diff options
Diffstat (limited to 'security')
-rw-r--r-- | security/capability.c | 1 | ||||
-rw-r--r-- | security/commoncap.c | 40 | ||||
-rw-r--r-- | security/smack/smack_lsm.c | 5 |
3 files changed, 0 insertions, 46 deletions
diff --git a/security/capability.c b/security/capability.c index 9e99f36a8b5c..2c6e06d18fab 100644 --- a/security/capability.c +++ b/security/capability.c | |||
@@ -40,7 +40,6 @@ static struct security_operations capability_ops = { | |||
40 | .inode_need_killpriv = cap_inode_need_killpriv, | 40 | .inode_need_killpriv = cap_inode_need_killpriv, |
41 | .inode_killpriv = cap_inode_killpriv, | 41 | .inode_killpriv = cap_inode_killpriv, |
42 | 42 | ||
43 | .task_kill = cap_task_kill, | ||
44 | .task_setscheduler = cap_task_setscheduler, | 43 | .task_setscheduler = cap_task_setscheduler, |
45 | .task_setioprio = cap_task_setioprio, | 44 | .task_setioprio = cap_task_setioprio, |
46 | .task_setnice = cap_task_setnice, | 45 | .task_setnice = cap_task_setnice, |
diff --git a/security/commoncap.c b/security/commoncap.c index bb0c095f5761..06d5c9469ba3 100644 --- a/security/commoncap.c +++ b/security/commoncap.c | |||
@@ -540,41 +540,6 @@ int cap_task_setnice (struct task_struct *p, int nice) | |||
540 | return cap_safe_nice(p); | 540 | return cap_safe_nice(p); |
541 | } | 541 | } |
542 | 542 | ||
543 | int cap_task_kill(struct task_struct *p, struct siginfo *info, | ||
544 | int sig, u32 secid) | ||
545 | { | ||
546 | if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info))) | ||
547 | return 0; | ||
548 | |||
549 | /* | ||
550 | * Running a setuid root program raises your capabilities. | ||
551 | * Killing your own setuid root processes was previously | ||
552 | * allowed. | ||
553 | * We must preserve legacy signal behavior in this case. | ||
554 | */ | ||
555 | if (p->uid == current->uid) | ||
556 | return 0; | ||
557 | |||
558 | /* sigcont is permitted within same session */ | ||
559 | if (sig == SIGCONT && (task_session_nr(current) == task_session_nr(p))) | ||
560 | return 0; | ||
561 | |||
562 | if (secid) | ||
563 | /* | ||
564 | * Signal sent as a particular user. | ||
565 | * Capabilities are ignored. May be wrong, but it's the | ||
566 | * only thing we can do at the moment. | ||
567 | * Used only by usb drivers? | ||
568 | */ | ||
569 | return 0; | ||
570 | if (cap_issubset(p->cap_permitted, current->cap_permitted)) | ||
571 | return 0; | ||
572 | if (capable(CAP_KILL)) | ||
573 | return 0; | ||
574 | |||
575 | return -EPERM; | ||
576 | } | ||
577 | |||
578 | /* | 543 | /* |
579 | * called from kernel/sys.c for prctl(PR_CABSET_DROP) | 544 | * called from kernel/sys.c for prctl(PR_CABSET_DROP) |
580 | * done without task_capability_lock() because it introduces | 545 | * done without task_capability_lock() because it introduces |
@@ -605,11 +570,6 @@ int cap_task_setnice (struct task_struct *p, int nice) | |||
605 | { | 570 | { |
606 | return 0; | 571 | return 0; |
607 | } | 572 | } |
608 | int cap_task_kill(struct task_struct *p, struct siginfo *info, | ||
609 | int sig, u32 secid) | ||
610 | { | ||
611 | return 0; | ||
612 | } | ||
613 | #endif | 573 | #endif |
614 | 574 | ||
615 | void cap_task_reparent_to_init (struct task_struct *p) | 575 | void cap_task_reparent_to_init (struct task_struct *p) |
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 38d707593b31..732ba27923c4 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c | |||
@@ -1117,11 +1117,6 @@ static int smack_task_movememory(struct task_struct *p) | |||
1117 | static int smack_task_kill(struct task_struct *p, struct siginfo *info, | 1117 | static int smack_task_kill(struct task_struct *p, struct siginfo *info, |
1118 | int sig, u32 secid) | 1118 | int sig, u32 secid) |
1119 | { | 1119 | { |
1120 | int rc; | ||
1121 | |||
1122 | rc = cap_task_kill(p, info, sig, secid); | ||
1123 | if (rc != 0) | ||
1124 | return rc; | ||
1125 | /* | 1120 | /* |
1126 | * Special cases where signals really ought to go through | 1121 | * Special cases where signals really ought to go through |
1127 | * in spite of policy. Stephen Smalley suggests it may | 1122 | * in spite of policy. Stephen Smalley suggests it may |