmor/policy_ns.c create mode 100644 security/apparmor/secid.c delete mode 100644 security/apparmor/sid.c --NO5auFFwiIQObu2aslvQGrnb3w2Ws3dxr-- --LS6WFNUtr5B7kotmPfxet19MiN0AFXSfh Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJYfTuAAAoJEAUvNnAY1cPYHs4P/Rlx9nhG5Fbp70O73ce0rwex IoOdR/xdihhXNPMtZXAd0QLdlGwcc7Qd9nNp4yV4+vq7tr9j/PPYzrOlMS4W9P4Y peSjZfI/GF2FLm769BB70Gv93ZdFr/7m3Vc2s0vxGTf9MOs1puFaOuWhu2fUa4bI dbSdE0KptbvBOrUr+GfkFRQoxFJac7p8JyfBbKYWsw6HVGcp9ST8JKgWjOG0zYQR c4FD6yPfWIwTpdSW4oVH1iBnNa7yObmJ1Khh+QTDUauY57i1YZxfC0qBbNWvwgam ZKwz25O3uwM1/sDkW7PRFbZTAJ2/KDJOa+cBJyIN/+JCAvRUS0NOfa+Tbom+QByy p3sW78Yv2nWS0bNs2xnUuu8JHke/BuA/KYAvdEpPF12EDcJzK2jUJeewyqllUuZK oHdQu5hDmd/5cU1uaQ/xbEHYz8p1tX5GAoud4zFt0xhzQR2C7ydrUp50nCvzi/8K 8xvhVWbC4P4gOJgjVR1k1EiHT4v/p6ndnMVi79bR8MOkL3ogVrA+/RgGnSkCr7Zi cnq29FKBNZ5XzD7QBJAYfLawIAO3fUDvo8E5UwvUncZ+WHaCypJ9P7SJIYm6op8S 1VtsuWEkBBDjctEMDeU/0l9y/LOuWmL6pMl3gePXLTIsWsCgWFfjwsrvDCUTv3I5 SI5CXRK3A5P+5tTcOutQ =Yvki -----END PGP SIGNATURE----- --LS6WFNUtr5B7kotmPfxet19MiN0AFXSfh--