1 files changed, 10 insertions, 73 deletions

diff --git a/security/commoncap.c b/security/commoncap.c
index fe30751a6cd9..61669730da98 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -1,4 +1,4 @@
-/* Common capabilities, needed by capability.o and root_plug.o
+/* Common capabilities, needed by capability.o.
  *
  *      This program is free software; you can redistribute it and/or modify
  *      it under the terms of the GNU General Public License as published by
@@ -27,6 +27,7 @@
 #include <linux/sched.h>
 #include <linux/prctl.h>
 #include <linux/securebits.h>
+#include <linux/syslog.h>
 
 /*
  * If a non-root user executes a setuid-root binary in
@@ -173,7 +174,6 @@ int cap_capget(struct task_struct *target, kernel_cap_t *effective,
  */
 static inline int cap_inh_is_capped(void)
 {
-#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
 
         /* they are so limited unless the current task has the CAP_SETPCAP
          * capability
@@ -181,7 +181,6 @@ static inline int cap_inh_is_capped(void)
         if (cap_capable(current, current_cred(), CAP_SETPCAP,
                         SECURITY_CAP_AUDIT) == 0)
                 return 0;
-#endif
         return 1;
 }
 
@@ -239,8 +238,6 @@ static inline void bprm_clear_caps(struct linux_binprm *bprm)
         bprm->cap_effective = false;
 }
 
-#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
-
 /**
  * cap_inode_need_killpriv - Determine if inode change affects privileges
  * @dentry: The inode/dentry in being changed with change marked ATTR_KILL_PRIV
@@ -421,49 +418,6 @@ out:
         return rc;
 }
 
-#else
-int cap_inode_need_killpriv(struct dentry *dentry)
-{
-        return 0;
-}
-
-int cap_inode_killpriv(struct dentry *dentry)
-{
-        return 0;
-}
-
-int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
-{
-        memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
-        return -ENODATA;
-}
-
-static inline int get_file_caps(struct linux_binprm *bprm, bool *effective)
-{
-        bprm_clear_caps(bprm);
-        return 0;
-}
-#endif
-
-/*
- * Determine whether a exec'ing process's new permitted capabilities should be
- * limited to just what it already has.
- *
- * This prevents processes that are being ptraced from gaining access to
- * CAP_SETPCAP, unless the process they're tracing already has it, and the
- * binary they're executing has filecaps that elevate it.
- *
- *  Returns 1 if they should be limited, 0 if they are not.
- */
-static inline int cap_limit_ptraced_target(void)
-{
-#ifndef CONFIG_SECURITY_FILE_CAPABILITIES
-        if (capable(CAP_SETPCAP))
-                return 0;
-#endif
-        return 1;
-}
-
 /**
  * cap_bprm_set_creds - Set up the proposed credentials for execve().
  * @bprm: The execution parameters, including the proposed creds
@@ -523,9 +477,8 @@ skip:
                         new->euid = new->uid;
                         new->egid = new->gid;
                 }
-                if (cap_limit_ptraced_target())
-                        new->cap_permitted = cap_intersect(new->cap_permitted,
-                                                           old->cap_permitted);
+                new->cap_permitted = cap_intersect(new->cap_permitted,
+                                                   old->cap_permitted);
         }
 
         new->suid = new->fsuid = new->euid;
@@ -739,7 +692,6 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
         return 0;
 }
 
-#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
 /*
  * Rationale: code calling task_setscheduler, task_setioprio, and
  * task_setnice, assumes that
@@ -820,22 +772,6 @@ static long cap_prctl_drop(struct cred *new, unsigned long cap)
         return 0;
 }
 
-#else
-int cap_task_setscheduler (struct task_struct *p, int policy,
-                           struct sched_param *lp)
-{
-        return 0;
-}
-int cap_task_setioprio (struct task_struct *p, int ioprio)
-{
-        return 0;
-}
-int cap_task_setnice (struct task_struct *p, int nice)
-{
-        return 0;
-}
-#endif
-
 /**
  * cap_task_prctl - Implement process control functions for this security module
  * @option: The process control function requested
@@ -866,7 +802,6 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                 error = !!cap_raised(new->cap_bset, arg2);
                 goto no_change;
 
-#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
         case PR_CAPBSET_DROP:
                 error = cap_prctl_drop(new, arg2);
                 if (error < 0)
@@ -917,8 +852,6 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                 error = new->securebits;
                 goto no_change;
 
-#endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
-
         case PR_GET_KEEPCAPS:
                 if (issecure(SECURE_KEEP_CAPS))
                         error = 1;
@@ -956,13 +889,17 @@ error:
 /**
  * cap_syslog - Determine whether syslog function is permitted
  * @type: Function requested
+ * @from_file: Whether this request came from an open file (i.e. /proc)
  *
  * Determine whether the current process is permitted to use a particular
  * syslog function, returning 0 if permission is granted, -ve if not.
  */
-int cap_syslog(int type)
+int cap_syslog(int type, bool from_file)
 {
-        if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
+        if (type != SYSLOG_ACTION_OPEN && from_file)
+                return 0;
+        if ((type != SYSLOG_ACTION_READ_ALL &&
+             type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN))
                 return -EPERM;
         return 0;
 }