オープンソース・ソフトウェアの開発とダウンロード

Notes for AKARI project

AKARI is Access Keeping And Regulating Instrument for Linux 2.6 and later
kernels.

You can use AKARI for analyzing your system's behavior (i.e. reports which
application accesses which resources like strace command does) and optionally
restricting your system's behavior (i.e. controls which application can
access which resources like TOMOYO/AppArmor does).

AKARI is forked from TOMOYO 1.8 and made as a LKM (loadable kernel module)
so that you don't need to replace your kernels installed in your system.

This patch is released under the GPLv2.

Project URL: https://akari.osdn.jp/

ChangeLog:

Version 1.0   2010/10/10   First release.

Version 1.0.1   2010/10/18   Minor update release.

   Synchronize with TOMOYO revision 4069.

   Fix off-by-two in ccs_check_unix_address().

   Implement post accept() LSM hook.

Version 1.0.2   2010/10/25   Minor update release.

   Synchronize with TOMOYO revision 4090.

   Add getattr() and readdir() checks.

   Use "YYYY/MM/DD hh:mm:ss" format for /proc/ccs/ interface.

   Do not automatically add / for umount().

Version 1.0.3   2010/11/01   Minor update release.

   Synchronize with TOMOYO revision 4104.

   Fix pathname handling in ccs_unix_entry().

Version 1.0.4   2010/11/11   Minor update release.

   Synchronize with TOMOYO 1.8.0 release.

   Add sysctl() check for 2.6.21 to 2.6.32 kernels.

   Fix double new_decode_dev() bug for mknod().

   Fix keyword typo.

   Fix build failure on some kernels.

   Changed pathname prefix priority.

   Use hash table for faster scan.

   Updated function comments.

Version 1.0.5   2010/11/22   Minor update release.

   Make ccs_domain_info/ccs_flags inheritable for 2.6.29 and later kernels.

Version 1.0.6   2010/12/31   Minor update release.

   Synchronize with TOMOYO revision 4280.

   Use same interface for audit logs.

   Split ccs_null_security into ccs_default_security and ccs_oom_security.

Version 1.0.7   2011/01/21   Minor update release.

   Synchronize with TOMOYO revision 4400.

   Use filesystem name for unnamed devices when vfsmount is missing.

Version 1.0.8   2011/02/07   Minor update release.

   Synchronize with TOMOYO revision 4545.

   Fix infinite loop bug when reading /proc/ccs/audit or /proc/ccs/query .

Version 1.0.9   2011/02/14   Minor update release.

   Fix missing permission check for interpreters in 2.6.30 and later kernels.

Version 1.0.10   2011/02/15   Minor update release.

   Fix missing permission check for interpreters in 2.6.23 and earlier kernels.

   Fix wrong execute permission check and domain transition in 2.6.28 and earlier kernels.

Version 1.0.11   2010/04/01   Minor update release.

   Synchronize with TOMOYO 1.8.1 release.

   Run garbage collector without waiting for /proc/ccs/ users.

   Support built-in policy configuration.

   Remove /proc/ccs/meminfo interface.

   Pack policy when printing via /proc/ccs/ interface.

   Fix conditional policy parsing.

   Serialize updating profile's comment line.

Version 1.0.12   2011/04/11   Minor update release.

   Synchronize with TOMOYO revision 4874.

   Fix fcntl(F_SETFL, O_APPEND) handling.

Version 1.0.13   2011/05/05   Minor update release.

   Synchronize with TOMOYO revision 4963.

   Fix wrong profile number in audit logs for "misc env" permission.

Version 1.0.14   2011/05/11   Minor update release.

   Synchronize with TOMOYO revision 4978.

   Fix wrong domainname validation.

Version 1.0.15   2011/06/20   Minor update release.

   Synchronize with TOMOYO 1.8.2 release.

   Add policy namespace support.

Version 1.0.16   2011/07/07   Minor update release.

   Synchronize with TOMOYO revision 5235.

   Remove /proc/ccs/.domain_status interface.

Version 1.0.17   2011/07/13   Minor update release.

   Synchronize with TOMOYO revision 5266.

   Fix /proc/ccs/stat parser.

   Accept "::" notation for IPv6 address.

Version 1.0.18   2011/09/03   Minor update release.

   Synchronize with TOMOYO revision 5401.

   Avoid race when retrying "file execute" permission check.

   Remove unneeded daemonize().

   Fix load failure with !CONFIG_SMP && !CONFIG_DEBUG_SPINLOCK kernels.

Version 1.0.19   2011/09/15   Minor update release.

   Use akari/config.h for choosing build options.

   Fix build error on CONFIG_CCSECURITY_OMIT_USERSPACE_LOADER=y case.

   Use lookup_mnt() rather than __put_namespace(). (2.6.0 to 2.6.2 kernels) 

   Fix unbalanced spin_lock()/spin_unlock() pair in lsm_pin().
   (2.6.15 to 2.6.35 kernels)

   Fix "struct task_struct" leaks of tasks created before loading akari.ko .
   (2.6.28 and earlier kernels)

   Use "struct task_struct"->pids[PIDTYPE_PID].pid instead of
   "struct task_struct" for associating with per "struct task_struct" variables
   (i.e. "struct ccs_security") in order to reduce amount of dead memory
   waiting for garbage collection. (2.6.29 and later kernels)

   Add akari_test.ko for checking whether akari.ko seems to work or not.

   Add SH and ARM architectures support. (Needs more testing.)

Version 1.0.20   2011/09/29   Minor update release.

   Synchronize with TOMOYO 1.8.3 release.

   Allow specifying domain transition preference.

   Simplify garbage collector.

Version 1.0.21   2011/10/25   Minor update release.

   Synchronize with TOMOYO revision 5569.

   Fix incomplete read after seek.

   Use query id for reaching target process's domain policy.

   Fix quota counting.

Version 1.0.22   2011/11/11   Minor update release.

   Synchronize with TOMOYO revision 5625.

   Optimize for object's size.

Version 1.0.23   2011/11/18   Minor update release.

   Synchronize with TOMOYO revision 5646.

   Fix kernel config mapping error.

Version 1.0.24   2011/12/13   Minor update release.

   Synchronize with TOMOYO revision 5711.

   Follow __d_path() behavior change. (Only 2.6.36 and later)

Version 1.0.25   2012/02/29   Minor update release.

   Synchronize with TOMOYO revision 5893.

   Follow UMH_WAIT_PROC constant renumbering.

   Fix mount flags checking order.

Version 1.0.26   2012/04/01   Minor update release.

   Synchronize with TOMOYO revision 5973.

   Return appropriate value to poll().

Version 1.0.27   2012/05/05   Minor update release.

   Synchronize with TOMOYO revision 6035.

   Readd RHEL_MINOR/AX_MINOR checks.

   Accept manager programs which do not start with / .

Version 1.0.28   2012/10/20   Security update release.

   Fix kernel panic caused by double kfree() bug when "struct ccs_execve"
   pointer was by error duplicated at __ccs_alloc_task_security().
   This bug affects only 2.6.28 and earlier kernels.

Version 1.0.29   2012/11/04   Minor update release.

   Use dummy pointer as needed in order to make sure that security_bprm_free()
   (which is used for making the caller of do_execve() return to previous
   domain when do_execve() failed after domain transition) is always called.
   Without this fix, domain transition history on 2.6.28 and earlier kernels
   becomes inaccurate.

Version 1.0.30   2013/02/14   Minor update release.

   Commit a2a8474c "exec: do not sleep in TASK_TRACED under ->cred_guard_mutex"
   moved "current->in_execve = 1;" from before prepare_bprm_creds() to after
   prepare_bprm_creds(). It turned out that, as an unexpected bonus, we can use
   security_prepare_creds() as a hook for emulating security_bprm_free() hook.

   I updated the logic for security_bprm_free() emulation, and now AKARI should
   be able to coexist with other AKARI-like LKM-based LSM implementations (e.g.
   CaitSith) on all kernel versions other than 2.6.29 and 2.6.30.

Version 1.0.31   2015/01/12   Minor update release.

   Synchronize with TOMOYO revision 6373.

   Fix missing chmod(-1) check in Linux 3.1 and later kernels.

   Fix potentially using bogus attributes when stat() fails.

Version 1.0.32   2015/04/08   Minor update release.

   Synchronize with TOMOYO revision 6388.

   Fix incorrect readdir() permission check.

Version 1.0.33   2015/04/21   Minor update release.

   Synchronize with TOMOYO revision 6407.

   Fix incorrect retry request check.

Version 1.0.34   2015/05/05   Minor update release.

   Synchronize with TOMOYO 1.8.4 release.

   Support multiple use_group entries.

Version 1.0.35   2015/11/11   Minor update release.

   Synchronize with TOMOYO 1.8.5 release.

   Use memory allocation flags used by TOMOYO 2.x.

   Limit wildcard recursion depth.

Version 1.0.36   2017/02/20   Minor update release.

   Synchronize with TOMOYO revision 6553.

   The bug fixed in TOMOYO's GC does not affect AKARI because
   AKARI always uses CONFIG_CCSECURITY_USE_EXTERNAL_TASK_SECURITY.

Version 1.0.37   2017/09/17   Minor update release.

   Use smp_rmb() when waiting for hook readiness.

Version 1.0.38   2018/04/01   Minor update release.

   Synchronize with TOMOYO revision 6638.

   Due to incorrect probe_kernel_write() usage, previously registered LSM
   hook (if any) was by error overwritten by this hook. This bug affects
   only 4.12 and later kernels.

Version 1.0.39   2019/08/20   Minor update release.

   Synchronize with TOMOYO 1.8.6 release.

   Change pathname calculation for read-only filesystems.

   Reject move_mount() system call for now.

   Don't check open/getattr permission on sockets.

Version 1.0.40   2019/12/25   Minor update release.

   Synchronize with TOMOYO revision 6758.

   Don't use nifty names on sockets.

Version 1.0.41   2020/04/13   Minor update release.

   Synchronize with TOMOYO revision 6785.

   Fix wrong put_page() usage in ccs_dump_page().

Version 1.0.42   2020/05/05   Minor update release.

   Synchronize with TOMOYO 1.8.7 release.

   Loosen domainname validation and pathname validation.

Version 1.0.43   2020/08/08   Minor update release.

   Synchronize with TOMOYO revision 6816.

   Fix domain transition preference.

Version 1.0.44   2020/08/20   Minor update release.

   Synchronize with TOMOYO revision 6821.

   Fix ccs_realpath() fallback.

   Fix wrong ccs_search_binary_handler() mapping.

Version 1.0.45   2020/11/11   Minor update release.

   Synchronize with TOMOYO 1.8.8 release.

   Fix LSM hook detection on ARM64.

Version 1.0.46   2020/11/12   Minor update release.

   Since ccsecurity_exports.load_policy is initialized to NULL in AKARI,
   calling ccsecurity_exports.load_policy() before ccs_permission_init() is
   called (changed in revision 654) caused kernel panic as soon as loading
   akari.ko module. Since AKARI directly calls ccs_load_policy(), there is
   no need to use ccsecurity_exports.load_policy().

Version 1.0.47   2021/04/01   Minor update release.

   Synchronize with TOMOYO 1.8.9 release.

   Skip permission checks for fileless execution requests.

   Fix ccs_kernel_service().

Version 1.0.48   2023/05/27   Security update release.

   When ccs_start_execve() failed before CCS_TASK_IS_IN_EXECVE is set,
   ccs_clear_execve(-1, ptr) was not called. As a result, retried execve()
   request did not check execute permission. This bug affects only 2.6.29
   and later kernels.