microsoft
/
WSL2-Linux-Kernel
зеркало из https://github.com/microsoft/WSL2-Linux-Kernel.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
The source for the Linux kernel used in Windows Subsystem for Linux 2 (WSL2)
1 057 542 коммитов 10 Ветки 3 162 Теги 3,2 GiB
C 97.7%
Assembly 1.2%
Shell 0.4%
Makefile 0.3%
Python 0.2%
Разное 0.1%
Перейти к файлу
Ondrej Mosnacek c52d9c25d9 fs: don't audit the capability check in simple_xattr_list() 
[ Upstream commit e7eda157c4 ]

The check being unconditional may lead to unwanted denials reported by
LSMs when a process has the capability granted by DAC, but denied by an
LSM. In the case of SELinux such denials are a problem, since they can't
be effectively filtered out via the policy and when not silenced, they
produce noise that may hide a true problem or an attack.

Checking for the capability only if any trusted xattr is actually
present wouldn't really address the issue, since calling listxattr(2) on
such node on its own doesn't indicate an explicit attempt to see the
trusted xattrs. Additionally, it could potentially leak the presence of
trusted xattrs to an unprivileged user if they can check for the denials
(e.g. through dmesg).

Therefore, it's best (and simplest) to keep the check unconditional and
instead use ns_capable_noaudit() that will silence any associated LSM
denials.

Fixes: 38f3865744 ("xattr: extract simple_xattr code from tmpfs")
Reported-by: Martin Pitt <mpitt@redhat.com>
Suggested-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Reviewed-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2022-12-31 13:14:01 +01:00
Documentation docs: update mediator contact information in CoC doc 2022-11-26 09:24:48 +01:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
arch x86/sgx: Reduce delay and interference of enclave release 2022-12-31 13:14:01 +01:00
block block: move CONFIG_BLOCK guard to top Makefile 2022-12-14 11:37:30 +01:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:22:01 +02:00
crypto crypto: akcipher - default implementation for setting a private key 2022-10-26 12:35:25 +02:00
drivers cpuidle: dt: Return the correct numbers of parsed idle states 2022-12-31 13:14:01 +01:00
fs fs: don't audit the capability check in simple_xattr_list() 2022-12-31 13:14:01 +01:00
include soc: qcom: apr: make code more reuseable 2022-12-31 13:13:57 +01:00
init init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash 2022-12-02 17:41:08 +01:00
io_uring io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() 2022-12-14 11:37:31 +01:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:28:45 +01:00
kernel PM: hibernate: Fix mistake in kerneldoc comment 2022-12-31 13:14:01 +01:00
lib Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled 2022-12-08 11:28:44 +01:00
mm mm/gup: fix gup_pud_range() for dax 2022-12-14 11:37:20 +01:00
net Bluetooth: L2CAP: Fix u8 overflow 2022-12-21 17:36:38 +01:00
samples samples/landlock: Format with clang-format 2022-06-09 10:23:23 +02:00
scripts scripts/faddr2line: Fix regression in name resolution on ppc64le 2022-12-08 11:28:38 +01:00
security capabilities: fix potential memleak on error path from vfs_getxattr_alloc() 2022-11-10 18:15:39 +01:00
sound ASoC: ops: Correct bounds check for second channel on SX controls 2022-12-19 12:36:44 +01:00
tools objtool, kcsan: Add volatile read/write instrumentation to whitelist 2022-12-31 13:13:57 +01:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:27:15 +01:00
virt kvm: Add support for arch compat vm ioctls 2022-10-29 10:12:54 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore .gitignore: ignore only top-level modules.builtin 2021-05-02 00:43:35 +09:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS io_uring: move to separate directory 2022-12-14 11:37:31 +01:00
Makefile Linux 5.15.85 2022-12-21 17:36:38 +01:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.