4 files changed, 13 insertions, 43 deletions

diff --git a/kernel/fork.c b/kernel/fork.c
index 1160f87ba700..2b55b74cd999 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1118,6 +1118,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 #ifdef CONFIG_SECURITY
         p->security = NULL;
 #endif
+        p->cap_bset = current->cap_bset;
         p->io_context = NULL;
         p->audit_context = NULL;
         cgroup_fork(p);
diff --git a/kernel/sys.c b/kernel/sys.c
index d1fe71eb4546..4162d12390b6 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1637,7 +1637,7 @@ asmlinkage long sys_umask(int mask)
         mask = xchg(&current->fs->umask, mask & S_IRWXUGO);
         return mask;
 }
-    
+
 asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
                           unsigned long arg4, unsigned long arg5)
 {
@@ -1742,6 +1742,17 @@ asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
                         error = prctl_set_seccomp(arg2);
                         break;
 
+                case PR_CAPBSET_READ:
+                        if (!cap_valid(arg2))
+                                return -EINVAL;
+                        return !!cap_raised(current->cap_bset, arg2);
+                case PR_CAPBSET_DROP:
+#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+                        return cap_prctl_drop(arg2);
+#else
+                        return -EINVAL;
+#endif
+
                 default:
                         error = -EINVAL;
                         break;
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index d0b47b859067..5e2ad5bf88e2 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -419,15 +419,6 @@ static struct ctl_table kern_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
 #endif
-#ifdef CONFIG_SECURITY_CAPABILITIES
-        {
-                .procname       = "cap-bound",
-                .data           = &cap_bset,
-                .maxlen         = sizeof(kernel_cap_t),
-                .mode           = 0600,
-                .proc_handler   = &proc_dointvec_bset,
-        },
-#endif /* def CONFIG_SECURITY_CAPABILITIES */
 #ifdef CONFIG_BLK_DEV_INITRD
         {
                 .ctl_name       = KERN_REALROOTDEV,
@@ -2096,26 +2087,6 @@ static int do_proc_dointvec_bset_conv(int *negp, unsigned long *lvalp,
         return 0;
 }
 
-#ifdef CONFIG_SECURITY_CAPABILITIES
-/*
- *      init may raise the set.
- */
-
-int proc_dointvec_bset(struct ctl_table *table, int write, struct file *filp,
-                        void __user *buffer, size_t *lenp, loff_t *ppos)
-{
-        int op;
-
-        if (write && !capable(CAP_SYS_MODULE)) {
-                return -EPERM;
-        }
-
-        op = is_global_init(current) ? OP_SET : OP_AND;
-        return do_proc_dointvec(table,write,filp,buffer,lenp,ppos,
-                                do_proc_dointvec_bset_conv,&op);
-}
-#endif /* def CONFIG_SECURITY_CAPABILITIES */
-
 /*
  *      Taint values can only be increased
  */
@@ -2529,12 +2500,6 @@ int proc_dointvec(struct ctl_table *table, int write, struct file *filp,
         return -ENOSYS;
 }
 
-int proc_dointvec_bset(struct ctl_table *table, int write, struct file *filp,
-                        void __user *buffer, size_t *lenp, loff_t *ppos)
-{
-        return -ENOSYS;
-}
-
 int proc_dointvec_minmax(struct ctl_table *table, int write, struct file *filp,
                     void __user *buffer, size_t *lenp, loff_t *ppos)
 {
diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
index c3206fa50048..006365b69eaf 100644
--- a/kernel/sysctl_check.c
+++ b/kernel/sysctl_check.c
@@ -37,10 +37,6 @@ static struct trans_ctl_table trans_kern_table[] = {
         { KERN_NODENAME,                "hostname" },
         { KERN_DOMAINNAME,              "domainname" },
 
-#ifdef CONFIG_SECURITY_CAPABILITIES
-        { KERN_CAP_BSET,                "cap-bound" },
-#endif /* def CONFIG_SECURITY_CAPABILITIES */
-
         { KERN_PANIC,                   "panic" },
         { KERN_REALROOTDEV,             "real-root-dev" },
 
@@ -1498,9 +1494,6 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
                             (table->strategy == sysctl_ms_jiffies) ||
                             (table->proc_handler == proc_dostring) ||
                             (table->proc_handler == proc_dointvec) ||
-#ifdef CONFIG_SECURITY_CAPABILITIES
-                            (table->proc_handler == proc_dointvec_bset) ||
-#endif /* def CONFIG_SECURITY_CAPABILITIES */
                             (table->proc_handler == proc_dointvec_minmax) ||
                             (table->proc_handler == proc_dointvec_jiffies) ||
                             (table->proc_handler == proc_dointvec_userhz_jiffies) ||