security: remove dummy module

Remove the dummy module and make the "capability" module the default.

Compile and boot tested.

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>

5 files changed, 996 insertions, 1340 deletions

diff --git a/security/Kconfig b/security/Kconfig
index 49b51f964897..77def9f9f5f5 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -73,17 +73,9 @@ config SECURITY_NETWORK_XFRM
           IPSec.
           If you are unsure how to answer this question, answer N.
 
-config SECURITY_CAPABILITIES
-        bool "Default Linux Capabilities"
-        depends on SECURITY
-        default y
-        help
-          This enables the "default" Linux capabilities functionality.
-          If you are unsure how to answer this question, answer Y.
-
 config SECURITY_FILE_CAPABILITIES
         bool "File POSIX Capabilities (EXPERIMENTAL)"
-        depends on (SECURITY=n || SECURITY_CAPABILITIES!=n) && EXPERIMENTAL
+        depends on SECURITY && EXPERIMENTAL
         default n
         help
           This enables filesystem capabilities, allowing you to give
diff --git a/security/Makefile b/security/Makefile
index 7ef1107a7287..f65426099aa6 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -6,16 +6,13 @@ obj-$(CONFIG_KEYS)			+= keys/
 subdir-$(CONFIG_SECURITY_SELINUX)       += selinux
 subdir-$(CONFIG_SECURITY_SMACK)         += smack
 
-# if we don't select a security model, use the default capabilities
-ifneq ($(CONFIG_SECURITY),y)
+# always enable default capabilities
 obj-y           += commoncap.o
-endif
 
 # Object file lists
-obj-$(CONFIG_SECURITY)                  += security.o dummy.o inode.o
+obj-$(CONFIG_SECURITY)                  += security.o capability.o inode.o
 # Must precede capability.o in order to stack properly.
 obj-$(CONFIG_SECURITY_SELINUX)          += selinux/built-in.o
-obj-$(CONFIG_SECURITY_SMACK)            += commoncap.o smack/built-in.o
-obj-$(CONFIG_SECURITY_CAPABILITIES)     += commoncap.o capability.o
-obj-$(CONFIG_SECURITY_ROOTPLUG)         += commoncap.o root_plug.o
+obj-$(CONFIG_SECURITY_SMACK)            += smack/built-in.o
+obj-$(CONFIG_SECURITY_ROOTPLUG)         += root_plug.o
 obj-$(CONFIG_CGROUP_DEVICE)             += device_cgroup.o
diff --git a/security/capability.c b/security/capability.c
index 38ac54e3aed1..6e0671c82018 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -1,6 +1,8 @@
 /*
  *  Capabilities Linux Security Module
  *
+ *  This is the default security module in case no other module is loaded.
+ *
  *      This program is free software; you can redistribute it and/or modify
  *      it under the terms of the GNU General Public License as published by
  *      the Free Software Foundation; either version 2 of the License, or
@@ -8,75 +10,995 @@
  *
  */
 
-#include <linux/init.h>
-#include <linux/kernel.h>
 #include <linux/security.h>
-#include <linux/file.h>
-#include <linux/mm.h>
-#include <linux/mman.h>
-#include <linux/pagemap.h>
-#include <linux/swap.h>
-#include <linux/skbuff.h>
-#include <linux/netlink.h>
-#include <linux/ptrace.h>
-#include <linux/moduleparam.h>
-
-static struct security_operations capability_ops = {
-        .ptrace =                       cap_ptrace,
-        .capget =                       cap_capget,
-        .capset_check =                 cap_capset_check,
-        .capset_set =                   cap_capset_set,
-        .capable =                      cap_capable,
-        .settime =                      cap_settime,
-        .netlink_send =                 cap_netlink_send,
-        .netlink_recv =                 cap_netlink_recv,
-
-        .bprm_apply_creds =             cap_bprm_apply_creds,
-        .bprm_set_security =            cap_bprm_set_security,
-        .bprm_secureexec =              cap_bprm_secureexec,
-
-        .inode_setxattr =               cap_inode_setxattr,
-        .inode_removexattr =            cap_inode_removexattr,
-        .inode_need_killpriv =          cap_inode_need_killpriv,
-        .inode_killpriv =               cap_inode_killpriv,
-
-        .task_setscheduler =            cap_task_setscheduler,
-        .task_setioprio =               cap_task_setioprio,
-        .task_setnice =                 cap_task_setnice,
-        .task_post_setuid =             cap_task_post_setuid,
-        .task_prctl =                   cap_task_prctl,
-        .task_reparent_to_init =        cap_task_reparent_to_init,
-
-        .syslog =                       cap_syslog,
-
-        .vm_enough_memory =             cap_vm_enough_memory,
-};
 
-/* flag to keep track of how we were registered */
-static int secondary;
+static int cap_acct(struct file *file)
+{
+        return 0;
+}
+
+static int cap_sysctl(ctl_table *table, int op)
+{
+        return 0;
+}
+
+static int cap_quotactl(int cmds, int type, int id, struct super_block *sb)
+{
+        return 0;
+}
+
+static int cap_quota_on(struct dentry *dentry)
+{
+        return 0;
+}
+
+static int cap_bprm_alloc_security(struct linux_binprm *bprm)
+{
+        return 0;
+}
+
+static void cap_bprm_free_security(struct linux_binprm *bprm)
+{
+}
+
+static void cap_bprm_post_apply_creds(struct linux_binprm *bprm)
+{
+}
+
+static int cap_bprm_check_security(struct linux_binprm *bprm)
+{
+        return 0;
+}
+
+static int cap_sb_alloc_security(struct super_block *sb)
+{
+        return 0;
+}
+
+static void cap_sb_free_security(struct super_block *sb)
+{
+}
+
+static int cap_sb_copy_data(char *orig, char *copy)
+{
+        return 0;
+}
+
+static int cap_sb_kern_mount(struct super_block *sb, void *data)
+{
+        return 0;
+}
+
+static int cap_sb_show_options(struct seq_file *m, struct super_block *sb)
+{
+        return 0;
+}
+
+static int cap_sb_statfs(struct dentry *dentry)
+{
+        return 0;
+}
+
+static int cap_sb_mount(char *dev_name, struct path *path, char *type,
+                        unsigned long flags, void *data)
+{
+        return 0;
+}
+
+static int cap_sb_check_sb(struct vfsmount *mnt, struct path *path)
+{
+        return 0;
+}
+
+static int cap_sb_umount(struct vfsmount *mnt, int flags)
+{
+        return 0;
+}