July 2024 - rsbac-commit

linux-6.6.y 6.6.43 commit 19e528dc52bb Add feature CAP filesystem object hiding If enabled, you can hide f
by Amon Ott 29 Jul '24

29 Jul '24

https://git.rsbac.org/cgi-bin/gitweb.cgi?p=linux-6.6.y.git;a=summary RSBAC for Linux 6.6 (Long Term) Current version: 6.6.43 commit 19e528dc52bbbf0d390bd82238d09d6a549c74d4 Author: Amon Ott <ao(a)rsbac.org> Date: Mon Jul 29 12:56:30 2024 +0200 Add feature CAP filesystem object hiding If enabled, you can hide filesystem objects from users without Linux read rights on them, set with the kernel command line switch rsbac_cap_fd_hiding or through the RSBAC proc interface. There are two possible values: 0 / off: no hiding. 1 / on: only processes with Linux read right to a filesystem object, Linux capability DAC_OVERRIDE or DAC_READ_SEARCH or with CAP role security officer or system admin may see this object. Hiding works with many, but not all types of file system object access. While at it, reduce overhead with CAP process hiding: only use global variable rsbac_cap_process_hiding instead of per-process attribute, which does not get set individually anyway. Since rsbac_get_owner() never returns an error, change it to not return a result and remove all result checks. Add some type casts to rc_main.c. fs/locks.c | 12 + fs/namei.c | 37 ++ fs/open.c | 34 ++ fs/readdir.c | 50 +-- fs/stat.c | 31 ++ include/rsbac/aci_data_structures.h | 10 +- include/rsbac/adf.h | 10 +- include/rsbac/debug.h | 7 +- include/rsbac/helpers.h | 6 +- include/rsbac/types.h | 11 +- rsbac/Kconfig | 23 +- rsbac/adf/acl/acl_syscalls.c | 26 +- rsbac/adf/adf_main.c | 91 ++--- rsbac/adf/cap/cap_main.c | 45 +-- rsbac/adf/rc/rc_main.c | 30 +- rsbac/adf/rc/rc_syscalls.c | 562 ++++++++++++---------------- rsbac/data_structures/aci_data_structures.c | 14 +- rsbac/help/debug.c | 124 +++++- rsbac/help/getname.c | 8 +- rsbac/help/helpers.c | 91 ++++- rsbac/help/syscalls.c | 10 +- 21 files changed, 702 insertions(+), 530 deletions(-)

1 0

linux-6.6.y 6.6.42 commit c01a4c130ac7 Add feature CAP filesystem object hiding If enabled, you can hide f
by Amon Ott 29 Jul '24

29 Jul '24

https://git.rsbac.org/cgi-bin/gitweb.cgi?p=linux-6.6.y.git;a=summary RSBAC for Linux 6.6 (Long Term) Current version: 6.6.42 commit c01a4c130ac7692a4fb075ff51aec8805cdc540f Author: Amon Ott <ao(a)rsbac.org> Date: Mon Jul 29 12:56:30 2024 +0200 Add feature CAP filesystem object hiding If enabled, you can hide filesystem objects from users without Linux read rights on them, set with the kernel command line switch rsbac_cap_fd_hiding or through the RSBAC proc interface. There are two possible values: 0 / off: no hiding. 1 / on: only processes with Linux read right to a filesystem object, Linux capability DAC_OVERRIDE or DAC_READ_SEARCH or with CAP role security officer or system admin may see this object. Hiding works with many, but not all types of file system object access. While at it, reduce overhead with CAP process hiding: only use global variable rsbac_cap_process_hiding instead of per-process attribute, which does not get set individually anyway. Since rsbac_get_owner() never returns an error, change it to not return a result and remove all result checks. Add some type casts to rc_main.c. fs/locks.c | 12 + fs/namei.c | 37 ++ fs/open.c | 34 ++ fs/readdir.c | 50 +-- fs/stat.c | 31 ++ include/rsbac/aci_data_structures.h | 10 +- include/rsbac/adf.h | 10 +- include/rsbac/debug.h | 7 +- include/rsbac/helpers.h | 6 +- include/rsbac/types.h | 11 +- rsbac/Kconfig | 23 +- rsbac/adf/acl/acl_syscalls.c | 26 +- rsbac/adf/adf_main.c | 91 ++--- rsbac/adf/cap/cap_main.c | 45 +-- rsbac/adf/rc/rc_main.c | 30 +- rsbac/adf/rc/rc_syscalls.c | 562 ++++++++++++---------------- rsbac/data_structures/aci_data_structures.c | 14 +- rsbac/help/debug.c | 124 +++++- rsbac/help/getname.c | 8 +- rsbac/help/helpers.c | 91 ++++- rsbac/help/syscalls.c | 10 +- 21 files changed, 702 insertions(+), 530 deletions(-)

1 0

linux-5.10.y 5.10.222 commit 355665e551b0 Always call rsbac_mount() with parent info, but not from do_move_mo
by Amon Ott 25 Jul '24

25 Jul '24

https://git.rsbac.org/cgi-bin/gitweb.cgi?p=linux-5.10.y.git;a=summary RSBAC for Linux 5.10 (Long Term) Current version: 5.10.222 commit 355665e551b08aab63b52ef4cb13a6e22448ef9f Author: Amon Ott <ao(a)rsbac.org> Date: Thu Jul 25 13:43:14 2024 +0200 Always call rsbac_mount() with parent info, but not from do_move_mount(). This commit ports the rsbac_mount() changes from kernel 6.6. fs/namespace.c | 57 ++++++++++++++++++++--------- rsbac/data_structures/aci_data_structures.c | 31 ++++++++++------ rsbac/data_structures/acl_data_structures.c | 22 +++++------ 3 files changed, 71 insertions(+), 39 deletions(-)

1 0

linux-5.15.y 5.15.163 commit b3f79be12c70 Always call rsbac_mount() with parent info, but not from do_move_mo
by Amon Ott 25 Jul '24

25 Jul '24

https://git.rsbac.org/cgi-bin/gitweb.cgi?p=linux-5.15.y.git;a=summary RSBAC for Linux 5.15 (Long Term) Current version: 5.15.163 commit b3f79be12c7084470623412c59def156595ebf15 Author: Amon Ott <ao(a)rsbac.org> Date: Thu Jul 25 13:34:43 2024 +0200 Always call rsbac_mount() with parent info, but not from do_move_mount(). This commit ports the rsbac_mount() changes from kernel 6.6. fs/namespace.c | 58 ++++++++++++++++++++--------- rsbac/data_structures/aci_data_structures.c | 31 +++++++++------ rsbac/data_structures/acl_data_structures.c | 20 +++++----- 3 files changed, 70 insertions(+), 39 deletions(-)

1 0

linux-6.1.y 6.1.101 commit 656f5b426bc4 Always call rsbac_mount() with parent info, but not from do_move_mo
by Amon Ott 25 Jul '24

25 Jul '24

https://git.rsbac.org/cgi-bin/gitweb.cgi?p=linux-6.1.y.git;a=summary RSBAC for Linux 6.1 (Long Term) Current version: 6.1.101 commit 656f5b426bc451fbbfdd3a142fd65321bdfb11fd Author: Amon Ott <ao(a)rsbac.org> Date: Thu Jul 25 13:31:24 2024 +0200 Always call rsbac_mount() with parent info, but not from do_move_mount(). This commit ports the rsbac_mount() changes from kernel 6.6. fs/namespace.c | 58 ++++++++++++++++++++--------- rsbac/data_structures/aci_data_structures.c | 31 +++++++++------ rsbac/data_structures/acl_data_structures.c | 20 +++++----- 3 files changed, 70 insertions(+), 39 deletions(-)

1 0

linux-6.1.y 6.1.101 commit 7615c1a2a0af Fix some KCSAN findings. gen_lists: increase list->read_count outsi
by Amon Ott 25 Jul '24

25 Jul '24

https://git.rsbac.org/cgi-bin/gitweb.cgi?p=linux-6.1.y.git;a=summary RSBAC for Linux 6.1 (Long Term) Current version: 6.1.101 commit 7615c1a2a0af612e86c6218039aa748081dfa29a Author: Amon Ott <ao(a)rsbac.org> Date: Tue Jun 25 15:13:09 2024 +0200 Fix some KCSAN findings. gen_lists: increase list->read_count outside RCU lock. aci_data_structures.c: lookup_device(): do not update global curr. acl_data_structures.c: acl_lookup_device(): do not update global curr. Mark various stat counters with data_race(), atomic updates not needed. rsbac/adf/adf_main.c | 12 +- rsbac/data_structures/aci_data_structures.c | 39 +++-- rsbac/data_structures/acl_data_structures.c | 6 +- rsbac/data_structures/gen_lists.c | 213 +++++++++++++++++----------- 4 files changed, 155 insertions(+), 115 deletions(-)

1 0

linux-6.6.y 6.6.42 commit 9052b27bc4b1 acl_data_structures: log device number with "Could not lookup devic
by Amon Ott 25 Jul '24

25 Jul '24

https://git.rsbac.org/cgi-bin/gitweb.cgi?p=linux-6.6.y.git;a=summary RSBAC for Linux 6.6 (Long Term) Current version: 6.6.42 commit 9052b27bc4b1bf6145d0a11dc9e39b7f0797fa69 Author: Amon Ott <ao(a)rsbac.org> Date: Thu Jul 25 11:54:28 2024 +0200 acl_data_structures: log device number with "Could not lookup device" warnings. rsbac/data_structures/aci_data_structures.c | 2 +- rsbac/data_structures/acl_data_structures.c | 20 ++++++++++---------- 2 files changed, 11 insertions(+), 11 deletions(-)

1 0

linux-6.6.y 6.6.41 commit 075cfda474d8 Add rsbac_mount() calls to fc_mount() and sys_fsmount(). Make small
by Amon Ott 25 Jul '24

25 Jul '24

https://git.rsbac.org/cgi-bin/gitweb.cgi?p=linux-6.6.y.git;a=summary RSBAC for Linux 6.6 (Long Term) Current version: 6.6.41 commit 075cfda474d8793e44429bfb2ea098c442968dc7 Author: Amon Ott <ao(a)rsbac.org> Date: Thu Jul 25 08:13:33 2024 +0200 Add rsbac_mount() calls to fc_mount() and sys_fsmount(). Make small cleanup in rsbac_mount(). fs/namespace.c | 21 ++++++++++++++++++++- rsbac/data_structures/aci_data_structures.c | 25 ++++++++++++------------- 2 files changed, 32 insertions(+), 14 deletions(-)

1 0

linux-6.6.y 6.6.41 commit fc6a08818233 Always call rsbac_mount() with parent info, log parent, fix parent
by Amon Ott 24 Jul '24

24 Jul '24

https://git.rsbac.org/cgi-bin/gitweb.cgi?p=linux-6.6.y.git;a=summary RSBAC for Linux 6.6 (Long Term) Current version: 6.6.41 commit fc6a08818233c07ba5c9b735140e22617925f750 Author: Amon Ott <ao(a)rsbac.org> Date: Wed Jul 24 15:00:06 2024 +0200 Always call rsbac_mount() with parent info, log parent, fix parent value in proc. Do not call rsbac_mount() from do_move_mount(), this makes no sense, leads to repeated mount entries and breaks inheritance. fs/namespace.c | 36 +++++++++++++---------------- rsbac/data_structures/aci_data_structures.c | 12 ++++++---- 2 files changed, 23 insertions(+), 25 deletions(-)

1 0

linux-6.1.y 6.1.99 commit 689c19a83afd Fix some KCSAN findings. gen_lists: increase list->read_count outsi
by Amon Ott 16 Jul '24

16 Jul '24

https://git.rsbac.org/cgi-bin/gitweb.cgi?p=linux-6.1.y.git;a=summary RSBAC for Linux 6.1 (Long Term) Current version: 6.1.99 commit 689c19a83afd4a0f7347e4e76b6e703316980d1d Author: Amon Ott <ao(a)rsbac.org> Date: Tue Jun 25 15:13:09 2024 +0200 Fix some KCSAN findings. gen_lists: increase list->read_count outside RCU lock. aci_data_structures.c: lookup_device(): do not update global curr. acl_data_structures.c: acl_lookup_device(): do not update global curr. Mark various stat counters with data_race(), atomic updates not needed. rsbac/adf/adf_main.c | 12 +- rsbac/data_structures/aci_data_structures.c | 39 +++-- rsbac/data_structures/acl_data_structures.c | 6 +- rsbac/data_structures/gen_lists.c | 213 +++++++++++++++++----------- 4 files changed, 155 insertions(+), 115 deletions(-)

1 0

2025

2024

2023

2022

rsbac-commit July 2024