[PATCH 0/2] Smack: allow multiple labels in onlycap

[Rafal Krypa]

It has been pointed out in Tizen recently, that onlycap feature might be
impractical with possibility of only one label to set.
If there is a desire to limit CAP_MAC_ADMIN and CAP_MAC_OVERRIDE in the
system, all privileged processes would have to run with a single label.
If multiple modules need those capabilities, they cannot have different
policy rules.

This patch set aims for making onlycap more flexible. Multiple labels can
be configured for privilege.

To support that, the first patch does some preparation in smackfs. Until
now all lists in Smack were add-only. No elements were ever removed from
lists of labels, rules and all other. Therefore Smack uses RCU lists with
non-standard, relaxed usage of critical sections. But extended onlycap
functionality will require both addition and removal of elements. To
support that, smackfs must be adapted first for correct usage of RCU read
critical sections. Failing to do that could lead to memory races and
undefined behaviour in smackfs.
As a bonus, first patch also fixes a bug in smackfs that was found by
coincidence.


Rafal Krypa (2):
  Smack: fix seq operations in smackfs
  Smack: allow multiple labels in onlycap

 Documentation/security/Smack.txt |   6 +-
 security/smack/smack.h           |  25 ++---
 security/smack/smack_access.c    |  41 ++++++++
 security/smack/smackfs.c         | 214 ++++++++++++++++++++++++---------------
 4 files changed, 184 insertions(+), 102 deletions(-)

-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/