kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
No description
1,317,772 commits 117 branches 5,827 tags 6.3 GiB
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Christian Göttsche 94c3cbc69a ext4: reorder capability check last 
[ Upstream commit 1b419c889c ]

capable() calls refer to enabled LSMs whether to permit or deny the
request.  This is relevant in connection with SELinux, where a
capability check results in a policy decision and by default a denial
message on insufficient permission is issued.
It can lead to three undesired cases:
  1. A denial message is generated, even in case the operation was an
     unprivileged one and thus the syscall succeeded, creating noise.
  2. To avoid the noise from 1. the policy writer adds a rule to ignore
     those denial messages, hiding future syscalls, where the task
     performs an actual privileged operation, leading to hidden limited
     functionality of that task.
  3. To avoid the noise from 1. the policy writer adds a rule to permit
     the task the requested capability, while it does not need it,
     violating the principle of least privilege.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20250302160657.127253-2-cgoettsche@seltendoof.de
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-05-29 11:02:15 +02:00
arch riscv: Call secondary mmu notifier when flushing the tlb 2025-05-29 11:02:14 +02:00
block blk-cgroup: improve policy registration error handling 2025-05-29 11:02:13 +02:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto crypto: Kconfig - Select LIB generic option 2025-05-02 07:59:33 +02:00
Documentation netlink: specs: tc: all actions are indexed arrays 2025-05-22 14:29:42 +02:00
drivers bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set 2025-05-29 11:02:14 +02:00
fs ext4: reorder capability check last 2025-05-29 11:02:15 +02:00
include tracing: Mark binary printing functions with __printf() attribute 2025-05-29 11:02:04 +02:00
init rust: clean Rust 1.88.0's unnecessary_transmutes lint 2025-05-18 08:24:51 +02:00
io_uring io_uring/msg: initialise msg request opcode 2025-05-29 11:02:03 +02:00
ipc ipc: fix memleak if msg_init_ns failed in create_ipc_ns 2024-12-05 14:03:02 +01:00
kernel cgroup/rstat: avoid disabling irqs for O(num_cpu) 2025-05-29 11:02:10 +02:00
lib dql: Fix dql->limit value when reset. 2025-05-29 11:02:07 +02:00
LICENSES LICENSES: add 0BSD license text 2024-09-01 20:43:24 -07:00
mm mm/page_alloc: fix race condition in unaccepted memory handling 2025-05-22 14:29:52 +02:00
net Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken 2025-05-29 11:02:07 +02:00
rust rust: clean Rust 1.88.0's clippy::uninlined_format_args lint 2025-05-18 08:24:57 +02:00
samples samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora 2025-05-29 11:02:01 +02:00
scripts kconfig: merge_config: use an empty file as initfile 2025-05-29 11:02:02 +02:00
security ima: process_measurement() needlessly takes inode_lock() on MAY_READ 2025-05-29 11:02:00 +02:00
sound ASoC: codecs: wsa883x: Correct VI sense channel mask 2025-05-29 11:02:06 +02:00
tools tools/build: Don't pass test log files to linker 2025-05-29 11:02:08 +02:00
usr kbuild: hdrcheck: fix cross build with clang 2025-03-13 13:02:18 +01:00
virt KVM: Add member to struct kvm_gfn_range to indicate private/shared 2025-05-22 14:29:36 +02:00
.clang-format clang-format: Update with v6.11-rc1's for_each macro list 2024-08-02 13:20:31 +02:00
.clippy.toml rust: clean Rust 1.88.0's warning about clippy::disallowed_macros configuration 2025-05-18 08:24:51 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore Add Jeff Kirsher to .get_maintainer.ignore 2024-03-08 11:36:54 +00:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore rust: introduce .clippy.toml 2025-03-13 13:01:42 +01:00
.mailmap mailmap: add entry for Thorsten Blum 2024-11-07 14:14:59 -08:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Remove self from DSA entry 2024-11-03 12:52:38 -08:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS MAINTAINERS: Update Alexey Makhalov's email address 2025-05-22 14:29:46 +02:00
Makefile Linux 6.12.30 2025-05-22 14:29:54 +02:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.