-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
yaml --- r: 140447 b: refs/heads/master c: 83f2f0e h: refs/heads/master i: 140445: b92ba7e 140443: 12e010d 140439: dd4259f 140431: 2e796ee 140415: 3799523 v: v3
- Loading branch information
Ingo Molnar
committed
Apr 2, 2009
1 parent
549dbd5
commit 69f9936
Showing
5,417 changed files
with
421,756 additions
and
199,177 deletions.
The diff you're trying to view is too large. We only load the first 3000 changed files.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,2 @@ | ||
| --- | ||
| refs/heads/master: 3de46fda4c104deef17ec70f85361f5c6b84ce0e | ||
| refs/heads/master: 83f2f0ed715eb15a8e13c07df479d65bbc10d8d5 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| What: security/ima/policy | ||
| Date: May 2008 | ||
| Contact: Mimi Zohar <zohar@us.ibm.com> | ||
| Description: | ||
| The Trusted Computing Group(TCG) runtime Integrity | ||
| Measurement Architecture(IMA) maintains a list of hash | ||
| values of executables and other sensitive system files | ||
| loaded into the run-time of this system. At runtime, | ||
| the policy can be constrained based on LSM specific data. | ||
| Policies are loaded into the securityfs file ima/policy | ||
| by opening the file, writing the rules one at a time and | ||
| then closing the file. The new policy takes effect after | ||
| the file ima/policy is closed. | ||
|
|
||
| rule format: action [condition ...] | ||
|
|
||
| action: measure | dont_measure | ||
| condition:= base | lsm | ||
| base: [[func=] [mask=] [fsmagic=] [uid=]] | ||
| lsm: [[subj_user=] [subj_role=] [subj_type=] | ||
| [obj_user=] [obj_role=] [obj_type=]] | ||
|
|
||
| base: func:= [BPRM_CHECK][FILE_MMAP][INODE_PERMISSION] | ||
| mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC] | ||
| fsmagic:= hex value | ||
| uid:= decimal value | ||
| lsm: are LSM specific | ||
|
|
||
| default policy: | ||
| # PROC_SUPER_MAGIC | ||
| dont_measure fsmagic=0x9fa0 | ||
| # SYSFS_MAGIC | ||
| dont_measure fsmagic=0x62656572 | ||
| # DEBUGFS_MAGIC | ||
| dont_measure fsmagic=0x64626720 | ||
| # TMPFS_MAGIC | ||
| dont_measure fsmagic=0x01021994 | ||
| # SECURITYFS_MAGIC | ||
| dont_measure fsmagic=0x73636673 | ||
|
|
||
| measure func=BPRM_CHECK | ||
| measure func=FILE_MMAP mask=MAY_EXEC | ||
| measure func=INODE_PERM mask=MAY_READ uid=0 | ||
|
|
||
| The default policy measures all executables in bprm_check, | ||
| all files mmapped executable in file_mmap, and all files | ||
| open for read by root in inode_permission. | ||
|
|
||
| Examples of LSM specific definitions: | ||
|
|
||
| SELinux: | ||
| # SELINUX_MAGIC | ||
| dont_measure fsmagic=0xF97CFF8C | ||
|
|
||
| dont_measure obj_type=var_log_t | ||
| dont_measure obj_type=auditd_log_t | ||
| measure subj_user=system_u func=INODE_PERM mask=MAY_READ | ||
| measure subj_role=system_r func=INODE_PERM mask=MAY_READ | ||
|
|
||
| Smack: | ||
| measure subj_user=_ func=INODE_PERM mask=MAY_READ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| What: /sys/fs/ext4/<disk>/mb_stats | ||
| Date: March 2008 | ||
| Contact: "Theodore Ts'o" <tytso@mit.edu> | ||
| Description: | ||
| Controls whether the multiblock allocator should | ||
| collect statistics, which are shown during the unmount. | ||
| 1 means to collect statistics, 0 means not to collect | ||
| statistics | ||
|
|
||
| What: /sys/fs/ext4/<disk>/mb_group_prealloc | ||
| Date: March 2008 | ||
| Contact: "Theodore Ts'o" <tytso@mit.edu> | ||
| Description: | ||
| The multiblock allocator will round up allocation | ||
| requests to a multiple of this tuning parameter if the | ||
| stripe size is not set in the ext4 superblock | ||
|
|
||
| What: /sys/fs/ext4/<disk>/mb_max_to_scan | ||
| Date: March 2008 | ||
| Contact: "Theodore Ts'o" <tytso@mit.edu> | ||
| Description: | ||
| The maximum number of extents the multiblock allocator | ||
| will search to find the best extent | ||
|
|
||
| What: /sys/fs/ext4/<disk>/mb_min_to_scan | ||
| Date: March 2008 | ||
| Contact: "Theodore Ts'o" <tytso@mit.edu> | ||
| Description: | ||
| The minimum number of extents the multiblock allocator | ||
| will search to find the best extent | ||
|
|
||
| What: /sys/fs/ext4/<disk>/mb_order2_req | ||
| Date: March 2008 | ||
| Contact: "Theodore Ts'o" <tytso@mit.edu> | ||
| Description: | ||
| Tuning parameter which controls the minimum size for | ||
| requests (as a power of 2) where the buddy cache is | ||
| used | ||
|
|
||
| What: /sys/fs/ext4/<disk>/mb_stream_req | ||
| Date: March 2008 | ||
| Contact: "Theodore Ts'o" <tytso@mit.edu> | ||
| Description: | ||
| Files which have fewer blocks than this tunable | ||
| parameter will have their blocks allocated out of a | ||
| block group specific preallocation pool, so that small | ||
| files are packed closely together. Each large file | ||
| will have its blocks allocated out of its own unique | ||
| preallocation pool. | ||
|
|
||
| What: /sys/fs/ext4/<disk>/inode_readahead | ||
| Date: March 2008 | ||
| Contact: "Theodore Ts'o" <tytso@mit.edu> | ||
| Description: | ||
| Tuning parameter which controls the maximum number of | ||
| inode table blocks that ext4's inode table readahead | ||
| algorithm will pre-read into the buffer cache | ||
|
|
||
| What: /sys/fs/ext4/<disk>/delayed_allocation_blocks | ||
| Date: March 2008 | ||
| Contact: "Theodore Ts'o" <tytso@mit.edu> | ||
| Description: | ||
| This file is read-only and shows the number of blocks | ||
| that are dirty in the page cache, but which do not | ||
| have their location in the filesystem allocated yet. | ||
|
|
||
| What: /sys/fs/ext4/<disk>/lifetime_write_kbytes | ||
| Date: March 2008 | ||
| Contact: "Theodore Ts'o" <tytso@mit.edu> | ||
| Description: | ||
| This file is read-only and shows the number of kilobytes | ||
| of data that have been written to this filesystem since it was | ||
| created. | ||
|
|
||
| What: /sys/fs/ext4/<disk>/session_write_kbytes | ||
| Date: March 2008 | ||
| Contact: "Theodore Ts'o" <tytso@mit.edu> | ||
| Description: | ||
| This file is read-only and shows the number of | ||
| kilobytes of data that have been written to this | ||
| filesystem since it was mounted. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.