Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2024-12-28 00:32:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
master
linux-next/fs/gfs2
History
Christian Göttsche ead64b20f1 gfs2: reorder capability check last 
capable() calls refer to enabled LSMs whether to permit or deny the
request.  This is relevant in connection with SELinux, where a
capability check results in a policy decision and by default a denial
message on insufficient permission is issued.
It can lead to three undesired cases:
  1. A denial message is generated, even in case the operation was an
     unprivileged one and thus the syscall succeeded, creating noise.
  2. To avoid the noise from 1. the policy writer adds a rule to ignore
     those denial messages, hiding future syscalls, where the task
     performs an actual privileged operation, leading to hidden limited
     functionality of that task.
  3. To avoid the noise from 1. the policy writer adds a rule to permit
     the task the requested capability, while it does not need it,
     violating the principle of least privilege.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2024-12-09 10:44:35 +01:00
..
acl.c gfs2: convert to ctime accessor functions 2023-07-24 10:29:59 +02:00
acl.h gfs2: No longer use 'extern' in function declarations 2023-11-06 01:51:26 +01:00
aops.c gfs2: Remove gfs2_jdata_writepage() 2024-09-02 14:46:33 +02:00
aops.h gfs2: No longer use 'extern' in function declarations 2023-11-06 01:51:26 +01:00
bmap.c gfs2 updates 2024-05-14 17:35:22 -07:00
bmap.h gfs2: No longer use 'extern' in function declarations 2023-11-06 01:51:26 +01:00
dentry.c Revert "gfs2: Use GL_NOBLOCK flag for non-blocking lookups" 2024-02-02 17:21:44 +01:00
dir.c gfs2: Improve gfs2_consist_inode() usage 2024-04-09 18:35:57 +02:00
dir.h gfs2: No longer use 'extern' in function declarations 2023-11-06 01:51:26 +01:00
export.c exportfs: Remove EXPORT_OP_ASYNC_LOCK 2024-10-01 17:01:08 +02:00
file.c Merge patch series "Fixup NLM and kNFSD file lock callbacks" 2024-10-02 07:52:07 +02:00
gfs2.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
glock.c gfs2 changes 2024-11-26 12:34:50 -08:00
glock.h gfs2: Faster gfs2_upgrade_iopen_glock wakeups 2024-11-05 12:39:28 +01:00
glops.c gfs2: Make gfs2_inode_refresh static 2024-11-05 12:39:29 +01:00
glops.h gfs2: No longer use 'extern' in function declarations 2023-11-06 01:51:26 +01:00
incore.h gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE 2024-11-05 12:39:28 +01:00
inode.c gfs2: Initialize gl_no_formal_ino earlier 2024-09-24 19:03:33 +02:00
inode.h gfs2: Make gfs2_inode_refresh static 2024-11-05 12:39:29 +01:00
Kconfig fs: add CONFIG_BUFFER_HEAD 2023-08-02 09:13:09 -06:00
lock_dlm.c gfs2: Simplify DLM_LKF_QUECVT use 2024-11-05 12:39:29 +01:00
log.c gfs2: Remove __gfs2_writepage() 2024-09-02 14:46:29 +02:00
log.h gfs2: No longer use 'extern' in function declarations 2023-11-06 01:51:26 +01:00
lops.c gfs2: Remove use of error flag in journal reads 2023-12-20 21:29:41 +01:00
lops.h gfs2: No longer use 'extern' in function declarations 2023-11-06 01:51:26 +01:00
main.c mm, slab: remove last vestiges of SLAB_MEM_SPREAD 2024-03-12 20:32:19 -07:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
meta_io.c gfs2: Remove gfs2_aspace_writepage() 2024-09-02 14:46:37 +02:00
meta_io.h gfs2: No longer use 'extern' in function declarations 2023-11-06 01:51:26 +01:00
ops_fstype.c gfs2: fix double destroy_workqueue error 2024-08-20 16:27:22 +02:00
quota.c mm/list_lru: simplify the list_lru walk callback function 2024-11-11 17:22:26 -08:00
quota.h gfs2: reorder capability check last 2024-12-09 10:44:35 +01:00
recovery.c gfs2: Rename gfs2_withdrawn to gfs2_withdrawing_or_withdrawn 2023-12-20 21:29:40 +01:00
recovery.h gfs2: No longer use 'extern' in function declarations 2023-11-06 01:51:26 +01:00
rgrp.c gfs2: Use get_random_u32 in gfs2_orlov_skip 2024-11-05 12:39:29 +01:00
rgrp.h gfs2: No longer use 'extern' in function declarations 2023-11-06 01:51:26 +01:00
super.c gfs2: Only defer deletes when we have an iopen glock 2024-11-19 12:33:20 +01:00
super.h gfs2 fixes 2023-11-07 11:54:17 -08:00
sys.c gfs2: Use [NO_]CREATE consistently for gfs2_glock_get 2024-04-09 18:35:57 +02:00
sys.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
trace_gfs2.h gfs2: Invert the GLF_INITIAL flag 2024-05-29 15:34:55 +02:00
trans.c gfs2: Rename gfs2_withdrawn to gfs2_withdrawing_or_withdrawn 2023-12-20 21:29:40 +01:00
trans.h gfs2: No longer use 'extern' in function declarations 2023-11-06 01:51:26 +01:00
util.c gfs2: Revert "Add quota_change type" 2024-06-08 02:35:09 +02:00
util.h gfs2: gfs2_freeze_unlock cleanup 2024-04-29 12:35:15 +02:00
xattr.c gfs2: Improve gfs2_consist_inode() usage 2024-04-09 18:35:57 +02:00
xattr.h gfs2: No longer use 'extern' in function declarations 2023-11-06 01:51:26 +01:00