Tetsuo Handa d58e0da854 TOMOYO: Add environment variable name restriction support. ... This patch adds support for checking environment variable's names. Although TOMOYO already provides ability to check argv[]/envp[] passed to execve() requests, file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="bar" will reject execution of /bin/sh if environment variable LD_LIBRARY_PATH is not defined. To grant execution of /bin/sh if LD_LIBRARY_PATH is not defined, administrators have to specify like file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="/system/lib" file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]=NULL . Since there are many environment variables whereas conditional checks are applied as "&&", it is difficult to cover all combinations. Therefore, this patch supports conditional checks that are applied as "||", by specifying like file execute /bin/sh misc env LD_LIBRARY_PATH exec.envp["LD_LIBRARY_PATH"]="/system/lib" which means "grant execution of /bin/sh if environment variable is not defined or is defined and its value is /system/lib". Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <jmorris@namei.org>		2011-09-14 08:27:05 +10:00
..
apparmor	apparmor: sparse fix: include procattr.h in procattr.c	2011-09-09 16:56:29 -07:00
integrity	ima: sparse fix: include linux/ima.h in ima_main.c	2011-09-09 16:56:30 -07:00
keys	KEYS: Correctly destroy key payloads when their keytype is removed	2011-08-23 09:57:37 +10:00
selinux	selinux: sparse fix: fix several warnings in the security server code	2011-09-09 16:56:32 -07:00
smack	doc: Update the email address for Paul Moore in various source files	2011-08-01 17:58:33 -07:00
tomoyo	TOMOYO: Add environment variable name restriction support.	2011-09-14 08:27:05 +10:00
capability.c	->permission() sanitizing: don't pass flags to ->inode_permission()	2011-07-20 01:43:26 -04:00
commoncap.c	capabilities: initialize has_cap	2011-08-16 09:20:45 +10:00
device_cgroup.c	security,rcu: Convert call_rcu(whitelist_item_free) to kfree_rcu()	2011-07-20 11:05:30 -07:00
inode.c	convert get_sb_single() users	2010-10-29 04:16:28 -04:00
Kconfig	integrity: move ima inode integrity data management	2011-07-18 12:29:38 -04:00
lsm_audit.c	LSM: separate LSM_AUDIT_DATA_DENTRY from LSM_AUDIT_DATA_PATH	2011-04-25 18:14:07 -04:00
Makefile	integrity: move ima inode integrity data management	2011-07-18 12:29:38 -04:00
min_addr.c	mmap_min_addr check CAP_SYS_RAWIO only for write	2010-04-23 08:56:31 +10:00
security.c	security: sparse fix: Move security_fixup_op to security.h	2011-09-09 16:56:33 -07:00