Notes for CaitSith project

CaitSith (which was derived from TOMOYO Linux 1.8.3) is an access restriction
module for Linux systems. This module gives you ability to restrict access
(e.g. opening files, executing programs) at the kernel level.

This module is released under the GPLv2.

Project URL: https://caitsith.osdn.jp/

ChangeLog:

Version 0.1   2012/04/01   First release.

  ccs-patch-\*.diff for TOMOYO 1.8.x is reusable to CaitSith by converting

    sed -e 's/CCSECURITY/CAITSITH/g' -e 's/ccsecurity/caitsith/g'

  before feeding to patch command.

Fix 2012/05/04

    @ Fix compiler warning.

      Some compilers complained possible use of uninitialized variable
      in ccs_read_policy(), though it actually should not happen.

    @ Do not continue if policy version was not specified by policy file.

      In order to stop if policy file was by error empty,
      set default policy version to undefined.

Version 0.1.1   2012/05/05   Bug fix release.

Fix 2012/07/12

    @ Fix wrong operation name when selectively reading via query id.

      Operation name "execute" was by error always printed when
      reading via query id.

    @ Fix garbage collection check.

      If an acl block was deleted without deleting decision lines in the acl
      block, garbage collector was by error unable to reclaim memory.

Version 0.1.2   2012/07/12   Bug fix release.

Fix 2012/08/02

    @ Fix identical conditions detection under 64 bits environment.

      Detecting identical conditions was randomly failing because memory block
      which holds conditions part by error had uninitialized 32 bits of hole
      under 64 bits environment.

Version 0.1.3   2012/08/02   Bug fix release.

Fix 2012/08/17

    @ Fix kfree() oops.

      If CONFIG_CAITSITH_USE_EXTERNAL_TASK_SECURITY is not set, and no process
      is using statically assigned ccs_kernel_domain object when
      /proc/caitsith/ interface is close()d, the object was by error subjected
      to kfree() by the garbage collector.

Version 0.1.4   2012/08/17   Bug fix release.

Fix 2012/08/31

    @ Fix environment variable checking logic.

      envp["ENVNAME"] was returning incorrect comparison results. However,
      envp["ENVNAME"] still returns (you might think) incorrect comparison
      results if multiple values with the same environment variable name
      (e.g. HOME=/ and HOME=/root ) are passed in a way comparison results
      differ. For further restriction, you might also want to use
      "acl environ" in addition to "acl execute".

Version 0.1.5   2012/08/31   Bug fix release.

Fix 2012/10/08

    @ Fix KABI breakage on Ubuntu 12.10.

      I was using include/linux/security.h as the common path for pulling in
      include/linux/caitsith.h so that I can avoid scattering #include line.

      When scripts/genksyms/genksyms calculates hash values for Module.symvers
      file, it uses the extracted form of involved structures if the structure
      layout is known but it instead uses UNKNOWN if the structure layout is
      not known. Therefore, pulling in include files that define structure's
      layout from include/linux/caitsith.h causes changes in the hash values
      and causes KABI breakage, even if no changes were made to the involved
      structures.

      Fix this breakage by avoiding pulling in include/linux/sched.h and
      include/linux/dcache.h from include/linux/caitsith.h where possible.

Fix 2012/11/01

    @ Fix ccs_manager() oops.

      If CONFIG_CAITSITH_USE_EXTERNAL_TASK_SECURITY is not set and
      current->ccs_domain_info is not yet assigned, ccs_manager() triggered
      oops when printing denial message.

Version 0.1.6   2012/11/01   Bug fix release.

    @ Allow more flexible conditions.

      Updated policy parser in order to allow more flexible conditions.
      As a side effect, information available in the audit logs may have
      changed.

Version 0.1.7   2012/12/25   Functionality enhancement release.

    @ Fix policy parser regressions.

      Parsing errors in "environ" and "pivot_root" are fixed.

Version 0.1.8   2013/01/06   Bug fix release.

    @ Support multiple concurrent LKM-based LSM modules.

      Commit a2a8474c "exec: do not sleep in TASK_TRACED under
      ->cred_guard_mutex" moved "current->in_execve = 1;" from before
      prepare_bprm_creds() to after prepare_bprm_creds(). It turned out that,
      as an unexpected bonus, we can use security_prepare_creds() as a hook for
      emulating security_bprm_free() hook.

      I updated the logic for security_bprm_free() emulation, and now LKM-based
      LSM version of CaitSith should be able to coexist with other AKARI-like
      LKM-based LSM implementations on all kernel versions other than 2.6.29
      and 2.6.30.

    @ Fix policy parser regressions.

      Parsing errors in "handler" and "transition" are fixed.

Version 0.1.9   2013/02/14   Functionality enhancement release.

    @ Fix incompatible argument warning.

      The hook for checking chown/chgrp permission was by error using
      uid_t/gid_t instead of kuid_t/kgid_t, resulting in compiler warning with
      3.5 and later kernels.

    @ Change symbol prefix.

      ccs_ prefix was changed to cs_ .
      CCS_loader= and CCS_trigger= were changed to CS_loader= and CS_trigger= .

      ccs-patch-\*.diff for TOMOYO 1.8.x is reusable to CaitSith by converting

        sed -e 's/CCSECURITY/CAITSITH/g' -e 's/ccsecurity/caitsith/g' -e 's/ccs_domain_info/cs_domain_info/g' -e 's/ccs_flags/cs_flags/g'

      before feeding to patch command.

Version 0.1.10   2013/05/12   Bug fix release.

Fix 2015/01/01

    @ Fix missing chmod(-1) check in Linux 3.1 and later kernels.

      Commit e57712ebebbb9db7 "merge fchmod() and fchmodat() guts, kill
      ancient broken kludge" changed chmod(-1) from no-op to setting to
      07777. Therefore, CaitSith must not ignore chmod(-1) case.

    @ Fix potentially using bogus attributes when stat() fails.

      We should reset attributes information when executing handler program,
      or attributes of original program could be used when stat() on handler
      program failed.

Version 0.1.11   2015/01/12   Bug fix release.

Fix 2015/04/08

    @ Fix incorrect readdir() permission check.

      CONFIG_CAITSITH_READDIR was meant for allowing users to control readdir()
      permission check. However, CONFIG_CAITSITH_GETATTR was by error used for
      controlling readdir() permission check. This fix should not affect
      kernels built with default configuration, for both
      CONFIG_CAITSITH_READDIR and CONFIG_CAITSITH_GETATTR are defined by
      default.

Version 0.1.12   2015/04/08   Bug fix release.

Fix 2015/06/04

    @ Fix incorrect open() argument.

      The first argument for cs_open_permission() in LKM-based LSM version
      for RHEL 6 branch was wrong since 0.1.11.

Version 0.1.13   2015/06/06   Bug fix release.

Fix 2015/07/19

    @ Fix truncated quota reporting.

      The audit[$index] quota lines were reported for only 0 <= $index <= 2
      by error. Now, all 0 <= $index <= 255 will be reported.

Version 0.1.14   2015/07/21   Bug fix release.

Fix 2015/08/03

    @ Limit wildcard recursion depth.

      Since wildcards that need recursion consume kernel stack memory,
      we cannot allow infinite recursion.

Fix 2015/08/04

    @ Fix incorrect /\(dir\)/ pattern match.

      "/\(\*\)/\*" was failing to match "/" because "/\(\*\)/" did not match
      "/" due to a bug in pattern matching function.

Version 0.1.15   2015/08/06   Bug fix release.
