1. 17 Jan, 2012 1 commit
  2. 12 Oct, 2011 1 commit
  3. 13 Sep, 2011 3 commits
    • Tetsuo Handa's avatar
      TOMOYO: Allow domain transition without execve(). · 731d37aa
      Tetsuo Handa authored
      To be able to split permissions for Apache's CGI programs which are executed
      without execve(), add special domain transition which is performed by writing
      a TOMOYO's domainname to /sys/kernel/security/tomoyo/self_domain interface.
      
      This is an API for TOMOYO-aware userland applications. However, since I expect
      TOMOYO and other LSM modules to run in parallel, this patch does not use
      /proc/self/attr/ interface in order to avoid conflicts with other LSM modules
      when it became possible to run multiple LSM modules in parallel.
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      731d37aa
    • Tetsuo Handa's avatar
      TOMOYO: Add socket operation restriction support. · 059d84db
      Tetsuo Handa authored
      This patch adds support for permission checks for PF_INET/PF_INET6/PF_UNIX
      socket's bind()/listen()/connect()/send() operations.
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      059d84db
    • Tetsuo Handa's avatar
      TOMOYO: Add environment variable name restriction support. · d58e0da8
      Tetsuo Handa authored
      This patch adds support for checking environment variable's names.
      Although TOMOYO already provides ability to check argv[]/envp[] passed to
      execve() requests,
      
        file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="bar"
      
      will reject execution of /bin/sh if environment variable LD_LIBRARY_PATH is not
      defined. To grant execution of /bin/sh if LD_LIBRARY_PATH is not defined,
      administrators have to specify like
      
        file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="/system/lib"
        file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]=NULL
      
      . Since there are many environment variables whereas conditional checks are
      applied as "&&", it is difficult to cover all combinations. Therefore, this
      patch supports conditional checks that are applied as "||", by specifying like
      
        file execute /bin/sh
        misc env LD_LIBRARY_PATH exec.envp["LD_LIBRARY_PATH"]="/system/lib"
      
      which means "grant execution of /bin/sh if environment variable is not defined
      or is defined and its value is /system/lib".
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      d58e0da8
  4. 09 Sep, 2011 1 commit
  5. 14 Jul, 2011 1 commit
  6. 11 Jul, 2011 1 commit
  7. 28 Jun, 2011 8 commits
  8. 12 May, 2011 1 commit
  9. 02 Aug, 2010 9 commits