v0.5.28

Added

• AppArmor checks the sockets, as net.c and af_inet.c of the Ubuntu kernel: a create, a bind, a connect, a listen, an accept, a send, a receive, getsockname, getpeername, getsockopt, setsockopt and shutdown need a network rule for the family and the type of the socket. For IPv4 and IPv6, a rule can also name the protocol, the addresses and the ports, the option and the backlog. A denial gives EACCES and a record of the class net (#540).
• AppArmor checks the creation of a user namespace, as task.c and lsm.c of the Ubuntu kernel. A profile with userns rules needs a rule that allows it, and a rule can give the label of the task in the new namespace. The new files kernel.apparmor_restrict_unprivileged_userns, _force and _complain of /proc/sys work as on Ubuntu: with the first at 1, an unconfined task without CAP_SYS_ADMIN goes to the profile unprivileged_userns, or gets EACCES if that profile is not there. A denial gives EACCES and a record of the class namespace. A security module can now give files of /proc/sys (#540).

Fixed

• A read end of a FIFO gives POLLHUP in poll only after a writer opened after the end and closed, as pipe_poll of Linux. Before, a reader that waited in select for the first writer woke at once (#540).
• A tmpfs mount with size=N% takes N percent of the memory as its limit, as shmem_parse_one of Linux, and size=0 has no limit. Before this, a size in percent had no limit, so statfs gave 0 free blocks, and systemd refused daemon-reload because /run had less than 16 MiB free. systemd mounts /run with size=20% (#538).

v0.5.27

Added

• AppArmor checks ptrace, as task.c of Linux: an attach and a PTRACE_TRACEME need the ptrace rules of the tracer and of the tracee. A profile without ptrace rules needs CAP_SYS_PTRACE to trace a task with another label. An exec of a traced task changes the label only if the tracer can trace the new label, as may_change_ptraced_domain of Linux. A denial gives EACCES and a record of the class ptrace (#540).
• The objects ct helper, ct timeout, ct expectation and synproxy of nf_tables, as nft_ct.c and nft_synproxy.c of Linux, with the checks of Linux and their dumps, and the ct key helper. The objects do not change the packets yet: the connections of rk have no helpers, no timeouts of their own and no expectations, and rk has no SYN proxy. The dump of a rule now gives the name of its object with a NUL byte, as Linux. Before, ct expectation set "ctexpect" came back with a wrong byte at the end of the name (#542).
• The boot test cryptenroll on x86-64 and arm64, with a TPM. cryptsetup makes a LUKS2 image in a file, systemd-cryptenroll adds a key slot that the TPM seals to PCR 7, and cryptsetup opens the key slot with the token of the TPM only. libcryptsetup uses the skcipher sockets of AF_ALG for the key slots. tools/systemd/build.sh adds cryptsetup, systemd-cryptenroll and tpm2-tools to the tree. With RK_TPM=1, the systemd boot test prints systemd-analyze has-tpm2, and with the full TPM2 support of systemd (a boot with EFI) it compares the PCRs of systemd-analyze pcrs with the PCRs of tpm2_pcrread. RK_RELEASE=1 makes the boot tests use the release kernel, which unpacks the initramfs of the systemd tree much faster on a host without KVM (#541).
• snat and dnat to a prefix of nf_tables (snat ip prefix to ip saddr map { 10.141.11.0/24 : 192.168.2.0/24 }), as NF_NAT_RANGE_NETMAP of nft_nat.c of Linux. The address keeps the bits that are not in the prefix (#542).

v0.5.26

Added

• A socket has the owner and the mode of its inode, as sockfs of Linux. A new socket has the file system user and group IDs of the process and the mode 0777. fchown, fchmod and fchownat with AT_EMPTY_PATH change them. After the release of the socket, a change of the owner gives ENOENT, as sockfs_setattr of Linux for CVE-2019-8912. LTP af_alg07 tests this (#541).
• AppArmor checks the capabilities, as capability.c of Linux. A capability that the profile does not allow gives EPERM and a record of the class cap, with the rules audit and quiet and the skip of a repeated record. Each check of a capability calls the capable hook of the security modules after the check of the capability module, also the checks in a user namespace and the checks of a file, as ns_capable and capable_wrt_inode_uidgid of Linux (#540).
• AppArmor checks the signals, as ipc.c of Linux. The rules of the sender must allow the send to the label of the target, and the rules of the target must allow the receive from the label of the sender. A denial gives EACCES and a record of the class signal. The match of the label of the other task, aa_label_match of Linux, is in the new module label (#540).

Fixed

• AppArmor finds the parent of a hat that has the name of a program, as aa_split_fqname of Linux. In P///bin/x the parent is P and the hat is /bin/x. Before, the parent was P/, so a change_hat from that hat to a sibling hat gave ECHILD (#540).

v0.5.25

Added

• The AF_ALG sockets with the type skcipher, as crypto/algif_skcipher.c of Linux, for ecb(aes), cbc(aes), ctr(aes) and xts(aes) of rk-crypto. A sendmsg gives the operation with ALG_SET_OP and the IV with ALG_SET_IV in control messages, and adds the data to the queue. A recv encrypts or decrypts the data of the queue in blocks. With MSG_MORE, the operation continues in the next send, and the IV goes from one recv to the next. libcryptsetup uses these sockets to open a LUKS2 key slot without dm-crypt (#541).
• The getdents call of x86_64, with the records of the old format linux_dirent, as filldir of Linux. The readdir test of the AppArmor regression tests uses it (#540).
• AppArmor checks the path operations, as the path hooks of lsm.c of Linux: a create, a mkdir, a mknod, a symbolic link, a hard link, a rename, an unlink, an rmdir, a truncate, a chmod, a chown and a stat. The VFS has the hooks path_*, inode_getattr and file_truncate of Linux, at the places where Linux calls them (#540).
• The expressions numgen and hash of nf_tables, as nft_numgen.c and nft_hash.c of Linux, and more keys of meta, as nft_meta.c: priority, pkttype, cpu, iifgroup, oifgroup, random, iifkind, oifkind, time, day, hour, sdif and sdifname. A rule sets meta priority and meta pkttype too. A packet now has a priority and a type, as skb->priority and skb->pkt_type. meta iif and meta iifname of a packet with no device give 0 and "", as in Linux (#542).
• The expression payload of nf_tables writes the packet, as nft_payload_set_eval of Linux, with the checksums of IP, of the transport header and of SCTP. The expression queue, as nft_queue.c of Linux, gives the packet to its queue (#542).

v0.5.24

Added

• fanotify has FAN_REPORT_MNT. A group with this flag marks a mount namespace with FAN_MARK_MNTNS and gets FAN_MNT_ATTACH and FAN_MNT_DETACH when a mount of the namespace is attached, moved or unmounted. Each event has a FAN_EVENT_INFO_TYPE_MNT record with the unique mount ID, and the errors and the record layout are the same as in Linux. The init boot test checks the errors, the fdinfo line and the events of mount, move and umount. (#539)
• The sdbpf boot test runs the unit tests test-bpf-devices, test-bpf-firewall and test-bpf-foreign-programs of systemd. They attach cgroup programs with BPF_PROG_ATTACH, BPF_PROG_DETACH, BPF_PROG_QUERY and BPF_LINK_CREATE, and all three pass. RK_SYSTEMD_PACKAGES of tools/systemd/build.sh adds packages to the systemd tree, and this test needs systemd-tests and iputils-ping (#537).

Fixed

• NFT_MSG_GETSETELEM of nf_tables in a set with NFT_SET_INTERVAL gives the range that has the key, as the get operations of nft_set_rbtree.c and nft_set_pipapo.c of Linux. Before this change, it gave ENOENT for a key that is not the start or the end of a range (#542).
• A range of a set with a key of more than one field matches a key that is in the range in each field, as nft_set_pipapo.c of Linux. Before this change, the key was compared as one number (#542).
• A new element of a set of nf_tables with NFT_SET_INTERVAL that overlaps a range of the set gives EEXIST, as __nft_rbtree_insert and nft_pipapo_insert of Linux. The add of an element no longer looks at all of the elements of a set with no timeouts, so that a batch of 65000 ranges does not take minutes (#542).
• A range of a set of nf_tables that starts where the range before it ends matches its keys. Before this change, the start and the end at the same key were in the wrong order, and the two ranges did not match (#542).
• The dump of a set of nf_tables with ranges of keys of more than one field gives the elements in the order of their inserts, as nft_pipapo_walk of Linux. Before this change, the elements were in the order of their keys (#542).
• A set of nf_tables with ranges of keys of more than one field takes a range again when a later range also has its first key, as nft_pipapo_insert of Linux. Before this change, the set gave EEXIST (#542).

v0.5.23

Added

• The eBPF verifier gives the result of kernel/bpf/verifier.c of Linux for all programs of bpf/test_verifier of the socket filter and cgroup program types. It prunes the paths with equal states at the jump targets and refuses a loop that does not end, it refines the bounds of a register after BPF_JSET and after a BPF_JMP32 that compares as 64 bits, and it checks the alignment of the pointers and the size of each context field as Linux, with the errors and the log messages of Linux in the same order. bpf(BPF_PROG_TEST_RUN) runs a program on a packet or a context from user space. The kselftest boot test runs bpf/test_verifier, and tools/kselftest/bpf.md gives the result: 281 passed and 0 failed (#537).
• The stateful expressions of the sets of nf_tables, as nft_set_elem_expr_alloc of Linux: NFTA_SET_EXPR and NFTA_SET_EXPRESSIONS of a set, NFTA_SET_ELEM_EXPR and NFTA_SET_ELEM_EXPRESSIONS of an element, and NFTA_DYNSET_EXPR and NFTA_DYNSET_EXPRESSIONS of dynset. The expressions are counter, quota, limit and connlimit, two at most. Each element has its own state: a copy of the expressions of the set, or the ones that it gives with the same types. A lookup and a dynset run the expressions of the element that they find. The connlimit expression of nft_connlimit.c counts the connections that connection tracking still has (#542).
• The AF_ALG sockets with the type hash, as crypto/af_alg.c and crypto/algif_hash.c of Linux. A socket binds to a hash of rk-crypto by its name, setsockopt(SOL_ALG, ALG_SET_KEY) sets the key of an HMAC, and accept gives a socket for one computation. A send with MSG_MORE adds data, and a recv gives the digest. An accept on the socket of a computation copies its state. As with crypto.af_alg_restrict=1 of Linux, a name that is not in the allow list gives ENOENT, and a name that needs a capability gives ENOENT without CAP_SYS_ADMIN or CAP_NET_ADMIN (#541).

v0.5.22

Added

• The crypto API in the new crate rk-crypto, as crypto/ of Linux: the hashes SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512, the template hmac, the block cipher AES, and the templates ecb, cbc, ctr and xts with ciphertext stealing. The code is plain Rust. The unit tests use the vectors of crypto/testmgr.h of Linux (#541).
• The event log of the firmware at /sys/kernel/security/tpm0/binary_bios_measurements, as drivers/char/tpm/eventlog of Linux. The kernel copies the log area of the ACPI TPM2 table on x86-64, or the area of linux,sml-base and linux,sml-size of the device tree node of the TPM on arm64. The file has the first event and each next event of the crypto agile format, up to the first event that is not valid, as tpm2_binary_bios_measurements_show of Linux. On x86-64 the tpm boot test replays the log of SeaBIOS with tpm2_eventlog, and the SHA-256 PCRs of the log must be the PCRs of tpm2_pcrread (#541).
• The flowtables of nf_tables, as nf_tables_api.c and nft_flow_offload.c of Linux: NFT_MSG_NEWFLOWTABLE, NFT_MSG_GETFLOWTABLE, NFT_MSG_DELFLOWTABLE and NFT_MSG_DESTROYFLOWTABLE, with the ingress hook, the priority, the flags and the list of devices, and the flow_offload expression in the forward hook. A device can be in one flowtable of a table only (EEXIST), a flowtable that a rule uses cannot be deleted (EBUSY), and a device that goes away leaves the flowtable. The packets do not take a fast path: flow_offload does not change them (#542).
• AppArmor enforces the file rules of a profile in enforce mode, as file.c and domain.c of Linux. An open, a read, a write, a lock or a map that the rules do not allow gives EACCES and a DENIED record. So does an exec with no exec rule, an exec to a profile that is not there, and a change_profile or a change_onexec that the rules do not allow. A profile in complain mode gives an ALLOWED record and the operation goes on, and a profile in kill mode also kills the task. A deny rule denies in each mode (#540).

v0.5.21

Added

• AppArmor has child policy namespaces, as policy_ns.c of Linux. A load of a profile :NS:NAME, or of a policy with the namespace NS, makes the namespace NS if it is not there, and the load records end with ns="NS". The file profiles lists these profiles as :NS:NAME, and a remove of :NS:NAME or :NS: removes the profile or the namespace. Thus apparmor_parser loads all the profiles of Ubuntu 26.04, also :glycin:loaders and :glycin:bwrap, and aa-status lists them. A task changes to a profile of a namespace with change_profile or change_onexec of :NS://NAME, as aa-exec --namespace does. The task sees the names of its namespace without the namespace, and the attach at exec looks in its namespace. A task can also put a profile on a stack with its label, with stack NAME or changeprofile &NAME, now or at the next exec. The label of the task is then A//&B, and each profile of the stack checks the file accesses and changes at an exec. For a script, the exec hook of AppArmor now gets the script and not its interpreter, as on Linux, so the rules for the script give the profile and AT_SECURE. tools/apparmor runs the AppArmor regression tests in complain mode under QEMU, on rukernel and on a Linux reference kernel, and tools/apparmor/report.md compares the results (#540).
• /dev/tpmrm0 (253:65536), the resource manager of TPM 2.0, as tpm2-space.c and tpmrm-dev.c of Linux. Each open file has a space with up to 3 transient objects and 3 sessions. Between two commands the driver saves their contexts and flushes the objects, and before the next command it loads them again. The objects get virtual handles, and TPM2_GetCapability for the handles gives only the objects of the space. A command that the TPM does not have gets TPM_RC_COMMAND_CODE in the layer of the resource manager. The driver reads the attributes of the commands at boot. /dev/tpm0 and /dev/tpmrm0 now take a new command after a read of a part of the response, give EINVAL for a command that is shorter than its size field, and give the error of a nonblocking write in the next read, as Linux. tools/kselftest/build.sh copies the tpm2 kselftests, tools/tpm/build.sh adds python3, and the tpm boot test runs test_smoke.sh, test_space.sh and test_async.sh (#541).

Fixed

• A kill of the processes of a cgroup with memory.oom.group counts the victim again in oom_kill of memory.events, as oom_kill_memcg_member of Linux kills each process of the group, the victim too. It also counts a process that is on its way out. Before, the count was one less than on Linux, and test_memcg_oom_group_score_events of the cgroup kselftests failed (#536).
• A cgroup that ran past its cpu.max quota stays throttled until the next periods pay for the difference, as distribute_cfs_runtime of Linux unthrottles a group only when its time is above 0. Its threads wait once, up to the end of the period that pays, and do not wake in each period, because the CPU time of such a wake also counts against the quota. throttled_usec counts the throttle up to the end of that period. Before, a thread waited only to the end of one period and then ran again, so a cgroup that ran past its quota got more CPU time than its quota over many periods (#536).

v0.5.20

Added

• BPF_MAP_TYPE_PROG_ARRAY and the helper bpf_tail_call, as kernel/bpf/arraymap.c and JMP_TAIL_CALL of Linux. A system call writes the descriptor of a program to a slot and reads the ID of the program. All programs of an array and all programs that use it have one type. A tail call to an empty slot or to an index out of the array continues after the call, and a run does at most 33 tail calls. The last close of the array removes its programs. The verifier refuses a program array with another helper, a tail call with another map, and a tail call in a program with functions, with the messages of Linux. The ltp boot test also runs bpf_prog05, bpf_prog06 and bpf_prog07. They do not apply, as on Linux, because they drop CAP_BPF and kernel.unprivileged_bpf_disabled is 2 (#537).
• /dev/tpm0 (10:224) for the TPM, as tpm-dev.c of Linux: one open file at a time, a write sends one command and a read gives its response. /sys/class/tpm/tpm0 has dev, uevent, tpm_version_major and the directory pcr-sha256 with the digest of each PCR, from a new hook for the attributes of a class in sysfs. tools/tpm/build.sh installs tpm2-tools from Alpine, and with it the tpm boot test runs tpm2_getrandom 8 and tpm2_pcrread sha256:0,7 on /dev/tpm0 and compares the PCRs with pcr-sha256 (#541).

Fixed

• A write of memory.peak starts a new peak for the open file only, as peak_write of Linux. A read of that open file shows the largest use after the write, and the other readers of memory.peak still see the largest use since the cgroup was made. Each other open file with a write gets the use now if it is larger than its value. Before, a write reset the peak of the cgroup for all readers, and test_memcg_current_peak of the cgroup kselftests failed. memory.swap.peak stays 0, because rukernel has no swap (#536).
• A populate of many pages in one system call, as mlock, MAP_POPULATE and MAP_LOCKED do, waits for memory.high after each batch of 64 pages, as try_charge_memcg of Linux calls mem_cgroup_handle_over_high. A kill stops the populate. Before, the wait came only at the return to user mode, so one mlock of 200 MB in a cgroup with memory.high 30M went up to memory.max at once, and test_memcg_high_sync of the cgroup kselftests failed (#536).
• tools/kselftest/build.sh builds the cgroup selftests without optimization, as their Makefile in Linux does. At -O2, gcc removed the memory use of alloc_anon of test_memcontrol, so test_memcg_max, test_memcg_oom_events and the memory.oom.group tests found no OOM kill (#536).

v0.5.19

Added

• The kselftest boot test runs test_core and test_cpuset of the cgroup selftests. tools/kselftest/build.sh builds them with cgroup/lib/cgroup_util.c, and the init script of the test mounts cgroup2 at /sys/fs/cgroup with nsdelegate, as systemd mounts it (#536).
• The kselftest boot test runs test_freezer and test_kill of the cgroup selftests (#536).
• A TPM 2.0 driver, rk-drv-tpm, as drivers/char/tpm of Linux. On x86-64 the kernel reads the address of the CRB from the ACPI TPM2 table, and on arm64 it finds the FIFO (TIS) interface at the device tree node with compatible = "tcg,tpm-tis-mmio", also on a bus with ranges. The CRB driver uses the locality, the ready and idle requests, the start and cancel registers and the command and response buffers. The TIS driver uses the locality, the status, the burst count and the data FIFO. Each step waits up to the TCG time limits, and each command up to its duration of Linux. At boot the driver starts the TPM as tpm2_auto_startup of Linux. The new tpm boot test gives the machine a swtpm, and the kernel sends TPM2_Startup, TPM2_GetRandom and TPM2_PCR_Read on x86-64 and on arm64 (#541).

Fixed

• A thread that a signal or a tracer stopped, or that waits for its vfork child, counts as frozen in its cgroup, as cgroup_enter_frozen in do_signal_stop, ptrace_stop and wait_for_vfork_done of Linux. A thread that moves to another cgroup in such a wait moves its count. A stop of the group or a request of PTRACE_INTERRUPT ends the wait in the freezer, and the thread takes the stop, as JOBCTL_PENDING_MASK ends the freezer trap of Linux. Before, a freeze of a cgroup with a stopped, traced or vfork thread did not end, and test_freezer of the cgroup kselftests failed (#536).
• A change of cgroup.events and of the other files with events of cgroup2 sends IN_MODIFY to the inotify marks of the file, as kernfs_notify of Linux. A write of cgroup.freeze in a cgroup that a cgroup above it keeps frozen also tells an event, as cgroup_freeze of Linux, so that a reader does not wait for a change that does not come (#536).
• The scheduler does not call the notice function of rk-cgroup, because that function now sends inotify events, which must not run in the scheduler. As kernfs_notify of Linux defers its work, a change of a file with events that comes from a CPU charge waits for the next call outside the scheduler (#536).
• /proc/PID/task/TID/cgroup shows the cgroup of the thread TID, as proc_cgroup_show of Linux. In a threaded subtree, a thread can be in another cgroup than its process. Before, the file showed the cgroup of the process, and test_cgcore_thread_migration failed (#536).