{"push_id":865768346,"size":9,"distinct_size":9,"ref":"refs/heads/cm-13.0","head":"284ec1e4e8a7f7a8e32a631648bea1a07aa80124","before":"c0a0b7d7f4e20df12e8415f74a1dd51be2b7fbb9","commits":[{"sha":"62b34d12e8593c546900a3b71bf4ee44706a913d","author":{"email":"b0b36e3cd9ea4e5739ff430a3056fabf2fdb0376@redhat.com","name":"Eric Paris"},"message":"SELinux: allow default source/target selectors for user/role/range\n\nWhen new objects are created we have great and flexible rules to\ndetermine the type of the new object.  We aren't quite as flexible or\nmature when it comes to determining the user, role, and range.  This\npatch adds a new ability to specify the place a new objects user, role,\nand range should come from.  For users and roles it can come from either\nthe source or the target of the operation.  aka for files the user can\neither come from the source (the running process and todays default) or\nit can come from the target (aka the parent directory of the new file)\n\nexamples always are done with\ndirectory context: system_u:object_r:mnt_t:s0-s0:c0.c512\nprocess context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023\n\n[no rule]\n\tunconfined_u:object_r:mnt_t:s0   test_none\n[default user source]\n\tunconfined_u:object_r:mnt_t:s0   test_user_source\n[default user target]\n\tsystem_u:object_r:mnt_t:s0       test_user_target\n[default role source]\n\tunconfined_u:unconfined_r:mnt_t:s0 test_role_source\n[default role target]\n\tunconfined_u:object_r:mnt_t:s0   test_role_target\n[default range source low]\n\tunconfined_u:object_r:mnt_t:s0 test_range_source_low\n[default range source high]\n\tunconfined_u:object_r:mnt_t:s0:c0.c1023 test_range_source_high\n[default range source low-high]\n\tunconfined_u:object_r:mnt_t:s0-s0:c0.c1023 test_range_source_low-high\n[default range target low]\n\tunconfined_u:object_r:mnt_t:s0 test_range_target_low\n[default range target high]\n\tunconfined_u:object_r:mnt_t:s0:c0.c512 test_range_target_high\n[default range target low-high]\n\tunconfined_u:object_r:mnt_t:s0-s0:c0.c512 test_range_target_low-high\n\nChange-Id: I923402e61890e286ae56666f1bb5e148ad0c6a15\nSigned-off-by: Eric Paris <eparis@redhat.com>","distinct":true,"url":"https://api.github.com/repos/CM-Tab-S/android_kernel_samsung_klimtwifi/commits/62b34d12e8593c546900a3b71bf4ee44706a913d"},{"sha":"be7587abfb6bb554edee101ef210f5919c24b3d5","author":{"email":"b0b36e3cd9ea4e5739ff430a3056fabf2fdb0376@redhat.com","name":"Eric Paris"},"message":"SELinux: add default_type statements\n\nBecause Fedora shipped userspace based on my development tree we now\nhave policy version 27 in the wild defining only default user, role, and\nrange.  Thus to add default_type we need a policy.28.\n\nChange-Id: I6f6e2056dd068742b55b88cf75506adb7cb721f1\nSigned-off-by: Eric Paris <eparis@redhat.com>","distinct":true,"url":"https://api.github.com/repos/CM-Tab-S/android_kernel_samsung_klimtwifi/commits/be7587abfb6bb554edee101ef210f5919c24b3d5"},{"sha":"8aec2a3299b89a879ad7f5a49b9c11a709f57cea","author":{"email":"b3eef4c91db124096f17b389c40733c06b7d5036@btinternet.com","name":"Richard Haines"},"message":"SELinux: Update policy version to support constraints info\n\nUpdate the policy version (POLICYDB_VERSION_CONSTRAINT_NAMES) to allow\nholding of policy source info for constraints.\n\nChange-Id: I7ddd57fce90e0da1a63cdba258f321eb3aade381\nSigned-off-by: Richard Haines <richard_c_haines@btinternet.com>\nAcked-by: Stephen Smalley <sds@tycho.nsa.gov>\nSigned-off-by: Paul Moore <pmoore@redhat.com>","distinct":true,"url":"https://api.github.com/repos/CM-Tab-S/android_kernel_samsung_klimtwifi/commits/8aec2a3299b89a879ad7f5a49b9c11a709f57cea"},{"sha":"dcd17df24da4f5e1a6724646753fc7c710fdea6b","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"SELinux: per-command whitelisting of ioctls\n\n note that this patch depends on a prior patch that is already in\n android-3.4 but has not apparently found its way into the msm 3.4\n branches (but is included in exynos and tegra),\n https://android-review.googlesource.com/#/c/92962/\n\nExtend the generic ioctl permission check with support for per-command\nfiltering. Source/target/class sets including the ioctl permission may\nadditionally include a set of commands. Example:\n\nallow <source> <target>:<class> { 0x8910-0x8926 0x892A-0x8935 }\nauditallow <source> <target>:<class> 0x892A\n\nWhen ioctl commands are omitted only the permissions are checked. This\nfeature is intended to provide finer granularity for the ioctl\npermission which may be too imprecise in some circumstances. For\nexample, the same driver may use ioctls to provide important and\nbenign functionality such as driver version or socket type as well as\ndangerous capabilities such as debugging features, read/write/execute\nto physical memory or access to sensitive data. Per-command filtering\nprovides a mechanism to reduce the attack surface of the kernel, and\nlimit applications to the subset of commands required.\n\nThe format of the policy binary has been modified to include ioctl\ncommands, and the policy version number has been incremented to\nPOLICYDB_VERSION_IOCTL_OPERATIONS=30 to account for the format change.\n\nBug: 20350607\nBug: 18087110\nChange-Id: Ibf0e36728f6f3f0d5af56ccdeddee40800af689d\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/CM-Tab-S/android_kernel_samsung_klimtwifi/commits/dcd17df24da4f5e1a6724646753fc7c710fdea6b"},{"sha":"255f8f4ea749a8e5218f808ed91739e80d6b7ee9","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"SELinux: use deletion-safe iterator to free list\n\nThis code is not exercised by policy version 26, but will be upon\nupgrade to policy version 30.\n\nBug: 18087110\nChange-Id: I07c6f34607713294a6a12c43a64d9936f0602200\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/CM-Tab-S/android_kernel_samsung_klimtwifi/commits/255f8f4ea749a8e5218f808ed91739e80d6b7ee9"},{"sha":"b4e63bfe0d27ad23b628990fab27d1dcf9690b31","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"SELinux: ss: Fix policy write for ioctl operations\n\nSecurity server omits the type field when writing out the contents of the\navtab from /sys/fs/selinux/policy. This leads to a corrupt output. No impact\non the running kernel or its loaded policy. Impacts CTS neverallow tests.\n\nBug: 20665861\nChange-Id: I657e18013dd5a1f40052bc2b02dd8e0afee9bcfb\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\n(cherry picked from commit 8cdfb356b51e29494ca0b9e4e86727d6f841a52d)","distinct":true,"url":"https://api.github.com/repos/CM-Tab-S/android_kernel_samsung_klimtwifi/commits/b4e63bfe0d27ad23b628990fab27d1dcf9690b31"},{"sha":"934fc5b66cffafe4a69c0e4245c5d784c1a468c0","author":{"email":"4bb1064d1f46929ded0070376617aece30f0ee54@google.com","name":"Mark Salyzyn"},"message":"pstore: selinux: add security in-core xattr support for pstore and debugfs\n\n- add \"pstore\" and \"debugfs\" to list of in-core exceptions\n- change fstype checks to boolean equation\n- change from strncmp to strcmp for checking\n\n(Cherry Pick from commit 2294d499b7969df3838becf5e58bf16b0e3c86c8)\n\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nBug: 18917345\nBug: 18935184\nChange-Id: Ib648f30ce4b5d6c96f11465836d6fee89bec1c72","distinct":true,"url":"https://api.github.com/repos/CM-Tab-S/android_kernel_samsung_klimtwifi/commits/934fc5b66cffafe4a69c0e4245c5d784c1a468c0"},{"sha":"531f2f0ebf61c36cbef1f928ace743b20a317412","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"security: lsm_audit: add ioctl specific auditing\n\nAdd information about ioctl calls to the LSM audit data. Log the\nfile path and command number.\n\nBug: 20350607\nBug: 18087110\nChange-Id: Idbbd106db6226683cb30022d9e8f6f3b8fab7f84\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/CM-Tab-S/android_kernel_samsung_klimtwifi/commits/531f2f0ebf61c36cbef1f928ace743b20a317412"},{"sha":"284ec1e4e8a7f7a8e32a631648bea1a07aa80124","author":{"email":"de609eb4d5d70b1d38ec6642adbfc33a2781f63c@zeniv.linux.org.uk","name":"Al Viro"},"message":"consitify do_mount() arguments\n\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\n(cherry picked from commit 808d4e3cfdcc52b19276175464f6dbca4df13b09)\n\nChange-Id: I5dcf2bcae8f7893c8ded19fb68c89102575de57d","distinct":true,"url":"https://api.github.com/repos/CM-Tab-S/android_kernel_samsung_klimtwifi/commits/284ec1e4e8a7f7a8e32a631648bea1a07aa80124"}]}