Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac8cc0fa authored by James Morris's avatar James Morris
Browse files

Merge branch 'next' into for-linus

parents 238c6d54 3699c53c

Documentation/feature-removal-schedule.txt

+12 −0
Original line number Diff line number Diff line
@@ -315,3 +315,15 @@ When: 2.6.29 (ideally) or 2.6.30 (more likely) 
Why:	Deprecated by the new (standard) device driver binding model. Use

	i2c_driver->probe() and ->remove() instead.

Who:	Jean Delvare <khali@linux-fr.org>



---------------------------



What:	SELinux "compat_net" functionality

When:	2.6.30 at the earliest

Why:	In 2.6.18 the Secmark concept was introduced to replace the "compat_net"

	network access control functionality of SELinux.  Secmark offers both

	better performance and greater flexibility than the "compat_net"

	mechanism.  Now that the major Linux distributions have moved to

	Secmark, it is time to deprecate the older mechanism and start the

	process of removing the old code.

Who:	Paul Moore <paul.moore@hp.com>

include/linux/capability.h

+15 −2
Original line number Diff line number Diff line
@@ -529,8 +529,21 @@ extern const kernel_cap_t __cap_init_eff_set; 
 *

 * Note that this does not set PF_SUPERPRIV on the task.

 */

#define has_capability(t, cap) (security_capable((t), (cap)) == 0)

#define has_capability_noaudit(t, cap) (security_capable_noaudit((t), (cap)) == 0)

#define has_capability(t, cap) (security_real_capable((t), (cap)) == 0)



/**

 * has_capability_noaudit - Determine if a task has a superior capability available (unaudited)

 * @t: The task in question

 * @cap: The capability to be tested for

 *

 * Return true if the specified task has the given superior capability

 * currently in effect, false if not, but don't write an audit message for the

 * check.

 *

 * Note that this does not set PF_SUPERPRIV on the task.

 */

#define has_capability_noaudit(t, cap) \

	(security_real_capable_noaudit((t), (cap)) == 0)



extern int capable(int cap);

include/linux/security.h

+32 −9
Original line number Diff line number Diff line
@@ -48,7 +48,8 @@ struct audit_krule; 
 * These functions are in security/capability.c and are used

 * as the default capabilities functions

 */

extern int cap_capable(struct task_struct *tsk, int cap, int audit);

extern int cap_capable(struct task_struct *tsk, const struct cred *cred,

		       int cap, int audit);

extern int cap_settime(struct timespec *ts, struct timezone *tz);

extern int cap_ptrace_may_access(struct task_struct *child, unsigned int mode);

extern int cap_ptrace_traceme(struct task_struct *parent);
@@ -1251,9 +1252,12 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) 
 *	@permitted contains the permitted capability set.

 *	Return 0 and update @new if permission is granted.

 * @capable:

 *	Check whether the @tsk process has the @cap capability.

 *	Check whether the @tsk process has the @cap capability in the indicated

 *	credentials.

 *	@tsk contains the task_struct for the process.

 *	@cred contains the credentials to use.

 *	@cap contains the capability <include/linux/capability.h>.

 *	@audit: Whether to write an audit message or not

 *	Return 0 if the capability is granted for @tsk.

 * @acct:

 *	Check permission before enabling or disabling process accounting.  If
@@ -1346,7 +1350,8 @@ struct security_operations { 
		       const kernel_cap_t *effective,

		       const kernel_cap_t *inheritable,

		       const kernel_cap_t *permitted);

	int (*capable) (struct task_struct *tsk, int cap, int audit);

	int (*capable) (struct task_struct *tsk, const struct cred *cred,

			int cap, int audit);

	int (*acct) (struct file *file);

	int (*sysctl) (struct ctl_table *table, int op);

	int (*quotactl) (int cmds, int type, int id, struct super_block *sb);
@@ -1628,8 +1633,9 @@ int security_capset(struct cred *new, const struct cred *old, 
		    const kernel_cap_t *effective,

		    const kernel_cap_t *inheritable,

		    const kernel_cap_t *permitted);

int security_capable(struct task_struct *tsk, int cap);

int security_capable_noaudit(struct task_struct *tsk, int cap);

int security_capable(int cap);

int security_real_capable(struct task_struct *tsk, int cap);

int security_real_capable_noaudit(struct task_struct *tsk, int cap);

int security_acct(struct file *file);

int security_sysctl(struct ctl_table *table, int op);

int security_quotactl(int cmds, int type, int id, struct super_block *sb);
@@ -1826,14 +1832,31 @@ static inline int security_capset(struct cred *new, 
	return cap_capset(new, old, effective, inheritable, permitted);

}



static inline int security_capable(struct task_struct *tsk, int cap)

static inline int security_capable(int cap)

{

	return cap_capable(tsk, cap, SECURITY_CAP_AUDIT);

	return cap_capable(current, current_cred(), cap, SECURITY_CAP_AUDIT);

}



static inline int security_capable_noaudit(struct task_struct *tsk, int cap)

static inline int security_real_capable(struct task_struct *tsk, int cap)

{

	return cap_capable(tsk, cap, SECURITY_CAP_NOAUDIT);

	int ret;



	rcu_read_lock();

	ret = cap_capable(tsk, __task_cred(tsk), cap, SECURITY_CAP_AUDIT);

	rcu_read_unlock();

	return ret;

}



static inline

int security_real_capable_noaudit(struct task_struct *tsk, int cap)

{

	int ret;



	rcu_read_lock();

	ret = cap_capable(tsk, __task_cred(tsk), cap,

			       SECURITY_CAP_NOAUDIT);

	rcu_read_unlock();

	return ret;

}



static inline int security_acct(struct file *file)

include/net/cipso_ipv4.h

+4 −2
Original line number Diff line number Diff line
@@ -131,7 +131,8 @@ extern int cipso_v4_rbm_strictvalid; 
 */



#ifdef CONFIG_NETLABEL

int cipso_v4_doi_add(struct cipso_v4_doi *doi_def);

int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,

		     struct netlbl_audit *audit_info);

void cipso_v4_doi_free(struct cipso_v4_doi *doi_def);

int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info);

struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi);
@@ -140,7 +141,8 @@ int cipso_v4_doi_walk(u32 *skip_cnt, 
		     int (*callback) (struct cipso_v4_doi *doi_def, void *arg),

	             void *cb_arg);

#else

static inline int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)

static inline int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,

				   struct netlbl_audit *audit_info)

{

	return -ENOSYS;

}

include/net/netlabel.h

+80 −6
Original line number Diff line number Diff line
@@ -33,6 +33,8 @@ 
#include <linux/types.h>

#include <linux/net.h>

#include <linux/skbuff.h>

#include <linux/in.h>

#include <linux/in6.h>

#include <net/netlink.h>

#include <asm/atomic.h>
@@ -353,13 +355,37 @@ static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr) 
/*

 * LSM configuration operations

 */

int netlbl_cfg_map_del(const char *domain, struct netlbl_audit *audit_info);

int netlbl_cfg_unlbl_add_map(const char *domain,

int netlbl_cfg_map_del(const char *domain,

		       u16 family,

		       const void *addr,

		       const void *mask,

		       struct netlbl_audit *audit_info);

int netlbl_cfg_unlbl_map_add(const char *domain,

			     u16 family,

			     const void *addr,

			     const void *mask,

			     struct netlbl_audit *audit_info);

int netlbl_cfg_unlbl_static_add(struct net *net,

				const char *dev_name,

				const void *addr,

				const void *mask,

				u16 family,

				u32 secid,

				struct netlbl_audit *audit_info);

int netlbl_cfg_cipsov4_add_map(struct cipso_v4_doi *doi_def,

int netlbl_cfg_unlbl_static_del(struct net *net,

				const char *dev_name,

				const void *addr,

				const void *mask,

				u16 family,

				struct netlbl_audit *audit_info);

int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,

			   struct netlbl_audit *audit_info);

void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info);

int netlbl_cfg_cipsov4_map_add(u32 doi,

			       const char *domain,

			       const struct in_addr *addr,

			       const struct in_addr *mask,

			       struct netlbl_audit *audit_info);



/*

 * LSM security attribute operations

 */
@@ -401,19 +427,62 @@ void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway); 
void netlbl_cache_invalidate(void);

int netlbl_cache_add(const struct sk_buff *skb,

		     const struct netlbl_lsm_secattr *secattr);



/*

 * Protocol engine operations

 */

struct audit_buffer *netlbl_audit_start(int type,

					struct netlbl_audit *audit_info);

#else

static inline int netlbl_cfg_map_del(const char *domain,

				     u16 family,

				     const void *addr,

				     const void *mask,

				     struct netlbl_audit *audit_info)

{

	return -ENOSYS;

}

static inline int netlbl_cfg_unlbl_map_add(const char *domain,

					   u16 family,

					   void *addr,

					   void *mask,

					   struct netlbl_audit *audit_info)

{

	return -ENOSYS;

}

static inline int netlbl_cfg_unlbl_static_add(struct net *net,

					      const char *dev_name,

					      const void *addr,

					      const void *mask,

					      u16 family,

					      u32 secid,

					      struct netlbl_audit *audit_info)

{

	return -ENOSYS;

}

static inline int netlbl_cfg_unlbl_static_del(struct net *net,

					      const char *dev_name,

					      const void *addr,

					      const void *mask,

					      u16 family,

					      struct netlbl_audit *audit_info)

{

	return -ENOSYS;

}

static inline int netlbl_cfg_unlbl_add_map(const char *domain,

static inline int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,

					 struct netlbl_audit *audit_info)

{

	return -ENOSYS;

}

static inline int netlbl_cfg_cipsov4_add_map(struct cipso_v4_doi *doi_def,

static inline void netlbl_cfg_cipsov4_del(u32 doi,

					  struct netlbl_audit *audit_info)

{

	return;

}

static inline int netlbl_cfg_cipsov4_map_add(u32 doi,

					     const char *domain,

					     const struct in_addr *addr,

					     const struct in_addr *mask,

					     struct netlbl_audit *audit_info)

{

	return -ENOSYS;
@@ -495,6 +564,11 @@ static inline int netlbl_cache_add(const struct sk_buff *skb, 
{

	return 0;

}

static inline struct audit_buffer *netlbl_audit_start(int type,

						struct netlbl_audit *audit_info)

{

	return NULL;

}

#endif /* CONFIG_NETLABEL */



#endif /* _NETLABEL_H */