linux-next: manual merge of the security-testing tree

linux-next: manual merge of the security-testing tree

[Stephen Rothwell]

Hi James,

Today's linux-next merge of the security-testing tree got a conflict in
fs/cifs/misc.c between commit 14fbf50d695207754daeb96270b3027a3821121f
("cifs: reinstate sharing of SMB sessions sans races") from the cifs tree
and commit a001e5b558f25eb1e588522d73ac949b643b7a37 ("CRED: Wrap task
credential accesses in the CIFS filesystem") from the security-testing
tree.

I fixed it up (see below) and can carry it for a short while.

Steve, you should apply the patch from the security-testing (creds) tree
that was sent to you - its dependencies are upstream already.
-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

2343ec9bd0c5c15a77e7261355dc93a075e8f753
diff --cc fs/cifs/misc.c
index 46c8c7b,ec36410..1913b65
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@@ -343,13 -347,13 +343,13 @@@ header_assemble(struct smb_hdr *buffer
  		/*  BB Add support for establishing new tCon and SMB Session  */
  		/*      with userid/password pairs found on the smb session   */
  		/*	for other target tcp/ip addresses 		BB    */
- 				if (current->fsuid != treeCon->ses->linux_uid) {
+ 				if (current_fsuid() != treeCon->ses->linux_uid) {
  					cFYI(1, ("Multiuser mode and UID "
  						 "did not match tcon uid"));
 -					read_lock(&GlobalSMBSeslock);
 -					list_for_each(temp_item, &GlobalSMBSessionList) {
 -						ses = list_entry(temp_item, struct cifsSesInfo, cifsSessionList);
 +					read_lock(&cifs_tcp_ses_lock);
 +					list_for_each(temp_item, &treeCon->ses->server->smb_ses_list) {
 +						ses = list_entry(temp_item, struct cifsSesInfo, smb_ses_list);
- 						if (ses->linux_uid == current->fsuid) {
+ 						if (ses->linux_uid == current_fsuid()) {
  							if (ses->server == treeCon->ses->server) {
  								cFYI(1, ("found matching uid substitute right smb_uid"));
  								buffer->Uid = ses->Suid;

Re: linux-next: manual merge of the security-testing tree

[James Morris]

On Mon, 17 Nov 2008, Stephen Rothwell wrote:

> Hi James,
> 
> Today's linux-next merge of the security-testing tree got a conflict in
> fs/cifs/misc.c between commit 14fbf50d695207754daeb96270b3027a3821121f
> ("cifs: reinstate sharing of SMB sessions sans races") from the cifs tree
> and commit a001e5b558f25eb1e588522d73ac949b643b7a37 ("CRED: Wrap task
> credential accesses in the CIFS filesystem") from the security-testing
> tree.
> 
> I fixed it up (see below) and can carry it for a short while.

I merged with linus to resolve this, in 
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next

commit f3a5c547012a09f38f7c27b17a8e3150b69cd259

Please test.



- James
-- 
James Morris
<jmorris@namei.org>

linux-next: manual merge of the security-testing tree

[Stephen Rothwell]

Hi James,

Today's linux-next merge of the security-testing tree got a conflict in
fs/ocfs2/namei.c between commit 8b50970dda2c81dfbd120ae650fcf5439f268f37
("[PATCH 01/10] ocfs2: move new inode allocation out of the transaction")
from the ocsf2 tree and commit b19c2a3b839b9dfb3f258e8943dc3784ae20c7b0
("CRED: Wrap task credential accesses in the OCFS2 filesystem") from the
security-testing tree.

I fixed it up (see below) and can carry it.  The ocfs2 tree change moved
the place where the security-testing tree change to this file needs to be
made.  The below patch could be applied to the ocfs2 tree (as part of the
above security-testing patch as all its dependencies are already upstream.
-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

diff --cc fs/ocfs2/namei.c
index 98fd325,2545e74..0000000
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@@ -187,34 -186,6 +187,34 @@@ bail
  	return ret;
  }
  
 +static struct inode *ocfs2_get_init_inode(struct inode *dir, int mode)
 +{
 +	struct inode *inode;
 +
 +	inode = new_inode(dir->i_sb);
 +	if (!inode) {
 +		mlog(ML_ERROR, "new_inode failed!\n");
 +		return NULL;
 +	}
 +
 +	/* populate as many fields early on as possible - many of
 +	 * these are used by the support functions here and in
 +	 * callers. */
 +	if (S_ISDIR(mode))
 +		inode->i_nlink = 2;
 +	else
 +		inode->i_nlink = 1;
- 	inode->i_uid = current->fsuid;
++	inode->i_uid = current_fsuid();
 +	if (dir->i_mode & S_ISGID) {
 +		inode->i_gid = dir->i_gid;
 +		if (S_ISDIR(mode))
 +			mode |= S_ISGID;
 +	} else
- 		inode->i_gid = current->fsgid;
++		inode->i_gid = current_fsgid();
 +	inode->i_mode = mode;
 +	return inode;
 +}
 +
  static int ocfs2_mknod(struct inode *dir,
  		       struct dentry *dentry,
  		       int mode,

linux-next: manual merge of the security-testing tree

[Stephen Rothwell]

Hi James,

Today's linux-next merge of the security-testing tree got a conflict in
fs/nfsd/nfs4recover.c between commit
e4625eb826de4f6774ee602c442ba23b686bdcc7 ("nfsd: use of unitialized list
head on error exit in nfs4recover.c") from the nfsd tree and commit
d84f4f992cbd76e8f39c488cf0c5d123843923b1 ("CRED: Inaugurate COW
credentials") from the security-testing tree.

Just a context change. I fixed it up (see below) and can carry the fix as
necessary.
-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

diff --cc fs/nfsd/nfs4recover.c
index cf94563,9371ea1..0000000
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@@ -224,10 -230,12 +230,13 @@@ nfsd4_list_rec_dir(struct dentry *dir, 
  	if (!rec_dir_init)
  		return 0;
  
- 	nfs4_save_user(&uid, &gid);
+ 	status = nfs4_save_creds(&original_cred);
+ 	if (status < 0)
+ 		return status;
 +	INIT_LIST_HEAD(dentries);
  
- 	filp = dentry_open(dget(dir), mntget(rec_dir.mnt), O_RDONLY);
+ 	filp = dentry_open(dget(dir), mntget(rec_dir.mnt), O_RDONLY,
+ 			   current_cred());
  	status = PTR_ERR(filp);
  	if (IS_ERR(filp))
  		goto out;

Re: linux-next: manual merge of the security-testing tree

[David Howells]

Stephen Rothwell <sfr@canb.auug.org.au> wrote:

> Today's linux-next merge of the security-testing tree got a conflict in
> fs/nfsd/nfs4recover.c between commit
> e4625eb826de4f6774ee602c442ba23b686bdcc7 ("nfsd: use of unitialized list
> head on error exit in nfs4recover.c") from the nfsd tree and commit
> d84f4f992cbd76e8f39c488cf0c5d123843923b1 ("CRED: Inaugurate COW
> credentials") from the security-testing tree.
> 
> Just a context change. I fixed it up (see below) and can carry the fix as
> necessary.

That looks okay.

Re: linux-next: manual merge of the security-testing tree

[J. Bruce Fields]

On Tue, Nov 25, 2008 at 07:11:37PM +1100, Stephen Rothwell wrote:
> Hi James,
> 
> Today's linux-next merge of the security-testing tree got a conflict in
> fs/nfsd/nfs4recover.c between commit
> e4625eb826de4f6774ee602c442ba23b686bdcc7 ("nfsd: use of unitialized list
> head on error exit in nfs4recover.c") from the nfsd tree and commit
> d84f4f992cbd76e8f39c488cf0c5d123843923b1 ("CRED: Inaugurate COW
> credentials") from the security-testing tree.
> 
> Just a context change. I fixed it up (see below) and can carry the fix as
> necessary.

Thanks!--b.

> -- 
> Cheers,
> Stephen Rothwell                    sfr@canb.auug.org.au
> http://www.canb.auug.org.au/~sfr/
> 
> diff --cc fs/nfsd/nfs4recover.c
> index cf94563,9371ea1..0000000
> --- a/fs/nfsd/nfs4recover.c
> +++ b/fs/nfsd/nfs4recover.c
> @@@ -224,10 -230,12 +230,13 @@@ nfsd4_list_rec_dir(struct dentry *dir, 
>   	if (!rec_dir_init)
>   		return 0;
>   
> - 	nfs4_save_user(&uid, &gid);
> + 	status = nfs4_save_creds(&original_cred);
> + 	if (status < 0)
> + 		return status;
>  +	INIT_LIST_HEAD(dentries);
>   
> - 	filp = dentry_open(dget(dir), mntget(rec_dir.mnt), O_RDONLY);
> + 	filp = dentry_open(dget(dir), mntget(rec_dir.mnt), O_RDONLY,
> + 			   current_cred());
>   	status = PTR_ERR(filp);
>   	if (IS_ERR(filp))
>   		goto out;

linux-next: manual merge of the security-testing tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 608 bytes --]

Hi James,

Today's linux-next merge of the security-testing tree got a conflict in
fs/xfs/xfs_vnodeops.h between commit
ea5a3dc8356bf1cf27bab9a5a0da5dfbbb82013d ("[XFS] kill sys_cred") from the
xfs tree and commit b6dff3ec5e116e3af6f537d4caedcad6b9e5082a ("CRED:
Separate task security context from task_struct") from the
security-testing tree.

I fixed it up (by using the xfs tree version - since that removed the
parameters that the latter changed) and can carry the fix as necessary.
-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/


[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

linux-next: manual merge of the security-testing tree

[Stephen Rothwell]

Hi James,

Today's linux-next merge of the security-testing tree got a conflict in
drivers/char/tty_audit.c between commit
49518720d67042cf431e7f96aed5b0f5c51a84e3 ("[PATCH] Audit: Log TIOCSTI")
from the audit-current tree and commit
66303bce9b924e35e435d35409d3abc371755767 ("CRED: Wrap task credential
accesses in the tty driver") from the security-testing tree.

The former moved the code that the latter was modifying.  I fixed it up
(see below) and can carry the fix as necessary.
-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

diff --cc drivers/char/tty_audit.c
index 632c296,d961fa9..0000000
--- a/drivers/char/tty_audit.c
+++ b/drivers/char/tty_audit.c
@@@ -76,11 -82,16 +76,12 @@@ static void tty_audit_log(const char *d
  	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY);
  	if (ab) {
  		char name[sizeof(tsk->comm)];
+ 		uid_t uid = task_uid(tsk);
  
 -		audit_log_format(ab, "tty pid=%u uid=%u auid=%u ses=%u "
 -				 "major=%d minor=%d comm=",
 +		audit_log_format(ab, "%s pid=%u uid=%u auid=%u ses=%u "
 +				 "major=%d minor=%d comm=", description,
- 				 tsk->pid, tsk->uid, loginuid, sessionid,
+ 				 tsk->pid, uid, loginuid, sessionid,
 -				 buf->major, buf->minor);
 +				 major, minor);
  		get_task_comm(name, tsk);
  		audit_log_untrustedstring(ab, name);
  		audit_log_format(ab, " data=");

Re: linux-next: manual merge of the security-testing tree

[David Howells]

Stephen Rothwell <sfr@canb.auug.org.au> wrote:

> Today's linux-next merge of the security-testing tree got a conflict in
> drivers/char/tty_audit.c between commit
> 49518720d67042cf431e7f96aed5b0f5c51a84e3 ("[PATCH] Audit: Log TIOCSTI")
> from the audit-current tree and commit
> 66303bce9b924e35e435d35409d3abc371755767 ("CRED: Wrap task credential
> accesses in the tty driver") from the security-testing tree.
> 
> The former moved the code that the latter was modifying.  I fixed it up
> (see below) and can carry the fix as necessary.

Your changes look okay.

David

Re: linux-next: manual merge of the security-testing tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 2293 bytes --]

Hi Mark,

On Thu, 20 Nov 2008 16:37:34 +1100 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> Today's linux-next merge of the security-testing tree got a conflict in
> fs/ocfs2/namei.c between commit 8b50970dda2c81dfbd120ae650fcf5439f268f37
> ("[PATCH 01/10] ocfs2: move new inode allocation out of the transaction")
> from the ocsf2 tree and commit b19c2a3b839b9dfb3f258e8943dc3784ae20c7b0
> ("CRED: Wrap task credential accesses in the OCFS2 filesystem") from the
> security-testing tree.
> 
> I fixed it up (see below) and can carry it.  The ocfs2 tree change moved
> the place where the security-testing tree change to this file needs to be
> made.  The below patch could be applied to the ocfs2 tree (as part of the
> above security-testing patch as all its dependencies are already upstream.
> -- 
> Cheers,
> Stephen Rothwell                    sfr@canb.auug.org.au
> http://www.canb.auug.org.au/~sfr/
> 
> diff --cc fs/ocfs2/namei.c
> index 98fd325,2545e74..0000000
> --- a/fs/ocfs2/namei.c
> +++ b/fs/ocfs2/namei.c
> @@@ -187,34 -186,6 +187,34 @@@ bail
>   	return ret;
>   }
>   
>  +static struct inode *ocfs2_get_init_inode(struct inode *dir, int mode)
>  +{
>  +	struct inode *inode;
>  +
>  +	inode = new_inode(dir->i_sb);
>  +	if (!inode) {
>  +		mlog(ML_ERROR, "new_inode failed!\n");
>  +		return NULL;
>  +	}
>  +
>  +	/* populate as many fields early on as possible - many of
>  +	 * these are used by the support functions here and in
>  +	 * callers. */
>  +	if (S_ISDIR(mode))
>  +		inode->i_nlink = 2;
>  +	else
>  +		inode->i_nlink = 1;
> - 	inode->i_uid = current->fsuid;
> ++	inode->i_uid = current_fsuid();
>  +	if (dir->i_mode & S_ISGID) {
>  +		inode->i_gid = dir->i_gid;
>  +		if (S_ISDIR(mode))
>  +			mode |= S_ISGID;
>  +	} else
> - 		inode->i_gid = current->fsgid;
> ++		inode->i_gid = current_fsgid();
>  +	inode->i_mode = mode;
>  +	return inode;
>  +}
>  +
>   static int ocfs2_mknod(struct inode *dir,
>   		       struct dentry *dentry,
>   		       int mode,

This conflict is now between the ocfs2 tree and Linus' tree (the
security-testing tree beat you to being merged :-)).

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: linux-next: manual merge of the security-testing tree

[David Howells]

Stephen Rothwell <sfr@canb.auug.org.au> wrote:

> This conflict is now between the ocfs2 tree and Linus' tree (the
> security-testing tree beat you to being merged :-)).

Replace current->fsuid with current_fsuid().

David