{"push_id":1271394940,"size":9,"distinct_size":9,"ref":"refs/heads/cm-14.0","head":"04068c76440f9c8fd63ce43a06a4481b44fe4104","before":"5a7fa77582d5d3f87b5a57c7cf7b5627dd5c9a77","commits":[{"sha":"d944a5d7800a654df74afcfe7c156842867aa6f4","author":{"name":"dcashman","email":"3d629d435dc38ffde22fdd784f2eb4e36e384463@google.com"},"message":"FROMLIST: mm: mmap: Add new /proc tunable for mmap_base ASLR.\n\n(cherry picked from commit https://lkml.org/lkml/2015/12/21/337)\n\nASLR  only uses as few as 8 bits to generate the random offset for the\nmmap base address on 32 bit architectures. This value was chosen to\nprevent a poorly chosen value from dividing the address space in such\na way as to prevent large allocations. This may not be an issue on all\nplatforms. Allow the specification of a minimum number of bits so that\nplatforms desiring greater ASLR protection may determine where to place\nthe trade-off.\n\nBug: 24047224\nSigned-off-by: Daniel Cashman <dcashman@android.com>\nSigned-off-by: Daniel Cashman <dcashman@google.com>\nChange-Id: Ic74424e07710cd9ccb4a02871a829d14ef0cc4bc","distinct":true,"url":"https://api.github.com/repos/CNBLACK-CM/android_kernel_samsung_u1/commits/d944a5d7800a654df74afcfe7c156842867aa6f4"},{"sha":"92358d9ccda4bceb54d952b7b3db1b81f61c9f74","author":{"name":"dcashman","email":"3d629d435dc38ffde22fdd784f2eb4e36e384463@google.com"},"message":"FROMLIST: arm: mm: support ARCH_MMAP_RND_BITS.\n\n(cherry picked from commit https://lkml.org/lkml/2015/12/21/341)\n\narm: arch_mmap_rnd() uses a hard-code value of 8 to generate the\nrandom offset for the mmap base address.  This value represents a\ncompromise between increased ASLR effectiveness and avoiding\naddress-space fragmentation. Replace it with a Kconfig option, which\nis sensibly bounded, so that platform developers may choose where to\nplace this compromise. Keep 8 as the minimum acceptable value.\n\nBug: 24047224\nSigned-off-by: Daniel Cashman <dcashman@android.com>\nSigned-off-by: Daniel Cashman <dcashman@google.com>\nChange-Id: I2f6c18a0060e1c21b53200ecdcfde9a8c2e3db98","distinct":true,"url":"https://api.github.com/repos/CNBLACK-CM/android_kernel_samsung_u1/commits/92358d9ccda4bceb54d952b7b3db1b81f61c9f74"},{"sha":"435ab8429080d9a8e32a6d112bd5929948bbaf56","author":{"name":"Lorenzo Colitti","email":"bb03c7a1072f7993eaae5ac54ef7bc06e4588478@google.com"},"message":"net: diag: Add the ability to destroy a socket.\n\nThis patch adds a SOCK_DESTROY operation, a destroy function\npointer to sock_diag_handler, and a diag_destroy function\npointer.  It does not include any implementation code.\n\n[Backport of net-next 64be0aed59ad519d6f2160868734f7e278290ac1]\n\nChange-Id: I1d998e1c5f836b2f5638c0f79244c372c8d2d9d9\nSigned-off-by: Lorenzo Colitti <lorenzo@google.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/CNBLACK-CM/android_kernel_samsung_u1/commits/435ab8429080d9a8e32a6d112bd5929948bbaf56"},{"sha":"9a19552a9c6a81946d31911eda72a6fd853fd84e","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"Revert \"SELinux: per-command whitelisting of ioctls\"\n\nThis reverts commit bc84b4adb1469e3d05ad76c304a4c545feaf1f88.\n\nBug: 22846070\nChange-Id: Ib4cb130b2225ea2e22556ff852313e0de7dddcab\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/CNBLACK-CM/android_kernel_samsung_u1/commits/9a19552a9c6a81946d31911eda72a6fd853fd84e"},{"sha":"b9f71e154edcd03efe8b185d7c451499f2d701f9","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"selinux: remove unnecessary pointer reassignment\n\n(cherry pick from commit 83d4a806ae46397f606de7376b831524bd3a21e5)\n\nCommit f01e1af445fa (\"selinux: don't pass in NULL avd to avc_has_perm_noaudit\")\nmade this pointer reassignment unnecessary. Avd should continue to reference\nthe stack-based copy.\n\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\nAcked-by: Stephen Smalley <sds@tycho.nsa.gov>\n[PM: tweaked subject line]\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nBug: 22846070\nChange-Id: Ie33688d163870705272607309a27fb7c8f870748","distinct":true,"url":"https://api.github.com/repos/CNBLACK-CM/android_kernel_samsung_u1/commits/b9f71e154edcd03efe8b185d7c451499f2d701f9"},{"sha":"07188cbf736b383acc1cc543d49aea29987302c5","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"selinux: extended permissions for ioctls\n\n(cherry picked from commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a)\n\nAdd extended permissions logic to selinux. Extended permissions\nprovides additional permissions in 256 bit increments. Extend the\ngeneric ioctl permission check to use the extended permissions for\nper-command filtering. Source/target/class sets including the ioctl\npermission may additionally include a set of commands. Example:\n\nallowxperm <source> <target>:<class> ioctl unpriv_app_socket_cmds\nauditallowxperm <source> <target>:<class> ioctl priv_gpu_cmds\n\nWhere unpriv_app_socket_cmds and priv_gpu_cmds are macros\nrepresenting commonly granted sets of ioctl commands.\n\nWhen ioctl commands are omitted only the permissions are checked.\nThis feature is intended to provide finer granularity for the ioctl\npermission that may be too imprecise. For example, the same driver\nmay use ioctls to provide important and benign functionality such as\ndriver version or socket type as well as dangerous capabilities such\nas debugging features, read/write/execute to physical memory or\naccess to sensitive data. Per-command filtering provides a mechanism\nto reduce the attack surface of the kernel, and limit applications\nto the subset of commands required.\n\nThe format of the policy binary has been modified to include ioctl\ncommands, and the policy version number has been incremented to\nPOLICYDB_VERSION_XPERMS_IOCTL=30 to account for the format\nchange.\n\nThe extended permissions logic is deliberately generic to allow\ncomponents to be reused e.g. netlink filters\n\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\nAcked-by: Nick Kralevich <nnk@google.com>\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nBug: 22846070\nChange-Id: I299dc776d2f98d593ecc051707110c92a085350f","distinct":true,"url":"https://api.github.com/repos/CNBLACK-CM/android_kernel_samsung_u1/commits/07188cbf736b383acc1cc543d49aea29987302c5"},{"sha":"848ac2471701dd9c759edc340da00ec7c627641f","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"selinux: Android kernel compatibility with M userspace\n\nNOT intended for new Android devices - this commit is unnecessary\nfor a target device that does not have a previous M variant.\n\nDO NOT upstream. Android only.\n\nMotivation:\n\nThis commit mitigates a mismatch between selinux kernel and\nselinux userspace. The selinux ioctl white-listing binary policy\nformat that was accepted into Android M differs slightly from what\nwas later accepted into the upstream kernel. This leaves Android\nmaster branch kernels incompatible with Android M releases. This\npatch restores backwards compatibility. This is important because:\n\n1. kernels may be updated on a different cycle than the rest of the\n   OS e.g. security patching.\n2. Android M bringup may still be ongoing for some devices. The\n   same kernel should work for both M and master.\n\nBackwards compatibility is achieved by checking for an Android M\npolicy characteristic during initial policy read and converting to\nupstream policy format. The inverse conversion is done for policy\nwrite as required for CTS testing.\n\nBug: 22846070\nChange-Id: I2f1ee2eee402f37cf3c9df9f9e03c1b9ddec1929\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/CNBLACK-CM/android_kernel_samsung_u1/commits/848ac2471701dd9c759edc340da00ec7c627641f"},{"sha":"af0e893cbb856e873fd8f4143e652cb43d0aecb0","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"UPSTREAM: selinux: fix bug in conditional rules handling\n\n(cherry picked from commit commit f3bef67992e8698897b584616535803887c4a73e)\n\ncommit fa1aa143ac4a (\"selinux: extended permissions for ioctls\")\nintroduced a bug into the handling of conditional rules, skipping the\nprocessing entirely when the caller does not provide an extended\npermissions (xperms) structure.  Access checks from userspace using\n/sys/fs/selinux/access do not include such a structure since that\ninterface does not presently expose extended permission information.\nAs a result, conditional rules were being ignored entirely on userspace\naccess requests, producing denials when access was allowed by\nconditional rules in the policy.  Fix the bug by only skipping\ncomputation of extended permissions in this situation, not the entire\nconditional rules processing.\n\nChange-Id: I6f81765f6cdb9ce72f93c290d7987d93688651a0\nReported-by: Laurent Bigonville <bigon@debian.org>\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>\n[PM: fixed long lines in patch description]\nCc: stable@vger.kernel.org # 4.3\nSigned-off-by: Paul Moore <pmoore@redhat.com>","distinct":true,"url":"https://api.github.com/repos/CNBLACK-CM/android_kernel_samsung_u1/commits/af0e893cbb856e873fd8f4143e652cb43d0aecb0"},{"sha":"04068c76440f9c8fd63ce43a06a4481b44fe4104","author":{"name":"Lorenzo Colitti","email":"bb03c7a1072f7993eaae5ac54ef7bc06e4588478@google.com"},"message":"selinux: nlmsgtab: add SOCK_DESTROY to the netlink mapping tables\n\nWithout this, using SOCK_DESTROY in enforcing mode results in:\n\n  SELinux: unrecognized netlink message type=21 for sclass=32\n\nChange-Id: I7862bb0fc83573567243ffa9549a2c7405b5986c","distinct":true,"url":"https://api.github.com/repos/CNBLACK-CM/android_kernel_samsung_u1/commits/04068c76440f9c8fd63ce43a06a4481b44fe4104"}]}
{"actor":{"display_login":"CNBLACK"}}