Merge branch 'for-linus' of git://oss.sgi.com:8090/xfs/xfs-2.6

[sfrench/cifs-2.6.git] / security / commoncap.c

diff --git a/security/commoncap.c b/security/commoncap.c
index 778cb0cfc5d892fa9ae3f001d35d2560779dd15c..43f902750a1b6c802d650b6e9bbafde70ec8ae70 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -23,6 +23,26 @@
 #include <linux/xattr.h>
 #include <linux/hugetlb.h>
 #include <linux/mount.h>
+#include <linux/sched.h>
+
+#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+/*
+ * Because of the reduced scope of CAP_SETPCAP when filesystem
+ * capabilities are in effect, it is safe to allow this capability to
+ * be available in the default configuration.
+ */
+# define CAP_INIT_BSET  CAP_FULL_SET
+#else /* ie. ndef CONFIG_SECURITY_FILE_CAPABILITIES */
+# define CAP_INIT_BSET  CAP_INIT_EFF_SET
+#endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
+
+kernel_cap_t cap_bset = CAP_INIT_BSET;    /* systemwide capability bound */
+EXPORT_SYMBOL(cap_bset);
+
+/* Global security state */
+
+unsigned securebits = SECUREBITS_DEFAULT; /* systemwide security settings */
+EXPORT_SYMBOL(securebits);
 
 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
 {
@@ -73,14 +93,44 @@ int cap_capget (struct task_struct *target, kernel_cap_t *effective,
        return 0;
 }
 
+#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+
+static inline int cap_block_setpcap(struct task_struct *target)
+{
+       /*
+        * No support for remote process capability manipulation with
+        * filesystem capability support.
+        */
+       return (target != current);
+}
+
+static inline int cap_inh_is_capped(void)
+{
+       /*
+        * return 1 if changes to the inheritable set are limited
+        * to the old permitted set.
+        */
+       return !cap_capable(current, CAP_SETPCAP);
+}
+
+#else /* ie., ndef CONFIG_SECURITY_FILE_CAPABILITIES */
+
+static inline int cap_block_setpcap(struct task_struct *t) { return 0; }
+static inline int cap_inh_is_capped(void) { return 1; }
+
+#endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
+
 int cap_capset_check (struct task_struct *target, kernel_cap_t *effective,
                      kernel_cap_t *inheritable, kernel_cap_t *permitted)
 {
-       /* Derived from kernel/capability.c:sys_capset. */
-       /* verify restrictions on target's new Inheritable set */
-       if (!cap_issubset (*inheritable,
-                          cap_combine (target->cap_inheritable,
-                                       current->cap_permitted))) {
+       if (cap_block_setpcap(target)) {
+               return -EPERM;
+       }
+       if (cap_inh_is_capped()
+           && !cap_issubset(*inheritable,
+                            cap_combine(target->cap_inheritable,
+                                        current->cap_permitted))) {
+               /* incapable of using this inheritable set */
                return -EPERM;
        }
 
@@ -285,7 +335,7 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
        /* For init, we want to retain the capabilities set
         * in the init_task struct. Thus we skip the usual
         * capability rules */
-       if (!is_init(current)) {
+       if (!is_global_init(current)) {
                current->cap_permitted = new_permitted;
                current->cap_effective = bprm->cap_effective ?
                                new_permitted : 0;