aboutsummaryrefslogtreecommitdiffstats
path: root/security/commoncap.c
diff options
context:
space:
mode:
Diffstat (limited to 'security/commoncap.c')
-rw-r--r--security/commoncap.c30
1 files changed, 30 insertions, 0 deletions
diff --git a/security/commoncap.c b/security/commoncap.c
index 48b7e0228fa3..e3097c0a1311 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -984,3 +984,33 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
984 cap_sys_admin = 1; 984 cap_sys_admin = 1;
985 return __vm_enough_memory(mm, pages, cap_sys_admin); 985 return __vm_enough_memory(mm, pages, cap_sys_admin);
986} 986}
987
988/*
989 * cap_file_mmap - check if able to map given addr
990 * @file: unused
991 * @reqprot: unused
992 * @prot: unused
993 * @flags: unused
994 * @addr: address attempting to be mapped
995 * @addr_only: unused
996 *
997 * If the process is attempting to map memory below mmap_min_addr they need
998 * CAP_SYS_RAWIO. The other parameters to this function are unused by the
999 * capability security module. Returns 0 if this mapping should be allowed
1000 * -EPERM if not.
1001 */
1002int cap_file_mmap(struct file *file, unsigned long reqprot,
1003 unsigned long prot, unsigned long flags,
1004 unsigned long addr, unsigned long addr_only)
1005{
1006 int ret = 0;
1007
1008 if (addr < dac_mmap_min_addr) {
1009 ret = cap_capable(current, current_cred(), CAP_SYS_RAWIO,
1010 SECURITY_CAP_AUDIT);
1011 /* set PF_SUPERPRIV if it turns out we allow the low mmap */
1012 if (ret == 0)
1013 current->flags |= PF_SUPERPRIV;
1014 }
1015 return ret;
1016}