1 files changed, 48 insertions, 84 deletions

diff --git a/include/linux/security.h b/include/linux/security.h
index 19d8e04e1688..83c18e8c846d 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -54,8 +54,8 @@ struct user_namespace;
  * These functions are in security/capability.c and are used
  * as the default capabilities functions
  */
-extern int cap_capable(struct task_struct *tsk, const struct cred *cred,
-                       struct user_namespace *ns, int cap, int audit);
+extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
+                       int cap, int audit);
 extern int cap_settime(const struct timespec *ts, const struct timezone *tz);
 extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode);
 extern int cap_ptrace_traceme(struct task_struct *parent);
@@ -96,7 +96,6 @@ struct xfrm_user_sec_ctx;
 struct seq_file;
 
 extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);
-extern int cap_netlink_recv(struct sk_buff *skb, int cap);
 
 void reset_security_ops(void);
 
@@ -186,7 +185,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  * Security module identifier.
  *
  * @name:
- *      A string that acts as a unique identifeir for the LSM with max number
+ *      A string that acts as a unique identifier for the LSM with max number
  *      of characters = SECURITY_NAME_MAX.
  *
  * Security hooks for program execution operations.
@@ -275,7 +274,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      @copy copied data which will be passed to the security module.
  *      Returns 0 if the copy was successful.
  * @sb_remount:
- *      Extracts security system specifc mount options and verifys no changes
+ *      Extracts security system specific mount options and verifies no changes
  *      are being made to those options.
  *      @sb superblock being remounted
  *      @data contains the filesystem-specific data.
@@ -380,15 +379,15 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      Return 0 if permission is granted.
  * @inode_mkdir:
  *      Check permissions to create a new directory in the existing directory
- *      associated with inode strcture @dir.
- *      @dir containst the inode structure of parent of the directory to be created.
+ *      associated with inode structure @dir.
+ *      @dir contains the inode structure of parent of the directory to be created.
  *      @dentry contains the dentry structure of new directory.
  *      @mode contains the mode of new directory.
  *      Return 0 if permission is granted.
  * @path_mkdir:
  *      Check permissions to create a new directory in the existing directory
- *      associated with path strcture @path.
- *      @dir containst the path structure of parent of the directory
+ *      associated with path structure @path.
+ *      @dir contains the path structure of parent of the directory
  *      to be created.
  *      @dentry contains the dentry structure of new directory.
  *      @mode contains the mode of new directory.
@@ -578,7 +577,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      @file contains the file structure.
  *      @cmd contains the operation to perform.
  *      @arg contains the operational arguments.
- *      Check permission for an ioctl operation on @file.  Note that @arg can
+ *      Check permission for an ioctl operation on @file.  Note that @arg
  *      sometimes represents a user space pointer; in other cases, it may be a
  *      simple integer value.  When @arg represents a user space pointer, it
  *      should never be used by the security module.
@@ -590,6 +589,8 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      @reqprot contains the protection requested by the application.
  *      @prot contains the protection that will be applied by the kernel.
  *      @flags contains the operational flags.
+ *      @addr contains virtual address that will be used for the operation.
+ *      @addr_only contains a boolean: 0 if file-backed VMA, otherwise 1.
  *      Return 0 if permission is granted.
  * @file_mprotect:
  *      Check permissions before changing memory access permissions.
@@ -606,7 +607,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      Return 0 if permission is granted.
  * @file_fcntl:
  *      Check permission before allowing the file operation specified by @cmd
- *      from being performed on the file @file.  Note that @arg can sometimes
+ *      from being performed on the file @file.  Note that @arg sometimes
  *      represents a user space pointer; in other cases, it may be a simple
  *      integer value.  When @arg represents a user space pointer, it should
  *      never be used by the security module.
@@ -793,16 +794,10 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      information can be saved using the eff_cap field of the
  *      netlink_skb_parms structure.  Also may be used to provide fine
  *      grained control over message transmission.
- *      @sk associated sock of task sending the message.,
+ *      @sk associated sock of task sending the message.
  *      @skb contains the sk_buff structure for the netlink message.
  *      Return 0 if the information was successfully saved and message
  *      is allowed to be transmitted.
- * @netlink_recv:
- *      Check permission before processing the received netlink message in
- *      @skb.
- *      @skb contains the sk_buff structure for the netlink message.
- *      @cap indicates the capability required
- *      Return 0 if permission is granted.
  *
  * Security hooks for Unix domain networking.
  *
@@ -1080,9 +1075,9 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      should free it.
  *      @key points to the key to be queried.
  *      @_buffer points to a pointer that should be set to point to the
- *       resulting string (if no label or an error occurs).
+ *      resulting string (if no label or an error occurs).
  *      Return the length of the string (including terminating NUL) or -ve if
- *      an error.
+ *      an error.
  *      May also return 0 (and a NULL buffer pointer) if there is no label.
  *
  * Security hooks affecting all System V IPC operations.
@@ -1266,9 +1261,8 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  * @capable:
  *      Check whether the @tsk process has the @cap capability in the indicated
  *      credentials.
- *      @tsk contains the task_struct for the process.
  *      @cred contains the credentials to use.
- *      @ns contains the user namespace we want the capability in
+ *      @ns contains the user namespace we want the capability in
  *      @cap contains the capability <include/linux/capability.h>.
  *      @audit: Whether to write an audit message or not
  *      Return 0 if the capability is granted for @tsk.
@@ -1370,7 +1364,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      @ctxlen contains the length of @ctx.
  *
  * @inode_getsecctx:
- *      Returns a string containing all relavent security context information
+ *      Returns a string containing all relevant security context information
  *
  *      @inode we wish to get the security context of.
  *      @ctx is a pointer in which to place the allocated security context.
@@ -1390,8 +1384,8 @@ struct security_operations {
                        const kernel_cap_t *effective,
                        const kernel_cap_t *inheritable,
                        const kernel_cap_t *permitted);
-        int (*capable) (struct task_struct *tsk, const struct cred *cred,
-                        struct user_namespace *ns, int cap, int audit);
+        int (*capable) (const struct cred *cred, struct user_namespace *ns,
+                        int cap, int audit);
         int (*quotactl) (int cmds, int type, int id, struct super_block *sb);
         int (*quota_on) (struct dentry *dentry);
         int (*syslog) (int type);
@@ -1424,9 +1418,9 @@ struct security_operations {
 
 #ifdef CONFIG_SECURITY_PATH
         int (*path_unlink) (struct path *dir, struct dentry *dentry);
-        int (*path_mkdir) (struct path *dir, struct dentry *dentry, int mode);
+        int (*path_mkdir) (struct path *dir, struct dentry *dentry, umode_t mode);
         int (*path_rmdir) (struct path *dir, struct dentry *dentry);
-        int (*path_mknod) (struct path *dir, struct dentry *dentry, int mode,
+        int (*path_mknod) (struct path *dir, struct dentry *dentry, umode_t mode,
                            unsigned int dev);
         int (*path_truncate) (struct path *path);
         int (*path_symlink) (struct path *dir, struct dentry *dentry,
@@ -1435,8 +1429,7 @@ struct security_operations {
                           struct dentry *new_dentry);
         int (*path_rename) (struct path *old_dir, struct dentry *old_dentry,
                             struct path *new_dir, struct dentry *new_dentry);
-        int (*path_chmod) (struct dentry *dentry, struct vfsmount *mnt,
-                           mode_t mode);
+        int (*path_chmod) (struct path *path, umode_t mode);
         int (*path_chown) (struct path *path, uid_t uid, gid_t gid);
         int (*path_chroot) (struct path *path);
 #endif
@@ -1447,16 +1440,16 @@ struct security_operations {
                                     const struct qstr *qstr, char **name,
                                     void **value, size_t *len);
         int (*inode_create) (struct inode *dir,
-                             struct dentry *dentry, int mode);
+                             struct dentry *dentry, umode_t mode);
         int (*inode_link) (struct dentry *old_dentry,
                            struct inode *dir, struct dentry *new_dentry);
         int (*inode_unlink) (struct inode *dir, struct dentry *dentry);
         int (*inode_symlink) (struct inode *dir,
                               struct dentry *dentry, const char *old_name);
-        int (*inode_mkdir) (struct inode *dir, struct dentry *dentry, int mode);
+        int (*inode_mkdir) (struct inode *dir, struct dentry *dentry, umode_t mode);
         int (*inode_rmdir) (struct inode *dir, struct dentry *dentry);
         int (*inode_mknod) (struct inode *dir, struct dentry *dentry,
-                            int mode, dev_t dev);
+                            umode_t mode, dev_t dev);
         int (*inode_rename) (struct inode *old_dir, struct dentry *old_dentry,
                              struct inode *new_dir, struct dentry *new_dentry);
         int (*inode_readlink) (struct dentry *dentry);
@@ -1562,7 +1555,6 @@ struct security_operations {
                           struct sembuf *sops, unsigned nsops, int alter);
 
         int (*netlink_send) (struct sock *sk, struct sk_buff *skb);
-        int (*netlink_recv) (struct sk_buff *skb, int cap);
 
         void (*d_instantiate) (struct dentry *dentry, struct inode *inode);
 
@@ -1674,12 +1666,10 @@ int security_capset(struct cred *new, const struct cred *old,
                     const kernel_cap_t *effective,
                     const kernel_cap_t *inheritable,
                     const kernel_cap_t *permitted);
-int security_capable(struct user_namespace *ns, const struct cred *cred,
+int security_capable(const struct cred *cred, struct user_namespace *ns,
                         int cap);
-int security_real_capable(struct task_struct *tsk, struct user_namespace *ns,
-                        int cap);
-int security_real_capable_noaudit(struct task_struct *tsk,
-                        struct user_namespace *ns, int cap);
+int security_capable_noaudit(const struct cred *cred, struct user_namespace *ns,
+                             int cap);
 int security_quotactl(int cmds, int type, int id, struct super_block *sb);
 int security_quota_on(struct dentry *dentry);
 int security_syslog(int type);
@@ -1716,15 +1706,15 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
 int security_old_inode_init_security(struct inode *inode, struct inode *dir,
                                      const struct qstr *qstr, char **name,
                                      void **value, size_t *len);
-int security_inode_create(struct inode *dir, struct dentry *dentry, int mode);
+int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
 int security_inode_link(struct dentry *old_dentry, struct inode *dir,
                          struct dentry *new_dentry);
 int security_inode_unlink(struct inode *dir, struct dentry *dentry);
 int security_inode_symlink(struct inode *dir, struct dentry *dentry,
                            const char *old_name);
-int security_inode_mkdir(struct inode *dir, struct dentry *dentry, int mode);
+int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
 int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
-int security_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev);
+int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);
 int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
                           struct inode *new_dir, struct dentry *new_dentry);
 int security_inode_readlink(struct dentry *dentry);
@@ -1816,7 +1806,6 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode);
 int security_getprocattr(struct task_struct *p, char *name, char **value);
 int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size);
 int security_netlink_send(struct sock *sk, struct sk_buff *skb);
-int security_netlink_recv(struct sk_buff *skb, int cap);
 int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
 int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
 void security_release_secctx(char *secdata, u32 seclen);
@@ -1874,32 +1863,15 @@ static inline int security_capset(struct cred *new,
         return cap_capset(new, old, effective, inheritable, permitted);
 }
 
-static inline int security_capable(struct user_namespace *ns,
-                                   const struct cred *cred, int cap)
+static inline int security_capable(const struct cred *cred,
+                                   struct user_namespace *ns, int cap)
 {
-        return cap_capable(current, cred, ns, cap, SECURITY_CAP_AUDIT);
-}
-
-static inline int security_real_capable(struct task_struct *tsk, struct user_namespace *ns, int cap)
-{
-        int ret;
-
-        rcu_read_lock();
-        ret = cap_capable(tsk, __task_cred(tsk), ns, cap, SECURITY_CAP_AUDIT);
-        rcu_read_unlock();
-        return ret;
+        return cap_capable(cred, ns, cap, SECURITY_CAP_AUDIT);
 }
 
-static inline
-int security_real_capable_noaudit(struct task_struct *tsk, struct user_namespace *ns, int cap)
-{
-        int ret;
-
-        rcu_read_lock();
-        ret = cap_capable(tsk, __task_cred(tsk), ns, cap,
-                               SECURITY_CAP_NOAUDIT);
-        rcu_read_unlock();
-        return ret;
+static inline int security_capable_noaudit(const struct cred *cred,
+                                           struct user_namespace *ns, int cap) {
+        return cap_capable(cred, ns, cap, SECURITY_CAP_NOAUDIT);
 }
 
 static inline int security_quotactl(int cmds, int type, int id,
@@ -2044,7 +2016,7 @@ static inline void security_inode_free(struct inode *inode)
 static inline int security_inode_init_security(struct inode *inode,
                                                 struct inode *dir,
                                                 const struct qstr *qstr,
-                                                initxattrs initxattrs,
+                                                const initxattrs initxattrs,
                                                 void *fs_data)
 {
         return 0;
@@ -2056,12 +2028,12 @@ static inline int security_old_inode_init_security(struct inode *inode,
                                                    char **name, void **value,
                                                    size_t *len)
 {
-        return 0;
+        return -EOPNOTSUPP;
 }
 
 static inline int security_inode_create(struct inode *dir,
                                          struct dentry *dentry,
-                                         int mode)
+                                         umode_t mode)
 {
         return 0;
 }
@@ -2516,11 +2488,6 @@ static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)
         return cap_netlink_send(sk, skb);
 }
 
-static inline int security_netlink_recv(struct sk_buff *skb, int cap)
-{
-        return cap_netlink_recv(skb, cap);
-}
-
 static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
 {
         return -EOPNOTSUPP;
@@ -2855,9 +2822,9 @@ static inline void security_skb_classify_flow(struct sk_buff *skb, struct flowi
 
 #ifdef CONFIG_SECURITY_PATH
 int security_path_unlink(struct path *dir, struct dentry *dentry);
-int security_path_mkdir(struct path *dir, struct dentry *dentry, int mode);
+int security_path_mkdir(struct path *dir, struct dentry *dentry, umode_t mode);
 int security_path_rmdir(struct path *dir, struct dentry *dentry);
-int security_path_mknod(struct path *dir, struct dentry *dentry, int mode,
+int security_path_mknod(struct path *dir, struct dentry *dentry, umode_t mode,
                         unsigned int dev);
 int security_path_truncate(struct path *path);
 int security_path_symlink(struct path *dir, struct dentry *dentry,
@@ -2866,8 +2833,7 @@ int security_path_link(struct dentry *old_dentry, struct path *new_dir,
                        struct dentry *new_dentry);
 int security_path_rename(struct path *old_dir, struct dentry *old_dentry,
                          struct path *new_dir, struct dentry *new_dentry);
-int security_path_chmod(struct dentry *dentry, struct vfsmount *mnt,
-                        mode_t mode);
+int security_path_chmod(struct path *path, umode_t mode);
 int security_path_chown(struct path *path, uid_t uid, gid_t gid);
 int security_path_chroot(struct path *path);
 #else   /* CONFIG_SECURITY_PATH */
@@ -2877,7 +2843,7 @@ static inline int security_path_unlink(struct path *dir, struct dentry *dentry)
 }
 
 static inline int security_path_mkdir(struct path *dir, struct dentry *dentry,
-                                      int mode)
+                                      umode_t mode)
 {
         return 0;
 }
@@ -2888,7 +2854,7 @@ static inline int security_path_rmdir(struct path *dir, struct dentry *dentry)
 }
 
 static inline int security_path_mknod(struct path *dir, struct dentry *dentry,
-                                      int mode, unsigned int dev)
+                                      umode_t mode, unsigned int dev)
 {
         return 0;
 }
@@ -2919,9 +2885,7 @@ static inline int security_path_rename(struct path *old_dir,
         return 0;
 }
 
-static inline int security_path_chmod(struct dentry *dentry,
-                                      struct vfsmount *mnt,
-                                      mode_t mode)
+static inline int security_path_chmod(struct path *path, umode_t mode)
 {
         return 0;
 }
@@ -3010,7 +2974,7 @@ static inline void security_audit_rule_free(void *lsmrule)
 
 #ifdef CONFIG_SECURITYFS
 
-extern struct dentry *securityfs_create_file(const char *name, mode_t mode,
+extern struct dentry *securityfs_create_file(const char *name, umode_t mode,
                                              struct dentry *parent, void *data,
                                              const struct file_operations *fops);
 extern struct dentry *securityfs_create_dir(const char *name, struct dentry *parent);
@@ -3025,7 +2989,7 @@ static inline struct dentry *securityfs_create_dir(const char *name,
 }
 
 static inline struct dentry *securityfs_create_file(const char *name,
-                                                    mode_t mode,
+                                                    umode_t mode,
                                                     struct dentry *parent,
                                                     void *data,
                                                     const struct file_operations *fops)