{"push_id":1425898710,"size":1,"distinct_size":1,"ref":"refs/heads/cm-14.1","head":"d81c0562be6de1daf743aab55e908a10933d91d8","before":"e05c4ff48e4957ab652baec4f71c1c25aea43354","commits":[{"sha":"d81c0562be6de1daf743aab55e908a10933d91d8","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"selinux: extended permissions for ioctls\n\n(cherry picked from commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a)\n\nAdd extended permissions logic to selinux. Extended permissions\nprovides additional permissions in 256 bit increments. Extend the\ngeneric ioctl permission check to use the extended permissions for\nper-command filtering. Source/target/class sets including the ioctl\npermission may additionally include a set of commands. Example:\n\nallowxperm <source> <target>:<class> ioctl unpriv_app_socket_cmds\nauditallowxperm <source> <target>:<class> ioctl priv_gpu_cmds\n\nWhere unpriv_app_socket_cmds and priv_gpu_cmds are macros\nrepresenting commonly granted sets of ioctl commands.\n\nWhen ioctl commands are omitted only the permissions are checked.\nThis feature is intended to provide finer granularity for the ioctl\npermission that may be too imprecise. For example, the same driver\nmay use ioctls to provide important and benign functionality such as\ndriver version or socket type as well as dangerous capabilities such\nas debugging features, read/write/execute to physical memory or\naccess to sensitive data. Per-command filtering provides a mechanism\nto reduce the attack surface of the kernel, and limit applications\nto the subset of commands required.\n\nThe format of the policy binary has been modified to include ioctl\ncommands, and the policy version number has been incremented to\nPOLICYDB_VERSION_XPERMS_IOCTL=30 to account for the format\nchange.\n\nThe extended permissions logic is deliberately generic to allow\ncomponents to be reused e.g. netlink filters\n\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\nAcked-by: Nick Kralevich <nnk@google.com>\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nBug: 22846070\nChange-Id: I299dc776d2f98d593ecc051707110c92a085350f","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_htc_msm8960/commits/d81c0562be6de1daf743aab55e908a10933d91d8"}]}
{"actor":{"display_login":"cm-gerrit"}}