linux-next: security-testing tree build failure

linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 541 bytes --]

Hi David,

Today's linux-next build (arm lots of configs) failed like this:

arch/arm/kernel/signal.c: In function 'do_notify_resume':
arch/arm/kernel/signal.c:701: error: implicit declaration of function 'tracehook_notify_resume'

Caused by commit d0420c83f39f79afb82010c2d2cafd150eef651b ("KEYS: Extend
TIF_NOTIFY_RESUME to (almost) all architectures [try #6]").  Presumably
the include of linux/tracehook.h is missing.

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 745 bytes --]

On Mon, 7 Sep 2009 23:40:28 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> Today's linux-next build (arm lots of configs) failed like this:
> 
> arch/arm/kernel/signal.c: In function 'do_notify_resume':
> arch/arm/kernel/signal.c:701: error: implicit declaration of function 'tracehook_notify_resume'
> 
> Caused by commit d0420c83f39f79afb82010c2d2cafd150eef651b ("KEYS: Extend
> TIF_NOTIFY_RESUME to (almost) all architectures [try #6]").  Presumably
> the include of linux/tracehook.h is missing.

The avr32 defconfig build fails the same way as well.  Thee may be
others, that is as far as we have gone so far.
-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 1078 bytes --]

Hi James, David,

On Mon, 7 Sep 2009 23:43:31 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> On Mon, 7 Sep 2009 23:40:28 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
> >
> > Today's linux-next build (arm lots of configs) failed like this:
> > 
> > arch/arm/kernel/signal.c: In function 'do_notify_resume':
> > arch/arm/kernel/signal.c:701: error: implicit declaration of function 'tracehook_notify_resume'
> > 
> > Caused by commit d0420c83f39f79afb82010c2d2cafd150eef651b ("KEYS: Extend
> > TIF_NOTIFY_RESUME to (almost) all architectures [try #6]").  Presumably
> > the include of linux/tracehook.h is missing.
> 
> The avr32 defconfig build fails the same way as well.  Thee may be
> others, that is as far as we have gone so far.

This also broke the alpha and mips builds.  I am going to use the version
of the security-testing tree from next-20090902 (the latest version I
have before the above commit was added) for today.

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 307 bytes --]

Hi James, David,

On Tue, 8 Sep 2009 10:40:12 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> This also broke the alpha and mips builds.  I am going to use the version

And cris :-(

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

[PATCH] KEYS: Add missing linux/tracehook.h #inclusions

[David Howells]

Add #inclusions of linux/tracehook.h to those arch files that had the tracehook
call for TIF_NOTIFY_RESUME added when support for that flag was added to that
arch.

Signed-off-by: David Howells <dhowells@redhat.com>
---

 arch/alpha/kernel/signal.c  |    1 +
 arch/arm/kernel/signal.c    |    1 +
 arch/avr32/kernel/signal.c  |    1 +
 arch/cris/kernel/ptrace.c   |    1 +
 arch/h8300/kernel/signal.c  |    1 +
 arch/m32r/kernel/signal.c   |    1 +
 arch/mips/kernel/signal.c   |    1 +
 arch/parisc/kernel/signal.c |    1 +
 8 files changed, 8 insertions(+), 0 deletions(-)


diff --git a/arch/alpha/kernel/signal.c b/arch/alpha/kernel/signal.c
index d91aaa7..0932dbb 100644
--- a/arch/alpha/kernel/signal.c
+++ b/arch/alpha/kernel/signal.c
@@ -20,6 +20,7 @@
 #include <linux/binfmts.h>
 #include <linux/bitops.h>
 #include <linux/syscalls.h>
+#include <linux/tracehook.h>
 
 #include <asm/uaccess.h>
 #include <asm/sigcontext.h>
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index ea4ad3a..b76fe06 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -12,6 +12,7 @@
 #include <linux/personality.h>
 #include <linux/freezer.h>
 #include <linux/uaccess.h>
+#include <linux/tracehook.h>
 
 #include <asm/elf.h>
 #include <asm/cacheflush.h>
diff --git a/arch/avr32/kernel/signal.c b/arch/avr32/kernel/signal.c
index de9f7fe..64f886f 100644
--- a/arch/avr32/kernel/signal.c
+++ b/arch/avr32/kernel/signal.c
@@ -16,6 +16,7 @@
 #include <linux/ptrace.h>
 #include <linux/unistd.h>
 #include <linux/freezer.h>
+#include <linux/tracehook.h>
 
 #include <asm/uaccess.h>
 #include <asm/ucontext.h>
diff --git a/arch/cris/kernel/ptrace.c b/arch/cris/kernel/ptrace.c
index 32e9d5e..48b0f39 100644
--- a/arch/cris/kernel/ptrace.c
+++ b/arch/cris/kernel/ptrace.c
@@ -16,6 +16,7 @@
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
+#include <linux/tracehook.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
diff --git a/arch/h8300/kernel/signal.c b/arch/h8300/kernel/signal.c
index abac3ee..af842c3 100644
--- a/arch/h8300/kernel/signal.c
+++ b/arch/h8300/kernel/signal.c
@@ -39,6 +39,7 @@
 #include <linux/tty.h>
 #include <linux/binfmts.h>
 #include <linux/freezer.h>
+#include <linux/tracehook.h>
 
 #include <asm/setup.h>
 #include <asm/uaccess.h>
diff --git a/arch/m32r/kernel/signal.c b/arch/m32r/kernel/signal.c
index f80bac1..144b0f1 100644
--- a/arch/m32r/kernel/signal.c
+++ b/arch/m32r/kernel/signal.c
@@ -21,6 +21,7 @@
 #include <linux/stddef.h>
 #include <linux/personality.h>
 #include <linux/freezer.h>
+#include <linux/tracehook.h>
 #include <asm/cacheflush.h>
 #include <asm/ucontext.h>
 #include <asm/uaccess.h>
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index c2acf31..6254041 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -21,6 +21,7 @@
 #include <linux/compiler.h>
 #include <linux/syscalls.h>
 #include <linux/uaccess.h>
+#include <linux/tracehook.h>
 
 #include <asm/abi.h>
 #include <asm/asm.h>
diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
index 5ca1c02..8eb3c63 100644
--- a/arch/parisc/kernel/signal.c
+++ b/arch/parisc/kernel/signal.c
@@ -25,6 +25,7 @@
 #include <linux/stddef.h>
 #include <linux/compat.h>
 #include <linux/elf.h>
+#include <linux/tracehook.h>
 #include <asm/ucontext.h>
 #include <asm/rt_sigframe.h>
 #include <asm/uaccess.h>

Re: [PATCH] KEYS: Add missing linux/tracehook.h #inclusions

[James Morris]

On Wed, 9 Sep 2009, David Howells wrote:

> Add #inclusions of linux/tracehook.h to those arch files that had the tracehook
> call for TIF_NOTIFY_RESUME added when support for that flag was added to that
> arch.
> 
> Signed-off-by: David Howells <dhowells@redhat.com>


Applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next


-- 
James Morris
<jmorris@namei.org>

Re: [PATCH] KEYS: Add missing linux/tracehook.h #inclusions

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 326 bytes --]

Hi James, David,

On Wed, 9 Sep 2009 18:38:55 +1000 (EST) James Morris <jmorris@namei.org> wrote:
>
> Applied to
> git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next

Thanks guys.

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 699 bytes --]

Hi ,

Today's linux-next build (sparc64 defconfig) failed like this:

cc1: warnings being treated as errors
include/linux/security.h:3012: error: 'security_key_session_to_parent' declared 'static' but never defined

Caused by commit ee18d64c1f632043a02e6f5ba5e045bb26a5465f ("KEYS: Add a
keyctl to install a process's session keyring on its parent [try #6]")
which I have reverted for today.

(I also reverted commit 945af7c3289c26c9070d6b1bf3ca759d36643e0b ("KEYS:
security_cred_alloc_blank() should return int under all circumstances")
which is a fix for the above commit.)

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 513 bytes --]

Hi James,

Today's linux-next build (powerpc ppc64_defconfig) failed like this:

kernel/cred.c: In function 'cred_alloc_blank':
kernel/cred.c:234: error: void value not ignored as it ought to be

Caused by commit ee18d64c1f632043a02e6f5ba5e045bb26a5465f ("KEYS: Add a
keyctl to install a process's session keyring on its parent [try #6]").

I have used the version from next-20090902 for today.
-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 651 bytes --]

Hi James,

Today's linux-next build (powerpc ppc64_defconfig) failed like this:

kernel/sysctl.c:1321: error: 'mmap_min_addr_handler' undeclared here (not in a function)
mm/mmap.c: In function 'do_mmap_pgoff':
mm/mmap.c:935: error: implicit declaration of function 'round_hint_to_min'

Caused by commit a2551df7ec568d87793d2eea4ca744e86318f205
("Security/SELinux: seperate lsm specific mmap_min_addr") -
CONFIG_SECURITY is not set in this build.

I have used the version of the security-testing tree from next-20090806
for today.
-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: linux-next: security-testing tree build failure

[Eric Paris]

On Fri, 2009-08-07 at 14:59 +1000, Stephen Rothwell wrote:
> Hi James,
> 
> Today's linux-next build (powerpc ppc64_defconfig) failed like this:
> 
> kernel/sysctl.c:1321: error: 'mmap_min_addr_handler' undeclared here (not in a function)
> mm/mmap.c: In function 'do_mmap_pgoff':
> mm/mmap.c:935: error: implicit declaration of function 'round_hint_to_min'
> 
> Caused by commit a2551df7ec568d87793d2eea4ca744e86318f205
> ("Security/SELinux: seperate lsm specific mmap_min_addr") -
> CONFIG_SECURITY is not set in this build.
> 
> I have used the version of the security-testing tree from next-20090806
> for today.

Sorry, I thought I put the definitions outside of the ifdef in
security.h but clearly they aren't.  Looks like James's tree has the fix
as of a couple of hours ago, so you should be fix on your next pull from
him.

-Eric

Re: linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 444 bytes --]

HI Eric,


On Mon, 10 Aug 2009 10:07:49 -0400 Eric Paris <eparis@redhat.com> wrote:
>
> Sorry, I thought I put the definitions outside of the ifdef in
> security.h but clearly they aren't.  Looks like James's tree has the fix
> as of a couple of hours ago, so you should be fix on your next pull from
> him.

Great, thanks.

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 599 bytes --]

Hi James,

Today's linux-next build (powerpc ppc64_defconfig) failed like this:

fs/namei.c: In function 'may_open':
fs/namei.c:1516: error: 'nd' undeclared (first use in this function)

Caused by commit 6146f0d5e47ca4047ffded0fb79b6c25359b386c ("integrity:
IMA hooks").

The "nd" parameter to may_open() was removed in commit
3fb64190aa3c23c10e6e9fd0124ac030115c99bf ("pass a struct path * to
may_open") before 2.6.29-rc1.

I have dropped the security-testing tree for today.
-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: linux-next: security-testing tree build failure

[James Morris]

On Fri, 6 Feb 2009, Stephen Rothwell wrote:

> Hi James,
> 
> Today's linux-next build (powerpc ppc64_defconfig) failed like this:
> 
> fs/namei.c: In function 'may_open':
> fs/namei.c:1516: error: 'nd' undeclared (first use in this function)
> 
> Caused by commit 6146f0d5e47ca4047ffded0fb79b6c25359b386c ("integrity:
> IMA hooks").
> 
> The "nd" parameter to may_open() was removed in commit
> 3fb64190aa3c23c10e6e9fd0124ac030115c99bf ("pass a struct path * to
> may_open") before 2.6.29-rc1.
> 
> I have dropped the security-testing tree for today.

This was also fixed before I pushed my tree out (can you re-pull the 
security-testing tree at ~11am your time if you get a conflict?  chances 
are I've fixed it by then).

-- 
James Morris
<jmorris@namei.org>

linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 580 bytes --]

Hi James,

Today's linux-next build (powerpc pseries_defconfig) failed like this:

kernel/built-in.o: In function `.__audit_log_bprm_fcaps':
(.text+0x63aec): undefined reference to `.get_vfs_caps_from_disk'
kernel/built-in.o: In function `.audit_copy_inode':
auditsc.c:(.text+0x64594): undefined reference to `.get_vfs_caps_from_disk'

get_vfs_caps_from_disk() is protected by
CONFIG_SECURITY_FILE_CAPABILITIES but the call sites in kernel/auditsc.c
are not.

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 802 bytes --]

Hi James,

On Thu, 13 Nov 2008 18:46:24 +1100 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> Today's linux-next build (powerpc pseries_defconfig) failed like this:
> 
> kernel/built-in.o: In function `.__audit_log_bprm_fcaps':
> (.text+0x63aec): undefined reference to `.get_vfs_caps_from_disk'
> kernel/built-in.o: In function `.audit_copy_inode':
> auditsc.c:(.text+0x64594): undefined reference to `.get_vfs_caps_from_disk'
> 
> get_vfs_caps_from_disk() is protected by
> CONFIG_SECURITY_FILE_CAPABILITIES but the call sites in kernel/auditsc.c
> are not.

This error is still there today.  I will have to drop the
security-testing tree on Monday if this is not fixed.

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: linux-next: security-testing tree build failure

[Eric Paris]

On Fri, 2008-11-14 at 18:43 +1100, Stephen Rothwell wrote:
> Hi James,
> 
> On Thu, 13 Nov 2008 18:46:24 +1100 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
> >
> > Today's linux-next build (powerpc pseries_defconfig) failed like this:
> > 
> > kernel/built-in.o: In function `.__audit_log_bprm_fcaps':
> > (.text+0x63aec): undefined reference to `.get_vfs_caps_from_disk'
> > kernel/built-in.o: In function `.audit_copy_inode':
> > auditsc.c:(.text+0x64594): undefined reference to `.get_vfs_caps_from_disk'
> > 
> > get_vfs_caps_from_disk() is protected by
> > CONFIG_SECURITY_FILE_CAPABILITIES but the call sites in kernel/auditsc.c
> > are not.
> 
> This error is still there today.  I will have to drop the
> security-testing tree on Monday if this is not fixed.

I am aware.  James didn't like my first fix for CONFIG_AUDIT but not
CONFIG_SECURITY_FILE_CAPABILITIES so I just sent another one which
should address the concern.

-Eric

Re: linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 382 bytes --]

Hi Eric,

On Fri, 14 Nov 2008 17:42:02 -0500 Eric Paris <eparis@redhat.com> wrote:
>
> I am aware.  James didn't like my first fix for CONFIG_AUDIT but not
> CONFIG_SECURITY_FILE_CAPABILITIES so I just sent another one which
> should address the concern.

Thanks.

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

linux-next: security-testing tree build failure

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 907 bytes --]

Hi James,

Today's linux-next build (powerpc ppc64_defconfig) failed like this:

In file included from init/main.c:35:
include/linux/security.h:1788: error: static declaration of 'security_capable' follows non-static declaration
include/linux/capability.h:524: error: previous declaration of 'security_capable' was here
include/linux/security.h:1793: error: static declaration of 'security_capable_noaudit' follows non-static declaration
include/linux/capability.h:525: error: previous declaration of 'security_capable_noaudit' was here

Caused by commit 06112163f5fd9e491a7f810443d81efa9d88e247 ("Add a new
capable interface that will be used by systems that use audit to").

Please compile test with and without CONFIG_SECURITY.

I have dropped the security-testing tree for today.
-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: linux-next: security-testing tree build failure

[James Morris]

On Wed, 12 Nov 2008, Stephen Rothwell wrote:

> Hi James,
> 
> Today's linux-next build (powerpc ppc64_defconfig) failed like this:
> 
> In file included from init/main.c:35:
> include/linux/security.h:1788: error: static declaration of 'security_capable' follows non-static declaration
> include/linux/capability.h:524: error: previous declaration of 'security_capable' was here
> include/linux/security.h:1793: error: static declaration of 'security_capable_noaudit' follows non-static declaration
> include/linux/capability.h:525: error: previous declaration of 'security_capable_noaudit' was here
> 
> Caused by commit 06112163f5fd9e491a7f810443d81efa9d88e247 ("Add a new
> capable interface that will be used by systems that use audit to").
> 
> Please compile test with and without CONFIG_SECURITY.

Done, with the patch below (now pushed to the tree).


commit 92a77aac9812d5397abbe6f1920e085e50838635
Author: James Morris <jmorris@namei.org>
Date:   Wed Nov 12 21:20:00 2008 +1100

    security: remove broken and useless declarations
    
    Remove broken declarations for security_capable* functions,
    which were not needed anyway.
    
    Signed-off-by: James Morris <jmorris@namei.org>

diff --git a/include/linux/capability.h b/include/linux/capability.h
index b313ba1..7f26580 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -521,8 +521,6 @@ extern const kernel_cap_t __cap_init_eff_set;
 
 kernel_cap_t cap_set_effective(const kernel_cap_t pE_new);
 
-extern int security_capable(struct task_struct *t, int cap);
-extern int security_capable_noaudit(struct task_struct *t, int cap);
 /**
  * has_capability - Determine if a task has a superior capability available
  * @t: The task in question

Re: linux-next: security-testing tree build failure

[Eric Paris]

On Wed, 2008-11-12 at 21:56 +1100, James Morris wrote:
> On Wed, 12 Nov 2008, Stephen Rothwell wrote:
> 
> > Hi James,
> > 
> > Today's linux-next build (powerpc ppc64_defconfig) failed like this:
> > 
> > In file included from init/main.c:35:
> > include/linux/security.h:1788: error: static declaration of 'security_capable' follows non-static declaration
> > include/linux/capability.h:524: error: previous declaration of 'security_capable' was here
> > include/linux/security.h:1793: error: static declaration of 'security_capable_noaudit' follows non-static declaration
> > include/linux/capability.h:525: error: previous declaration of 'security_capable_noaudit' was here
> > 
> > Caused by commit 06112163f5fd9e491a7f810443d81efa9d88e247 ("Add a new
> > capable interface that will be used by systems that use audit to").
> > 
> > Please compile test with and without CONFIG_SECURITY.
> 
> Done, with the patch below (now pushed to the tree).

Only works in the config security case because every function that calls
has_capability() also includes security.h

Since these are inlined the original caller needs to have the
security_capable and security_capable_noaudit prototype.  The filesystem
changes to use this new interface often do not already #include
security.h.  I'll look at it and wrap them in CONFIG_SECURITY rather
than include security.h in all the filesystem changes.....

-Eric