Linux v3.15.1

4 files changed, 5 insertions, 350 deletions

diff --git a/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch b/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
deleted file mode 100644
index 1a7763767..000000000
--- a/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-Bugzilla: 1102715
-Upstream-status: Submitted for 3.15 and CC'd to stable                                                                                                                                                                                                                                                               
-Delivered-To: jwboyer@gmail.com
-Received: by 10.76.6.212 with SMTP id d20csp285523oaa;
-        Wed, 28 May 2014 20:10:58 -0700 (PDT)
-X-Received: by 10.66.250.166 with SMTP id zd6mr4872927pac.7.1401333057574;
-        Wed, 28 May 2014 20:10:57 -0700 (PDT)
-Return-Path: <stable-owner@vger.kernel.org>
-Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67])
-        by mx.google.com with ESMTP id j1si26042371pbw.214.2014.05.28.20.10.31
-        for <multiple recipients>;
-        Wed, 28 May 2014 20:10:57 -0700 (PDT)
-Received-SPF: none (google.com: stable-owner@vger.kernel.org does not designate permitted sender hosts) client-ip=209.132.180.67;
-Authentication-Results: mx.google.com;
-       spf=neutral (google.com: stable-owner@vger.kernel.org does not designate permitted sender hosts) smtp.mail=stable-owner@vger.kernel.org
-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
-	id S1755059AbaE2DKa (ORCPT <rfc822;takashi.bg@gmail.com>
-	+ 73 others); Wed, 28 May 2014 23:10:30 -0400
-Received: from mx1.redhat.com ([209.132.183.28]:34907 "EHLO mx1.redhat.com"
-	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
-	id S1753861AbaE2DK3 (ORCPT <rfc822;stable@vger.kernel.org>);
-	Wed, 28 May 2014 23:10:29 -0400
-Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26])
-	by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s4T3AQfK017267
-	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK);
-	Wed, 28 May 2014 23:10:26 -0400
-Received: from paris.rdu.redhat.com (paris.rdu.redhat.com [10.13.136.28])
-	by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id s4T3APd7019240;
-	Wed, 28 May 2014 23:10:26 -0400
-From:	Eric Paris <eparis@redhat.com>
-To:	torvalds@linux-foundation.org
-Cc:	linux-audit@redhat.com, linux-kernel@vger.kernel.org,
-	Andy Lutomirski <luto@amacapital.net>, stable@vger.kernel.org,
-	Eric Paris <eparis@redhat.com>
-Subject: [PATCH 1/2] auditsc: audit_krule mask accesses need bounds checking
-Date:	Wed, 28 May 2014 23:09:58 -0400
-Message-Id: <1401332999-15167-1-git-send-email-eparis@redhat.com>
-X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26
-Sender:	stable-owner@vger.kernel.org
-Precedence: bulk
-List-ID: <stable.vger.kernel.org>
-X-Mailing-List:	stable@vger.kernel.org
-
-From: Andy Lutomirski <luto@amacapital.net>
-
-Fixes an easy DoS and possible information disclosure.
-
-This does nothing about the broken state of x32 auditing.
-
-eparis: If the admin has enabled auditd and has specifically loaded audit
-rules.  This bug has been around since before git.  Wow...
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Andy Lutomirski <luto@amacapital.net>
-Signed-off-by: Eric Paris <eparis@redhat.com>
----
- kernel/auditsc.c | 27 ++++++++++++++++++---------
- 1 file changed, 18 insertions(+), 9 deletions(-)
-
-diff --git a/kernel/auditsc.c b/kernel/auditsc.c
-index 254ce20..842f58a 100644
---- a/kernel/auditsc.c
-+++ b/kernel/auditsc.c
-@@ -728,6 +728,22 @@ static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
- 	return AUDIT_BUILD_CONTEXT;
- }
- 
-+static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
-+{
-+	int word, bit;
-+
-+	if (val > 0xffffffff)
-+		return false;
-+
-+	word = AUDIT_WORD(val);
-+	if (word >= AUDIT_BITMASK_SIZE)
-+		return false;
-+
-+	bit = AUDIT_BIT(val);
-+
-+	return rule->mask[word] & bit;
-+}
-+
- /* At syscall entry and exit time, this filter is called if the
-  * audit_state is not low enough that auditing cannot take place, but is
-  * also not high enough that we already know we have to write an audit
-@@ -745,11 +761,8 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
- 
- 	rcu_read_lock();
- 	if (!list_empty(list)) {
--		int word = AUDIT_WORD(ctx->major);
--		int bit  = AUDIT_BIT(ctx->major);
--
- 		list_for_each_entry_rcu(e, list, list) {
--			if ((e->rule.mask[word] & bit) == bit &&
-+			if (audit_in_mask(&e->rule, ctx->major) &&
- 			    audit_filter_rules(tsk, &e->rule, ctx, NULL,
- 					       &state, false)) {
- 				rcu_read_unlock();
-@@ -769,20 +782,16 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
- static int audit_filter_inode_name(struct task_struct *tsk,
- 				   struct audit_names *n,
- 				   struct audit_context *ctx) {
--	int word, bit;
- 	int h = audit_hash_ino((u32)n->ino);
- 	struct list_head *list = &audit_inode_hash[h];
- 	struct audit_entry *e;
- 	enum audit_state state;
- 
--	word = AUDIT_WORD(ctx->major);
--	bit  = AUDIT_BIT(ctx->major);
--
- 	if (list_empty(list))
- 		return 0;
- 
- 	list_for_each_entry_rcu(e, list, list) {
--		if ((e->rule.mask[word] & bit) == bit &&
-+		if (audit_in_mask(&e->rule, ctx->major) &&
- 		    audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
- 			ctx->current_state = state;
- 			return 1;
--- 
-1.9.0
-
---
-To unsubscribe from this list: send the line "unsubscribe stable" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff --git a/fs-userns-Change-inode_capable-to-capable_wrt_inode_.patch b/fs-userns-Change-inode_capable-to-capable_wrt_inode_.patch
deleted file mode 100644
index b56e7171a..000000000
--- a/fs-userns-Change-inode_capable-to-capable_wrt_inode_.patch
+++ /dev/null
@@ -1,209 +0,0 @@
-Bugzilla: 1109836
-Upstream-status: 3.16-rc1 and CC'd to stable
-
-From 23adbe12ef7d3d4195e80800ab36b37bee28cd03 Mon Sep 17 00:00:00 2001
-From: Andy Lutomirski <luto@amacapital.net>
-Date: Tue, 10 Jun 2014 12:45:42 -0700
-Subject: [PATCH] fs,userns: Change inode_capable to capable_wrt_inode_uidgid
-
-The kernel has no concept of capabilities with respect to inodes; inodes
-exist independently of namespaces.  For example, inode_capable(inode,
-CAP_LINUX_IMMUTABLE) would be nonsense.
-
-This patch changes inode_capable to check for uid and gid mappings and
-renames it to capable_wrt_inode_uidgid, which should make it more
-obvious what it does.
-
-Fixes CVE-2014-4014.
-
-Cc: Theodore Ts'o <tytso@mit.edu>
-Cc: Serge Hallyn <serge.hallyn@ubuntu.com>
-Cc: "Eric W. Biederman" <ebiederm@xmission.com>
-Cc: Dave Chinner <david@fromorbit.com>
-Cc: stable@vger.kernel.org
-Signed-off-by: Andy Lutomirski <luto@amacapital.net>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- fs/attr.c                  |  8 ++++----
- fs/inode.c                 | 10 +++++++---
- fs/namei.c                 | 11 ++++++-----
- fs/xfs/xfs_ioctl.c         |  2 +-
- include/linux/capability.h |  2 +-
- kernel/capability.c        | 20 ++++++++------------
- 6 files changed, 27 insertions(+), 26 deletions(-)
-
-diff --git a/fs/attr.c b/fs/attr.c
-index 5d4e59d..6530ced 100644
---- a/fs/attr.c
-+++ b/fs/attr.c
-@@ -50,14 +50,14 @@ int inode_change_ok(const struct inode *inode, struct iattr *attr)
- 	if ((ia_valid & ATTR_UID) &&
- 	    (!uid_eq(current_fsuid(), inode->i_uid) ||
- 	     !uid_eq(attr->ia_uid, inode->i_uid)) &&
--	    !inode_capable(inode, CAP_CHOWN))
-+	    !capable_wrt_inode_uidgid(inode, CAP_CHOWN))
- 		return -EPERM;
- 
- 	/* Make sure caller can chgrp. */
- 	if ((ia_valid & ATTR_GID) &&
- 	    (!uid_eq(current_fsuid(), inode->i_uid) ||
- 	    (!in_group_p(attr->ia_gid) && !gid_eq(attr->ia_gid, inode->i_gid))) &&
--	    !inode_capable(inode, CAP_CHOWN))
-+	    !capable_wrt_inode_uidgid(inode, CAP_CHOWN))
- 		return -EPERM;
- 
- 	/* Make sure a caller can chmod. */
-@@ -67,7 +67,7 @@ int inode_change_ok(const struct inode *inode, struct iattr *attr)
- 		/* Also check the setgid bit! */
- 		if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid :
- 				inode->i_gid) &&
--		    !inode_capable(inode, CAP_FSETID))
-+		    !capable_wrt_inode_uidgid(inode, CAP_FSETID))
- 			attr->ia_mode &= ~S_ISGID;
- 	}
- 
-@@ -160,7 +160,7 @@ void setattr_copy(struct inode *inode, const struct iattr *attr)
- 		umode_t mode = attr->ia_mode;
- 
- 		if (!in_group_p(inode->i_gid) &&
--		    !inode_capable(inode, CAP_FSETID))
-+		    !capable_wrt_inode_uidgid(inode, CAP_FSETID))
- 			mode &= ~S_ISGID;
- 		inode->i_mode = mode;
- 	}
-diff --git a/fs/inode.c b/fs/inode.c
-index 2feb9b6..6eecb7f 100644
---- a/fs/inode.c
-+++ b/fs/inode.c
-@@ -1839,14 +1839,18 @@ EXPORT_SYMBOL(inode_init_owner);
-  * inode_owner_or_capable - check current task permissions to inode
-  * @inode: inode being checked
-  *
-- * Return true if current either has CAP_FOWNER to the inode, or
-- * owns the file.
-+ * Return true if current either has CAP_FOWNER in a namespace with the
-+ * inode owner uid mapped, or owns the file.
-  */
- bool inode_owner_or_capable(const struct inode *inode)
- {
-+	struct user_namespace *ns;
-+
- 	if (uid_eq(current_fsuid(), inode->i_uid))
- 		return true;
--	if (inode_capable(inode, CAP_FOWNER))
-+
-+	ns = current_user_ns();
-+	if (ns_capable(ns, CAP_FOWNER) && kuid_has_mapping(ns, inode->i_uid))
- 		return true;
- 	return false;
- }
-diff --git a/fs/namei.c b/fs/namei.c
-index 8016827..985c6f3 100644
---- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -332,10 +332,11 @@ int generic_permission(struct inode *inode, int mask)
- 
- 	if (S_ISDIR(inode->i_mode)) {
- 		/* DACs are overridable for directories */
--		if (inode_capable(inode, CAP_DAC_OVERRIDE))
-+		if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
- 			return 0;
- 		if (!(mask & MAY_WRITE))
--			if (inode_capable(inode, CAP_DAC_READ_SEARCH))
-+			if (capable_wrt_inode_uidgid(inode,
-+						     CAP_DAC_READ_SEARCH))
- 				return 0;
- 		return -EACCES;
- 	}
-@@ -345,7 +346,7 @@ int generic_permission(struct inode *inode, int mask)
- 	 * at least one exec bit set.
- 	 */
- 	if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
--		if (inode_capable(inode, CAP_DAC_OVERRIDE))
-+		if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
- 			return 0;
- 
- 	/*
-@@ -353,7 +354,7 @@ int generic_permission(struct inode *inode, int mask)
- 	 */
- 	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
- 	if (mask == MAY_READ)
--		if (inode_capable(inode, CAP_DAC_READ_SEARCH))
-+		if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))
- 			return 0;
- 
- 	return -EACCES;
-@@ -2379,7 +2380,7 @@ static inline int check_sticky(struct inode *dir, struct inode *inode)
- 		return 0;
- 	if (uid_eq(dir->i_uid, fsuid))
- 		return 0;
--	return !inode_capable(inode, CAP_FOWNER);
-+	return !capable_wrt_inode_uidgid(inode, CAP_FOWNER);
- }
- 
- /*
-diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
-index 0b18776..6152cbe 100644
---- a/fs/xfs/xfs_ioctl.c
-+++ b/fs/xfs/xfs_ioctl.c
-@@ -1215,7 +1215,7 @@ xfs_ioctl_setattr(
- 		 * cleared upon successful return from chown()
- 		 */
- 		if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
--		    !inode_capable(VFS_I(ip), CAP_FSETID))
-+		    !capable_wrt_inode_uidgid(VFS_I(ip), CAP_FSETID))
- 			ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
- 
- 		/*
-diff --git a/include/linux/capability.h b/include/linux/capability.h
-index a6ee1f9..84b13ad 100644
---- a/include/linux/capability.h
-+++ b/include/linux/capability.h
-@@ -210,7 +210,7 @@ extern bool has_ns_capability_noaudit(struct task_struct *t,
- 				      struct user_namespace *ns, int cap);
- extern bool capable(int cap);
- extern bool ns_capable(struct user_namespace *ns, int cap);
--extern bool inode_capable(const struct inode *inode, int cap);
-+extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
- extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
- 
- /* audit system wants to get cap info from files as well */
-diff --git a/kernel/capability.c b/kernel/capability.c
-index 84b2bbf..a5cf13c 100644
---- a/kernel/capability.c
-+++ b/kernel/capability.c
-@@ -424,23 +424,19 @@ bool capable(int cap)
- EXPORT_SYMBOL(capable);
- 
- /**
-- * inode_capable - Check superior capability over inode
-+ * capable_wrt_inode_uidgid - Check nsown_capable and uid and gid mapped
-  * @inode: The inode in question
-  * @cap: The capability in question
-  *
-- * Return true if the current task has the given superior capability
-- * targeted at it's own user namespace and that the given inode is owned
-- * by the current user namespace or a child namespace.
-- *
-- * Currently we check to see if an inode is owned by the current
-- * user namespace by seeing if the inode's owner maps into the
-- * current user namespace.
-- *
-+ * Return true if the current task has the given capability targeted at
-+ * its own user namespace and that the given inode's uid and gid are
-+ * mapped into the current user namespace.
-  */
--bool inode_capable(const struct inode *inode, int cap)
-+bool capable_wrt_inode_uidgid(const struct inode *inode, int cap)
- {
- 	struct user_namespace *ns = current_user_ns();
- 
--	return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
-+	return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid) &&
-+		kgid_has_mapping(ns, inode->i_gid);
- }
--EXPORT_SYMBOL(inode_capable);
-+EXPORT_SYMBOL(capable_wrt_inode_uidgid);
--- 
-1.9.3
-
diff --git a/kernel.spec b/kernel.spec
index 6b007f133..0d7c91371 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -74,7 +74,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 0
+%define stable_update 1
 # Is it a -stable RC?
 %define stable_rc 0
 # Set rpm version accordingly
@@ -703,9 +703,6 @@ Patch25069: 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch
 
 Patch25071: s390-appldata-add-slab.h-for-kzalloc-kfree.patch
 
-# CVE-2014-3917 rhbz 1102571 1102715
-Patch25093: auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
-
 # Patch series from Hans for various backlight and platform driver fixes
 Patch26001: thinkpad_acpi-Add-mappings-for-F9-F12-hotkeys-on-X24.patch
 Patch26002: samsung-laptop-Add-broken-acpi-video-quirk-for-NC210.patch
@@ -737,9 +734,6 @@ Patch25100: dm-thin-update-discard_granularity-to-reflect-the-thin-pool-blocksiz
 #rhbz 1103528
 Patch25101: elantech-Deal-with-clickpads-reporting-right-button-.patch
 
-#CVE-2014-4014 rhbz 1107966 1109836
-Patch25102: fs-userns-Change-inode_capable-to-capable_wrt_inode_.patch
-
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1411,9 +1405,6 @@ ApplyPatch 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch
 
 ApplyPatch s390-appldata-add-slab.h-for-kzalloc-kfree.patch
 
-# CVE-2014-3917 rhbz 1102571 1102715
-ApplyPatch auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
-
 # Patch series from Hans for various backlight and platform driver fixes
 ApplyPatch thinkpad_acpi-Add-mappings-for-F9-F12-hotkeys-on-X24.patch
 ApplyPatch samsung-laptop-Add-broken-acpi-video-quirk-for-NC210.patch
@@ -1445,9 +1436,6 @@ ApplyPatch dm-thin-update-discard_granularity-to-reflect-the-thin-pool-blocksize
 #rhbz 1103528
 ApplyPatch elantech-Deal-with-clickpads-reporting-right-button-.patch
 
-#CVE-2014-4014 rhbz 1107966 1109836
-ApplyPatch fs-userns-Change-inode_capable-to-capable_wrt_inode_.patch
-
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2260,6 +2248,9 @@ fi
 #                                    ||----w |
 #                                    ||     ||
 %changelog
+* Tue Jun 17 2014 Josh Boyer <jwboyer@fedoraproject.org>
+- Linux v3.15.1
+
 * Mon Jun 16 2014 Josh Boyer <jwboyer@fedoraproject.org>
 - CVE-2014-4014 possible priv escalation in userns (rhbz 1107966 1109836)
 
diff --git a/sources b/sources
index b0282682e..87571d2d3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
 97ca1625bb40368dc41b9a7971549071  linux-3.15.tar.xz
 ef8f4db937f521a7e323ec589536ba25  perf-man-3.15.tar.gz
+78a944411af297b9e5e9aa430056de4c  patch-3.15.1.xz