This project is mirrored from The repository failed to update .
Repository mirroring has been paused due to too many failed attempts, and can be resumed by a project maintainer.
Last successful update .
  1. 22 Mar, 2012 1 commit
  2. 12 Jan, 2012 1 commit
  3. 11 Dec, 2011 1 commit
  4. 29 Nov, 2011 1 commit
    • Paul Moore's avatar
      netlabel: Fix build problems when IPv6 is not enabled · 1281bc25
      Paul Moore authored
      A recent fix to the the NetLabel code caused build problem with
      configurations that did not have IPv6 enabled; see below:
       netlabel_kapi.c: In function 'netlbl_cfg_unlbl_map_add':
        error: implicit declaration of function 'netlbl_af6list_add'
      This patch fixes this problem by making the IPv6 specific code conditional
      on the IPv6 configuration flags as we done in the rest of NetLabel and the
      network stack as a whole.  We have to move some variable declarations
      around as a result so things may not be quite as pretty, but at least it
      builds cleanly now.
      Some additional IPv6 conditionals were added to the NetLabel code as well
      for the sake of consistency.
      Reported-by: default avatarRandy Dunlap <>
      Signed-off-by: default avatarPaul Moore <>
      Acked-by: default avatarRandy Dunlap <>
      Signed-off-by: default avatarDavid S. Miller <>
  5. 25 Nov, 2011 1 commit
  6. 22 Nov, 2011 1 commit
  7. 11 Aug, 2011 1 commit
  8. 02 Aug, 2011 3 commits
  9. 26 Jul, 2011 1 commit
  10. 08 Jul, 2011 1 commit
  11. 17 Jun, 2011 1 commit
  12. 23 May, 2011 2 commits
  13. 08 May, 2011 2 commits
  14. 18 Apr, 2011 1 commit
  15. 31 Mar, 2011 1 commit
  16. 03 Mar, 2011 1 commit
  17. 20 Dec, 2010 1 commit
  18. 18 May, 2010 1 commit
  19. 02 Apr, 2010 1 commit
    • Paul Moore's avatar
      netlabel: Fix several rcu_dereference() calls used without RCU read locks · b914f3a2
      Paul Moore authored
      The recent changes to add RCU lock verification to rcu_dereference() calls
      caught out a problem with netlbl_unlhsh_hash(), see below.
       [ INFO: suspicious rcu_dereference_check() usage. ]
       net/netlabel/netlabel_unlabeled.c:246 invoked rcu_dereference_check()
       without protection!
      This patch fixes this problem as well as others like it in the NetLabel
      code.  Also included in this patch is the identification of future work
      to eliminate the RCU read lock in netlbl_domhsh_add(), but in the interest
      of getting this patch out quickly that work will happen in another patch
      to be finished later.
      Thanks to Eric Dumazet and Paul McKenney for their help in understanding
      the recent RCU changes.
      Signed-off-by: default avatarPaul Moore <>
      Reported-by: default avatarDavid Howells <>
      CC: Eric Dumazet <>
      CC: Paul E. McKenney <>
      Acked-by: default avatarEric Dumazet <>
      Signed-off-by: default avatarDavid S. Miller <>
  20. 30 Mar, 2010 1 commit
    • Tejun Heo's avatar
      include cleanup: Update gfp.h and slab.h includes to prepare for breaking... · 5a0e3ad6
      Tejun Heo authored
      include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
      percpu.h is included by sched.h and module.h and thus ends up being
      included when building most .c files.  percpu.h includes slab.h which
      in turn includes gfp.h making everything defined by the two files
      universally available and complicating inclusion dependencies.
      percpu.h -> slab.h dependency is about to be removed.  Prepare for
      this change by updating users of gfp and slab facilities include those
      headers directly instead of assuming availability.  As this conversion
      needs to touch large number of source files, the following script is
      used as the basis of conversion.
      The script does the followings.
      * Scan files for gfp and slab usages and update includes such that
        only the necessary includes are there.  ie. if only gfp is used,
        gfp.h, if slab is used, slab.h.
      * When the script inserts a new include, it looks at the include
        blocks and try to put the new include such that its order conforms
        to its surrounding.  It's put in the include block which contains
        core kernel includes, in the same order that the rest are ordered -
        alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
        doesn't seem to be any matching order.
      * If the script can't find a place to put a new include (mostly
        because the file doesn't have fitting include block), it prints out
        an error message indicating which .h file needs to be added to the
      The conversion was done in the following steps.
      1. The initial automatic conversion of all .c files updated slightly
         over 4000 files, deleting around 700 includes and adding ~480 gfp.h
         and ~3000 slab.h inclusions.  The script emitted errors for ~400
      2. Each error was manually checked.  Some didn't need the inclusion,
         some needed manual addition while adding it to implementation .h or
         embedding .c file was more appropriate for others.  This step added
         inclusions to around 150 files.
      3. The script was run again and the output was compared to the edits
         from #2 to make sure no file was left behind.
      4. Several build tests were done and a couple of problems were fixed.
         e.g. lib/decompress_*.c used malloc/free() wrappers around slab
         APIs requiring slab.h to be added manually.
      5. The script was run on all .h files but without automatically
         editing them as sprinkling gfp.h and slab.h inclusions around .h
         files could easily lead to inclusion dependency hell.  Most gfp.h
         inclusion directives were ignored as stuff from gfp.h was usually
         wildly available and often used in preprocessor macros.  Each
         slab.h inclusion directive was examined and added manually as
      6. percpu.h was updated not to include slab.h.
      7. Build test were done on the following configurations and failures
         were fixed.  CONFIG_GCOV_KERNEL was turned off for all tests (as my
         distributed build env didn't work with gcov compiles) and a few
         more options had to be turned off depending on archs to make things
         build (like ipr on powerpc/64 which failed due to missing writeq).
         * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
         * powerpc and powerpc64 SMP allmodconfig
         * sparc and sparc64 SMP allmodconfig
         * ia64 SMP allmodconfig
         * s390 SMP allmodconfig
         * alpha SMP allmodconfig
         * um on x86_64 SMP allmodconfig
      8. percpu.h modifications were reverted so that it could be applied as
         a separate patch and serve as bisection point.
      Given the fact that I had only a couple of failures from tests on step
      6, I'm fairly confident about the coverage of this conversion patch.
      If there is a breakage, it's likely to be something in one of the arch
      headers which should be easily discoverable easily on most builds of
      the specific arch.
      Signed-off-by: default avatarTejun Heo <>
      Guess-its-ok-by: default avatarChristoph Lameter <>
      Cc: Ingo Molnar <>
      Cc: Lee Schermerhorn <>
  21. 17 Feb, 2010 1 commit
  22. 04 Dec, 2009 1 commit
  23. 20 Nov, 2009 1 commit
  24. 06 Nov, 2009 1 commit
  25. 30 Jul, 2009 1 commit
  26. 27 Jul, 2009 1 commit
  27. 21 May, 2009 1 commit
  28. 22 Apr, 2009 1 commit
  29. 28 Mar, 2009 2 commits
    • Paul Moore's avatar
      netlabel: Cleanup the Smack/NetLabel code to fix incoming TCP connections · 07feee8f
      Paul Moore authored
      This patch cleans up a lot of the Smack network access control code.  The
      largest changes are to fix the labeling of incoming TCP connections in a
      manner similar to the recent SELinux changes which use the
      security_inet_conn_request() hook to label the request_sock and let the label
      move to the child socket via the normal network stack mechanisms.  In addition
      to the incoming TCP connection fixes this patch also removes the smk_labled
      field from the socket_smack struct as the minor optimization advantage was
      outweighed by the difficulty in maintaining it's proper state.
      Signed-off-by: default avatarPaul Moore <>
      Acked-by: default avatarCasey Schaufler <>
      Signed-off-by: default avatarJames Morris <>
    • Paul Moore's avatar
      netlabel: Label incoming TCP connections correctly in SELinux · 389fb800
      Paul Moore authored
      The current NetLabel/SELinux behavior for incoming TCP connections works but
      only through a series of happy coincidences that rely on the limited nature of
      standard CIPSO (only able to convey MLS attributes) and the write equality
      imposed by the SELinux MLS constraints.  The problem is that network sockets
      created as the result of an incoming TCP connection were not on-the-wire
      labeled based on the security attributes of the parent socket but rather based
      on the wire label of the remote peer.  The issue had to do with how IP options
      were managed as part of the network stack and where the LSM hooks were in
      relation to the code which set the IP options on these newly created child
      sockets.  While NetLabel/SELinux did correctly set the socket's on-the-wire
      label it was promptly cleared by the network stack and reset based on the IP
      options of the remote peer.
      This patch, in conjunction with a prior patch that adjusted the LSM hook
      locations, works to set the correct on-the-wire label format for new incoming
      connections through the security_inet_conn_request() hook.  Besides the
      correct behavior there are many advantages to this change, the most significant
      is that all of the NetLabel socket labeling code in SELinux now lives in hooks
      which can return error codes to the core stack which allows us to finally get
      ride of the selinux_netlbl_inode_permission() logic which greatly simplfies
      the NetLabel/SELinux glue code.  In the process of developing this patch I
      also ran into a small handful of AF_INET6 cleanliness issues that have been
      fixed which should make the code safer and easier to extend in the future.
      Signed-off-by: default avatarPaul Moore <>
      Acked-by: default avatarCasey Schaufler <>
      Signed-off-by: default avatarJames Morris <>
  30. 31 Dec, 2008 1 commit
  31. 12 Dec, 2008 1 commit
  32. 03 Dec, 2008 1 commit
  33. 22 Nov, 2008 1 commit
  34. 31 Oct, 2008 1 commit
  35. 30 Oct, 2008 1 commit