1 files changed, 35 insertions, 33 deletions

diff --git a/include/linux/security.h b/include/linux/security.h
index fea1f4aa4dd5..e6299e50e210 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -34,8 +34,6 @@
 #include <linux/xfrm.h>
 #include <net/flow.h>
 
-extern unsigned securebits;
-
 /* Maximum number of letters for an LSM name string */
 #define SECURITY_NAME_MAX       10
 
@@ -61,6 +59,8 @@ extern int cap_inode_need_killpriv(struct dentry *dentry);
 extern int cap_inode_killpriv(struct dentry *dentry);
 extern int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid, int flags);
 extern void cap_task_reparent_to_init (struct task_struct *p);
+extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
+                          unsigned long arg4, unsigned long arg5, long *rc_p);
 extern int cap_task_setscheduler (struct task_struct *p, int policy, struct sched_param *lp);
 extern int cap_task_setioprio (struct task_struct *p, int ioprio);
 extern int cap_task_setnice (struct task_struct *p, int nice);
@@ -230,7 +230,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      loopback/bind mount (@flags & MS_BIND), @dev_name identifies the
  *      pathname of the object being mounted.
  *      @dev_name contains the name for object being mounted.
- *      @nd contains the nameidata structure for mount point object.
+ *      @path contains the path for mount point object.
  *      @type contains the filesystem type.
  *      @flags contains the mount flags.
  *      @data contains the filesystem-specific data.
@@ -249,7 +249,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      Check permission before the device with superblock @mnt->sb is mounted
  *      on the mount point named by @nd.
  *      @mnt contains the vfsmount for device being mounted.
- *      @nd contains the nameidata object for the mount point.
+ *      @path contains the path for the mount point.
  *      Return 0 if permission is granted.
  * @sb_umount:
  *      Check permission before the @mnt file system is unmounted.
@@ -278,16 +278,16 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      This hook is called any time a mount is successfully grafetd to
  *      the tree.
  *      @mnt contains the mounted filesystem.
- *      @mountpoint_nd contains the nameidata structure for the mount point.
+ *      @mountpoint contains the path for the mount point.
  * @sb_pivotroot:
  *      Check permission before pivoting the root filesystem.
- *      @old_nd contains the nameidata structure for the new location of the current root (put_old).
- *      @new_nd contains the nameidata structure for the new root (new_root).
+ *      @old_path contains the path for the new location of the current root (put_old).
+ *      @new_path contains the path for the new root (new_root).
  *      Return 0 if permission is granted.
  * @sb_post_pivotroot:
  *      Update module state after a successful pivot.
- *      @old_nd contains the nameidata structure for the old root.
- *      @new_nd contains the nameidata structure for the new root.
+ *      @old_path contains the path for the old root.
+ *      @new_path contains the path for the new root.
  * @sb_get_mnt_opts:
  *      Get the security relevant mount options used for a superblock
  *      @sb the superblock to get security mount options from
@@ -720,7 +720,9 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      @arg3 contains a argument.
  *      @arg4 contains a argument.
  *      @arg5 contains a argument.
- *      Return 0 if permission is granted.
+ *      @rc_p contains a pointer to communicate back the forced return code
+ *      Return 0 if permission is granted, and non-zero if the security module
+ *      has taken responsibility (setting *rc_p) for the prctl call.
  * @task_reparent_to_init:
  *      Set the security attributes in @p->security for a kernel thread that
  *      is being reparented to the init task.
@@ -1315,20 +1317,20 @@ struct security_operations {
         int (*sb_copy_data)(char *orig, char *copy);
         int (*sb_kern_mount) (struct super_block *sb, void *data);
         int (*sb_statfs) (struct dentry *dentry);
-        int (*sb_mount) (char *dev_name, struct nameidata * nd,
+        int (*sb_mount) (char *dev_name, struct path *path,
                          char *type, unsigned long flags, void *data);
-        int (*sb_check_sb) (struct vfsmount * mnt, struct nameidata * nd);
+        int (*sb_check_sb) (struct vfsmount * mnt, struct path *path);
         int (*sb_umount) (struct vfsmount * mnt, int flags);
         void (*sb_umount_close) (struct vfsmount * mnt);
         void (*sb_umount_busy) (struct vfsmount * mnt);
         void (*sb_post_remount) (struct vfsmount * mnt,
                                  unsigned long flags, void *data);
         void (*sb_post_addmount) (struct vfsmount * mnt,
-                                  struct nameidata * mountpoint_nd);
-        int (*sb_pivotroot) (struct nameidata * old_nd,
-                             struct nameidata * new_nd);
-        void (*sb_post_pivotroot) (struct nameidata * old_nd,
-                                   struct nameidata * new_nd);
+                                  struct path *mountpoint);
+        int (*sb_pivotroot) (struct path *old_path,
+                             struct path *new_path);
+        void (*sb_post_pivotroot) (struct path *old_path,
+                                   struct path *new_path);
         int (*sb_get_mnt_opts) (const struct super_block *sb,
                                 struct security_mnt_opts *opts);
         int (*sb_set_mnt_opts) (struct super_block *sb,
@@ -1420,7 +1422,7 @@ struct security_operations {
         int (*task_wait) (struct task_struct * p);
         int (*task_prctl) (int option, unsigned long arg2,
                            unsigned long arg3, unsigned long arg4,
-                           unsigned long arg5);
+                           unsigned long arg5, long *rc_p);
         void (*task_reparent_to_init) (struct task_struct * p);
         void (*task_to_inode)(struct task_struct *p, struct inode *inode);
 
@@ -1593,16 +1595,16 @@ void security_sb_free(struct super_block *sb);
 int security_sb_copy_data(char *orig, char *copy);
 int security_sb_kern_mount(struct super_block *sb, void *data);
 int security_sb_statfs(struct dentry *dentry);
-int security_sb_mount(char *dev_name, struct nameidata *nd,
+int security_sb_mount(char *dev_name, struct path *path,
                        char *type, unsigned long flags, void *data);
-int security_sb_check_sb(struct vfsmount *mnt, struct nameidata *nd);
+int security_sb_check_sb(struct vfsmount *mnt, struct path *path);
 int security_sb_umount(struct vfsmount *mnt, int flags);
 void security_sb_umount_close(struct vfsmount *mnt);
 void security_sb_umount_busy(struct vfsmount *mnt);
 void security_sb_post_remount(struct vfsmount *mnt, unsigned long flags, void *data);
-void security_sb_post_addmount(struct vfsmount *mnt, struct nameidata *mountpoint_nd);
-int security_sb_pivotroot(struct nameidata *old_nd, struct nameidata *new_nd);
-void security_sb_post_pivotroot(struct nameidata *old_nd, struct nameidata *new_nd);
+void security_sb_post_addmount(struct vfsmount *mnt, struct path *mountpoint);
+int security_sb_pivotroot(struct path *old_path, struct path *new_path);
+void security_sb_post_pivotroot(struct path *old_path, struct path *new_path);
 int security_sb_get_mnt_opts(const struct super_block *sb,
                                 struct security_mnt_opts *opts);
 int security_sb_set_mnt_opts(struct super_block *sb, struct security_mnt_opts *opts);
@@ -1684,7 +1686,7 @@ int security_task_kill(struct task_struct *p, struct siginfo *info,
                         int sig, u32 secid);
 int security_task_wait(struct task_struct *p);
 int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
-                         unsigned long arg4, unsigned long arg5);
+                         unsigned long arg4, unsigned long arg5, long *rc_p);
 void security_task_reparent_to_init(struct task_struct *p);
 void security_task_to_inode(struct task_struct *p, struct inode *inode);
 int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
@@ -1872,7 +1874,7 @@ static inline int security_sb_statfs (struct dentry *dentry)
         return 0;
 }
 
-static inline int security_sb_mount (char *dev_name, struct nameidata *nd,
+static inline int security_sb_mount (char *dev_name, struct path *path,
                                     char *type, unsigned long flags,
                                     void *data)
 {
@@ -1880,7 +1882,7 @@ static inline int security_sb_mount (char *dev_name, struct nameidata *nd,
 }
 
 static inline int security_sb_check_sb (struct vfsmount *mnt,
-                                        struct nameidata *nd)
+                                        struct path *path)
 {
         return 0;
 }
@@ -1901,17 +1903,17 @@ static inline void security_sb_post_remount (struct vfsmount *mnt,
 { }
 
 static inline void security_sb_post_addmount (struct vfsmount *mnt,
-                                              struct nameidata *mountpoint_nd)
+                                              struct path *mountpoint)
 { }
 
-static inline int security_sb_pivotroot (struct nameidata *old_nd,
-                                         struct nameidata *new_nd)
+static inline int security_sb_pivotroot (struct path *old_path,
+                                         struct path *new_path)
 {
         return 0;
 }
 
-static inline void security_sb_post_pivotroot (struct nameidata *old_nd,
-                                               struct nameidata *new_nd)
+static inline void security_sb_post_pivotroot (struct path *old_path,
+                                               struct path *new_path)
 { }
 static inline int security_sb_get_mnt_opts(const struct super_block *sb,
                                            struct security_mnt_opts *opts)
@@ -2271,9 +2273,9 @@ static inline int security_task_wait (struct task_struct *p)
 static inline int security_task_prctl (int option, unsigned long arg2,
                                        unsigned long arg3,
                                        unsigned long arg4,
-                                       unsigned long arg5)
+                                       unsigned long arg5, long *rc_p)
 {
-        return 0;
+        return cap_task_prctl(option, arg2, arg3, arg3, arg5, rc_p);
 }
 
 static inline void security_task_reparent_to_init (struct task_struct *p)