Hello,
On 2015년 04월 16일 22:48, Stephen Smalley wrote:
> On 04/16/2015 09:40 AM, Seung-Woo Kim wrote:
>> The dma-buf fd from anon_inode can be shared across processes, but
>> there is no way to set security permission for the fd. So this
>> patch fix just to ignore private inode from security_file_receive.
>>
>> Signed-off-by: Seung-Woo Kim <sw0312.kim(a)samsung.com>
>> ---
>>
>> If security like smack is enabled, the dmabuf fd can not be shared between
>> processes via unix domain socket. I am not familiar with security, so I am
>> not sure that this kind of patch can be acceptable.
>>
>> Is there other option to share dmabuf fd via socket with security check?
>>
>> Best Regards,
>> - Seung-Woo Kim
>>
>> ---
>> security/security.c | 3 +++
>> 1 files changed, 3 insertions(+), 0 deletions(-)
>>
>> diff --git a/security/security.c b/security/security.c
>> index 730ac65..c57354c 100644
>> --- a/security/security.c
>> +++ b/security/security.c
>> @@ -810,6 +810,9 @@ int security_file_send_sigiotask(struct task_struct *tsk,
>>
>> int security_file_receive(struct file *file)
>> {
>> +
>> + if (unlikely(IS_PRIVATE(file->f_path.dentry->d_inode)))
>> + return 0;
>> return security_ops->file_receive(file);
>> }
>
> SELinux handles this internally; see its inode_has_perm() function.
> Doing it here would prevent any security module checking at all, even of
> the struct file, which SELinux does presently do (selinux_file_receive
> calls file_has_perm which applies the fd use check and then calls
> inode_has_perm on the inode). Unless you are saying that the
> file->f_security field is also not being set correctly.
Thanks for the suggestion. I will try to do on smack side.
Best Regards,
- Seung-Woo Kim
>
>
>
--
Seung-Woo Kim
Samsung Software R&D Center
--
The dma-buf fd from anon_inode can be shared across processes, but
there is no way to set security permission for the fd. So this
patch fix just to ignore private inode from security_file_receive.
Signed-off-by: Seung-Woo Kim <sw0312.kim(a)samsung.com>
---
If security like smack is enabled, the dmabuf fd can not be shared between
processes via unix domain socket. I am not familiar with security, so I am
not sure that this kind of patch can be acceptable.
Is there other option to share dmabuf fd via socket with security check?
Best Regards,
- Seung-Woo Kim
---
security/security.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/security/security.c b/security/security.c
index 730ac65..c57354c 100644
--- a/security/security.c
+++ b/security/security.c
@@ -810,6 +810,9 @@ int security_file_send_sigiotask(struct task_struct *tsk,
int security_file_receive(struct file *file)
{
+
+ if (unlikely(IS_PRIVATE(file->f_path.dentry->d_inode)))
+ return 0;
return security_ops->file_receive(file);
}
--
1.7.4.1
Hello Dave,
This patch makes STI driver use the atomic helpers.
I have fix the comments done by Daniel on the first version and get
his ack with this second version.
Regards,
Benjamin
The following changes since commit 03be70050c85768e9ce7c0d0887110d1b629e127:
Merge tag 'topic/drm-misc-2015-03-10' of
git://anongit.freedesktop.org/drm-intel into drm-next (2015-03-11
12:15:06 +1000)
are available in the git repository at:
http://git.linaro.org/people/benjamin.gaignard/kernel.git
drm-st-next-2015-03-19
for you to fetch changes up to de4b00b0937aba99b7099afc6ed17a81163faab3:
drm: sti: convert driver to atomic modeset (2015-03-19 13:35:16 +0100)
----------------------------------------------------------------
Benjamin Gaignard (1):
drm: sti: convert driver to atomic modeset
drivers/gpu/drm/sti/sti_drm_crtc.c | 175 ++++++++----------------------------
drivers/gpu/drm/sti/sti_drm_drv.c | 86 +++++++++++++++++-
drivers/gpu/drm/sti/sti_drm_drv.h | 6 ++
drivers/gpu/drm/sti/sti_drm_plane.c | 66 ++++++++++++--
drivers/gpu/drm/sti/sti_dvo.c | 6 +-
drivers/gpu/drm/sti/sti_hda.c | 6 +-
drivers/gpu/drm/sti/sti_hdmi.c | 6 +-
7 files changed, 205 insertions(+), 146 deletions(-)
Hi Linus,
May I please request you to pull a couple of fixes in dma-buf for 4.0-rc3?
The following changes since commit b942c653ae265abbd31032f3b4f5f857e5c7c723:
Merge tag 'trace-sh-3.19' of
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
(2015-01-22 06:26:07 +1200)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/sumits/dma-buf.git
tags/dma-buf-for-4.0-rc3
for you to fetch changes up to 4eb2440ed60fb5793f7aa6da89b3d517cc59de43:
reservation: Remove shadowing local variable 'ret' (2015-01-22 16:29:31 +0530)
----------------------------------------------------------------
dma-buf pull request for 4.0-rc3
- minor timeout & other fixes on reservation/fence
----------------------------------------------------------------
Jammy Zhou (2):
reservation: wait only with non-zero timeout specified (v3)
dma-buf/fence: don't wait when specified timeout is zero
Michel Dänzer (1):
reservation: Remove shadowing local variable 'ret'
drivers/dma-buf/fence.c | 3 +++
drivers/dma-buf/reservation.c | 5 +++--
2 files changed, 6 insertions(+), 2 deletions(-)
Thanks, and Best regards,
Sumit.
PS: I am not submitting the cleanup that I submitted in my earlier
pull request that you had to reject due to my stupid copy-paste error;
that one patch and it's fix is in for-next, but it's not, strictly
speaking, a "fix" to qualify for -rc3, hence I'll wait for the next
merge-window to submit it.
Hi Linus,
Could you please pull a few dma-buf changes for 3.20-rc1? Nothing
fancy, minor cleanups.
The following changes since commit b942c653ae265abbd31032f3b4f5f857e5c7c723:
Merge tag 'trace-sh-3.19' of
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
(2015-01-22 06:26:07 +1200)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/sumits/dma-buf.git
tags/dma-buf-for-3.20
for you to fetch changes up to 817bd7253291fc69d83d4340a7e186f3e6933169:
dma-buf: cleanup dma_buf_export() to make it easily extensible
(2015-02-18 20:16:20 +0530)
----------------------------------------------------------------
dma-buf pull request for 3.20
- minor timeout & other cleanups on reservation/fence
- cleanup of dma_buf_export()
----------------------------------------------------------------
Jammy Zhou (2):
reservation: wait only with non-zero timeout specified (v3)
dma-buf/fence: don't wait when specified timeout is zero
Michel Dänzer (1):
reservation: Remove shadowing local variable 'ret'
Sumit Semwal (1):
dma-buf: cleanup dma_buf_export() to make it easily extensible
Documentation/dma-buf-sharing.txt | 23 +++++++------
drivers/dma-buf/dma-buf.c | 47 ++++++++++++--------------
drivers/dma-buf/fence.c | 3 ++
drivers/dma-buf/reservation.c | 5 +--
drivers/gpu/drm/armada/armada_gem.c | 10 ++++--
drivers/gpu/drm/drm_prime.c | 12 ++++---
drivers/gpu/drm/exynos/exynos_drm_dmabuf.c | 9 +++--
drivers/gpu/drm/i915/i915_gem_dmabuf.c | 10 ++++--
drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c | 9 ++++-
drivers/gpu/drm/tegra/gem.c | 10 ++++--
drivers/gpu/drm/ttm/ttm_object.c | 9 +++--
drivers/gpu/drm/udl/udl_dmabuf.c | 9 ++++-
drivers/media/v4l2-core/videobuf2-dma-contig.c | 8 ++++-
drivers/media/v4l2-core/videobuf2-dma-sg.c | 8 ++++-
drivers/media/v4l2-core/videobuf2-vmalloc.c | 8 ++++-
drivers/staging/android/ion/ion.c | 9 +++--
include/linux/dma-buf.h | 34 +++++++++++++++----
17 files changed, 158 insertions(+), 65 deletions(-)
Thanks, and best regards,
Sumit.