file capabilities: remove cap_task_kill()

[sfrench/cifs-2.6.git] / security / smack / smack_lsm.c

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 25cbfa3f71f4f141ff68ce3165c9bde7fe20b409..732ba27923c44f16dd63871416b1fd77ae18d2e4 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -189,17 +189,10 @@ static void smack_sb_free_security(struct super_block *sb)
  * Copy the Smack specific mount options out of the mount
  * options list.
  */
-static int smack_sb_copy_data(struct file_system_type *type, void *orig,
-                             void *smackopts)
+static int smack_sb_copy_data(char *orig, char *smackopts)
 {
        char *cp, *commap, *otheropts, *dp;
 
-       /* Binary mount data: just copy */
-       if (type->fs_flags & FS_BINARY_MOUNTDATA) {
-               copy_page(smackopts, orig);
-               return 0;
-       }
-
        otheropts = (char *)get_zeroed_page(GFP_KERNEL);
        if (otheropts == NULL)
                return -ENOMEM;
@@ -584,14 +577,20 @@ static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
 static int smack_inode_setxattr(struct dentry *dentry, char *name,
                                void *value, size_t size, int flags)
 {
-       if (!capable(CAP_MAC_ADMIN)) {
-               if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
-                   strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
-                   strcmp(name, XATTR_NAME_SMACKIPOUT) == 0)
-                       return -EPERM;
-       }
+       int rc = 0;
 
-       return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE);
+       if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
+           strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
+           strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
+               if (!capable(CAP_MAC_ADMIN))
+                       rc = -EPERM;
+       } else
+               rc = cap_inode_setxattr(dentry, name, value, size, flags);
+
+       if (rc == 0)
+               rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE);
+
+       return rc;
 }
 
 /**
@@ -658,10 +657,20 @@ static int smack_inode_getxattr(struct dentry *dentry, char *name)
  */
 static int smack_inode_removexattr(struct dentry *dentry, char *name)
 {
-       if (strcmp(name, XATTR_NAME_SMACK) == 0 && !capable(CAP_MAC_ADMIN))
-               return -EPERM;
+       int rc = 0;
 
-       return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE);
+       if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
+           strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
+           strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
+               if (!capable(CAP_MAC_ADMIN))
+                       rc = -EPERM;
+       } else
+               rc = cap_inode_removexattr(dentry, name);
+
+       if (rc == 0)
+               rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE);
+
+       return rc;
 }
 
 /**
@@ -1016,7 +1025,12 @@ static void smack_task_getsecid(struct task_struct *p, u32 *secid)
  */
 static int smack_task_setnice(struct task_struct *p, int nice)
 {
-       return smk_curacc(p->security, MAY_WRITE);
+       int rc;
+
+       rc = cap_task_setnice(p, nice);
+       if (rc == 0)
+               rc = smk_curacc(p->security, MAY_WRITE);
+       return rc;
 }
 
 /**
@@ -1028,7 +1042,12 @@ static int smack_task_setnice(struct task_struct *p, int nice)
  */
 static int smack_task_setioprio(struct task_struct *p, int ioprio)
 {
-       return smk_curacc(p->security, MAY_WRITE);
+       int rc;
+
+       rc = cap_task_setioprio(p, ioprio);
+       if (rc == 0)
+               rc = smk_curacc(p->security, MAY_WRITE);
+       return rc;
 }
 
 /**
@@ -1053,7 +1072,12 @@ static int smack_task_getioprio(struct task_struct *p)
 static int smack_task_setscheduler(struct task_struct *p, int policy,
                                   struct sched_param *lp)
 {
-       return smk_curacc(p->security, MAY_WRITE);
+       int rc;
+
+       rc = cap_task_setscheduler(p, policy, lp);
+       if (rc == 0)
+               rc = smk_curacc(p->security, MAY_WRITE);
+       return rc;
 }
 
 /**
@@ -1479,7 +1503,7 @@ static int smack_shm_associate(struct shmid_kernel *shp, int shmflg)
  */
 static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd)
 {
-       char *ssp = smack_of_shm(shp);
+       char *ssp;
        int may;
 
        switch (cmd) {
@@ -1503,6 +1527,7 @@ static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd)
                return -EINVAL;
        }
 
+       ssp = smack_of_shm(shp);
        return smk_curacc(ssp, may);
 }
 
@@ -1587,7 +1612,7 @@ static int smack_sem_associate(struct sem_array *sma, int semflg)
  */
 static int smack_sem_semctl(struct sem_array *sma, int cmd)
 {
-       char *ssp = smack_of_sem(sma);
+       char *ssp;
        int may;
 
        switch (cmd) {
@@ -1616,6 +1641,7 @@ static int smack_sem_semctl(struct sem_array *sma, int cmd)
                return -EINVAL;
        }
 
+       ssp = smack_of_sem(sma);
        return smk_curacc(ssp, may);
 }
 
@@ -1701,7 +1727,7 @@ static int smack_msg_queue_associate(struct msg_queue *msq, int msqflg)
  */
 static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd)
 {
-       char *msp = smack_of_msq(msq);
+       char *msp;
        int may;
 
        switch (cmd) {
@@ -1723,6 +1749,7 @@ static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd)
                return -EINVAL;
        }
 
+       msp = smack_of_msq(msq);
        return smk_curacc(msp, may);
 }
 
@@ -1778,6 +1805,27 @@ static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
        return smk_curacc(isp, may);
 }
 
+/* module stacking operations */
+
+/**
+ * smack_register_security - stack capability module
+ * @name: module name
+ * @ops: module operations - ignored
+ *
+ * Allow the capability module to register.
+ */
+static int smack_register_security(const char *name,
+                                  struct security_operations *ops)
+{
+       if (strcmp(name, "capability") != 0)
+               return -EINVAL;
+
+       printk(KERN_INFO "%s:  Registering secondary module %s\n",
+              __func__, name);
+
+       return 0;
+}
+
 /**
  * smack_d_instantiate - Make sure the blob is correct on an inode
  * @opt_dentry: unused
@@ -2412,6 +2460,8 @@ static struct security_operations smack_ops = {
        .inode_post_setxattr =          smack_inode_post_setxattr,
        .inode_getxattr =               smack_inode_getxattr,
        .inode_removexattr =            smack_inode_removexattr,
+       .inode_need_killpriv =          cap_inode_need_killpriv,
+       .inode_killpriv =               cap_inode_killpriv,
        .inode_getsecurity =            smack_inode_getsecurity,
        .inode_setsecurity =            smack_inode_setsecurity,
        .inode_listsecurity =           smack_inode_listsecurity,
@@ -2471,6 +2521,8 @@ static struct security_operations smack_ops = {
        .netlink_send =                 cap_netlink_send,
        .netlink_recv =                 cap_netlink_recv,
 
+       .register_security =            smack_register_security,
+
        .d_instantiate =                smack_d_instantiate,
 
        .getprocattr =                  smack_getprocattr,