From 4b174b6d281f5c87234fc65bafc02877f565c5cf Mon Sep 17 00:00:00 2001 From: Mimi Zohar Date: Tue, 18 Jan 2011 09:07:11 -0500 Subject: [PATCH 1/7] trusted-keys: rename trusted_defined files to trusted Rename trusted_defined.c and trusted_defined.h files to trusted.c and trusted.h, respectively. Based on request from David Howells. Signed-off-by: Mimi Zohar Acked-by: David Howells Signed-off-by: James Morris --- security/keys/Makefile | 2 +- security/keys/{trusted_defined.c => trusted.c} | 2 +- security/keys/{trusted_defined.h => trusted.h} | 0 3 files changed, 2 insertions(+), 2 deletions(-) rename security/keys/{trusted_defined.c => trusted.c} (99%) rename security/keys/{trusted_defined.h => trusted.h} (100%) diff --git a/security/keys/Makefile b/security/keys/Makefile index 6c941050f573..ad8da87653cf 100644 --- a/security/keys/Makefile +++ b/security/keys/Makefile @@ -13,7 +13,7 @@ obj-y := \ request_key_auth.o \ user_defined.o -obj-$(CONFIG_TRUSTED_KEYS) += trusted_defined.o +obj-$(CONFIG_TRUSTED_KEYS) += trusted.o obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted_defined.o obj-$(CONFIG_KEYS_COMPAT) += compat.o obj-$(CONFIG_PROC_FS) += proc.o diff --git a/security/keys/trusted_defined.c b/security/keys/trusted.c similarity index 99% rename from security/keys/trusted_defined.c rename to security/keys/trusted.c index 2836c6dc18a3..3066f56c7676 100644 --- a/security/keys/trusted_defined.c +++ b/security/keys/trusted.c @@ -29,7 +29,7 @@ #include #include -#include "trusted_defined.h" +#include "trusted.h" static const char hmac_alg[] = "hmac(sha1)"; static const char hash_alg[] = "sha1"; diff --git a/security/keys/trusted_defined.h b/security/keys/trusted.h similarity index 100% rename from security/keys/trusted_defined.h rename to security/keys/trusted.h From b9703449347603289cac0bd04e574ac2e777275d Mon Sep 17 00:00:00 2001 From: Mimi Zohar Date: Tue, 18 Jan 2011 09:07:12 -0500 Subject: [PATCH 2/7] encrypted-keys: rename encrypted_defined files to encrypted Rename encrypted_defined.c and encrypted_defined.h files to encrypted.c and encrypted.h, respectively. Based on request from David Howells. Signed-off-by: Mimi Zohar Acked-by: David Howells Signed-off-by: James Morris --- security/keys/Makefile | 2 +- security/keys/{encrypted_defined.c => encrypted.c} | 3 ++- security/keys/{encrypted_defined.h => encrypted.h} | 0 3 files changed, 3 insertions(+), 2 deletions(-) rename security/keys/{encrypted_defined.c => encrypted.c} (99%) rename security/keys/{encrypted_defined.h => encrypted.h} (100%) diff --git a/security/keys/Makefile b/security/keys/Makefile index ad8da87653cf..1bf090a885fe 100644 --- a/security/keys/Makefile +++ b/security/keys/Makefile @@ -14,7 +14,7 @@ obj-y := \ user_defined.o obj-$(CONFIG_TRUSTED_KEYS) += trusted.o -obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted_defined.o +obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted.o obj-$(CONFIG_KEYS_COMPAT) += compat.o obj-$(CONFIG_PROC_FS) += proc.o obj-$(CONFIG_SYSCTL) += sysctl.o diff --git a/security/keys/encrypted_defined.c b/security/keys/encrypted.c similarity index 99% rename from security/keys/encrypted_defined.c rename to security/keys/encrypted.c index 28791a65740e..9e7e4ce3fae8 100644 --- a/security/keys/encrypted_defined.c +++ b/security/keys/encrypted.c @@ -30,7 +30,7 @@ #include #include -#include "encrypted_defined.h" +#include "encrypted.h" static const char KEY_TRUSTED_PREFIX[] = "trusted:"; static const char KEY_USER_PREFIX[] = "user:"; @@ -888,6 +888,7 @@ static int __init init_encrypted(void) out: encrypted_shash_release(); return ret; + } static void __exit cleanup_encrypted(void) diff --git a/security/keys/encrypted_defined.h b/security/keys/encrypted.h similarity index 100% rename from security/keys/encrypted_defined.h rename to security/keys/encrypted.h From 7f3c68bee977ab872827e44de017216736fe21d7 Mon Sep 17 00:00:00 2001 From: Mimi Zohar Date: Tue, 18 Jan 2011 09:07:13 -0500 Subject: [PATCH 3/7] keys: add trusted and encrypted maintainers Add myself and David Safford as maintainers for trusted/encrypted keys. Signed-off-by: Mimi Zohar Acked-by: David Howells Signed-off-by: James Morris --- MAINTAINERS | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/MAINTAINERS b/MAINTAINERS index 55592f8b672c..cf0f3a5c09cc 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -3674,6 +3674,28 @@ F: include/linux/key-type.h F: include/keys/ F: security/keys/ +KEYS-TRUSTED +M: David Safford +M: Mimi Zohar +L: linux-security-module@vger.kernel.org +L: keyrings@linux-nfs.org +S: Supported +F: Documentation/keys-trusted-encrypted.txt +F: include/keys/trusted-type.h +F: security/keys/trusted.c +F: security/keys/trusted.h + +KEYS-ENCRYPTED +M: Mimi Zohar +M: David Safford +L: linux-security-module@vger.kernel.org +L: keyrings@linux-nfs.org +S: Supported +F: Documentation/keys-trusted-encrypted.txt +F: include/keys/encrypted-type.h +F: security/keys/encrypted.c +F: security/keys/encrypted.h + KGDB / KDB /debug_core M: Jason Wessel W: http://kgdb.wiki.kernel.org/ From 5403110943a2dcf1f96416d7a412a8b46895facd Mon Sep 17 00:00:00 2001 From: Jesper Juhl Date: Sun, 23 Jan 2011 22:40:42 +0100 Subject: [PATCH 4/7] trusted keys: Fix a memory leak in trusted_update(). One failure path in security/keys/trusted.c::trusted_update() does not free 'new_p' while the others do. This patch makes sure we also free it in the remaining path (if datablob_parse() returns different from Opt_update). Signed-off-by: Jesper Juhl Signed-off-by: James Morris --- security/keys/trusted.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/keys/trusted.c b/security/keys/trusted.c index 3066f56c7676..83fc92e297cd 100644 --- a/security/keys/trusted.c +++ b/security/keys/trusted.c @@ -1032,6 +1032,7 @@ static int trusted_update(struct key *key, const void *data, size_t datalen) ret = datablob_parse(datablob, new_p, new_o); if (ret != Opt_update) { ret = -EINVAL; + kfree(new_p); goto out; } /* copy old key values, and reseal with new pcrs */ From c4ff4b829ef9e6353c0b133b7adb564a68054979 Mon Sep 17 00:00:00 2001 From: Rajiv Andrade Date: Fri, 12 Nov 2010 22:30:02 +0100 Subject: [PATCH 5/7] TPM: Long default timeout fix If duration variable value is 0 at this point, it's because chip->vendor.duration wasn't filled by tpm_get_timeouts() yet. This patch sets then the lowest timeout just to give enough time for tpm_get_timeouts() to further succeed. This fix avoids long boot times in case another entity attempts to send commands to the TPM when the TPM isn't accessible. Signed-off-by: Rajiv Andrade Signed-off-by: James Morris --- drivers/char/tpm/tpm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c index 1f46f1cd9225..36e0fa161c2b 100644 --- a/drivers/char/tpm/tpm.c +++ b/drivers/char/tpm/tpm.c @@ -364,12 +364,14 @@ unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip, tpm_protected_ordinal_duration[ordinal & TPM_PROTECTED_ORDINAL_MASK]; - if (duration_idx != TPM_UNDEFINED) + if (duration_idx != TPM_UNDEFINED) { duration = chip->vendor.duration[duration_idx]; - if (duration <= 0) + /* if duration is 0, it's because chip->vendor.duration wasn't */ + /* filled yet, so we set the lowest timeout just to give enough */ + /* time for tpm_get_timeouts() to succeed */ + return (duration <= 0 ? HZ : duration); + } else return 2 * 60 * HZ; - else - return duration; } EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration); From e5cce6c13c25d9ac56955a3ae2fd562719848172 Mon Sep 17 00:00:00 2001 From: Olof Johansson Date: Thu, 6 Jan 2011 21:24:01 -0600 Subject: [PATCH 6/7] tpm: fix panic caused by "tpm: Autodetect itpm devices" commit 3f0d3d016d89a5efb8b926d4707eb21fa13f3d27 adds a check for PNP device id to the common tpm_tis_init() function, which in some cases (force=1) will be called without the device being a member of a pnp_dev. Oopsing and panics ensue. Move the test up to before the call to tpm_tis_init(), since it just modifies a global variable anyway. Signed-off-by: Olof Johansson Acked-by: Rajiv Andrade Signed-off-by: James Morris --- drivers/char/tpm/tpm_tis.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c index c17a305ecb28..dd21df55689d 100644 --- a/drivers/char/tpm/tpm_tis.c +++ b/drivers/char/tpm/tpm_tis.c @@ -493,9 +493,6 @@ static int tpm_tis_init(struct device *dev, resource_size_t start, "1.2 TPM (device-id 0x%X, rev-id %d)\n", vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0))); - if (is_itpm(to_pnp_dev(dev))) - itpm = 1; - if (itpm) dev_info(dev, "Intel iTPM workaround enabled\n"); @@ -637,6 +634,9 @@ static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev, else interrupts = 0; + if (is_itpm(pnp_dev)) + itpm = 1; + return tpm_tis_init(&pnp_dev->dev, start, len, irq); } From 3ac285ff23cd6e1bc402b6db836521bce006eb89 Mon Sep 17 00:00:00 2001 From: Davidlohr Bueso Date: Fri, 21 Jan 2011 12:28:04 -0300 Subject: [PATCH 7/7] selinux: return -ENOMEM when memory allocation fails Return -ENOMEM when memory allocation fails in cond_init_bool_indexes, correctly propagating error code to caller. Signed-off-by: Davidlohr Bueso Signed-off-by: James Morris --- security/selinux/ss/conditional.c | 2 +- security/selinux/ss/policydb.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index c3f845cbcd48..a53373207fb4 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -178,7 +178,7 @@ int cond_init_bool_indexes(struct policydb *p) p->bool_val_to_struct = (struct cond_bool_datum **) kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL); if (!p->bool_val_to_struct) - return -1; + return -ENOMEM; return 0; } diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index be9de3872837..57363562f0f8 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -501,8 +501,8 @@ static int policydb_index(struct policydb *p) if (rc) goto out; - rc = -ENOMEM; - if (cond_init_bool_indexes(p)) + rc = cond_init_bool_indexes(p); + if (rc) goto out; for (i = 0; i < SYM_NUM; i++) {