October 3rd, 2011
· Fix 2011/09/25
· @ Simplify garbage collector.
· It turned out that use of batched processing tends to choke garbage
· collector when certain pattern of entries are queued. Thus, I replaced it
· with sequential processing.
· Fix 2011/09/16
· @ Allow specifying domain transition preference.
· I got an opinion that it is difficult to use exception policy's domain
· transition control directives because they need to match the pathname
· specified to "file execute" directives. For example, if "file execute
· /bin/\*\-ls\-cat" is given, corresponding domain transition control
· directive needs to be like "no_keep_domain /bin/\*\-ls\-cat from any".
· To solve this difficulty, I introduced optional argument that supersedes
· exception policy's domain transition control directives.
· file execute /bin/ls keep exec.realpath="/bin/ls" exec.argv="ls"
· file execute /bin/cat keep exec.realpath="/bin/cat" exec.argv="cat"
· file execute /bin/\*\-ls\-cat child
· file execute /usr/sbin/httpd exec.realpath="/usr/sbin/httpd" exec.argv="/usr/sbin/httpd"
· This argument allows transition to different domains based on conditions.
· file execute /bin/bash /usr/sbin/sshd //batch-session exec.argc=2 exec.argv="-c"
· file execute /bin/bash /usr/sbin/sshd //root-session task.uid=0
· file execute /bin/bash /usr/sbin/sshd //nonroot-session task.uid!=0
June 21st, 2011
· Remove unused "struct inode *" parameter from ccs-patch-\*.diff .
· Allow specifying trigger for activation.
· Add policy namespace support.
· Remove CONFIG_CCSECURITY_BUILTIN_INITIALIZERS option.
April 1st, 2011
· Several bugs were fixed.
· A new feature to protect the Android environment from privilege escalation was added.
· Support for packed policy format was added.
· The garbage collector was modified so as not to wait for /proc/ccs/ users.
· As a result, memory reclamation can start earlier.
February 8th, 2011
· Fix infinite loop bug when reading /proc/ccs/audit or /proc/ccs/query .
· @ Use filesystem name for unnamed devices when vfsmount is missing.
· @ Split ccs_null_security into ccs_default_security and ccs_oom_security.
· @ Use same interface for audit logs.
February 8th, 2011
· Fix infinite loop bug when reading /proc/ccs/audit or /proc/ccs/query . In ccs_flush(), head->r.w holds pointer to string data to be printed. But head->r.w was updated only when the string data was partially printed (because head->r.w will be updated by head->r.w later if completely printed). However, regarding /proc/ccs/audit and /proc/ccs/query , an additional '\0' is printed after the string data was completely printed. But if free space for read buffer became 0 before printing the additional '\0', ccs_flush() was returning without updating head->r.w. As a result, ccs_flush() forever reprints already printed string data.
April 2nd, 2009
· A severe memory consumption problem was discovered in ccs-patch-1.6.5-20081111.tar.gz .
· Those who downloaded ccs-patch-1.6.5-20081111.tar.gz , please update to ccs-patch-1.6.6-20090202.tar.gz .
February 2nd, 2009
· This release fixes 3 bugs that existed in versions 1.6.0 to 1.6.5.
November 14th, 2008
· This third anniversary release fixes many bugs and includes many enhancements.