Re: [PATCH v2 3/3] Documentation/kernel-parameters.txt: Update 'memmap=' option description

2017-04-23 Thread Baoquan He
On 04/24/17 at 11:53am, Dou Liyang wrote: > > > At 04/24/2017 10:40 AM, Baoquan He wrote: > > In commit: > > > > 9710f581bb4c ("x86, mm: Let "memmap=" take more entries one time") > > > > ... 'memmap=' was changed to adopt multiple, comma delimited values in a > > single entry, so update the

[PATCH v4 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Matt Brown
This patch adds struct user_namespace *owner_user_ns to the tty_struct. Then it is set to current_user_ns() in the alloc_tty_struct function. This is done to facilitate capability checks against the original user namespace that allocated the tty. E.g. ns_capable(tty->owner_user_ns,CAP_SYS_ADMIN)

[PATCH v4 2/2] tiocsti-restrict : make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-23 Thread Matt Brown
This introduces the tiocsti_restrict sysctl, whose default is controlled via CONFIG_SECURITY_TIOCSTI_RESTRICT. When activated, this control restricts all TIOCSTI ioctl calls from non CAP_SYS_ADMIN users. This patch depends on patch 1/2 This patch was inspired from GRKERNSEC_HARDEN_TTY. This patc

[PATCH v4 0/2] tiocsti-restrict : make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-23 Thread Matt Brown
This patchset introduces the tiocsti_restrict sysctl, whose default is controlled via CONFIG_SECURITY_TIOCSTI_RESTRICT. When activated, this control restricts all TIOCSTI ioctl calls from non CAP_SYS_ADMIN users. This patch was inspired from GRKERNSEC_HARDEN_TTY. This patch would have prevented h

Re: [PATCH v2 3/3] Documentation/kernel-parameters.txt: Update 'memmap=' option description

2017-04-23 Thread Dou Liyang
At 04/24/2017 10:40 AM, Baoquan He wrote: In commit: 9710f581bb4c ("x86, mm: Let "memmap=" take more entries one time") ... 'memmap=' was changed to adopt multiple, comma delimited values in a single entry, so update the related description. In the special case of only specifying size valu

Re: [PATCH v3 2/2] tiocsti-restrict : make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-23 Thread Serge E. Hallyn
Quoting Matt Brown (m...@nmatt.com): > This introduces the tiocsti_restrict sysctl, whose default is controlled via > CONFIG_SECURITY_TIOCSTI_RESTRICT. When activated, this control restricts > all TIOCSTI ioctl calls from non CAP_SYS_ADMIN users. > > This patch was inspired from GRKERNSEC_HARDEN_T

Re: [PATCH v3 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Serge E. Hallyn
Quoting Matt Brown (m...@nmatt.com): > On 04/23/2017 09:09 PM, Serge E. Hallyn wrote: > >Quoting Matt Brown (m...@nmatt.com): > >>This patch adds struct user_namespace *owner_user_ns to the tty_struct. > >>Then it is set to current_user_ns() in the alloc_tty_struct function. > >> > >>This is done t

Re: [PATCH v3 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Matt Brown
On 04/23/2017 09:09 PM, Serge E. Hallyn wrote: Quoting Matt Brown (m...@nmatt.com): This patch adds struct user_namespace *owner_user_ns to the tty_struct. Then it is set to current_user_ns() in the alloc_tty_struct function. This is done to facilitate capability checks against the original use

[PATCH v2 3/3] Documentation/kernel-parameters.txt: Update 'memmap=' option description

2017-04-23 Thread Baoquan He
In commit: 9710f581bb4c ("x86, mm: Let "memmap=" take more entries one time") ... 'memmap=' was changed to adopt multiple, comma delimited values in a single entry, so update the related description. In the special case of only specifying size value without an offset, like memmap=nn[KMG], memm

Re: [PATCH v3 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Serge E. Hallyn
Quoting Matt Brown (m...@nmatt.com): > This patch adds struct user_namespace *owner_user_ns to the tty_struct. > Then it is set to current_user_ns() in the alloc_tty_struct function. > > This is done to facilitate capability checks against the original user > namespace that allocated the tty. > >

[PATCH v3 2/2] tiocsti-restrict : make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-23 Thread Matt Brown
This introduces the tiocsti_restrict sysctl, whose default is controlled via CONFIG_SECURITY_TIOCSTI_RESTRICT. When activated, this control restricts all TIOCSTI ioctl calls from non CAP_SYS_ADMIN users. This patch was inspired from GRKERNSEC_HARDEN_TTY. This patch would have prevented https://bu

[PATCH v3 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Matt Brown
This patch adds struct user_namespace *owner_user_ns to the tty_struct. Then it is set to current_user_ns() in the alloc_tty_struct function. This is done to facilitate capability checks against the original user namespace that allocated the tty. E.g. ns_capable(tty->owner_user_ns,CAP_SYS_ADMIN)

[PATCH v3 0/2] tiocsti-restrict : make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-23 Thread Matt Brown
This patchset introduces the tiocsti_restrict sysctl, whose default is controlled via CONFIG_SECURITY_TIOCSTI_RESTRICT. When activated, this control restricts all TIOCSTI ioctl calls from non CAP_SYS_ADMIN users. This patch was inspired from GRKERNSEC_HARDEN_TTY. This patch would have prevented h

Re: [PATCH v2 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Jann Horn
On Sun, Apr 23, 2017 at 10:23 PM, Matt Brown wrote: > On 04/23/2017 01:02 PM, Jann Horn wrote: >> >> On Sun, Apr 23, 2017 at 9:24 AM, Matt Brown wrote: >>> >>> This patch adds struct user_namespace *owner_user_ns to the tty_struct. >>> Then it is set to current_user_ns() in the alloc_tty_struct f

Re: [PATCH v2 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Matt Brown
On 04/23/2017 01:02 PM, Jann Horn wrote: On Sun, Apr 23, 2017 at 9:24 AM, Matt Brown wrote: This patch adds struct user_namespace *owner_user_ns to the tty_struct. Then it is set to current_user_ns() in the alloc_tty_struct function. This is done to facilitate capability checks against the ori

[PATCH v6] Documentation: Input: Add uinput documentation

2017-04-23 Thread Marcos Paulo de Souza
Signed-off-by: Marcos Paulo de Souza --- v5 -> v6: Resend v5, but now include a change into input_uapi.rst (added by Dmitry and Mauro) to include the newly added uinput documentation. v4 -> v5: Fixed the way we detect the old interface of uinput (suggested by Peter) v3 -> v4: Add comment

Re: [PATCH v2 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Jann Horn
On Sun, Apr 23, 2017 at 9:24 AM, Matt Brown wrote: > This patch adds struct user_namespace *owner_user_ns to the tty_struct. > Then it is set to current_user_ns() in the alloc_tty_struct function. > > This is done to facilitate capability checks against the original user > namespace that allocated

[PATCH v2 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Matt Brown
This patch adds struct user_namespace *owner_user_ns to the tty_struct. Then it is set to current_user_ns() in the alloc_tty_struct function. This is done to facilitate capability checks against the original user namespace that allocated the tty. E.g. ns_capable(tty->owner_user_ns,CAP_SYS_ADMIN)

[PATCH v2 2/2] tiocsti-restrict : make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-23 Thread Matt Brown
This introduces the tiocsti_restrict sysctl, whose default is controlled via CONFIG_SECURITY_TIOCSTI_RESTRICT. When activated, this control restricts all TIOCSTI ioctl calls from non CAP_SYS_ADMIN users. This patch was inspired from GRKERNSEC_HARDEN_TTY. This patch would have prevented https://bu