Commit c49c41a4 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security 

* 'for-linus' of git://selinuxproject.org/~jmorris/linux-security:
  capabilities: remove __cap_full_set definition
  security: remove the security_netlink_recv hook as it is equivalent to capable()
  ptrace: do not audit capability check when outputing /proc/pid/stat
  capabilities: remove task_ns_* functions
  capabitlies: ns_capable can use the cap helpers rather than lsm call
  capabilities: style only - move capable below ns_capable
  capabilites: introduce new has_ns_capabilities_noaudit
  capabilities: call has_ns_capability from has_capability
  capabilities: remove all _real_ interfaces
  capabilities: introduce security_capable_noaudit
  capabilities: reverse arguments to security_capable
  capabilities: remove the task from capable LSM hook entirely
  selinux: sparse fix: fix several warnings in the security server cod
  selinux: sparse fix: fix warnings in netlink code
  selinux: sparse fix: eliminate warnings for selinuxfs
  selinux: sparse fix: declare selinux_disable() in security.h
  selinux: sparse fix: move selinux_complete_init
  selinux: sparse fix: make selinux_secmark_refcount static
  SELinux: Fix RCU deref check warning in sel_netport_insert()

Manually fix up a semantic mis-merge wrt security_netlink_recv():

 - the interface was removed in commit fd778461 ("security: remove
   the security_netlink_recv hook as it is equivalent to capable()")

 - a new user of it appeared in commit a38f7907 ("crypto: Add
   userspace configuration API")

causing no automatic merge conflict, but Eric Paris pointed out the
issue.
parents 892d208b f423e5ba

crypto/crypto_user.c

+1 −1
Original line number Diff line number Diff line
@@ -382,7 +382,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 
	type -= CRYPTO_MSG_BASE;

	link = &crypto_dispatch[type];



	if (security_netlink_recv(skb, CAP_NET_ADMIN))

	if (!capable(CAP_NET_ADMIN))

		return -EPERM;



	if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) &&

drivers/pci/pci-sysfs.c

+1 −1
Original line number Diff line number Diff line
@@ -432,7 +432,7 @@ pci_read_config(struct file *filp, struct kobject *kobj, 
	u8 *data = (u8*) buf;



	/* Several chips lock up trying to read undefined config space */

	if (security_capable(&init_user_ns, filp->f_cred, CAP_SYS_ADMIN) == 0) {

	if (security_capable(filp->f_cred, &init_user_ns, CAP_SYS_ADMIN) == 0) {

		size = dev->cfg_size;

	} else if (dev->hdr_type == PCI_HEADER_TYPE_CARDBUS) {

		size = 128;

drivers/scsi/scsi_netlink.c

+1 −1
Original line number Diff line number Diff line
@@ -112,7 +112,7 @@ scsi_nl_rcv_msg(struct sk_buff *skb) 
			goto next_msg;

		}



		if (security_netlink_recv(skb, CAP_SYS_ADMIN)) {

		if (!capable(CAP_SYS_ADMIN)) {

			err = -EPERM;

			goto next_msg;

		}

fs/proc/array.c

+1 −1
Original line number Diff line number Diff line
@@ -380,7 +380,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, 


	state = *get_task_state(task);

	vsize = eip = esp = 0;

	permitted = ptrace_may_access(task, PTRACE_MODE_READ);

	permitted = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT);

	mm = get_task_mm(task);

	if (mm) {

		vsize = task_vsize(mm);

include/linux/capability.h

+2 −2
Original line number Diff line number Diff line
@@ -380,7 +380,6 @@ struct user_namespace; 
struct user_namespace *current_user_ns(void);



extern const kernel_cap_t __cap_empty_set;

extern const kernel_cap_t __cap_full_set;

extern const kernel_cap_t __cap_init_eff_set;



/*
@@ -544,9 +543,10 @@ extern bool has_capability(struct task_struct *t, int cap); 
extern bool has_ns_capability(struct task_struct *t,

			      struct user_namespace *ns, int cap);

extern bool has_capability_noaudit(struct task_struct *t, int cap);

extern bool has_ns_capability_noaudit(struct task_struct *t,

				      struct user_namespace *ns, int cap);

extern bool capable(int cap);

extern bool ns_capable(struct user_namespace *ns, int cap);

extern bool task_ns_capable(struct task_struct *t, int cap);

extern bool nsown_capable(int cap);



/* audit system wants to get cap info from files as well */

CRA Git | Maintained and supported by SUSTech CRA and CCSE