{"push_id":822540645,"size":7,"distinct_size":7,"ref":"refs/heads/cm-13.0","head":"7fc0280b4e5be0f3a1dd0b5f97418cb142d0867a","before":"b802b44d0ed4f795b3c30567cbb640a9e4c10088","commits":[{"sha":"868a64b1dae31807fc3e3c39f44082e842c78988","author":{"email":"b3eef4c91db124096f17b389c40733c06b7d5036@btinternet.com","name":"Richard Haines"},"message":"SELinux: Update policy version to support constraints info\n\nUpdate the policy version (POLICYDB_VERSION_CONSTRAINT_NAMES) to allow\nholding of policy source info for constraints.\n\nChange-Id: Id2971142ad2e2dd47c12796480705128b230349f\nSigned-off-by: Richard Haines <richard_c_haines@btinternet.com>\nAcked-by: Stephen Smalley <sds@tycho.nsa.gov>\nSigned-off-by: Paul Moore <pmoore@redhat.com>","distinct":true,"url":"https://api.github.com/repos/invisiblek/android_kernel_hp_tenderloin/commits/868a64b1dae31807fc3e3c39f44082e842c78988"},{"sha":"32a6db0a8aad3d626050546a0fc40cf65cc2f64c","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"SELinux: per-command whitelisting of ioctls\n\n note that this patch depends on a prior patch that is already in\n android-3.4 but has not apparently found its way into the msm 3.4\n branches (but is included in exynos and tegra),\n https://android-review.googlesource.com/#/c/92962/\n\nExtend the generic ioctl permission check with support for per-command\nfiltering. Source/target/class sets including the ioctl permission may\nadditionally include a set of commands. Example:\n\nallow <source> <target>:<class> { 0x8910-0x8926 0x892A-0x8935 }\nauditallow <source> <target>:<class> 0x892A\n\nWhen ioctl commands are omitted only the permissions are checked. This\nfeature is intended to provide finer granularity for the ioctl\npermission which may be too imprecise in some circumstances. For\nexample, the same driver may use ioctls to provide important and\nbenign functionality such as driver version or socket type as well as\ndangerous capabilities such as debugging features, read/write/execute\nto physical memory or access to sensitive data. Per-command filtering\nprovides a mechanism to reduce the attack surface of the kernel, and\nlimit applications to the subset of commands required.\n\nThe format of the policy binary has been modified to include ioctl\ncommands, and the policy version number has been incremented to\nPOLICYDB_VERSION_IOCTL_OPERATIONS=30 to account for the format change.\n\nBug: 20350607\nBug: 18087110\nChange-Id: Ibf0e36728f6f3f0d5af56ccdeddee40800af689d\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/invisiblek/android_kernel_hp_tenderloin/commits/32a6db0a8aad3d626050546a0fc40cf65cc2f64c"},{"sha":"a517c7ab78ac113d73424dfd571bfe61fbeca524","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"SELinux: use deletion-safe iterator to free list\n\nThis code is not exercised by policy version 26, but will be upon\nupgrade to policy version 30.\n\nBug: 18087110\nChange-Id: I07c6f34607713294a6a12c43a64d9936f0602200\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/invisiblek/android_kernel_hp_tenderloin/commits/a517c7ab78ac113d73424dfd571bfe61fbeca524"},{"sha":"a213fd28c8903be8094d0210d5c390bf29c1c6b7","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"SELinux: ss: Fix policy write for ioctl operations\n\nSecurity server omits the type field when writing out the contents of the\navtab from /sys/fs/selinux/policy. This leads to a corrupt output. No impact\non the running kernel or its loaded policy. Impacts CTS neverallow tests.\n\nBug: 20665861\nChange-Id: I657e18013dd5a1f40052bc2b02dd8e0afee9bcfb\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\n(cherry picked from commit 8cdfb356b51e29494ca0b9e4e86727d6f841a52d)","distinct":true,"url":"https://api.github.com/repos/invisiblek/android_kernel_hp_tenderloin/commits/a213fd28c8903be8094d0210d5c390bf29c1c6b7"},{"sha":"03811e4430b400d25e98f1ff866f9e99732e366a","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"selinux: Report permissive mode in avc: denied messages.\n\nWe cannot presently tell from an avc: denied message whether access was in\nfact denied or was allowed due to global or per-domain permissive mode.\nAdd a permissive= field to the avc message to reflect this information.\n\nBug: 20350607\nChange-Id: I23adf43e417687f1da7354d392d37f5fabbd805e\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/invisiblek/android_kernel_hp_tenderloin/commits/03811e4430b400d25e98f1ff866f9e99732e366a"},{"sha":"804c630e2d5a3c447df2c372cb1f3d1451d3c787","author":{"email":"4bb1064d1f46929ded0070376617aece30f0ee54@google.com","name":"Mark Salyzyn"},"message":"pstore: selinux: add security in-core xattr support for pstore and debugfs\n\n- add \"pstore\" and \"debugfs\" to list of in-core exceptions\n- change fstype checks to boolean equation\n- change from strncmp to strcmp for checking\n\n(Cherry Pick from commit 2294d499b7969df3838becf5e58bf16b0e3c86c8)\n\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nBug: 18917345\nBug: 18935184\nChange-Id: Ib648f30ce4b5d6c96f11465836d6fee89bec1c72","distinct":true,"url":"https://api.github.com/repos/invisiblek/android_kernel_hp_tenderloin/commits/804c630e2d5a3c447df2c372cb1f3d1451d3c787"},{"sha":"7fc0280b4e5be0f3a1dd0b5f97418cb142d0867a","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"security: lsm_audit: add ioctl specific auditing\n\nAdd information about ioctl calls to the LSM audit data. Log the\nfile path and command number.\n\nBug: 20350607\nBug: 18087110\nChange-Id: Idbbd106db6226683cb30022d9e8f6f3b8fab7f84\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/invisiblek/android_kernel_hp_tenderloin/commits/7fc0280b4e5be0f3a1dd0b5f97418cb142d0867a"}]}