OSDN > Finden Software > System > Operating System Kernels > Linux > TOMOYO > SCM > SVN > Commit

TOMOYO
Fork

R/O
SSH
HTTPS

tomoyo: Commit

Commit MetaInfo

Revision	6930 (tree)
Zeit	2023-01-14 16:15:48
Autor	kumaneko

Log Message

(empty log message)

Ändern Zusammenfassung

modified: trunk/1.8.x/ccs-patch/patches/ccs-patch-4.9.diff (diff)
modified: trunk/1.8.x/ccs-patch/patches/ccs-patch-5.10.diff (diff)
modified: trunk/1.8.x/ccs-patch/patches/ccs-patch-5.15.diff (diff)
modified: trunk/1.8.x/ccs-patch/patches/ccs-patch-6.0.diff (diff)
modified: trunk/1.8.x/ccs-patch/patches/ccs-patch-6.1.diff (diff)
modified: trunk/1.8.x/ccs-patch/patches/ccs-patch-6.2.diff (diff)

Diff

--- trunk/1.8.x/ccs-patch/patches/ccs-patch-4.9.diff (revision 6929)

+++ trunk/1.8.x/ccs-patch/patches/ccs-patch-4.9.diff (revision 6930)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 4.9.336.
	1	+This is TOMOYO Linux patch for kernel 4.9.337.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.9.336.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.9.337.tar.xz
4	4	---
5	5	fs/exec.c \| 2 -
6	6	fs/open.c \| 2 +

		@@ -28,8 +28,8 @@
28	28	security/Makefile \| 3 ++
29	29	24 files changed, 147 insertions(+), 26 deletions(-)
30	30
31		---- linux-4.9.336.orig/fs/exec.c
32		-+++ linux-4.9.336/fs/exec.c
	31	+--- linux-4.9.337.orig/fs/exec.c
	32	++++ linux-4.9.337/fs/exec.c
33	33	@@ -1662,7 +1662,7 @@ static int exec_binprm(struct linux_binp
34	34	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
35	35	rcu_read_unlock();

		@@ -39,8 +39,8 @@
39	39	if (ret >= 0) {
40	40	audit_bprm(bprm);
41	41	trace_sched_process_exec(current, old_pid, bprm);
42		---- linux-4.9.336.orig/fs/open.c
43		-+++ linux-4.9.336/fs/open.c
	42	+--- linux-4.9.337.orig/fs/open.c
	43	++++ linux-4.9.337/fs/open.c
44	44	@@ -1173,6 +1173,8 @@ EXPORT_SYMBOL(sys_close);
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-4.9.336.orig/fs/proc/version.c
54		-+++ linux-4.9.336/fs/proc/version.c
	53	+--- linux-4.9.337.orig/fs/proc/version.c
	54	++++ linux-4.9.337/fs/proc/version.c
55	55	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 4.9.336 2022/12/29\n");
	62	++ printk(KERN_INFO "Hook version: 4.9.337 2023/01/14\n");
63	63	+ return 0;
64	64	+}
65	65	+fs_initcall(ccs_show_version);
66		---- linux-4.9.336.orig/include/linux/init_task.h
67		-+++ linux-4.9.336/include/linux/init_task.h
	66	+--- linux-4.9.337.orig/include/linux/init_task.h
	67	++++ linux-4.9.337/include/linux/init_task.h
68	68	@@ -193,6 +193,14 @@ extern struct task_group root_task_group
69	69	# define INIT_TASK_TI(tsk)
70	70	#endif

		@@ -88,8 +88,8 @@
88	88	}
89	89
90	90
91		---- linux-4.9.336.orig/include/linux/sched.h
92		-+++ linux-4.9.336/include/linux/sched.h
	91	+--- linux-4.9.337.orig/include/linux/sched.h
	92	++++ linux-4.9.337/include/linux/sched.h
93	93	@@ -6,6 +6,8 @@
94	94	#include <linux/sched/prio.h>
95	95

		@@ -110,8 +110,8 @@
110	110	/* CPU-specific state of this task */
111	111	struct thread_struct thread;
112	112	/*
113		---- linux-4.9.336.orig/include/linux/security.h
114		-+++ linux-4.9.336/include/linux/security.h
	113	+--- linux-4.9.337.orig/include/linux/security.h
	114	++++ linux-4.9.337/include/linux/security.h
115	115	@@ -55,6 +55,7 @@ struct msg_queue;
116	116	struct xattr;
117	117	struct xfrm_sec_ctx;

		@@ -318,8 +318,8 @@
318	318	}
319	319	#endif /* CONFIG_SECURITY_PATH */
320	320
321		---- linux-4.9.336.orig/include/net/ip.h
322		-+++ linux-4.9.336/include/net/ip.h
	321	+--- linux-4.9.337.orig/include/net/ip.h
	322	++++ linux-4.9.337/include/net/ip.h
323	323	@@ -254,6 +254,8 @@ void inet_get_local_port_range(struct ne
324	324	#ifdef CONFIG_SYSCTL
325	325	static inline int inet_is_local_reserved_port(struct net *net, int port)

		@@ -338,8 +338,8 @@
338	338	return 0;
339	339	}
340	340	#endif
341		---- linux-4.9.336.orig/kernel/fork.c
342		-+++ linux-4.9.336/kernel/fork.c
	341	+--- linux-4.9.337.orig/kernel/fork.c
	342	++++ linux-4.9.337/kernel/fork.c
343	343	@@ -395,6 +395,7 @@ void __put_task_struct(struct task_struc
344	344	delayacct_tsk_free(tsk);
345	345	put_signal_struct(tsk->signal);

		@@ -366,8 +366,8 @@
366	366	bad_fork_cleanup_perf:
367	367	perf_event_free_task(p);
368	368	bad_fork_cleanup_policy:
369		---- linux-4.9.336.orig/kernel/kexec.c
370		-+++ linux-4.9.336/kernel/kexec.c
	369	+--- linux-4.9.337.orig/kernel/kexec.c
	370	++++ linux-4.9.337/kernel/kexec.c
371	371	@@ -17,7 +17,7 @@
372	372	#include <linux/syscalls.h>
373	373	#include <linux/vmalloc.h>

		@@ -386,8 +386,8 @@
386	386
387	387	/*
388	388	* Verify we have a legal set of flags
389		---- linux-4.9.336.orig/kernel/module.c
390		-+++ linux-4.9.336/kernel/module.c
	389	+--- linux-4.9.337.orig/kernel/module.c
	390	++++ linux-4.9.337/kernel/module.c
391	391	@@ -63,6 +63,7 @@
392	392	#include <linux/dynamic_debug.h>
393	393	#include <uapi/linux/module.h>

		@@ -414,8 +414,8 @@
414	414
415	415	return 0;
416	416	}
417		---- linux-4.9.336.orig/kernel/ptrace.c
418		-+++ linux-4.9.336/kernel/ptrace.c
	417	+--- linux-4.9.337.orig/kernel/ptrace.c
	418	++++ linux-4.9.337/kernel/ptrace.c
419	419	@@ -1178,6 +1178,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
420	420	{
421	421	struct task_struct *child;

		@@ -440,8 +440,8 @@
440	440
441	441	if (request == PTRACE_TRACEME) {
442	442	ret = ptrace_traceme();
443		---- linux-4.9.336.orig/kernel/reboot.c
444		-+++ linux-4.9.336/kernel/reboot.c
	443	+--- linux-4.9.337.orig/kernel/reboot.c
	444	++++ linux-4.9.337/kernel/reboot.c
445	445	@@ -16,6 +16,7 @@
446	446	#include <linux/syscalls.h>
447	447	#include <linux/syscore_ops.h>

		@@ -459,8 +459,8 @@
459	459
460	460	/*
461	461	* If pid namespaces are enabled and the current task is in a child
462		---- linux-4.9.336.orig/kernel/sched/core.c
463		-+++ linux-4.9.336/kernel/sched/core.c
	462	+--- linux-4.9.337.orig/kernel/sched/core.c
	463	++++ linux-4.9.337/kernel/sched/core.c
464	464	@@ -3817,6 +3817,8 @@ int can_nice(const struct task_struct *p
465	465	SYSCALL_DEFINE1(nice, int, increment)
466	466	{

		@@ -470,8 +470,8 @@
470	470
471	471	/*
472	472	* Setpriority might change our priority at the same moment.
473		---- linux-4.9.336.orig/kernel/signal.c
474		-+++ linux-4.9.336/kernel/signal.c
	473	+--- linux-4.9.337.orig/kernel/signal.c
	474	++++ linux-4.9.337/kernel/signal.c
475	475	@@ -2930,6 +2930,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
476	476	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
477	477	{

		@@ -517,8 +517,8 @@
517	517
518	518	return do_send_specific(tgid, pid, sig, info);
519	519	}
520		---- linux-4.9.336.orig/kernel/sys.c
521		-+++ linux-4.9.336/kernel/sys.c
	520	+--- linux-4.9.337.orig/kernel/sys.c
	521	++++ linux-4.9.337/kernel/sys.c
522	522	@@ -185,6 +185,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
523	523
524	524	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -548,8 +548,8 @@
548	548
549	549	errno = -EFAULT;
550	550	if (!copy_from_user(tmp, name, len)) {
551		---- linux-4.9.336.orig/kernel/time/ntp.c
552		-+++ linux-4.9.336/kernel/time/ntp.c
	551	+--- linux-4.9.337.orig/kernel/time/ntp.c
	552	++++ linux-4.9.337/kernel/time/ntp.c
553	553	@@ -17,6 +17,7 @@
554	554	#include <linux/module.h>
555	555	#include <linux/rtc.h>

		@@ -583,8 +583,8 @@
583	583
584	584	if (txc->modes & ADJ_NANO) {
585	585	struct timespec ts;
586		---- linux-4.9.336.orig/net/ipv4/raw.c
587		-+++ linux-4.9.336/net/ipv4/raw.c
	586	+--- linux-4.9.337.orig/net/ipv4/raw.c
	587	++++ linux-4.9.337/net/ipv4/raw.c
588	588	@@ -749,6 +749,10 @@ static int raw_recvmsg(struct sock *sk,
589	589	skb = skb_recv_datagram(sk, flags, noblock, &err);
590	590	if (!skb)

		@@ -596,8 +596,8 @@
596	596
597	597	copied = skb->len;
598	598	if (len < copied) {
599		---- linux-4.9.336.orig/net/ipv4/udp.c
600		-+++ linux-4.9.336/net/ipv4/udp.c
	599	+--- linux-4.9.337.orig/net/ipv4/udp.c
	600	++++ linux-4.9.337/net/ipv4/udp.c
601	601	@@ -1271,6 +1271,8 @@ try_again:
602	602	&peeked, &off, &err);
603	603	if (!skb)

		@@ -607,8 +607,8 @@
607	607
608	608	ulen = skb->len;
609	609	copied = len;
610		---- linux-4.9.336.orig/net/ipv6/raw.c
611		-+++ linux-4.9.336/net/ipv6/raw.c
	610	+--- linux-4.9.337.orig/net/ipv6/raw.c
	611	++++ linux-4.9.337/net/ipv6/raw.c
612	612	@@ -480,6 +480,10 @@ static int rawv6_recvmsg(struct sock *sk
613	613	skb = skb_recv_datagram(sk, flags, noblock, &err);
614	614	if (!skb)

		@@ -620,8 +620,8 @@
620	620
621	621	copied = skb->len;
622	622	if (copied > len) {
623		---- linux-4.9.336.orig/net/ipv6/udp.c
624		-+++ linux-4.9.336/net/ipv6/udp.c
	623	+--- linux-4.9.337.orig/net/ipv6/udp.c
	624	++++ linux-4.9.337/net/ipv6/udp.c
625	625	@@ -348,6 +348,8 @@ try_again:
626	626	&peeked, &off, &err);
627	627	if (!skb)

		@@ -631,8 +631,8 @@
631	631
632	632	ulen = skb->len;
633	633	copied = len;
634		---- linux-4.9.336.orig/net/socket.c
635		-+++ linux-4.9.336/net/socket.c
	634	+--- linux-4.9.337.orig/net/socket.c
	635	++++ linux-4.9.337/net/socket.c
636	636	@@ -1482,6 +1482,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
637	637	if (err < 0)
638	638	goto out_fd;

		@@ -644,8 +644,8 @@
644	644	if (upeer_sockaddr) {
645	645	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
646	646	&len, 2) < 0) {
647		---- linux-4.9.336.orig/net/unix/af_unix.c
648		-+++ linux-4.9.336/net/unix/af_unix.c
	647	+--- linux-4.9.337.orig/net/unix/af_unix.c
	648	++++ linux-4.9.337/net/unix/af_unix.c
649	649	@@ -2167,6 +2167,10 @@ static int unix_dgram_recvmsg(struct soc
650	650	POLLOUT \| POLLWRNORM \|
651	651	POLLWRBAND);

		@@ -665,8 +665,8 @@
665	665	mutex_unlock(&u->iolock);
666	666	out:
667	667	return err;
668		---- linux-4.9.336.orig/security/Kconfig
669		-+++ linux-4.9.336/security/Kconfig
	668	+--- linux-4.9.337.orig/security/Kconfig
	669	++++ linux-4.9.337/security/Kconfig
670	670	@@ -214,5 +214,7 @@ config DEFAULT_SECURITY
671	671	default "apparmor" if DEFAULT_SECURITY_APPARMOR
672	672	default "" if DEFAULT_SECURITY_DAC

		@@ -675,8 +675,8 @@
675	675	+
676	676	endmenu
677	677
678		---- linux-4.9.336.orig/security/Makefile
679		-+++ linux-4.9.336/security/Makefile
	678	+--- linux-4.9.337.orig/security/Makefile
	679	++++ linux-4.9.337/security/Makefile
680	680	@@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
681	681	# Object integrity file lists
682	682	subdir-$(CONFIG_INTEGRITY) += integrity

--- trunk/1.8.x/ccs-patch/patches/ccs-patch-5.10.diff (revision 6929)

+++ trunk/1.8.x/ccs-patch/patches/ccs-patch-5.10.diff (revision 6930)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 5.10.161.
	1	+This is TOMOYO Linux patch for kernel 5.10.162.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v5.x/linux-5.10.161.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v5.x/linux-5.10.162.tar.xz
4	4	---
5	5	fs/exec.c \| 2 -
6	6	fs/open.c \| 2 +

		@@ -28,8 +28,8 @@
28	28	security/security.c \| 5 ++-
29	29	24 files changed, 160 insertions(+), 30 deletions(-)
30	30
31		---- linux-5.10.161.orig/fs/exec.c
32		-+++ linux-5.10.161/fs/exec.c
	31	+--- linux-5.10.162.orig/fs/exec.c
	32	++++ linux-5.10.162/fs/exec.c
33	33	@@ -1826,7 +1826,7 @@ static int bprm_execve(struct linux_binp
34	34	if (retval)
35	35	goto out;

		@@ -39,9 +39,9 @@
39	39	if (retval < 0)
40	40	goto out;
41	41
42		---- linux-5.10.161.orig/fs/open.c
43		-+++ linux-5.10.161/fs/open.c
44		-@@ -1339,6 +1339,8 @@ SYSCALL_DEFINE3(close_range, unsigned in
	42	+--- linux-5.10.162.orig/fs/open.c
	43	++++ linux-5.10.162/fs/open.c
	44	+@@ -1345,6 +1345,8 @@ SYSCALL_DEFINE3(close_range, unsigned in
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)
47	47	{

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-5.10.161.orig/fs/proc/version.c
54		-+++ linux-5.10.161/fs/proc/version.c
	53	+--- linux-5.10.162.orig/fs/proc/version.c
	54	++++ linux-5.10.162/fs/proc/version.c
55	55	@@ -21,3 +21,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 5.10.161 2022/12/29\n");
	62	++ printk(KERN_INFO "Hook version: 5.10.162 2023/01/14\n");
63	63	+ return 0;
64	64	+}
65	65	+fs_initcall(ccs_show_version);
66		---- linux-5.10.161.orig/include/linux/sched.h
67		-+++ linux-5.10.161/include/linux/sched.h
	66	+--- linux-5.10.162.orig/include/linux/sched.h
	67	++++ linux-5.10.162/include/linux/sched.h
68	68	@@ -41,6 +41,7 @@ struct backing_dev_info;
69	69	struct bio_list;
70	70	struct blk_plug;

		@@ -73,7 +73,7 @@
73	73	struct cfs_rq;
74	74	struct fs_struct;
75	75	struct futex_pi_state;
76		-@@ -1337,6 +1338,10 @@ struct task_struct {
	76	+@@ -1340,6 +1341,10 @@ struct task_struct {
77	77	/* Used by LSM modules for access restriction: */
78	78	void *security;
79	79	#endif

		@@ -84,8 +84,8 @@
84	84
85	85	#ifdef CONFIG_GCC_PLUGIN_STACKLEAK
86	86	unsigned long lowest_stack;
87		---- linux-5.10.161.orig/include/linux/security.h
88		-+++ linux-5.10.161/include/linux/security.h
	87	+--- linux-5.10.162.orig/include/linux/security.h
	88	++++ linux-5.10.162/include/linux/security.h
89	89	@@ -59,6 +59,7 @@ struct fs_parameter;
90	90	enum fs_value_type;
91	91	struct watch;

		@@ -315,8 +315,8 @@
315	315	}
316	316	#endif /* CONFIG_SECURITY_PATH */
317	317
318		---- linux-5.10.161.orig/include/net/ip.h
319		-+++ linux-5.10.161/include/net/ip.h
	318	+--- linux-5.10.162.orig/include/net/ip.h
	319	++++ linux-5.10.162/include/net/ip.h
320	320	@@ -340,6 +340,8 @@ void inet_get_local_port_range(struct ne
321	321	#ifdef CONFIG_SYSCTL
322	322	static inline bool inet_is_local_reserved_port(struct net *net, unsigned short port)

		@@ -335,8 +335,8 @@
335	335	return false;
336	336	}
337	337
338		---- linux-5.10.161.orig/init/init_task.c
339		-+++ linux-5.10.161/init/init_task.c
	338	+--- linux-5.10.162.orig/init/init_task.c
	339	++++ linux-5.10.162/init/init_task.c
340	340	@@ -213,6 +213,10 @@ struct task_struct init_task
341	341	#ifdef CONFIG_SECCOMP_FILTER
342	342	.seccomp = { .filter_count = ATOMIC_INIT(0) },

		@@ -348,8 +348,8 @@
348	348	};
349	349	EXPORT_SYMBOL(init_task);
350	350
351		---- linux-5.10.161.orig/kernel/kexec.c
352		-+++ linux-5.10.161/kernel/kexec.c
	351	+--- linux-5.10.162.orig/kernel/kexec.c
	352	++++ linux-5.10.162/kernel/kexec.c
353	353	@@ -16,7 +16,7 @@
354	354	#include <linux/syscalls.h>
355	355	#include <linux/vmalloc.h>

		@@ -368,8 +368,8 @@
368	368
369	369	/* Permit LSMs and IMA to fail the kexec */
370	370	result = security_kernel_load_data(LOADING_KEXEC_IMAGE, false);
371		---- linux-5.10.161.orig/kernel/module.c
372		-+++ linux-5.10.161/kernel/module.c
	371	+--- linux-5.10.162.orig/kernel/module.c
	372	++++ linux-5.10.162/kernel/module.c
373	373	@@ -59,6 +59,7 @@
374	374	#include <linux/audit.h>
375	375	#include <uapi/linux/module.h>

		@@ -396,8 +396,8 @@
396	396
397	397	return 0;
398	398	}
399		---- linux-5.10.161.orig/kernel/ptrace.c
400		-+++ linux-5.10.161/kernel/ptrace.c
	399	+--- linux-5.10.162.orig/kernel/ptrace.c
	400	++++ linux-5.10.162/kernel/ptrace.c
401	401	@@ -1270,6 +1270,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
402	402	{
403	403	struct task_struct *child;

		@@ -422,8 +422,8 @@
422	422
423	423	if (request == PTRACE_TRACEME) {
424	424	ret = ptrace_traceme();
425		---- linux-5.10.161.orig/kernel/reboot.c
426		-+++ linux-5.10.161/kernel/reboot.c
	425	+--- linux-5.10.162.orig/kernel/reboot.c
	426	++++ linux-5.10.162/kernel/reboot.c
427	427	@@ -17,6 +17,7 @@
428	428	#include <linux/syscalls.h>
429	429	#include <linux/syscore_ops.h>

		@@ -441,8 +441,8 @@
441	441
442	442	/*
443	443	* If pid namespaces are enabled and the current task is in a child
444		---- linux-5.10.161.orig/kernel/sched/core.c
445		-+++ linux-5.10.161/kernel/sched/core.c
	444	+--- linux-5.10.162.orig/kernel/sched/core.c
	445	++++ linux-5.10.162/kernel/sched/core.c
446	446	@@ -5062,6 +5062,8 @@ int can_nice(const struct task_struct *p
447	447	SYSCALL_DEFINE1(nice, int, increment)
448	448	{

		@@ -452,9 +452,9 @@
452	452
453	453	/*
454	454	* Setpriority might change our priority at the same moment.
455		---- linux-5.10.161.orig/kernel/signal.c
456		-+++ linux-5.10.161/kernel/signal.c
457		-@@ -3648,6 +3648,8 @@ static inline void prepare_kill_siginfo(
	455	+--- linux-5.10.162.orig/kernel/signal.c
	456	++++ linux-5.10.162/kernel/signal.c
	457	+@@ -3651,6 +3651,8 @@ static inline void prepare_kill_siginfo(
458	458	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
459	459	{
460	460	struct kernel_siginfo info;

		@@ -463,7 +463,7 @@
463	463
464	464	prepare_kill_siginfo(sig, &info);
465	465
466		-@@ -3746,6 +3748,21 @@ SYSCALL_DEFINE4(pidfd_send_signal, int,
	466	+@@ -3749,6 +3751,21 @@ SYSCALL_DEFINE4(pidfd_send_signal, int,
467	467	if (!access_pidfd_pidns(pid))
468	468	goto err;
469	469

		@@ -485,7 +485,7 @@
485	485	if (info) {
486	486	ret = copy_siginfo_from_user_any(&kinfo, info);
487	487	if (unlikely(ret))
488		-@@ -3830,6 +3847,8 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
	488	+@@ -3833,6 +3850,8 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
489	489	/* This is only valid for single tasks */
490	490	if (pid <= 0 \|\| tgid <= 0)
491	491	return -EINVAL;

		@@ -494,7 +494,7 @@
494	494
495	495	return do_tkill(tgid, pid, sig);
496	496	}
497		-@@ -3846,6 +3865,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int,
	497	+@@ -3849,6 +3868,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int,
498	498	/* This is only valid for single tasks */
499	499	if (pid <= 0)
500	500	return -EINVAL;

		@@ -503,7 +503,7 @@
503	503
504	504	return do_tkill(0, pid, sig);
505	505	}
506		-@@ -3858,6 +3879,8 @@ static int do_rt_sigqueueinfo(pid_t pid,
	506	+@@ -3861,6 +3882,8 @@ static int do_rt_sigqueueinfo(pid_t pid,
507	507	if ((info->si_code >= 0 \|\| info->si_code == SI_TKILL) &&
508	508	(task_pid_vnr(current) != pid))
509	509	return -EPERM;

		@@ -512,7 +512,7 @@
512	512
513	513	/* POSIX.1b doesn't mention process groups. */
514	514	return kill_proc_info(sig, info, pid);
515		-@@ -3905,6 +3928,8 @@ static int do_rt_tgsigqueueinfo(pid_t tg
	515	+@@ -3908,6 +3931,8 @@ static int do_rt_tgsigqueueinfo(pid_t tg
516	516	if ((info->si_code >= 0 \|\| info->si_code == SI_TKILL) &&
517	517	(task_pid_vnr(current) != pid))
518	518	return -EPERM;

		@@ -521,8 +521,8 @@
521	521
522	522	return do_send_specific(tgid, pid, sig, info);
523	523	}
524		---- linux-5.10.161.orig/kernel/sys.c
525		-+++ linux-5.10.161/kernel/sys.c
	524	+--- linux-5.10.162.orig/kernel/sys.c
	525	++++ linux-5.10.162/kernel/sys.c
526	526	@@ -205,6 +205,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
527	527
528	528	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -552,8 +552,8 @@
552	552
553	553	errno = -EFAULT;
554	554	if (!copy_from_user(tmp, name, len)) {
555		---- linux-5.10.161.orig/kernel/time/timekeeping.c
556		-+++ linux-5.10.161/kernel/time/timekeeping.c
	555	+--- linux-5.10.162.orig/kernel/time/timekeeping.c
	556	++++ linux-5.10.162/kernel/time/timekeeping.c
557	557	@@ -24,6 +24,7 @@
558	558	#include <linux/compiler.h>
559	559	#include <linux/audit.h>

		@@ -587,8 +587,8 @@
587	587
588	588	/*
589	589	* Validate if a timespec/timeval used to inject a time
590		---- linux-5.10.161.orig/net/ipv4/raw.c
591		-+++ linux-5.10.161/net/ipv4/raw.c
	590	+--- linux-5.10.162.orig/net/ipv4/raw.c
	591	++++ linux-5.10.162/net/ipv4/raw.c
592	592	@@ -771,6 +771,10 @@ static int raw_recvmsg(struct sock *sk,
593	593	skb = skb_recv_datagram(sk, flags, noblock, &err);
594	594	if (!skb)

		@@ -600,8 +600,8 @@
600	600
601	601	copied = skb->len;
602	602	if (len < copied) {
603		---- linux-5.10.161.orig/net/ipv4/udp.c
604		-+++ linux-5.10.161/net/ipv4/udp.c
	603	+--- linux-5.10.162.orig/net/ipv4/udp.c
	604	++++ linux-5.10.162/net/ipv4/udp.c
605	605	@@ -1808,6 +1808,8 @@ try_again:
606	606	skb = __skb_recv_udp(sk, flags, noblock, &off, &err);
607	607	if (!skb)

		@@ -611,8 +611,8 @@
611	611
612	612	ulen = udp_skb_len(skb);
613	613	copied = len;
614		---- linux-5.10.161.orig/net/ipv6/raw.c
615		-+++ linux-5.10.161/net/ipv6/raw.c
	614	+--- linux-5.10.162.orig/net/ipv6/raw.c
	615	++++ linux-5.10.162/net/ipv6/raw.c
616	616	@@ -480,6 +480,10 @@ static int rawv6_recvmsg(struct sock *sk
617	617	skb = skb_recv_datagram(sk, flags, noblock, &err);
618	618	if (!skb)

		@@ -624,8 +624,8 @@
624	624
625	625	copied = skb->len;
626	626	if (copied > len) {
627		---- linux-5.10.161.orig/net/ipv6/udp.c
628		-+++ linux-5.10.161/net/ipv6/udp.c
	627	+--- linux-5.10.162.orig/net/ipv6/udp.c
	628	++++ linux-5.10.162/net/ipv6/udp.c
629	629	@@ -344,6 +344,8 @@ try_again:
630	630	skb = __skb_recv_udp(sk, flags, noblock, &off, &err);
631	631	if (!skb)

		@@ -635,9 +635,9 @@
635	635
636	636	ulen = udp6_skb_len(skb);
637	637	copied = len;
638		---- linux-5.10.161.orig/net/socket.c
639		-+++ linux-5.10.161/net/socket.c
640		-@@ -1744,6 +1744,10 @@ int __sys_accept4_file(struct file *file
	638	+--- linux-5.10.162.orig/net/socket.c
	639	++++ linux-5.10.162/net/socket.c
	640	+@@ -1727,6 +1727,10 @@ struct file do_accept(struct file file
641	641	if (err < 0)
642	642	goto out_fd;
643	643

		@@ -648,8 +648,8 @@
648	648	if (upeer_sockaddr) {
649	649	len = newsock->ops->getname(newsock,
650	650	(struct sockaddr *)&address, 2);
651		---- linux-5.10.161.orig/net/unix/af_unix.c
652		-+++ linux-5.10.161/net/unix/af_unix.c
	651	+--- linux-5.10.162.orig/net/unix/af_unix.c
	652	++++ linux-5.10.162/net/unix/af_unix.c
653	653	@@ -2197,6 +2197,10 @@ static int unix_dgram_recvmsg(struct soc
654	654	EPOLLOUT \| EPOLLWRNORM \|
655	655	EPOLLWRBAND);

		@@ -669,8 +669,8 @@
669	669	mutex_unlock(&u->iolock);
670	670	out:
671	671	return err;
672		---- linux-5.10.161.orig/security/Kconfig
673		-+++ linux-5.10.161/security/Kconfig
	672	+--- linux-5.10.162.orig/security/Kconfig
	673	++++ linux-5.10.162/security/Kconfig
674	674	@@ -283,5 +283,7 @@ config LSM
675	675
676	676	source "security/Kconfig.hardening"

		@@ -679,8 +679,8 @@
679	679	+
680	680	endmenu
681	681
682		---- linux-5.10.161.orig/security/Makefile
683		-+++ linux-5.10.161/security/Makefile
	682	+--- linux-5.10.162.orig/security/Makefile
	683	++++ linux-5.10.162/security/Makefile
684	684	@@ -36,3 +36,6 @@ obj-$(CONFIG_BPF_LSM) += bpf/
685	685	# Object integrity file lists
686	686	subdir-$(CONFIG_INTEGRITY) += integrity

		@@ -688,8 +688,8 @@
688	688	+
689	689	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
690	690	+obj-$(CONFIG_CCSECURITY) += ccsecurity/
691		---- linux-5.10.161.orig/security/security.c
692		-+++ linux-5.10.161/security/security.c
	691	+--- linux-5.10.162.orig/security/security.c
	692	++++ linux-5.10.162/security/security.c
693	693	@@ -1601,7 +1601,9 @@ int security_task_alloc(struct task_stru
694	694
695	695	if (rc)

--- trunk/1.8.x/ccs-patch/patches/ccs-patch-5.15.diff (revision 6929)

+++ trunk/1.8.x/ccs-patch/patches/ccs-patch-5.15.diff (revision 6930)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 5.15.85.
	1	+This is TOMOYO Linux patch for kernel 5.15.87.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v5.x/linux-5.15.85.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v5.x/linux-5.15.87.tar.xz
4	4	---
5	5	fs/exec.c \| 2 -
6	6	fs/open.c \| 2 +

		@@ -28,8 +28,8 @@
28	28	security/security.c \| 5 ++-
29	29	24 files changed, 160 insertions(+), 30 deletions(-)
30	30
31		---- linux-5.15.85.orig/fs/exec.c
32		-+++ linux-5.15.85/fs/exec.c
	31	+--- linux-5.15.87.orig/fs/exec.c
	32	++++ linux-5.15.87/fs/exec.c
33	33	@@ -1841,7 +1841,7 @@ static int bprm_execve(struct linux_binp
34	34	if (retval)
35	35	goto out;

		@@ -39,8 +39,8 @@
39	39	if (retval < 0)
40	40	goto out;
41	41
42		---- linux-5.15.85.orig/fs/open.c
43		-+++ linux-5.15.85/fs/open.c
	42	+--- linux-5.15.87.orig/fs/open.c
	43	++++ linux-5.15.87/fs/open.c
44	44	@@ -1370,6 +1370,8 @@ SYSCALL_DEFINE3(close_range, unsigned in
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-5.15.85.orig/fs/proc/version.c
54		-+++ linux-5.15.85/fs/proc/version.c
	53	+--- linux-5.15.87.orig/fs/proc/version.c
	54	++++ linux-5.15.87/fs/proc/version.c
55	55	@@ -21,3 +21,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 5.15.85 2022/12/29\n");
	62	++ printk(KERN_INFO "Hook version: 5.15.87 2023/01/14\n");
63	63	+ return 0;
64	64	+}
65	65	+fs_initcall(ccs_show_version);
66		---- linux-5.15.85.orig/include/linux/sched.h
67		-+++ linux-5.15.85/include/linux/sched.h
	66	+--- linux-5.15.87.orig/include/linux/sched.h
	67	++++ linux-5.15.87/include/linux/sched.h
68	68	@@ -44,6 +44,7 @@ struct blk_plug;
69	69	struct bpf_local_storage;
70	70	struct bpf_run_ctx;

		@@ -84,8 +84,8 @@
84	84
85	85	#ifdef CONFIG_TRACING
86	86	/* State flags for use by tracers: */
87		---- linux-5.15.85.orig/include/linux/security.h
88		-+++ linux-5.15.85/include/linux/security.h
	87	+--- linux-5.15.87.orig/include/linux/security.h
	88	++++ linux-5.15.87/include/linux/security.h
89	89	@@ -59,6 +59,7 @@ struct fs_parameter;
90	90	enum fs_value_type;
91	91	struct watch;

		@@ -315,8 +315,8 @@
315	315	}
316	316	#endif /* CONFIG_SECURITY_PATH */
317	317
318		---- linux-5.15.85.orig/include/net/ip.h
319		-+++ linux-5.15.85/include/net/ip.h
	318	+--- linux-5.15.87.orig/include/net/ip.h
	319	++++ linux-5.15.87/include/net/ip.h
320	320	@@ -340,6 +340,8 @@ void inet_get_local_port_range(struct ne
321	321	#ifdef CONFIG_SYSCTL
322	322	static inline bool inet_is_local_reserved_port(struct net *net, unsigned short port)

		@@ -335,8 +335,8 @@
335	335	return false;
336	336	}
337	337
338		---- linux-5.15.85.orig/init/init_task.c
339		-+++ linux-5.15.85/init/init_task.c
	338	+--- linux-5.15.87.orig/init/init_task.c
	339	++++ linux-5.15.87/init/init_task.c
340	340	@@ -214,6 +214,10 @@ struct task_struct init_task
341	341	#ifdef CONFIG_SECCOMP_FILTER
342	342	.seccomp = { .filter_count = ATOMIC_INIT(0) },

		@@ -348,8 +348,8 @@
348	348	};
349	349	EXPORT_SYMBOL(init_task);
350	350
351		---- linux-5.15.85.orig/kernel/kexec.c
352		-+++ linux-5.15.85/kernel/kexec.c
	351	+--- linux-5.15.87.orig/kernel/kexec.c
	352	++++ linux-5.15.87/kernel/kexec.c
353	353	@@ -16,7 +16,7 @@
354	354	#include <linux/syscalls.h>
355	355	#include <linux/vmalloc.h>

		@@ -368,8 +368,8 @@
368	368
369	369	/* Permit LSMs and IMA to fail the kexec */
370	370	result = security_kernel_load_data(LOADING_KEXEC_IMAGE, false);
371		---- linux-5.15.85.orig/kernel/module.c
372		-+++ linux-5.15.85/kernel/module.c
	371	+--- linux-5.15.87.orig/kernel/module.c
	372	++++ linux-5.15.87/kernel/module.c
373	373	@@ -59,6 +59,7 @@
374	374	#include <linux/audit.h>
375	375	#include <uapi/linux/module.h>

		@@ -396,8 +396,8 @@
396	396
397	397	return 0;
398	398	}
399		---- linux-5.15.85.orig/kernel/ptrace.c
400		-+++ linux-5.15.85/kernel/ptrace.c
	399	+--- linux-5.15.87.orig/kernel/ptrace.c
	400	++++ linux-5.15.87/kernel/ptrace.c
401	401	@@ -1295,6 +1295,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
402	402	{
403	403	struct task_struct *child;

		@@ -422,8 +422,8 @@
422	422
423	423	if (request == PTRACE_TRACEME) {
424	424	ret = ptrace_traceme();
425		---- linux-5.15.85.orig/kernel/reboot.c
426		-+++ linux-5.15.85/kernel/reboot.c
	425	+--- linux-5.15.87.orig/kernel/reboot.c
	426	++++ linux-5.15.87/kernel/reboot.c
427	427	@@ -18,6 +18,7 @@
428	428	#include <linux/syscalls.h>
429	429	#include <linux/syscore_ops.h>

		@@ -441,8 +441,8 @@
441	441
442	442	/*
443	443	* If pid namespaces are enabled and the current task is in a child
444		---- linux-5.15.85.orig/kernel/sched/core.c
445		-+++ linux-5.15.85/kernel/sched/core.c
	444	+--- linux-5.15.87.orig/kernel/sched/core.c
	445	++++ linux-5.15.87/kernel/sched/core.c
446	446	@@ -7002,6 +7002,8 @@ int can_nice(const struct task_struct *p
447	447	SYSCALL_DEFINE1(nice, int, increment)
448	448	{

		@@ -452,8 +452,8 @@
452	452
453	453	/*
454	454	* Setpriority might change our priority at the same moment.
455		---- linux-5.15.85.orig/kernel/signal.c
456		-+++ linux-5.15.85/kernel/signal.c
	455	+--- linux-5.15.87.orig/kernel/signal.c
	456	++++ linux-5.15.87/kernel/signal.c
457	457	@@ -3800,6 +3800,8 @@ static inline void prepare_kill_siginfo(
458	458	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
459	459	{

		@@ -521,8 +521,8 @@
521	521
522	522	return do_send_specific(tgid, pid, sig, info);
523	523	}
524		---- linux-5.15.85.orig/kernel/sys.c
525		-+++ linux-5.15.85/kernel/sys.c
	524	+--- linux-5.15.87.orig/kernel/sys.c
	525	++++ linux-5.15.87/kernel/sys.c
526	526	@@ -211,6 +211,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
527	527
528	528	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -552,8 +552,8 @@
552	552
553	553	errno = -EFAULT;
554	554	if (!copy_from_user(tmp, name, len)) {
555		---- linux-5.15.85.orig/kernel/time/timekeeping.c
556		-+++ linux-5.15.85/kernel/time/timekeeping.c
	555	+--- linux-5.15.87.orig/kernel/time/timekeeping.c
	556	++++ linux-5.15.87/kernel/time/timekeeping.c
557	557	@@ -24,6 +24,7 @@
558	558	#include <linux/compiler.h>
559	559	#include <linux/audit.h>

		@@ -587,8 +587,8 @@
587	587
588	588	/*
589	589	* Validate if a timespec/timeval used to inject a time
590		---- linux-5.15.85.orig/net/ipv4/raw.c
591		-+++ linux-5.15.85/net/ipv4/raw.c
	590	+--- linux-5.15.87.orig/net/ipv4/raw.c
	591	++++ linux-5.15.87/net/ipv4/raw.c
592	592	@@ -771,6 +771,10 @@ static int raw_recvmsg(struct sock *sk,
593	593	skb = skb_recv_datagram(sk, flags, noblock, &err);
594	594	if (!skb)

		@@ -600,8 +600,8 @@
600	600
601	601	copied = skb->len;
602	602	if (len < copied) {
603		---- linux-5.15.85.orig/net/ipv4/udp.c
604		-+++ linux-5.15.85/net/ipv4/udp.c
	603	+--- linux-5.15.87.orig/net/ipv4/udp.c
	604	++++ linux-5.15.87/net/ipv4/udp.c
605	605	@@ -1864,6 +1864,8 @@ try_again:
606	606	skb = __skb_recv_udp(sk, flags, noblock, &off, &err);
607	607	if (!skb)

		@@ -611,8 +611,8 @@
611	611
612	612	ulen = udp_skb_len(skb);
613	613	copied = len;
614		---- linux-5.15.85.orig/net/ipv6/raw.c
615		-+++ linux-5.15.85/net/ipv6/raw.c
	614	+--- linux-5.15.87.orig/net/ipv6/raw.c
	615	++++ linux-5.15.87/net/ipv6/raw.c
616	616	@@ -480,6 +480,10 @@ static int rawv6_recvmsg(struct sock *sk
617	617	skb = skb_recv_datagram(sk, flags, noblock, &err);
618	618	if (!skb)

		@@ -624,8 +624,8 @@
624	624
625	625	copied = skb->len;
626	626	if (copied > len) {
627		---- linux-5.15.85.orig/net/ipv6/udp.c
628		-+++ linux-5.15.85/net/ipv6/udp.c
	627	+--- linux-5.15.87.orig/net/ipv6/udp.c
	628	++++ linux-5.15.87/net/ipv6/udp.c
629	629	@@ -344,6 +344,8 @@ try_again:
630	630	skb = __skb_recv_udp(sk, flags, noblock, &off, &err);
631	631	if (!skb)

		@@ -635,8 +635,8 @@
635	635
636	636	ulen = udp6_skb_len(skb);
637	637	copied = len;
638		---- linux-5.15.85.orig/net/socket.c
639		-+++ linux-5.15.85/net/socket.c
	638	+--- linux-5.15.87.orig/net/socket.c
	639	++++ linux-5.15.87/net/socket.c
640	640	@@ -1778,6 +1778,10 @@ struct file do_accept(struct file file
641	641	if (err < 0)
642	642	goto out_fd;

		@@ -648,9 +648,9 @@
648	648	if (upeer_sockaddr) {
649	649	len = newsock->ops->getname(newsock,
650	650	(struct sockaddr *)&address, 2);
651		---- linux-5.15.85.orig/net/unix/af_unix.c
652		-+++ linux-5.15.85/net/unix/af_unix.c
653		-@@ -2332,6 +2332,10 @@ int __unix_dgram_recvmsg(struct sock *sk
	651	+--- linux-5.15.87.orig/net/unix/af_unix.c
	652	++++ linux-5.15.87/net/unix/af_unix.c
	653	+@@ -2339,6 +2339,10 @@ int __unix_dgram_recvmsg(struct sock *sk
654	654	EPOLLOUT \| EPOLLWRNORM \|
655	655	EPOLLWRBAND);
656	656

		@@ -661,7 +661,7 @@
661	661	if (msg->msg_name)
662	662	unix_copy_addr(msg, skb->sk);
663	663
664		-@@ -2382,6 +2386,7 @@ int __unix_dgram_recvmsg(struct sock *sk
	664	+@@ -2389,6 +2393,7 @@ int __unix_dgram_recvmsg(struct sock *sk
665	665
666	666	out_free:
667	667	skb_free_datagram(sk, skb);

		@@ -669,8 +669,8 @@
669	669	mutex_unlock(&u->iolock);
670	670	out:
671	671	return err;
672		---- linux-5.15.85.orig/security/Kconfig
673		-+++ linux-5.15.85/security/Kconfig
	672	+--- linux-5.15.87.orig/security/Kconfig
	673	++++ linux-5.15.87/security/Kconfig
674	674	@@ -284,5 +284,7 @@ config LSM
675	675
676	676	source "security/Kconfig.hardening"

		@@ -679,8 +679,8 @@
679	679	+
680	680	endmenu
681	681
682		---- linux-5.15.85.orig/security/Makefile
683		-+++ linux-5.15.85/security/Makefile
	682	+--- linux-5.15.87.orig/security/Makefile
	683	++++ linux-5.15.87/security/Makefile
684	684	@@ -27,3 +27,6 @@ obj-$(CONFIG_SECURITY_LANDLOCK) += land
685	685
686	686	# Object integrity file lists

		@@ -688,8 +688,8 @@
688	688	+
689	689	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
690	690	+obj-$(CONFIG_CCSECURITY) += ccsecurity/
691		---- linux-5.15.85.orig/security/security.c
692		-+++ linux-5.15.85/security/security.c
	691	+--- linux-5.15.87.orig/security/security.c
	692	++++ linux-5.15.87/security/security.c
693	693	@@ -1659,7 +1659,9 @@ int security_task_alloc(struct task_stru
694	694
695	695	if (rc)

--- trunk/1.8.x/ccs-patch/patches/ccs-patch-6.0.diff (revision 6929)

+++ trunk/1.8.x/ccs-patch/patches/ccs-patch-6.0.diff (revision 6930)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 6.0.15.
	1	+This is TOMOYO Linux patch for kernel 6.0.19.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.0.15.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.0.19.tar.xz
4	4	---
5	5	fs/exec.c \| 2 -
6	6	fs/open.c \| 2 +

		@@ -28,8 +28,8 @@
28	28	security/security.c \| 5 +++
29	29	24 files changed, 150 insertions(+), 30 deletions(-)
30	30
31		---- linux-6.0.15.orig/fs/exec.c
32		-+++ linux-6.0.15/fs/exec.c
	31	+--- linux-6.0.19.orig/fs/exec.c
	32	++++ linux-6.0.19/fs/exec.c
33	33	@@ -1834,7 +1834,7 @@ static int bprm_execve(struct linux_binp
34	34	if (retval)
35	35	goto out;

		@@ -39,8 +39,8 @@
39	39	if (retval < 0)
40	40	goto out;
41	41
42		---- linux-6.0.15.orig/fs/open.c
43		-+++ linux-6.0.15/fs/open.c
	42	+--- linux-6.0.19.orig/fs/open.c
	43	++++ linux-6.0.19/fs/open.c
44	44	@@ -1471,6 +1471,8 @@ SYSCALL_DEFINE3(close_range, unsigned in
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-6.0.15.orig/fs/proc/version.c
54		-+++ linux-6.0.15/fs/proc/version.c
	53	+--- linux-6.0.19.orig/fs/proc/version.c
	54	++++ linux-6.0.19/fs/proc/version.c
55	55	@@ -21,3 +21,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 6.0.15 2022/12/29\n");
	62	++ printk(KERN_INFO "Hook version: 6.0.19 2023/01/14\n");
63	63	+ return 0;
64	64	+}
65	65	+fs_initcall(ccs_show_version);
66		---- linux-6.0.15.orig/include/linux/sched.h
67		-+++ linux-6.0.15/include/linux/sched.h
	66	+--- linux-6.0.19.orig/include/linux/sched.h
	67	++++ linux-6.0.19/include/linux/sched.h
68	68	@@ -45,6 +45,7 @@ struct blk_plug;
69	69	struct bpf_local_storage;
70	70	struct bpf_run_ctx;

		@@ -84,8 +84,8 @@
84	84
85	85	#ifdef CONFIG_TRACING
86	86	/* State flags for use by tracers: */
87		---- linux-6.0.15.orig/include/linux/security.h
88		-+++ linux-6.0.15/include/linux/security.h
	87	+--- linux-6.0.19.orig/include/linux/security.h
	88	++++ linux-6.0.19/include/linux/security.h
89	89	@@ -59,6 +59,7 @@ struct fs_parameter;
90	90	enum fs_value_type;
91	91	struct watch;

		@@ -305,8 +305,8 @@
305	305	}
306	306	#endif /* CONFIG_SECURITY_PATH */
307	307
308		---- linux-6.0.15.orig/include/net/ip.h
309		-+++ linux-6.0.15/include/net/ip.h
	308	+--- linux-6.0.19.orig/include/net/ip.h
	309	++++ linux-6.0.19/include/net/ip.h
310	310	@@ -345,6 +345,8 @@ void inet_get_local_port_range(struct ne
311	311	#ifdef CONFIG_SYSCTL
312	312	static inline bool inet_is_local_reserved_port(struct net *net, unsigned short port)

		@@ -325,8 +325,8 @@
325	325	return false;
326	326	}
327	327
328		---- linux-6.0.15.orig/init/init_task.c
329		-+++ linux-6.0.15/init/init_task.c
	328	+--- linux-6.0.19.orig/init/init_task.c
	329	++++ linux-6.0.19/init/init_task.c
330	330	@@ -210,6 +210,10 @@ struct task_struct init_task
331	331	#ifdef CONFIG_SECCOMP_FILTER
332	332	.seccomp = { .filter_count = ATOMIC_INIT(0) },

		@@ -338,8 +338,8 @@
338	338	};
339	339	EXPORT_SYMBOL(init_task);
340	340
341		---- linux-6.0.15.orig/kernel/kexec.c
342		-+++ linux-6.0.15/kernel/kexec.c
	341	+--- linux-6.0.19.orig/kernel/kexec.c
	342	++++ linux-6.0.19/kernel/kexec.c
343	343	@@ -16,7 +16,7 @@
344	344	#include <linux/syscalls.h>
345	345	#include <linux/vmalloc.h>

		@@ -358,8 +358,8 @@
358	358
359	359	/* Permit LSMs and IMA to fail the kexec */
360	360	result = security_kernel_load_data(LOADING_KEXEC_IMAGE, false);
361		---- linux-6.0.15.orig/kernel/module/main.c
362		-+++ linux-6.0.15/kernel/module/main.c
	361	+--- linux-6.0.19.orig/kernel/module/main.c
	362	++++ linux-6.0.19/kernel/module/main.c
363	363	@@ -58,6 +58,7 @@
364	364
365	365	#define CREATE_TRACE_POINTS

		@@ -386,8 +386,8 @@
386	386
387	387	return 0;
388	388	}
389		---- linux-6.0.15.orig/kernel/ptrace.c
390		-+++ linux-6.0.15/kernel/ptrace.c
	389	+--- linux-6.0.19.orig/kernel/ptrace.c
	390	++++ linux-6.0.19/kernel/ptrace.c
391	391	@@ -1271,6 +1271,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
392	392	{
393	393	struct task_struct *child;

		@@ -412,8 +412,8 @@
412	412
413	413	if (request == PTRACE_TRACEME) {
414	414	ret = ptrace_traceme();
415		---- linux-6.0.15.orig/kernel/reboot.c
416		-+++ linux-6.0.15/kernel/reboot.c
	415	+--- linux-6.0.19.orig/kernel/reboot.c
	416	++++ linux-6.0.19/kernel/reboot.c
417	417	@@ -18,6 +18,7 @@
418	418	#include <linux/syscalls.h>
419	419	#include <linux/syscore_ops.h>

		@@ -431,8 +431,8 @@
431	431
432	432	/*
433	433	* If pid namespaces are enabled and the current task is in a child
434		---- linux-6.0.15.orig/kernel/sched/core.c
435		-+++ linux-6.0.15/kernel/sched/core.c
	434	+--- linux-6.0.19.orig/kernel/sched/core.c
	435	++++ linux-6.0.19/kernel/sched/core.c
436	436	@@ -7075,6 +7075,8 @@ int can_nice(const struct task_struct *p
437	437	SYSCALL_DEFINE1(nice, int, increment)
438	438	{

		@@ -442,8 +442,8 @@
442	442
443	443	/*
444	444	* Setpriority might change our priority at the same moment.
445		---- linux-6.0.15.orig/kernel/signal.c
446		-+++ linux-6.0.15/kernel/signal.c
	445	+--- linux-6.0.19.orig/kernel/signal.c
	446	++++ linux-6.0.19/kernel/signal.c
447	447	@@ -3770,6 +3770,8 @@ static inline void prepare_kill_siginfo(
448	448	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
449	449	{

		@@ -511,8 +511,8 @@
511	511
512	512	return do_send_specific(tgid, pid, sig, info);
513	513	}
514		---- linux-6.0.15.orig/kernel/sys.c
515		-+++ linux-6.0.15/kernel/sys.c
	514	+--- linux-6.0.19.orig/kernel/sys.c
	515	++++ linux-6.0.19/kernel/sys.c
516	516	@@ -218,6 +218,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
517	517
518	518	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -542,8 +542,8 @@
542	542
543	543	errno = -EFAULT;
544	544	if (!copy_from_user(tmp, name, len)) {
545		---- linux-6.0.15.orig/kernel/time/timekeeping.c
546		-+++ linux-6.0.15/kernel/time/timekeeping.c
	545	+--- linux-6.0.19.orig/kernel/time/timekeeping.c
	546	++++ linux-6.0.19/kernel/time/timekeeping.c
547	547	@@ -24,6 +24,7 @@
548	548	#include <linux/compiler.h>
549	549	#include <linux/audit.h>

		@@ -577,8 +577,8 @@
577	577
578	578	/*
579	579	* Validate if a timespec/timeval used to inject a time
580		---- linux-6.0.15.orig/net/ipv4/raw.c
581		-+++ linux-6.0.15/net/ipv4/raw.c
	580	+--- linux-6.0.19.orig/net/ipv4/raw.c
	581	++++ linux-6.0.19/net/ipv4/raw.c
582	582	@@ -744,6 +744,10 @@ static int raw_recvmsg(struct sock *sk,
583	583	skb = skb_recv_datagram(sk, flags, &err);
584	584	if (!skb)

		@@ -590,8 +590,8 @@
590	590
591	591	copied = skb->len;
592	592	if (len < copied) {
593		---- linux-6.0.15.orig/net/ipv4/udp.c
594		-+++ linux-6.0.15/net/ipv4/udp.c
	593	+--- linux-6.0.19.orig/net/ipv4/udp.c
	594	++++ linux-6.0.19/net/ipv4/udp.c
595	595	@@ -1865,6 +1865,8 @@ try_again:
596	596	skb = __skb_recv_udp(sk, flags, &off, &err);
597	597	if (!skb)

		@@ -601,8 +601,8 @@
601	601
602	602	ulen = udp_skb_len(skb);
603	603	copied = len;
604		---- linux-6.0.15.orig/net/ipv6/raw.c
605		-+++ linux-6.0.15/net/ipv6/raw.c
	604	+--- linux-6.0.19.orig/net/ipv6/raw.c
	605	++++ linux-6.0.19/net/ipv6/raw.c
606	606	@@ -446,6 +446,10 @@ static int rawv6_recvmsg(struct sock *sk
607	607	skb = skb_recv_datagram(sk, flags, &err);
608	608	if (!skb)

		@@ -614,8 +614,8 @@
614	614
615	615	copied = skb->len;
616	616	if (copied > len) {
617		---- linux-6.0.15.orig/net/ipv6/udp.c
618		-+++ linux-6.0.15/net/ipv6/udp.c
	617	+--- linux-6.0.19.orig/net/ipv6/udp.c
	618	++++ linux-6.0.19/net/ipv6/udp.c
619	619	@@ -346,6 +346,8 @@ try_again:
620	620	skb = __skb_recv_udp(sk, flags, &off, &err);
621	621	if (!skb)

		@@ -625,8 +625,8 @@
625	625
626	626	ulen = udp6_skb_len(skb);
627	627	copied = len;
628		---- linux-6.0.15.orig/net/socket.c
629		-+++ linux-6.0.15/net/socket.c
	628	+--- linux-6.0.19.orig/net/socket.c
	629	++++ linux-6.0.19/net/socket.c
630	630	@@ -1858,6 +1858,10 @@ struct file do_accept(struct file file
631	631	if (err < 0)
632	632	goto out_fd;

		@@ -638,9 +638,9 @@
638	638	if (upeer_sockaddr) {
639	639	len = newsock->ops->getname(newsock,
640	640	(struct sockaddr *)&address, 2);
641		---- linux-6.0.15.orig/net/unix/af_unix.c
642		-+++ linux-6.0.15/net/unix/af_unix.c
643		-@@ -2436,6 +2436,10 @@ int __unix_dgram_recvmsg(struct sock *sk
	641	+--- linux-6.0.19.orig/net/unix/af_unix.c
	642	++++ linux-6.0.19/net/unix/af_unix.c
	643	+@@ -2443,6 +2443,10 @@ int __unix_dgram_recvmsg(struct sock *sk
644	644	EPOLLOUT \| EPOLLWRNORM \|
645	645	EPOLLWRBAND);
646	646

		@@ -651,7 +651,7 @@
651	651	if (msg->msg_name)
652	652	unix_copy_addr(msg, skb->sk);
653	653
654		-@@ -2486,6 +2490,7 @@ int __unix_dgram_recvmsg(struct sock *sk
	654	+@@ -2493,6 +2497,7 @@ int __unix_dgram_recvmsg(struct sock *sk
655	655
656	656	out_free:
657	657	skb_free_datagram(sk, skb);

		@@ -659,8 +659,8 @@
659	659	mutex_unlock(&u->iolock);
660	660	out:
661	661	return err;
662		---- linux-6.0.15.orig/security/Kconfig
663		-+++ linux-6.0.15/security/Kconfig
	662	+--- linux-6.0.19.orig/security/Kconfig
	663	++++ linux-6.0.19/security/Kconfig
664	664	@@ -260,5 +260,7 @@ config LSM
665	665
666	666	source "security/Kconfig.hardening"

		@@ -669,8 +669,8 @@
669	669	+
670	670	endmenu
671	671
672		---- linux-6.0.15.orig/security/Makefile
673		-+++ linux-6.0.15/security/Makefile
	672	+--- linux-6.0.19.orig/security/Makefile
	673	++++ linux-6.0.19/security/Makefile
674	674	@@ -27,3 +27,6 @@ obj-$(CONFIG_SECURITY_LANDLOCK) += land
675	675
676	676	# Object integrity file lists

		@@ -678,8 +678,8 @@
678	678	+
679	679	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
680	680	+obj-$(CONFIG_CCSECURITY) += ccsecurity/
681		---- linux-6.0.15.orig/security/security.c
682		-+++ linux-6.0.15/security/security.c
	681	+--- linux-6.0.19.orig/security/security.c
	682	++++ linux-6.0.19/security/security.c
683	683	@@ -1656,7 +1656,9 @@ int security_task_alloc(struct task_stru
684	684
685	685	if (rc)

--- trunk/1.8.x/ccs-patch/patches/ccs-patch-6.1.diff (revision 6929)

+++ trunk/1.8.x/ccs-patch/patches/ccs-patch-6.1.diff (revision 6930)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 6.1.1.
	1	+This is TOMOYO Linux patch for kernel 6.1.5.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.1.1.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.1.5.tar.xz
4	4	---
5	5	fs/exec.c \| 2 -
6	6	fs/open.c \| 2 +

		@@ -28,8 +28,8 @@
28	28	security/security.c \| 5 +++
29	29	24 files changed, 150 insertions(+), 30 deletions(-)
30	30
31		---- linux-6.1.1.orig/fs/exec.c
32		-+++ linux-6.1.1/fs/exec.c
	31	+--- linux-6.1.5.orig/fs/exec.c
	32	++++ linux-6.1.5/fs/exec.c
33	33	@@ -1834,7 +1834,7 @@ static int bprm_execve(struct linux_binp
34	34	if (retval)
35	35	goto out;

		@@ -39,8 +39,8 @@
39	39	if (retval < 0)
40	40	goto out;
41	41
42		---- linux-6.1.1.orig/fs/open.c
43		-+++ linux-6.1.1/fs/open.c
	42	+--- linux-6.1.5.orig/fs/open.c
	43	++++ linux-6.1.5/fs/open.c
44	44	@@ -1471,6 +1471,8 @@ SYSCALL_DEFINE3(close_range, unsigned in
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-6.1.1.orig/fs/proc/version.c
54		-+++ linux-6.1.1/fs/proc/version.c
	53	+--- linux-6.1.5.orig/fs/proc/version.c
	54	++++ linux-6.1.5/fs/proc/version.c
55	55	@@ -25,3 +25,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 6.1.1 2022/12/29\n");
	62	++ printk(KERN_INFO "Hook version: 6.1.5 2023/01/14\n");
63	63	+ return 0;
64	64	+}
65	65	+fs_initcall(ccs_show_version);
66		---- linux-6.1.1.orig/include/linux/sched.h
67		-+++ linux-6.1.1/include/linux/sched.h
	66	+--- linux-6.1.5.orig/include/linux/sched.h
	67	++++ linux-6.1.5/include/linux/sched.h
68	68	@@ -46,6 +46,7 @@ struct blk_plug;
69	69	struct bpf_local_storage;
70	70	struct bpf_run_ctx;

		@@ -84,8 +84,8 @@
84	84
85	85	#ifdef CONFIG_TRACING
86	86	/* Bitmask and counter of trace recursion: */
87		---- linux-6.1.1.orig/include/linux/security.h
88		-+++ linux-6.1.1/include/linux/security.h
	87	+--- linux-6.1.5.orig/include/linux/security.h
	88	++++ linux-6.1.5/include/linux/security.h
89	89	@@ -59,6 +59,7 @@ struct fs_parameter;
90	90	enum fs_value_type;
91	91	struct watch;

		@@ -305,8 +305,8 @@
305	305	}
306	306	#endif /* CONFIG_SECURITY_PATH */
307	307
308		---- linux-6.1.1.orig/include/net/ip.h
309		-+++ linux-6.1.1/include/net/ip.h
	308	+--- linux-6.1.5.orig/include/net/ip.h
	309	++++ linux-6.1.5/include/net/ip.h
310	310	@@ -345,6 +345,8 @@ void inet_get_local_port_range(struct ne
311	311	#ifdef CONFIG_SYSCTL
312	312	static inline bool inet_is_local_reserved_port(struct net *net, unsigned short port)

		@@ -325,8 +325,8 @@
325	325	return false;
326	326	}
327	327
328		---- linux-6.1.1.orig/init/init_task.c
329		-+++ linux-6.1.1/init/init_task.c
	328	+--- linux-6.1.5.orig/init/init_task.c
	329	++++ linux-6.1.5/init/init_task.c
330	330	@@ -210,6 +210,10 @@ struct task_struct init_task
331	331	#ifdef CONFIG_SECCOMP_FILTER
332	332	.seccomp = { .filter_count = ATOMIC_INIT(0) },

		@@ -338,8 +338,8 @@
338	338	};
339	339	EXPORT_SYMBOL(init_task);
340	340
341		---- linux-6.1.1.orig/kernel/kexec.c
342		-+++ linux-6.1.1/kernel/kexec.c
	341	+--- linux-6.1.5.orig/kernel/kexec.c
	342	++++ linux-6.1.5/kernel/kexec.c
343	343	@@ -16,7 +16,7 @@
344	344	#include <linux/syscalls.h>
345	345	#include <linux/vmalloc.h>

		@@ -358,8 +358,8 @@
358	358
359	359	/* Permit LSMs and IMA to fail the kexec */
360	360	result = security_kernel_load_data(LOADING_KEXEC_IMAGE, false);
361		---- linux-6.1.1.orig/kernel/module/main.c
362		-+++ linux-6.1.1/kernel/module/main.c
	361	+--- linux-6.1.5.orig/kernel/module/main.c
	362	++++ linux-6.1.5/kernel/module/main.c
363	363	@@ -59,6 +59,7 @@
364	364
365	365	#define CREATE_TRACE_POINTS

		@@ -386,8 +386,8 @@
386	386
387	387	return 0;
388	388	}
389		---- linux-6.1.1.orig/kernel/ptrace.c
390		-+++ linux-6.1.1/kernel/ptrace.c
	389	+--- linux-6.1.5.orig/kernel/ptrace.c
	390	++++ linux-6.1.5/kernel/ptrace.c
391	391	@@ -1271,6 +1271,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
392	392	{
393	393	struct task_struct *child;

		@@ -412,8 +412,8 @@
412	412
413	413	if (request == PTRACE_TRACEME) {
414	414	ret = ptrace_traceme();
415		---- linux-6.1.1.orig/kernel/reboot.c
416		-+++ linux-6.1.1/kernel/reboot.c
	415	+--- linux-6.1.5.orig/kernel/reboot.c
	416	++++ linux-6.1.5/kernel/reboot.c
417	417	@@ -18,6 +18,7 @@
418	418	#include <linux/syscalls.h>
419	419	#include <linux/syscore_ops.h>

		@@ -431,8 +431,8 @@
431	431
432	432	/*
433	433	* If pid namespaces are enabled and the current task is in a child
434		---- linux-6.1.1.orig/kernel/sched/core.c
435		-+++ linux-6.1.1/kernel/sched/core.c
	434	+--- linux-6.1.5.orig/kernel/sched/core.c
	435	++++ linux-6.1.5/kernel/sched/core.c
436	436	@@ -7102,6 +7102,8 @@ int can_nice(const struct task_struct *p
437	437	SYSCALL_DEFINE1(nice, int, increment)
438	438	{

		@@ -442,8 +442,8 @@
442	442
443	443	/*
444	444	* Setpriority might change our priority at the same moment.
445		---- linux-6.1.1.orig/kernel/signal.c
446		-+++ linux-6.1.1/kernel/signal.c
	445	+--- linux-6.1.5.orig/kernel/signal.c
	446	++++ linux-6.1.5/kernel/signal.c
447	447	@@ -3771,6 +3771,8 @@ static inline void prepare_kill_siginfo(
448	448	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
449	449	{

		@@ -511,8 +511,8 @@
511	511
512	512	return do_send_specific(tgid, pid, sig, info);
513	513	}
514		---- linux-6.1.1.orig/kernel/sys.c
515		-+++ linux-6.1.1/kernel/sys.c
	514	+--- linux-6.1.5.orig/kernel/sys.c
	515	++++ linux-6.1.5/kernel/sys.c
516	516	@@ -219,6 +219,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
517	517
518	518	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -542,8 +542,8 @@
542	542
543	543	errno = -EFAULT;
544	544	if (!copy_from_user(tmp, name, len)) {
545		---- linux-6.1.1.orig/kernel/time/timekeeping.c
546		-+++ linux-6.1.1/kernel/time/timekeeping.c
	545	+--- linux-6.1.5.orig/kernel/time/timekeeping.c
	546	++++ linux-6.1.5/kernel/time/timekeeping.c
547	547	@@ -24,6 +24,7 @@
548	548	#include <linux/compiler.h>
549	549	#include <linux/audit.h>

		@@ -577,8 +577,8 @@
577	577
578	578	/*
579	579	* Validate if a timespec/timeval used to inject a time
580		---- linux-6.1.1.orig/net/ipv4/raw.c
581		-+++ linux-6.1.1/net/ipv4/raw.c
	580	+--- linux-6.1.5.orig/net/ipv4/raw.c
	581	++++ linux-6.1.5/net/ipv4/raw.c
582	582	@@ -744,6 +744,10 @@ static int raw_recvmsg(struct sock *sk,
583	583	skb = skb_recv_datagram(sk, flags, &err);
584	584	if (!skb)

		@@ -590,8 +590,8 @@
590	590
591	591	copied = skb->len;
592	592	if (len < copied) {
593		---- linux-6.1.1.orig/net/ipv4/udp.c
594		-+++ linux-6.1.1/net/ipv4/udp.c
	593	+--- linux-6.1.5.orig/net/ipv4/udp.c
	594	++++ linux-6.1.5/net/ipv4/udp.c
595	595	@@ -1856,6 +1856,8 @@ try_again:
596	596	skb = __skb_recv_udp(sk, flags, &off, &err);
597	597	if (!skb)

		@@ -601,8 +601,8 @@
601	601
602	602	ulen = udp_skb_len(skb);
603	603	copied = len;
604		---- linux-6.1.1.orig/net/ipv6/raw.c
605		-+++ linux-6.1.1/net/ipv6/raw.c
	604	+--- linux-6.1.5.orig/net/ipv6/raw.c
	605	++++ linux-6.1.5/net/ipv6/raw.c
606	606	@@ -446,6 +446,10 @@ static int rawv6_recvmsg(struct sock *sk
607	607	skb = skb_recv_datagram(sk, flags, &err);
608	608	if (!skb)

		@@ -614,8 +614,8 @@
614	614
615	615	copied = skb->len;
616	616	if (copied > len) {
617		---- linux-6.1.1.orig/net/ipv6/udp.c
618		-+++ linux-6.1.1/net/ipv6/udp.c
	617	+--- linux-6.1.5.orig/net/ipv6/udp.c
	618	++++ linux-6.1.5/net/ipv6/udp.c
619	619	@@ -360,6 +360,8 @@ try_again:
620	620	skb = __skb_recv_udp(sk, flags, &off, &err);
621	621	if (!skb)

		@@ -625,8 +625,8 @@
625	625
626	626	ulen = udp6_skb_len(skb);
627	627	copied = len;
628		---- linux-6.1.1.orig/net/socket.c
629		-+++ linux-6.1.1/net/socket.c
	628	+--- linux-6.1.5.orig/net/socket.c
	629	++++ linux-6.1.5/net/socket.c
630	630	@@ -1858,6 +1858,10 @@ struct file do_accept(struct file file
631	631	if (err < 0)
632	632	goto out_fd;

		@@ -638,9 +638,9 @@
638	638	if (upeer_sockaddr) {
639	639	len = newsock->ops->getname(newsock,
640	640	(struct sockaddr *)&address, 2);
641		---- linux-6.1.1.orig/net/unix/af_unix.c
642		-+++ linux-6.1.1/net/unix/af_unix.c
643		-@@ -2466,6 +2466,10 @@ int __unix_dgram_recvmsg(struct sock *sk
	641	+--- linux-6.1.5.orig/net/unix/af_unix.c
	642	++++ linux-6.1.5/net/unix/af_unix.c
	643	+@@ -2473,6 +2473,10 @@ int __unix_dgram_recvmsg(struct sock *sk
644	644	EPOLLOUT \| EPOLLWRNORM \|
645	645	EPOLLWRBAND);
646	646

		@@ -651,7 +651,7 @@
651	651	if (msg->msg_name)
652	652	unix_copy_addr(msg, skb->sk);
653	653
654		-@@ -2516,6 +2520,7 @@ int __unix_dgram_recvmsg(struct sock *sk
	654	+@@ -2523,6 +2527,7 @@ int __unix_dgram_recvmsg(struct sock *sk
655	655
656	656	out_free:
657	657	skb_free_datagram(sk, skb);

		@@ -659,8 +659,8 @@
659	659	mutex_unlock(&u->iolock);
660	660	out:
661	661	return err;
662		---- linux-6.1.1.orig/security/Kconfig
663		-+++ linux-6.1.1/security/Kconfig
	662	+--- linux-6.1.5.orig/security/Kconfig
	663	++++ linux-6.1.5/security/Kconfig
664	664	@@ -260,5 +260,7 @@ config LSM
665	665
666	666	source "security/Kconfig.hardening"

		@@ -669,8 +669,8 @@
669	669	+
670	670	endmenu
671	671
672		---- linux-6.1.1.orig/security/Makefile
673		-+++ linux-6.1.1/security/Makefile
	672	+--- linux-6.1.5.orig/security/Makefile
	673	++++ linux-6.1.5/security/Makefile
674	674	@@ -27,3 +27,6 @@ obj-$(CONFIG_SECURITY_LANDLOCK) += land
675	675
676	676	# Object integrity file lists

		@@ -678,8 +678,8 @@
678	678	+
679	679	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
680	680	+obj-$(CONFIG_CCSECURITY) += ccsecurity/
681		---- linux-6.1.1.orig/security/security.c
682		-+++ linux-6.1.1/security/security.c
	681	+--- linux-6.1.5.orig/security/security.c
	682	++++ linux-6.1.5/security/security.c
683	683	@@ -1658,7 +1658,9 @@ int security_task_alloc(struct task_stru
684	684
685	685	if (rc)

--- trunk/1.8.x/ccs-patch/patches/ccs-patch-6.2.diff (revision 6929)

+++ trunk/1.8.x/ccs-patch/patches/ccs-patch-6.2.diff (revision 6930)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 6.2-rc1.
	1	+This is TOMOYO Linux patch for kernel 6.2-rc3.
2	2
3		-Source code for this patch is https://git.kernel.org/torvalds/t/linux-6.2-rc1.tar.gz
	3	+Source code for this patch is https://git.kernel.org/torvalds/t/linux-6.2-rc3.tar.gz
4	4	---
5	5	fs/exec.c \| 2 -
6	6	fs/open.c \| 2 +

		@@ -28,8 +28,8 @@
28	28	security/security.c \| 5 ++-
29	29	24 files changed, 151 insertions(+), 31 deletions(-)
30	30
31		---- linux-6.2-rc1.orig/fs/exec.c
32		-+++ linux-6.2-rc1/fs/exec.c
	31	+--- linux-6.2-rc3.orig/fs/exec.c
	32	++++ linux-6.2-rc3/fs/exec.c
33	33	@@ -1848,7 +1848,7 @@ static int bprm_execve(struct linux_binp
34	34	if (retval)
35	35	goto out;

		@@ -39,8 +39,8 @@
39	39	if (retval < 0)
40	40	goto out;
41	41
42		---- linux-6.2-rc1.orig/fs/open.c
43		-+++ linux-6.2-rc1/fs/open.c
	42	+--- linux-6.2-rc3.orig/fs/open.c
	43	++++ linux-6.2-rc3/fs/open.c
44	44	@@ -1471,6 +1471,8 @@ SYSCALL_DEFINE3(close_range, unsigned in
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-6.2-rc1.orig/fs/proc/version.c
54		-+++ linux-6.2-rc1/fs/proc/version.c
	53	+--- linux-6.2-rc3.orig/fs/proc/version.c
	54	++++ linux-6.2-rc3/fs/proc/version.c
55	55	@@ -25,3 +25,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 6.2-rc1 2022/12/31\n");
	62	++ printk(KERN_INFO "Hook version: 6.2-rc3 2023/01/14\n");
63	63	+ return 0;
64	64	+}
65	65	+fs_initcall(ccs_show_version);
66		---- linux-6.2-rc1.orig/include/linux/sched.h
67		-+++ linux-6.2-rc1/include/linux/sched.h
	66	+--- linux-6.2-rc3.orig/include/linux/sched.h
	67	++++ linux-6.2-rc3/include/linux/sched.h
68	68	@@ -46,6 +46,7 @@ struct blk_plug;
69	69	struct bpf_local_storage;
70	70	struct bpf_run_ctx;

		@@ -84,8 +84,8 @@
84	84
85	85	#ifdef CONFIG_TRACING
86	86	/* Bitmask and counter of trace recursion: */
87		---- linux-6.2-rc1.orig/include/linux/security.h
88		-+++ linux-6.2-rc1/include/linux/security.h
	87	+--- linux-6.2-rc3.orig/include/linux/security.h
	88	++++ linux-6.2-rc3/include/linux/security.h
89	89	@@ -60,6 +60,7 @@ struct fs_parameter;
90	90	enum fs_value_type;
91	91	struct watch;

		@@ -311,8 +311,8 @@
311	311	}
312	312	#endif /* CONFIG_SECURITY_PATH */
313	313
314		---- linux-6.2-rc1.orig/include/net/ip.h
315		-+++ linux-6.2-rc1/include/net/ip.h
	314	+--- linux-6.2-rc3.orig/include/net/ip.h
	315	++++ linux-6.2-rc3/include/net/ip.h
316	316	@@ -345,6 +345,8 @@ void inet_get_local_port_range(struct ne
317	317	#ifdef CONFIG_SYSCTL
318	318	static inline bool inet_is_local_reserved_port(struct net *net, unsigned short port)

		@@ -331,8 +331,8 @@
331	331	return false;
332	332	}
333	333
334		---- linux-6.2-rc1.orig/init/init_task.c
335		-+++ linux-6.2-rc1/init/init_task.c
	334	+--- linux-6.2-rc3.orig/init/init_task.c
	335	++++ linux-6.2-rc3/init/init_task.c
336	336	@@ -210,6 +210,10 @@ struct task_struct init_task
337	337	#ifdef CONFIG_SECCOMP_FILTER
338	338	.seccomp = { .filter_count = ATOMIC_INIT(0) },

		@@ -344,8 +344,8 @@
344	344	};
345	345	EXPORT_SYMBOL(init_task);
346	346
347		---- linux-6.2-rc1.orig/kernel/kexec.c
348		-+++ linux-6.2-rc1/kernel/kexec.c
	347	+--- linux-6.2-rc3.orig/kernel/kexec.c
	348	++++ linux-6.2-rc3/kernel/kexec.c
349	349	@@ -16,7 +16,7 @@
350	350	#include <linux/syscalls.h>
351	351	#include <linux/vmalloc.h>

		@@ -364,8 +364,8 @@
364	364
365	365	/* Permit LSMs and IMA to fail the kexec */
366	366	result = security_kernel_load_data(LOADING_KEXEC_IMAGE, false);
367		---- linux-6.2-rc1.orig/kernel/module/main.c
368		-+++ linux-6.2-rc1/kernel/module/main.c
	367	+--- linux-6.2-rc3.orig/kernel/module/main.c
	368	++++ linux-6.2-rc3/kernel/module/main.c
369	369	@@ -59,6 +59,7 @@
370	370
371	371	#define CREATE_TRACE_POINTS

		@@ -392,8 +392,8 @@
392	392
393	393	return 0;
394	394	}
395		---- linux-6.2-rc1.orig/kernel/ptrace.c
396		-+++ linux-6.2-rc1/kernel/ptrace.c
	395	+--- linux-6.2-rc3.orig/kernel/ptrace.c
	396	++++ linux-6.2-rc3/kernel/ptrace.c
397	397	@@ -1271,6 +1271,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
398	398	{
399	399	struct task_struct *child;

		@@ -418,8 +418,8 @@
418	418
419	419	if (request == PTRACE_TRACEME) {
420	420	ret = ptrace_traceme();
421		---- linux-6.2-rc1.orig/kernel/reboot.c
422		-+++ linux-6.2-rc1/kernel/reboot.c
	421	+--- linux-6.2-rc3.orig/kernel/reboot.c
	422	++++ linux-6.2-rc3/kernel/reboot.c
423	423	@@ -18,6 +18,7 @@
424	424	#include <linux/syscalls.h>
425	425	#include <linux/syscore_ops.h>

		@@ -437,8 +437,8 @@
437	437
438	438	/*
439	439	* If pid namespaces are enabled and the current task is in a child
440		---- linux-6.2-rc1.orig/kernel/sched/core.c
441		-+++ linux-6.2-rc1/kernel/sched/core.c
	440	+--- linux-6.2-rc3.orig/kernel/sched/core.c
	441	++++ linux-6.2-rc3/kernel/sched/core.c
442	442	@@ -7136,6 +7136,8 @@ int can_nice(const struct task_struct *p
443	443	SYSCALL_DEFINE1(nice, int, increment)
444	444	{

		@@ -448,8 +448,8 @@
448	448
449	449	/*
450	450	* Setpriority might change our priority at the same moment.
451		---- linux-6.2-rc1.orig/kernel/signal.c
452		-+++ linux-6.2-rc1/kernel/signal.c
	451	+--- linux-6.2-rc3.orig/kernel/signal.c
	452	++++ linux-6.2-rc3/kernel/signal.c
453	453	@@ -3772,6 +3772,8 @@ static inline void prepare_kill_siginfo(
454	454	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
455	455	{

		@@ -517,8 +517,8 @@
517	517
518	518	return do_send_specific(tgid, pid, sig, info);
519	519	}
520		---- linux-6.2-rc1.orig/kernel/sys.c
521		-+++ linux-6.2-rc1/kernel/sys.c
	520	+--- linux-6.2-rc3.orig/kernel/sys.c
	521	++++ linux-6.2-rc3/kernel/sys.c
522	522	@@ -219,6 +219,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
523	523
524	524	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -548,8 +548,8 @@
548	548
549	549	errno = -EFAULT;
550	550	if (!copy_from_user(tmp, name, len)) {
551		---- linux-6.2-rc1.orig/kernel/time/timekeeping.c
552		-+++ linux-6.2-rc1/kernel/time/timekeeping.c
	551	+--- linux-6.2-rc3.orig/kernel/time/timekeeping.c
	552	++++ linux-6.2-rc3/kernel/time/timekeeping.c
553	553	@@ -24,6 +24,7 @@
554	554	#include <linux/compiler.h>
555	555	#include <linux/audit.h>

		@@ -583,8 +583,8 @@
583	583
584	584	/*
585	585	* Validate if a timespec/timeval used to inject a time
586		---- linux-6.2-rc1.orig/net/ipv4/raw.c
587		-+++ linux-6.2-rc1/net/ipv4/raw.c
	586	+--- linux-6.2-rc3.orig/net/ipv4/raw.c
	587	++++ linux-6.2-rc3/net/ipv4/raw.c
588	588	@@ -744,6 +744,10 @@ static int raw_recvmsg(struct sock *sk,
589	589	skb = skb_recv_datagram(sk, flags, &err);
590	590	if (!skb)

		@@ -596,8 +596,8 @@
596	596
597	597	copied = skb->len;
598	598	if (len < copied) {
599		---- linux-6.2-rc1.orig/net/ipv4/udp.c
600		-+++ linux-6.2-rc1/net/ipv4/udp.c
	599	+--- linux-6.2-rc3.orig/net/ipv4/udp.c
	600	++++ linux-6.2-rc3/net/ipv4/udp.c
601	601	@@ -1863,6 +1863,8 @@ try_again:
602	602	skb = __skb_recv_udp(sk, flags, &off, &err);
603	603	if (!skb)

		@@ -607,8 +607,8 @@
607	607
608	608	ulen = udp_skb_len(skb);
609	609	copied = len;
610		---- linux-6.2-rc1.orig/net/ipv6/raw.c
611		-+++ linux-6.2-rc1/net/ipv6/raw.c
	610	+--- linux-6.2-rc3.orig/net/ipv6/raw.c
	611	++++ linux-6.2-rc3/net/ipv6/raw.c
612	612	@@ -446,6 +446,10 @@ static int rawv6_recvmsg(struct sock *sk
613	613	skb = skb_recv_datagram(sk, flags, &err);
614	614	if (!skb)

		@@ -620,8 +620,8 @@
620	620
621	621	copied = skb->len;
622	622	if (copied > len) {
623		---- linux-6.2-rc1.orig/net/ipv6/udp.c
624		-+++ linux-6.2-rc1/net/ipv6/udp.c
	623	+--- linux-6.2-rc3.orig/net/ipv6/udp.c
	624	++++ linux-6.2-rc3/net/ipv6/udp.c
625	625	@@ -361,6 +361,8 @@ try_again:
626	626	skb = __skb_recv_udp(sk, flags, &off, &err);
627	627	if (!skb)

		@@ -631,8 +631,8 @@
631	631
632	632	ulen = udp6_skb_len(skb);
633	633	copied = len;
634		---- linux-6.2-rc1.orig/net/socket.c
635		-+++ linux-6.2-rc1/net/socket.c
	634	+--- linux-6.2-rc3.orig/net/socket.c
	635	++++ linux-6.2-rc3/net/socket.c
636	636	@@ -1858,6 +1858,10 @@ struct file do_accept(struct file file
637	637	if (err < 0)
638	638	goto out_fd;

		@@ -644,8 +644,8 @@
644	644	if (upeer_sockaddr) {
645	645	len = newsock->ops->getname(newsock,
646	646	(struct sockaddr *)&address, 2);
647		---- linux-6.2-rc1.orig/net/unix/af_unix.c
648		-+++ linux-6.2-rc1/net/unix/af_unix.c
	647	+--- linux-6.2-rc3.orig/net/unix/af_unix.c
	648	++++ linux-6.2-rc3/net/unix/af_unix.c
649	649	@@ -2473,6 +2473,10 @@ int __unix_dgram_recvmsg(struct sock *sk
650	650	EPOLLOUT \| EPOLLWRNORM \|
651	651	EPOLLWRBAND);

		@@ -665,8 +665,8 @@
665	665	mutex_unlock(&u->iolock);
666	666	out:
667	667	return err;
668		---- linux-6.2-rc1.orig/security/Kconfig
669		-+++ linux-6.2-rc1/security/Kconfig
	668	+--- linux-6.2-rc3.orig/security/Kconfig
	669	++++ linux-6.2-rc3/security/Kconfig
670	670	@@ -260,5 +260,7 @@ config LSM
671	671
672	672	source "security/Kconfig.hardening"

		@@ -675,8 +675,8 @@
675	675	+
676	676	endmenu
677	677
678		---- linux-6.2-rc1.orig/security/Makefile
679		-+++ linux-6.2-rc1/security/Makefile
	678	+--- linux-6.2-rc3.orig/security/Makefile
	679	++++ linux-6.2-rc3/security/Makefile
680	680	@@ -27,3 +27,6 @@ obj-$(CONFIG_SECURITY_LANDLOCK) += land
681	681
682	682	# Object integrity file lists

		@@ -684,8 +684,8 @@
684	684	+
685	685	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
686	686	+obj-$(CONFIG_CCSECURITY) += ccsecurity/
687		---- linux-6.2-rc1.orig/security/security.c
688		-+++ linux-6.2-rc1/security/security.c
	687	+--- linux-6.2-rc3.orig/security/security.c
	688	++++ linux-6.2-rc3/security/security.c
689	689	@@ -1733,7 +1733,9 @@ int security_task_alloc(struct task_stru
690	690
691	691	if (rc)

Show on old repository browser