1 files changed, 23 insertions, 18 deletions

diff --git a/include/linux/security.h b/include/linux/security.h
index fd4d55fb884..debbd97db7a 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -53,7 +53,7 @@ struct audit_krule;
  */
 extern int cap_capable(struct task_struct *tsk, const struct cred *cred,
                        int cap, int audit);
-extern int cap_settime(struct timespec *ts, struct timezone *tz);
+extern int cap_settime(const struct timespec *ts, const struct timezone *tz);
 extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode);
 extern int cap_ptrace_traceme(struct task_struct *parent);
 extern int cap_capget(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
@@ -457,7 +457,6 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      called when the actual read/write operations are performed.
  *      @inode contains the inode structure to check.
  *      @mask contains the permission mask.
- *      @nd contains the nameidata (may be NULL).
  *      Return 0 if permission is granted.
  * @inode_setattr:
  *      Check permission before setting file attributes.  Note that the kernel
@@ -796,8 +795,9 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  * @unix_stream_connect:
  *      Check permissions before establishing a Unix domain stream connection
  *      between @sock and @other.
- *      @sock contains the socket structure.
- *      @other contains the peer socket structure.
+ *      @sock contains the sock structure.
+ *      @other contains the peer sock structure.
+ *      @newsk contains the new sock structure.
  *      Return 0 if permission is granted.
  * @unix_may_send:
  *      Check permissions before connecting or sending datagrams from @sock to
@@ -1058,8 +1058,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      @cred points to the credentials to provide the context against which to
  *      evaluate the security data on the key.
  *      @perm describes the combination of permissions required of this key.
- *      Return 1 if permission granted, 0 if permission denied and -ve it the
- *      normal permissions model should be effected.
+ *      Return 0 if permission is granted, -ve error otherwise.
  * @key_getsecurity:
  *      Get a textual representation of the security context attached to a key
  *      for the purposes of honouring KEYCTL_GETSECURITY.  This function
@@ -1388,7 +1387,7 @@ struct security_operations {
         int (*quotactl) (int cmds, int type, int id, struct super_block *sb);
         int (*quota_on) (struct dentry *dentry);
         int (*syslog) (int type);
-        int (*settime) (struct timespec *ts, struct timezone *tz);
+        int (*settime) (const struct timespec *ts, const struct timezone *tz);
         int (*vm_enough_memory) (struct mm_struct *mm, long pages);
 
         int (*bprm_set_creds) (struct linux_binprm *bprm);
@@ -1568,8 +1567,7 @@ struct security_operations {
         int (*inode_getsecctx)(struct inode *inode, void **ctx, u32 *ctxlen);
 
 #ifdef CONFIG_SECURITY_NETWORK
-        int (*unix_stream_connect) (struct socket *sock,
-                                    struct socket *other, struct sock *newsk);
+        int (*unix_stream_connect) (struct sock *sock, struct sock *other, struct sock *newsk);
         int (*unix_may_send) (struct socket *sock, struct socket *other);
 
         int (*socket_create) (int family, int type, int protocol, int kern);
@@ -1664,14 +1662,14 @@ int security_capset(struct cred *new, const struct cred *old,
                     const kernel_cap_t *effective,
                     const kernel_cap_t *inheritable,
                     const kernel_cap_t *permitted);
-int security_capable(int cap);
+int security_capable(const struct cred *cred, int cap);
 int security_real_capable(struct task_struct *tsk, int cap);
 int security_real_capable_noaudit(struct task_struct *tsk, int cap);
 int security_sysctl(struct ctl_table *table, int op);
 int security_quotactl(int cmds, int type, int id, struct super_block *sb);
 int security_quota_on(struct dentry *dentry);
 int security_syslog(int type);
-int security_settime(struct timespec *ts, struct timezone *tz);
+int security_settime(const struct timespec *ts, const struct timezone *tz);
 int security_vm_enough_memory(long pages);
 int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
 int security_vm_enough_memory_kern(long pages);
@@ -1713,6 +1711,7 @@ int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
 int security_inode_readlink(struct dentry *dentry);
 int security_inode_follow_link(struct dentry *dentry, struct nameidata *nd);
 int security_inode_permission(struct inode *inode, int mask);
+int security_inode_exec_permission(struct inode *inode, unsigned int flags);
 int security_inode_setattr(struct dentry *dentry, struct iattr *attr);
 int security_inode_getattr(struct vfsmount *mnt, struct dentry *dentry);
 int security_inode_setxattr(struct dentry *dentry, const char *name,
@@ -1857,9 +1856,9 @@ static inline int security_capset(struct cred *new,
         return cap_capset(new, old, effective, inheritable, permitted);
 }
 
-static inline int security_capable(int cap)
+static inline int security_capable(const struct cred *cred, int cap)
 {
-        return cap_capable(current, current_cred(), cap, SECURITY_CAP_AUDIT);
+        return cap_capable(current, cred, cap, SECURITY_CAP_AUDIT);
 }
 
 static inline int security_real_capable(struct task_struct *tsk, int cap)
@@ -1905,7 +1904,8 @@ static inline int security_syslog(int type)
         return 0;
 }
 
-static inline int security_settime(struct timespec *ts, struct timezone *tz)
+static inline int security_settime(const struct timespec *ts,
+                                   const struct timezone *tz)
 {
         return cap_settime(ts, tz);
 }
@@ -2102,6 +2102,12 @@ static inline int security_inode_permission(struct inode *inode, int mask)
         return 0;
 }
 
+static inline int security_inode_exec_permission(struct inode *inode,
+                                                  unsigned int flags)
+{
+        return 0;
+}
+
 static inline int security_inode_setattr(struct dentry *dentry,
                                           struct iattr *attr)
 {
@@ -2525,8 +2531,7 @@ static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32
 
 #ifdef CONFIG_SECURITY_NETWORK
 
-int security_unix_stream_connect(struct socket *sock, struct socket *other,
-                                 struct sock *newsk);
+int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
 int security_unix_may_send(struct socket *sock,  struct socket *other);
 int security_socket_create(int family, int type, int protocol, int kern);
 int security_socket_post_create(struct socket *sock, int family,
@@ -2567,8 +2572,8 @@ void security_tun_dev_post_create(struct sock *sk);
 int security_tun_dev_attach(struct sock *sk);
 
 #else   /* CONFIG_SECURITY_NETWORK */
-static inline int security_unix_stream_connect(struct socket *sock,
-                                               struct socket *other,
+static inline int security_unix_stream_connect(struct sock *sock,
+                                               struct sock *other,
                                                struct sock *newsk)
 {
         return 0;