Changes in Makefile

b01c939d - selinux: add generated av_permissions.h to targets

Wed, 27 Nov 2024 10:09:22 +0000

selinux: add generated av_permissions.h to targetsav_permissions.h was not declared as a target and therefore not cleanedup automatically by kbuild.Suggested-by: Masahiro Yamada Link: https://lore.kernel.org/lkml/CAK7LNATUnCPt03BRFSKh1EH=+Sy0Q48wE4ER0BZdJqOb_44L8w@mail.gmail.com/Signed-off-by: Thomas Weißschuh Reviewed-by: Masahiro Yamada Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

3b70b66e - selinux: move genheaders to security/selinux/

Fri, 06 Sep 2024 17:29:14 +0000

selinux: move genheaders to security/selinux/This tool is only used in security/selinux/Makefile.Move it to security/selinux/ so that 'make clean' can clean it up.Please note 'make clean' does not clean scripts/ because tools underscripts/ are often used for external module builds. Obviously, genheadersis not the case here.Signed-off-by: Masahiro Yamada Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

6f594f5a - selinux: improve debug configuration

Fri, 18 Aug 2023 15:12:14 +0000

selinux: improve debug configurationIf the SELinux debug configuration is enabled define the macro DEBUGsuch that pr_debug() calls are always enabled, regardless ofCONFIG_DYNAMIC_DEBUG, since those message are the main reason for thisconfiguration in the first place.Mention example usage in case CONFIG_DYNAMIC_DEBUG is enabled in thehelp section of the configuration.Signed-off-by: Christian Göttsche Reviewed-by: Stephen Smalley Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

ec4a491d - selinux: fix Makefile for versions of make < v4.3

Thu, 01 Jun 2023 21:04:02 +0000

selinux: fix Makefile for versions of make < v4.3As noted in the comments of this commit, the current SELinux Makefilerequires features found in make v4.3 or later, which is problematicas the Linux Kernel currently only requires make v3.82. This patchfixes the SELinux Makefile so that it works properly on these olderversions of make, and adds a couple of comments to the Makefile abouthow it can be improved once make v4.3 is required by the kernel.Fixes: 6f933aa7dfd0 ("selinux: more Makefile tweaks")Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

42c4e97e - selinux: don't use make's grouped targets feature yet

Thu, 01 Jun 2023 14:21:21 +0000

selinux: don't use make's grouped targets feature yetThe Linux Kernel currently only requires make v3.82 while the groupedtarget functionality requires make v4.3. Removed the grouped targetintroduced in 4ce1f694eb5d ("selinux: ensure av_permissions.h isbuilt when needed") as well as the multiple header file targets inthe make rule. This effectively reverts the problem commit.We will revisit this change when make >= 4.3 is required by the restof the kernel.Cc: stable@vger.kernel.orgFixes: 4ce1f694eb5d ("selinux: ensure av_permissions.h is built when needed")Reported-by: Erwan Velu Reported-by: Luiz Capitulino Tested-by: Luiz Capitulino Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

6f933aa7 - selinux: more Makefile tweaks

Fri, 05 May 2023 22:48:35 +0000

selinux: more Makefile tweaksA few small tweaks to improve the SELinux Makefile:- Define a new variable, 'genhdrs', to represent both flask.h and av_permissions.h; this should help ensure consistent processing for both generated headers.- Move the 'ccflags-y' variable closer to the top, just after the main 'obj-$(CONFIG_SECURITY_SELINUX)' definition to make it more visible and improve the grouping in the Makefile.- Rework some of the vertical whitespace to improve some of the grouping in the Makefile.Reviewed-by: Ondrej Mosnacek Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

4ce1f694 - selinux: ensure av_permissions.h is built when needed

Wed, 12 Apr 2023 17:29:11 +0000

selinux: ensure av_permissions.h is built when neededThe Makefile rule responsible for building flask.h andav_permissions.h only lists flask.h as a target which means thatav_permissions.h is only generated when flask.h needs to begenerated. This patch fixes this by adding av_permissions.h as atarget to the rule.Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build")Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

bcab1ade - selinux: fix Makefile dependencies of flask.h

Wed, 12 Apr 2023 13:59:19 +0000

selinux: fix Makefile dependencies of flask.hMake the flask.h target depend on the genheaders binary instead ofclassmap.h to ensure that it is rebuilt if any of the dependencies ofgenheaders are changed.Notably this fixes flask.h not being rebuilt wheninitial_sid_to_string.h is modified.Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build")Signed-off-by: Ondrej Mosnacek Acked-by: Stephen Smalley Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

fdd1ffe8 - selinux: include a consumer of the new IMA critical data hook

Thu, 14 Jan 2021 19:15:22 +0000

selinux: include a consumer of the new IMA critical data hookSELinux stores the active policy in memory, so the changes to this dataat runtime would have an impact on the security guarantees providedby SELinux. Measuring in-memory SELinux policy through IMA subsystemprovides a secure way for the attestation service to remotely validatethe policy contents at runtime.Measure the hash of the loaded policy by calling the IMA hookima_measure_critical_data(). Since the size of the loaded policycan be large (several MB), measure the hash of the policy instead ofthe entire policy to avoid bloating the IMA log entry.To enable SELinux data measurement, the following steps are required:1, Add "ima_policy=critical_data" to the kernel command line arguments to enable measuring SELinux data at boot time.For example, BOOT_IMAGE=/boot/vmlinuz-5.10.0-rc1+ root=UUID=fd643309-a5d2-4ed3-b10d-3c579a5fab2f ro nomodeset security=selinux ima_policy=critical_data2, Add the following rule to /etc/ima/ima-policy measure func=CRITICAL_DATA label=selinuxSample measurement of the hash of SELinux policy:To verify the measured data with the current SELinux policy runthe following commands and verify the output hash values match. sha256sum /sys/fs/selinux/policy | cut -d' ' -f 1 grep "selinux-policy-hash" /sys/kernel/security/integrity/ima/ascii_runtime_measurements | tail -1 | cut -d' ' -f 6Note that the actual verification of SELinux policy would require loadingthe expected policy into an identical kernel on a pristine/known-safesystem and run the sha256sum /sys/kernel/selinux/policy there to getthe expected hash.Signed-off-by: Lakshmi Ramasubramanian Suggested-by: Stephen Smalley Acked-by: Paul Moore Reviewed-by: Tyler Hicks Signed-off-by: Mimi Zohar List of files: /linux-6.15/security/selinux/Makefile

50077289 - selinux: hash context structure directly

Fri, 17 Apr 2020 08:11:56 +0000

selinux: hash context structure directlyAlways hashing the string representation is inefficient. Just hash thecontents of the structure directly (using jhash). If the context isinvalid (str & len are set), then hash the string as before, otherwisehash the structured data.Since the context hashing function is now faster (about 10 times), thispatch decreases the overhead of security_transition_sid(), which iscalled from many hooks.The jhash function seemed as a good choice, since it is used as thedefault hashing algorithm in rhashtable.Signed-off-by: Ondrej Mosnacek Reviewed-by: Jeff Vander Stoep Tested-by: Jeff Vander Stoep [PM: fixed some spelling errors in the comments pointed out by JVS]Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

4b36cb77 - selinux: move status variables out of selinux_ss

Fri, 17 Jan 2020 13:15:14 +0000

selinux: move status variables out of selinux_ssIt fits more naturally in selinux_state, since it reflects also globalstate (the enforcing and policyload fields).Signed-off-by: Ondrej Mosnacek Reviewed-by: Stephen Smalley Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

fe49c7e4 - selinux: move ibpkeys code under CONFIG_SECURITY_INFINIBAND.

Thu, 09 Jan 2020 11:10:47 +0000

selinux: move ibpkeys code under CONFIG_SECURITY_INFINIBAND.Move cache based pkey sid retrieval code which was addedwith commit "409dcf31" under CONFIG_SECURITY_INFINIBAND.As its going to alloc a new cache which impactslow RAM devices which was enabled by default.Suggested-by: Paul Moore Signed-off-by: Ravi Kumar Siddojigari [PM: checkpatch.pl cleanups, fixed capitalization in the description]Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

3d252529 - SELinux: Remove unused selinux_is_enabled

Sat, 22 Sep 2018 00:17:34 +0000

SELinux: Remove unused selinux_is_enabledThere are no longer users of selinux_is_enabled().Remove it. As selinux_is_enabled() is the only reasonfor include/linux/selinux.h remove that as well.Signed-off-by: Casey Schaufler Reviewed-by: Kees Cook Signed-off-by: Kees Cook List of files: /linux-6.15/security/selinux/Makefile

b2441318 - License cleanup: add SPDX GPL-2.0 license identifier to files with no license

Wed, 01 Nov 2017 14:07:57 +0000

License cleanup: add SPDX GPL-2.0 license identifier to files with no licenseMany source files in the tree are missing licensing information, whichmakes it harder for compliance tools to determine the correct license.By default all files without license information are under the defaultlicense of the kernel, which is GPL version 2.Update the files which contain no license information with the 'GPL-2.0'SPDX license identifier. The SPDX identifier is a legally bindingshorthand, which can be used instead of the full boiler plate text.This patch is based on work done by Thomas Gleixner and Kate Stewart andPhilippe Ombredanne.How this work was done:Patches were generated and checked against linux-4.14-rc6 for a subset ofthe use cases: - file had no licensing information it it. - file was a */uapi/* one with no licensing information in it, - file was a */uapi/* one with existing licensing information,Further patches will be generated in subsequent months to fix up caseswhere non-standard license headers were used, and references to licensehad to be inferred by heuristics based on keywords.The analysis to determine which SPDX License Identifier to be applied toa file was done in a spreadsheet of side by side results from of theoutput of two independent scanners (ScanCode & Windriver) producing SPDXtag:value files created by Philippe Ombredanne. Philippe prepared thebase worksheet, and did an initial spot review of a few 1000 files.The 4.13 kernel was the starting point of the analysis with 60,537 filesassessed. Kate Stewart did a file by file comparison of the scannerresults in the spreadsheet to determine which SPDX license identifier(s)to be applied to the file. She confirmed any determination that was notimmediately clear with lawyers working with the Linux Foundation.Criteria used to select files for SPDX license identifier tagging was: - Files considered eligible had to be source code files. - Make and config files were included as candidates if they contained >5 lines of source - File already had some variant of a license header in it (even if <5 lines).All documentation files were explicitly excluded.The following heuristics were used to determine which SPDX licenseidentifiers to apply. - when both scanners couldn't find any license traces, file was considered to have no license information in it, and the top level COPYING file license applied. For non */uapi/* files that summary was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 11139 and resulted in the first patch in this series. If that file was a */uapi/* path one, it was "GPL-2.0 WITH Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 WITH Linux-syscall-note 930 and resulted in the second patch in this series. - if a file had some form of licensing information in it, and was one of the */uapi/* ones, it was denoted with the Linux-syscall-note if any GPL family license was found in the file or had no licensing in it (per prior point). Results summary: SPDX license identifier # files ---------------------------------------------------|------ GPL-2.0 WITH Linux-syscall-note 270 GPL-2.0+ WITH Linux-syscall-note 169 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17 LGPL-2.1+ WITH Linux-syscall-note 15 GPL-1.0+ WITH Linux-syscall-note 14 ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5 LGPL-2.0+ WITH Linux-syscall-note 4 LGPL-2.1 WITH Linux-syscall-note 3 ((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3 ((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1 and that resulted in the third patch in this series. - when the two scanners agreed on the detected license(s), that became the concluded license(s). - when there was disagreement between the two scanners (one detected a license but the other didn't, or they both detected different licenses) a manual inspection of the file occurred. - In most cases a manual inspection of the information in the file resulted in a clear resolution of the license that should apply (and which scanner probably needed to revisit its heuristics). - When it was not immediately clear, the license identifier was confirmed with lawyers working with the Linux Foundation. - If there was any question as to the appropriate license identifier, the file was flagged for further research and to be revisited later in time.In total, over 70 hours of logged manual review was done on thespreadsheet to determine the SPDX license identifiers to apply to thesource files by Kate, Philippe, Thomas and, in some cases, confirmationby lawyers working with the Linux Foundation.Kate also obtained a third independent scan of the 4.13 code base fromFOSSology, and compared selected files where the other two scannersdisagreed against that SPDX file, to see if there was new insights. TheWindriver scanner is based on an older version of FOSSology in part, sothey are related.Thomas did random spot checks in about 500 files from the spreadsheetsfor the uapi headers and agreed with SPDX license identifier in thefiles he inspected. For the non-uapi files Thomas did random spot checksin about 15000 files.In initial set of patches against 4.14-rc6, 3 files were found to havecopy/paste license identifier errors, and have been fixed to reflect thecorrect identifier.Additionally Philippe spent 10 hours this week doing a detailed manualinspection and review of the 12,461 patched files from the initial patchversion early this week with: - a full scancode scan run, collecting the matched texts, detected license ids and scores - reviewing anything where there was a license detected (about 500+ files) to ensure that the applied SPDX license was correct - reviewing anything where there was no detection but the patch license was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied SPDX license was correctThis produced a worksheet with 20 files needing minor correction. Thisworksheet was then exported into 3 different .csv files for thedifferent types of files to be modified.These .csv files were then reviewed by Greg. Thomas wrote a script toparse the csv files and add the proper SPDX tag to the file, in theformat that the file expected. This script was further refined by Gregbased on the output to detect more types of files automatically and todistinguish between header and source .c files (which need differentcomment types.) Finally Greg ran the script using the .csv files togenerate the patches.Reviewed-by: Kate Stewart Reviewed-by: Philippe Ombredanne Reviewed-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman List of files: /linux-6.15/security/selinux/Makefile

409dcf31 - selinux: Add a cache for quicker retreival of PKey SIDs

Fri, 19 May 2017 12:48:59 +0000

selinux: Add a cache for quicker retreival of PKey SIDsIt is likely that the SID for the same PKey will be requested manytimes. To reduce the time to modify QPs and process MADs use a cache tostore PKey SIDs.This code is heavily based on the "netif" and "netport" conceptoriginally developed by James Morris and Paul Moore (see security/selinux/netif.c andsecurity/selinux/netport.c for more information)Signed-off-by: Daniel Jurgens Acked-by: Doug Ledford Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

9090a2d5 - selinux: use absolute path to include directory

Thu, 28 Jan 2016 12:59:16 +0000

selinux: use absolute path to include directoryCompiler warns us a lot that it can't find include folder because it'sprovided in relative form. CC security/selinux/netlabel.occ1: warning: security/selinux/include: No such file or directorycc1: warning: security/selinux/include: No such file or directorycc1: warning: security/selinux/include: No such file or directorycc1: warning: security/selinux/include: No such file or directoryAdd $(srctree) prefix to the path.Signed-off-by: Andy Shevchenko [PM: minor description edits to fit under 80char width]Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Makefile

8b0c543e - selinux: change to new flag variable

Thu, 23 Sep 2010 06:50:06 +0000

selinux: change to new flag variableReplace EXTRA_CFLAGS with ccflags-y.Signed-off-by: matt mooney Signed-off-by: James Morris List of files: /linux-6.15/security/selinux/Makefile

60272da0 - selinux: really fix dependency causing parallel compile failure.

Thu, 16 Sep 2010 00:14:53 +0000

selinux: really fix dependency causing parallel compile failure.While the previous change to the selinux Makefile reduced the windowsignificantly for this failure, it is still possible to see a compilefailure where cpp starts processing selinux files before the autogenerated flask.h file is completed. This is easily reproduced byadding the following temporary change to expose the issue everytime:- cmd_flask = scripts/selinux/genheaders/genheaders ...+ cmd_flask = sleep 30 ; scripts/selinux/genheaders/genheaders ...This failure happens because the creation of the object files in the sssubdir also depends on flask.h. So simply incorporate them into theparent Makefile, as the ss/Makefile really doesn't do anything unique.With this change, compiling of all selinux files is dependent oncompletion of the header file generation, and this test case withthe "sleep 30" now confirms it is functioning as expected.Signed-off-by: Paul Gortmaker Signed-off-by: James Morris List of files: /linux-6.15/security/selinux/Makefile

ceba72a6 - selinux: fix parallel compile error

Mon, 09 Aug 2010 21:34:25 +0000

selinux: fix parallel compile errorSelinux has an autogenerated file, "flask.h" which is included bytwo other selinux files. The current makefile has a single dependencyon the first object file in the selinux-y list, assuming that will getflask.h generated before anyone looks for it, but that assumption breaksdown in a "make -jN" situation and you get: selinux/selinuxfs.c:35: fatal error: flask.h: No such file or directory compilation terminated. remake[9]: *** [security/selinux/selinuxfs.o] Error 1Since flask.h is included by security.h which in turn is includednearly everywhere, make the dependency apply to all of the selinux-ylist of objs.Signed-off-by: Paul Gortmaker Signed-off-by: James Morris List of files: /linux-6.15/security/selinux/Makefile

a7a387cc - SELINUX: Fix build error.

Fri, 06 Aug 2010 19:37:56 +0000

SELINUX: Fix build error.Fix build error caused by a stale security/selinux/av_permissions.h in the $(src)directory which will override a more recent version in $(obj) that is itappears to strike only when building with a separate object directory.Signed-off-by: Ralf Baechle Acked-by: Eric Paris Signed-off-by: James Morris List of files: /linux-6.15/security/selinux/Makefile