summaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2008-04-03 14:33:42 -0700
committerDavid S. Miller <davem@davemloft.net>2008-04-03 14:33:42 -0700
commit3bb5da3837cc1aa17736b05139c9a22c3794851a (patch)
treec92d5684a866542b1cb20641607ac1643ce03a47 /security
parent7feb49c82a74bc7c091b8ab2a3f96baa33d08ece (diff)
parent9597362d354f8655ece324b01d0c640a0e99c077 (diff)
downloadlinux-3bb5da3837cc1aa17736b05139c9a22c3794851a.tar.bz2
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
Diffstat (limited to 'security')
-rw-r--r--security/capability.c1
-rw-r--r--security/commoncap.c40
-rw-r--r--security/selinux/hooks.c9
-rw-r--r--security/smack/smack_lsm.c14
-rw-r--r--security/smack/smackfs.c35
5 files changed, 16 insertions, 83 deletions
diff --git a/security/capability.c b/security/capability.c
index 9e99f36a8b5c..2c6e06d18fab 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -40,7 +40,6 @@ static struct security_operations capability_ops = {
.inode_need_killpriv = cap_inode_need_killpriv,
.inode_killpriv = cap_inode_killpriv,
- .task_kill = cap_task_kill,
.task_setscheduler = cap_task_setscheduler,
.task_setioprio = cap_task_setioprio,
.task_setnice = cap_task_setnice,
diff --git a/security/commoncap.c b/security/commoncap.c
index bb0c095f5761..06d5c9469ba3 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -540,41 +540,6 @@ int cap_task_setnice (struct task_struct *p, int nice)
return cap_safe_nice(p);
}
-int cap_task_kill(struct task_struct *p, struct siginfo *info,
- int sig, u32 secid)
-{
- if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
- return 0;
-
- /*
- * Running a setuid root program raises your capabilities.
- * Killing your own setuid root processes was previously
- * allowed.
- * We must preserve legacy signal behavior in this case.
- */
- if (p->uid == current->uid)
- return 0;
-
- /* sigcont is permitted within same session */
- if (sig == SIGCONT && (task_session_nr(current) == task_session_nr(p)))
- return 0;
-
- if (secid)
- /*
- * Signal sent as a particular user.
- * Capabilities are ignored. May be wrong, but it's the
- * only thing we can do at the moment.
- * Used only by usb drivers?
- */
- return 0;
- if (cap_issubset(p->cap_permitted, current->cap_permitted))
- return 0;
- if (capable(CAP_KILL))
- return 0;
-
- return -EPERM;
-}
-
/*
* called from kernel/sys.c for prctl(PR_CABSET_DROP)
* done without task_capability_lock() because it introduces
@@ -605,11 +570,6 @@ int cap_task_setnice (struct task_struct *p, int nice)
{
return 0;
}
-int cap_task_kill(struct task_struct *p, struct siginfo *info,
- int sig, u32 secid)
-{
- return 0;
-}
#endif
void cap_task_reparent_to_init (struct task_struct *p)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4bf4807f2d44..c2fef7b12dc7 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -800,7 +800,8 @@ static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
mutex_unlock(&newsbsec->lock);
}
-int selinux_parse_opts_str(char *options, struct security_mnt_opts *opts)
+static int selinux_parse_opts_str(char *options,
+ struct security_mnt_opts *opts)
{
char *p;
char *context = NULL, *defcontext = NULL;
@@ -1629,6 +1630,12 @@ static inline u32 file_to_av(struct file *file)
else
av |= FILE__WRITE;
}
+ if (!av) {
+ /*
+ * Special file opened with flags 3 for ioctl-only use.
+ */
+ av = FILE__IOCTL;
+ }
return av;
}
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 0241fd359675..732ba27923c4 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1117,11 +1117,6 @@ static int smack_task_movememory(struct task_struct *p)
static int smack_task_kill(struct task_struct *p, struct siginfo *info,
int sig, u32 secid)
{
- int rc;
-
- rc = cap_task_kill(p, info, sig, secid);
- if (rc != 0)
- return rc;
/*
* Special cases where signals really ought to go through
* in spite of policy. Stephen Smalley suggests it may
@@ -1508,7 +1503,7 @@ static int smack_shm_associate(struct shmid_kernel *shp, int shmflg)
*/
static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd)
{
- char *ssp = smack_of_shm(shp);
+ char *ssp;
int may;
switch (cmd) {
@@ -1532,6 +1527,7 @@ static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd)
return -EINVAL;
}
+ ssp = smack_of_shm(shp);
return smk_curacc(ssp, may);
}
@@ -1616,7 +1612,7 @@ static int smack_sem_associate(struct sem_array *sma, int semflg)
*/
static int smack_sem_semctl(struct sem_array *sma, int cmd)
{
- char *ssp = smack_of_sem(sma);
+ char *ssp;
int may;
switch (cmd) {
@@ -1645,6 +1641,7 @@ static int smack_sem_semctl(struct sem_array *sma, int cmd)
return -EINVAL;
}
+ ssp = smack_of_sem(sma);
return smk_curacc(ssp, may);
}
@@ -1730,7 +1727,7 @@ static int smack_msg_queue_associate(struct msg_queue *msq, int msqflg)
*/
static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd)
{
- char *msp = smack_of_msq(msq);
+ char *msp;
int may;
switch (cmd) {
@@ -1752,6 +1749,7 @@ static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd)
return -EINVAL;
}
+ msp = smack_of_msq(msq);
return smk_curacc(msp, may);
}
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index afe7c9b0732a..cfae8afcc262 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -74,11 +74,6 @@ struct smk_list_entry *smack_list;
#define SEQ_READ_FINISHED 1
/*
- * Disable concurrent writing open() operations
- */
-static struct semaphore smack_write_sem;
-
-/*
* Values for parsing cipso rules
* SMK_DIGITLEN: Length of a digit field in a rule.
* SMK_CIPSOMIN: Minimum possible cipso rule length.
@@ -168,32 +163,7 @@ static struct seq_operations load_seq_ops = {
*/
static int smk_open_load(struct inode *inode, struct file *file)
{
- if ((file->f_flags & O_ACCMODE) == O_RDONLY)
- return seq_open(file, &load_seq_ops);
-
- if (down_interruptible(&smack_write_sem))
- return -ERESTARTSYS;
-
- return 0;
-}
-
-/**
- * smk_release_load - release() for /smack/load
- * @inode: inode structure representing file
- * @file: "load" file pointer
- *
- * For a reading session, use the seq_file release
- * implementation.
- * Otherwise, we are at the end of a writing session so
- * clean everything up.
- */
-static int smk_release_load(struct inode *inode, struct file *file)
-{
- if ((file->f_flags & O_ACCMODE) == O_RDONLY)
- return seq_release(inode, file);
-
- up(&smack_write_sem);
- return 0;
+ return seq_open(file, &load_seq_ops);
}
/**
@@ -341,7 +311,7 @@ static const struct file_operations smk_load_ops = {
.read = seq_read,
.llseek = seq_lseek,
.write = smk_write_load,
- .release = smk_release_load,
+ .release = seq_release,
};
/**
@@ -1011,7 +981,6 @@ static int __init init_smk_fs(void)
}
}
- sema_init(&smack_write_sem, 1);
smk_cipso_doi();
smk_unlbl_ambient(NULL);