Kernel Development - Revision history

JamesMorris: /* To Do List */

JamesMorris — Tue, 20 Apr 2010 23:05:28 GMT

To Do List

←Older revision		Revision as of 23:05, 20 April 2010
Line 1:		Line 1:
	== To Do List ==		== To Do List ==
		+
		+	* Fix error propagation for policydb_read to reflect actual errors rather than the default of -EINVAL.

	* Reduce SELinux memory footprint, both static and dynamic.		* Reduce SELinux memory footprint, both static and dynamic.

StephenSmalley at 11:25, 22 October 2009

StephenSmalley — Thu, 22 Oct 2009 11:25:35 GMT

←Older revision		Revision as of 11:25, 22 October 2009
Line 1:		Line 1:
	== To Do List ==		== To Do List ==
		+
		+	* Reduce SELinux memory footprint, both static and dynamic.
		+
		+	* Improve scripts/selinux/mdp to generate a more useful minimal policy as a starting point. Also make it more flexible.

	* Dynamic discovery of initial SIDs, similar to dynamic discovery of classes/perms. Map kernel initial SIDs to policy initial SIDs by string name rather than requiring identical index values, handle unknown initial SIDs cleanly (map to unlabeled), and allow future extensibility without causing problems (start regular SIDs at some fixed offset, e.g. 100, or start from the highest legal value and decrement, so that policy reload that changes the number of initial SIDs won't affect them).		* Dynamic discovery of initial SIDs, similar to dynamic discovery of classes/perms. Map kernel initial SIDs to policy initial SIDs by string name rather than requiring identical index values, handle unknown initial SIDs cleanly (map to unlabeled), and allow future extensibility without causing problems (start regular SIDs at some fixed offset, e.g. 100, or start from the highest legal value and decrement, so that policy reload that changes the number of initial SIDs won't affect them).

StephenSmalley at 18:00, 7 October 2009

StephenSmalley — Wed, 07 Oct 2009 18:00:35 GMT

←Older revision		Revision as of 18:00, 7 October 2009
Line 1:		Line 1:
	== To Do List ==		== To Do List ==
		+
		+	* Dynamic discovery of initial SIDs, similar to dynamic discovery of classes/perms. Map kernel initial SIDs to policy initial SIDs by string name rather than requiring identical index values, handle unknown initial SIDs cleanly (map to unlabeled), and allow future extensibility without causing problems (start regular SIDs at some fixed offset, e.g. 100, or start from the highest legal value and decrement, so that policy reload that changes the number of initial SIDs won't affect them).

	* Distinguish access(2) from open(2) auditing (see		* Distinguish access(2) from open(2) auditing (see

StephenSmalley at 18:35, 5 October 2009

StephenSmalley — Mon, 05 Oct 2009 18:35:51 GMT

←Older revision		Revision as of 18:35, 5 October 2009
Line 1:		Line 1:
	== To Do List ==		== To Do List ==

-	* Distinguish access(2) from open(2) auditing.	+	* Distinguish access(2) from open(2) auditing (see
		+	https://bugzilla.redhat.com/show_bug.cgi?id=495211).

	* Audit hooks to ensure that we don't have any more cases where DAC can be weakened.		* Audit hooks to ensure that we don't have any more cases where DAC can be weakened.

StephenSmalley at 18:34, 5 October 2009

StephenSmalley — Mon, 05 Oct 2009 18:34:58 GMT

←Older revision		Revision as of 18:34, 5 October 2009
Line 7:		Line 7:
	* Fix the performance issue apparently related to syscall audit which Linus keeps whining about.		* Fix the performance issue apparently related to syscall audit which Linus keeps whining about.

-	* Add support for SCTP.~~<sup>8<~~/~~sup>~~	+	* Add support for SCTP (see https://bugzilla.redhat.com/show_bug.cgi?id=517676).

	* Fix signal inheritance controls (possibly drop some or all, or only enforce in policy for certain domains).		* Fix signal inheritance controls (possibly drop some or all, or only enforce in policy for certain domains).

StephenSmalley at 14:17, 5 October 2009

StephenSmalley — Mon, 05 Oct 2009 14:17:02 GMT

←Older revision		Revision as of 14:17, 5 October 2009
Line 1:		Line 1:
	== To Do List ==		== To Do List ==

-	* ~~Resolve [https://bugzilla.redhat.com/show_bug.cgi?id=481618 bz 481618], re. CAP_SYS_MODULE checks and bluetooth~~.	+	* Distinguish access(2) from open(2) auditing.

	* Audit hooks to ensure that we don't have any more cases where DAC can be weakened.		* Audit hooks to ensure that we don't have any more cases where DAC can be weakened.
Line 12:		Line 12:

	* UBIFS support.		* UBIFS support.
-
-	* Audit for correctness when CONFIG_BUG=n (patches posted, http://marc.info/?l=selinux&m=123446905808001&w=2).

	* Add LTP tests for recent kernel changes.		* Add LTP tests for recent kernel changes.

	* Eliminate the need for secondary_ops altogether by providing LSM support for reverting to the original (capability) security module.		* Eliminate the need for secondary_ops altogether by providing LSM support for reverting to the original (capability) security module.
-
-	* avc_init() calls kmem_cache_create() but this is not freed if we call selinux_disable() from init

	* Reduce size of critical sections and use of GFP_ATOMIC.		* Reduce size of critical sections and use of GFP_ATOMIC.
Line 28:		Line 24:

	* crfs ?		* crfs ?
-
-	* cap_override class<sup>2</sup> (rfc patch posted, needs re-base and extension for 64-bit caps)
-
-	* Compile out LSM hooks & allow SELinux to be linked directly.

	* Automate checking for new syscalls in kernels (-mm, -rc etc).		* Automate checking for new syscalls in kernels (-mm, -rc etc).

-	* fine grained ~~enforcement of sysfs objects (RH BZ#228902)~~	+	* fine-grained labeling for usbfs and other pseudo filesystems of interest
-		+
-	* ditto for usbfs and other pseudo filesystems of interest	+
-		+
-	* additional support of a security netfilter table for secmark/net forwarding (RH: merged to nf repo)	+
-		+
-	* Namespacing of SELinux global functions and variables.<sup>4</sup>	+

	* NFSv4 support (in progress)		* NFSv4 support (in progress)
Line 56:		Line 42:

	* CIFS support for single-context clients (also has xattrs & Karl says it's better than NFS).		* CIFS support for single-context clients (also has xattrs & Karl says it's better than NFS).
-
-	* Investigate integration with integrity measurement (in progress IBM and NSA)

	* Crypto policy for domains & object handling		* Crypto policy for domains & object handling
Line 69:		Line 53:
	* move *mem permissions to new memprotect class. Bump policy version.		* move *mem permissions to new memprotect class. Bump policy version.

-	* discovery of class and permission offsets <sup>3</sup>	+	* better support for FS whose labelling behaviour is not specified in policy. If nothing from policy just test for xattr support and use it if it is there (RH in progress, patch reverted due to fuse deadlocks).
-		+
-	* better support for FS whose labelling behaviour is not specified in policy. If nothing from policy just test for xattr support and use it if it is there (RH in progress, patch reverted due to ~~ntfs~~ deadlocks).	+

	* memory leak detector pops on policy reload. probably due to {new,old}policydb being on stack and memcpy'd into the data section policydb (aka probably false positive)		* memory leak detector pops on policy reload. probably due to {new,old}policydb being on stack and memcpy'd into the data section policydb (aka probably false positive)

-	* better ~~error message in validate_classes~~. ~~If the~~ kernel ~~permission and~~ the policy ~~permission~~ are ~~!= we should print~~ the ~~name of both~~.	+	* better validation of classes/perms on policy reload. Warn if any permissions are defined in a kernel class in the policy that are not defined in the kernel's classmap.

	''Notes:''		''Notes:''
	<p>		<p>
-	</p><p>
-	<sup>2</sup>Allow SELinux to selectively grant capabilities authoritatively based on SELinux domain. Executables could be made privileged w/o needing to be setuid root, all via SELinux without needing yet another mechanism like file capabilities. Eliminate the need for filesystem capabilities support (which will be a nightmare to manage, as they are per-file bitmaps vs. per-type access vectors).</p>
-	<p>
-	<sup>3</sup> Make the hooks/avc layer request class/perm offsets from security server so that static offsets are no longer necessary and obsolete kernel classes can be purged.</p>
-	<p>
-	<sup>4</sup><pre>We have a lot of global functions and variables, some with no prefix at
-	all, some with prefixes that are not clearly scoped to selinux.
-
-	I'd at least:
-	- rename the security server functions from security_ to selinux_ to
-	avoid confusion/conflicts with LSM.
-	- rename ss_initialized to selinux_ss_initialized.
-	- rename the policydb and sidtab variables to selinux_policydb and
-	selinux_sidtab (and/or wrap them in a single container structure with a
-	single active policy pointer to it, with the intent of ultimately
-	refcounting it and introducing _get and _put functions).
-
-	Then you've got the generic data structures and their functions, like
-	hashtab_, symtab_, etc, which could either be taken to lib/ or given
-	selinux_ prefixes.</pre>
	</p>		</p>
-
-	<p>
-	<sup>8</sup> [http://marc.info/?l=selinux&m=124342862804578&w=2 ml post]
-	</p>
-
-	== Done ==
-
-	* Reduce memory usage of selinux structs: pahole (eparis RH BZ#235284)
-
-	* Remove secondary module stacking code (eparis RH BZ#231890)
-
-	* Labeling for loopback traffic [HP].
-
-	* Remove load_mutex mutex. [RH]
-
-	* Open code POLICY_RDLOCK and friends (per suggestion from akpm) [RH]
-
-	* drop selinux_inodekillpriv, selinux_tasksetuid and selinux_task_prctl since the hooks will default to the capability functions if SELinux doesn't define them. [RH]
-
-	* Remove all unnecessary secondary_ops calls that have no corresponding capability hook (legacy of old attempts to support other security modules as secondary) [RH]
-
-	* Finalize NFS binary mount support: ensure new hooks are called.
-
-	* Review ''Netlink link creation API'' code for security hook coverage.
-
-	* Remove obsolete object backpointers.
-
-	* Fix context_struct_compute_av latency issue raised by Ingo Molnar ([http://marc.info/?l=linux-kernel&m=118095653422494&w=2 lkml post])
-
-	* Better support for sys_splice and related syscalls
-
-	* change Kconfig to use select instead of depends (eparis RH BZ# 228899)
-
-	* allow undefined classes and permissions in kernel (eparis RH BZ#235280)
-
-	* explicitly set i_ino on all creations in selinuxfs (eparis RH BZ#235248)
-
-	* Review sys_fallocate if/when it is merged
-
-	* Labeling for forwarded traffic (done: HP)
-
-	* security_file_permission callsite consolidation<sup>1</sup> (done: RH)
-
-	* Add hook for filesystems with binary mount data per requests by fsdevel folk (done: RH)
-
-	* add NFSv4 support for command line mount options. (done: RH)
-
-	* Support for 64-bit capabilities (sds of the NSA)
-
-	* Display LSM mount options in /proc/mounts (done: RH)
-
-	* Permissive domains (done: RH).
-
-	* printk prefixes and error message cleanup (done: RH)
-
-	* open permission (done: RH)
-
-	* security_port_sid optimization (done: HP, netport cache)
-
-	* Normalize SELinux in-kernel API (obsolete: converted to LSM hooks)
-
-	* Support for setting down unknown file contexts for package managers and filesystem restore (done: NSA, deferred mapping of contexts patch).
-
-	* Finer-grained proc checking so that we don't require full ptrace permission just to read process state (done: NSA, split proc ptrace checking into read vs. attach).
-
-	* Improve/fix ioctl checking (done: NSA, simplify ioctl checking).
-
-	* Handle setxattr() consistently on filesystems that do not support labeling (cd89596f0ccfa3ccb8a81ce47782231cf7ea7296
-	).<sup>6</sup>
-
-	* Remove ae.used field and address avc_has_perm* scalability (906d27d9d28fd50fb40026e56842d8f6806a7a04).<sup>7</sup>
-
-	* Convert all security_ops calls to direct cap_ calls for greater efficiency and clarity (200ac532a4bc3134147ca06686c56a6420e66c46).
-
-	* The error message inode_doinit_with_dentry: context_to_sid(blah:blah:bah) returned 22 is meaningless to all but 2 people in the world and isn't uncommon (4ba0a8ad63e12a03ae01c039482967cc496b9174).
-
-	* Add a permission to allow multi-threaded dynamic transitions (via boundary support, (d9250dea3f89fe808a525f08888016b495240ed4).<sup>5</sup>
-
-
-	''Notes:''
-
-	<p><sup>1</sup> Provide a static inline helper for all FMODE_READ/FMODE_WRITE checks that also includes the corresponding security_file_permission() call to help ensure that they always happen together in the future. Possibly even rolling up rw_verify_area() checking as well into it.
-	</p>
-	<p>
-	<sup>5</sup> We may wish to consider removing this restriction altogether, and/or
-	making it subject to a permission check. Per-thread context can be
-	useful for multi-threaded server effectively acting as a userspace
-	object manager but wanting to set kernel context to avoid race
-	conditions on file accesses, ala the samba file server case.
-	</p>
-	<p>
-	<sup>6</sup> Seems like we ought to handle setxattr() consistently on filesystems
-	that do not support labeling. Mountpoint labeling triggers EOPNOTSUPP.
-	Genfscon does not.
-	</p>
-	<p>
-	<sup>7</sup> [http://lkml.org/lkml/2008/11/17/351 lkml post]
-	</p>
-

	== Resources ==		== Resources ==

EricParis: /* To Do List */

EricParis — Fri, 18 Sep 2009 19:22:48 GMT

To Do List

←Older revision		Revision as of 19:22, 18 September 2009
Line 74:		Line 74:

	* memory leak detector pops on policy reload. probably due to {new,old}policydb being on stack and memcpy'd into the data section policydb (aka probably false positive)		* memory leak detector pops on policy reload. probably due to {new,old}policydb being on stack and memcpy'd into the data section policydb (aka probably false positive)
		+
		+	* better error message in validate_classes. If the kernel permission and the policy permission are != we should print the name of both.

	''Notes:''		''Notes:''

JamesMorris: /* To Do List */

JamesMorris — Wed, 05 Aug 2009 22:35:20 GMT

To Do List

←Older revision		Revision as of 22:35, 5 August 2009
Line 1:		Line 1:
	== To Do List ==		== To Do List ==
		+
		+	* Resolve [https://bugzilla.redhat.com/show_bug.cgi?id=481618 bz 481618], re. CAP_SYS_MODULE checks and bluetooth.

	* Audit hooks to ensure that we don't have any more cases where DAC can be weakened.		* Audit hooks to ensure that we don't have any more cases where DAC can be weakened.

JamesMorris: /* To Do List */

JamesMorris — Wed, 22 Jul 2009 10:08:24 GMT

To Do List

←Older revision		Revision as of 10:08, 22 July 2009
Line 1:		Line 1:
	== To Do List ==		== To Do List ==
		+
		+	* Audit hooks to ensure that we don't have any more cases where DAC can be weakened.

	* Fix the performance issue apparently related to syscall audit which Linus keeps whining about.		* Fix the performance issue apparently related to syscall audit which Linus keeps whining about.

JamesMorris: /* To Do List */

JamesMorris — Wed, 03 Jun 2009 23:04:49 GMT

To Do List

←Older revision		Revision as of 23:04, 3 June 2009
Line 1:		Line 1:
	== To Do List ==		== To Do List ==
		+
		+	* Fix the performance issue apparently related to syscall audit which Linus keeps whining about.

	* Add support for SCTP.<sup>8</sup>		* Add support for SCTP.<sup>8</sup>