summaryrefslogtreecommitdiff
path: root/src/core/ima-setup.c
Commit message (Collapse)AuthorAgeFilesLines
* tree-wide: use -EBADF for fd initializationZbigniew Jędrzejewski-Szmek2022-12-191-1/+1
| | | | | | | | | | | | | | | | -1 was used everywhere, but -EBADF or -EBADFD started being used in various places. Let's make things consistent in the new style. Note that there are two candidates: EBADF 9 Bad file descriptor EBADFD 77 File descriptor in bad state Since we're initializating the fd, we're just assigning a value that means "no fd yet", so it's just a bad file descriptor, and the first errno fits better. If instead we had a valid file descriptor that became invalid because of some operation or state change, the other errno would fit better. In some places, initialization is dropped if unnecessary.
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* headers: remove unneeded includes from util.hZbigniew Jędrzejewski-Szmek2019-03-271-1/+3
| | | | | This means we need to include many more headers in various files that simply included util.h before, but it seems cleaner to do it this way.
* Move LONG_LINE_MAX definition to fileio.hZbigniew Jędrzejewski-Szmek2018-11-141-1/+0
| | | | | | | | | | | All users of the macro (except for one, in serialize.c), use the macro in connection with read_line(), so they must include fileio.h. Let's not play libc games and require multiple header file to be included for the most common use of a function. The removal of def.h includes is not exact. I mostly went over the commits that switch over to use read_line() and add def.h at the same time and reverted the addition of def.h in those files.
* ima-setup: prefer safe_close() over plain close()Lennart Poettering2018-10-181-1/+1
|
* ima-setup: include error cause in failure messagesLennart Poettering2018-10-181-3/+3
|
* ima-setup: FOREACH_LINE excorcismLennart Poettering2018-10-181-3/+11
|
* tree-wide: remove Lennart's copyright linesLennart Poettering2018-06-141-1/+0
| | | | | | | | | | | These lines are generally out-of-date, incomplete and unnecessary. With SPDX and git repository much more accurate and fine grained information about licensing and authorship is available, hence let's drop the per-file copyright notice. Of course, removing copyright lines of others is problematic, hence this commit only removes my own lines and leaves all others untouched. It might be nicer if sooner or later those could go away too, making git the only and accurate source of authorship information.
* tree-wide: use proper unicode © instead of (C) where we canLennart Poettering2018-06-141-2/+2
| | | | | | Let's use a proper unicode copyright symbol where we can, it's prettier. This important patch is very important.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-141-2/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* tree-wide: make use of new STRLEN() macro everywhere (#7639)Lennart Poettering2017-12-141-1/+1
| | | | | Let's employ coccinelle to do this for us. Follow-up for #7625.
* Add SPDX license identifiers to source files under the LGPLZbigniew Jędrzejewski-Szmek2017-11-191-0/+1
| | | | | This follows what the kernel is doing, c.f. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5fd54ace4721fc5ce2bb5aef6318fcf17f421460.
* build-sys: s/HAVE_IMA/ENABLE_IMA/Zbigniew Jędrzejewski-Szmek2017-10-041-2/+2
| | | | Same justification as for HAVE_UTMP.
* build-sys: use #if Y instead of #ifdef Y everywhereZbigniew Jędrzejewski-Szmek2017-10-041-1/+1
| | | | | | | | | | | | | | | The advantage is that is the name is mispellt, cpp will warn us. $ git grep -Ee "conf.set\('(HAVE|ENABLE)_" -l|xargs sed -r -i "s/conf.set\('(HAVE|ENABLE)_/conf.set10('\1_/" $ git grep -Ee '#ifn?def (HAVE|ENABLE)' -l|xargs sed -r -i 's/#ifdef (HAVE|ENABLE)/#if \1/; s/#ifndef (HAVE|ENABLE)/#if ! \1/;' $ git grep -Ee 'if.*defined\(HAVE' -l|xargs sed -i -r 's/defined\((HAVE_[A-Z0-9_]*)\)/\1/g' $ git grep -Ee 'if.*defined\(ENABLE' -l|xargs sed -i -r 's/defined\((ENABLE_[A-Z0-9_]*)\)/\1/g' + manual changes to meson.build squash! build-sys: use #if Y instead of #ifdef Y everywhere v2: - fix incorrect setting of HAVE_LIBIDN2
* ima: Ensure policy exists before asking the kernel to load it (#5777)Benjamin Gilbert2017-04-211-2/+6
| | | | | | | e8e42b31c5a950a7b43d64f4a531ec59750e823e added support for having the kernel load the IMA policy directly, but didn't check that the policy file exists. If not, this produced a kernel message: IMA: policy update failed
* ima: Write the policy filename into IMA's sysfs policy file (#4766)Stefan Berger2016-11-291-4/+18
| | | | | | | | | | IMA validates file signatures based on the security.ima xattr. As of Linux-4.7, instead of copying the IMA policy into the securityfs policy, the IMA policy pathname can be written, allowing the IMA policy file signature to be validated. This patch modifies the existing code to first attempt to write the pathname, but on failure falls back to copying the IMA policy contents.
* tree-wide: use mdash instead of a two minusesZbigniew Jędrzejewski-Szmek2016-04-211-1/+1
|
* tree-wide: remove Emacs lines from all filesDaniel Mack2016-02-101-2/+0
| | | | | This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.
* tree-wide: sort includesThomas Hindoe Paaboel Andersen2015-11-161-1/+1
| | | | Sort the includes accoding to the new coding style.
* util-lib: move more file I/O related calls into fileio.[ch]Lennart Poettering2015-10-271-0/+1
|
* util-lib: split out fd-related operations into fd-util.[ch]Lennart Poettering2015-10-251-1/+2
| | | | | There are more than enough to deserve their own .c file, hence move them over.
* ima-setup: write policy one line at a timeZbigniew Jędrzejewski-Szmek2015-06-111-22/+17
| | | | | | | | | ima_write_policy() expects data to be written as one or more rules, no more than PAGE_SIZE at a time. Easiest way to ensure that we are not splitting rules is to read and write one line at a time. https://bugzilla.redhat.com/show_bug.cgi?id=1226948
* Partially revert "ma-setup: simplify"Zbigniew Jędrzejewski-Szmek2015-06-041-2/+13
| | | | | | | | | | copy_bytes() tries to do the write in chunks, but ima kernel code needs every rule to be written in one write. Writing the whole file at once avoids the issue. http://lists.freedesktop.org/archives/systemd-devel/2015-June/032623.html http://sourceforge.net/p/linux-ima/mailman/message/34145236/ https://bugzilla.redhat.com/show_bug.cgi?id=1226948
* remove unused includesThomas Hindoe Paaboel Andersen2015-02-231-3/+0
| | | | | | This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.
* copy: use btrfs reflinking only whe we know we copy full filesLennart Poettering2014-12-121-1/+1
|
* ima-setup: simplifyZbigniew Jędrzejewski-Szmek2014-12-091-42/+17
|
* treewide: sanitize loop_writeZbigniew Jędrzejewski-Szmek2014-12-091-10/+7
| | | | | | | loop_write() didn't follow the usual systemd rules and returned status partially in errno and required extensive checks from callers. Some of the callers dealt with this properly, but many did not, treating partial writes as successful. Simplify things by conforming to usual rules.
* treewide: use log_*_errno whenever %m is in the format stringMichal Schmidt2014-11-281-9/+8
| | | | | | | | | | | If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
* core: reindent {selinux, ima, smack}-setup.cWill Woods2014-04-261-55/+55
| | | | | 7-space indentation is just too weird to leave alone. Make it 8 spaces, as per CODING_STYLE. No other changes.
* util: replace close_nointr_nofail() by a more useful safe_close()Lennart Poettering2014-03-181-5/+1
| | | | | | | | | | | | | | | safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
* core: move mount_setup_early() to main.cNathaniel Chen2013-03-071-5/+0
| | | | | move mount_setup_early() call to main.c, before security module setup, so there are no more repeat calls.
* relicense to LGPLv2.1 (with exceptions)Lennart Poettering2012-04-121-4/+4
| | | | | | | | | | | | | | We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
* move libsystemd_core.la sources into core/Kay Sievers2012-04-111-0/+115
View Lorry Controller Status