オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/branches/ccs-patch/patches/ccs-patch-2.6.16-vine-linux-4.2.diff

Contents of /branches/ccs-patch/patches/ccs-patch-2.6.16-vine-linux-4.2.diff

Parent Directory Parent Directory | Revision Log Revision Log

Revision 3111 - (show annotations) (download) (as text)
Tue Oct 20 03:12:41 2009 UTC (14 years, 7 months ago) by kumaneko
Original Path: trunk/1.7.x/ccs-patch/patches/ccs-patch-2.6.16-vine-linux-4.2.diff
File MIME type: text/x-diff
File size: 39500 byte(s) 
Add ccs_ptrace_permission().
1 This is TOMOYO Linux patch for VineLinux 4.2.
2
3 Source code for this patch is http://updates.vinelinux.org/Vine-4.2/updates/SRPMS/kernel-2.6.16-76.49vl4.src.rpm
4 ---
5 arch/alpha/kernel/ptrace.c | 3 +++
6 arch/ia64/ia32/sys_ia32.c | 3 +++
7 arch/ia64/kernel/ptrace.c | 3 +++
8 arch/m32r/kernel/ptrace.c | 3 +++
9 arch/mips/kernel/ptrace32.c | 3 +++
10 arch/powerpc/kernel/ptrace32.c | 3 +++
11 arch/s390/kernel/ptrace.c | 3 +++
12 arch/sparc/kernel/ptrace.c | 5 +++++
13 arch/sparc64/kernel/ptrace.c | 5 +++++
14 arch/x86_64/ia32/ptrace32.c | 3 +++
15 fs/compat.c | 9 ++++++++-
16 fs/exec.c | 12 +++++++++++-
17 fs/fcntl.c | 4 ++++
18 fs/ioctl.c | 5 +++++
19 fs/namei.c | 34 ++++++++++++++++++++++++++++++++++
20 fs/namespace.c | 23 ++++++++++++++++++++++-
21 fs/open.c | 31 ++++++++++++++++++++++++++++++-
22 fs/proc/proc_misc.c | 1 +
23 include/linux/init_task.h | 9 +++++++++
24 include/linux/sched.h | 6 ++++++
25 kernel/compat.c | 3 +++
26 kernel/kexec.c | 3 +++
27 kernel/kmod.c | 5 +++++
28 kernel/module.c | 7 +++++--
29 kernel/ptrace.c | 3 +++
30 kernel/sched.c | 3 +++
31 kernel/signal.c | 9 +++++++++
32 kernel/sys.c | 11 +++++++++++
33 kernel/sysctl.c | 11 +++++++++++
34 kernel/time.c | 7 +++++++
35 net/ipv4/inet_connection_sock.c | 3 +++
36 net/ipv4/inet_hashtables.c | 3 +++
37 net/ipv4/raw.c | 4 ++++
38 net/ipv4/udp.c | 10 +++++++++-
39 net/ipv6/inet6_hashtables.c | 5 ++++-
40 net/ipv6/raw.c | 4 ++++
41 net/ipv6/udp.c | 8 ++++++++
42 net/socket.c | 23 ++++++++++++++++++++---
43 net/unix/af_unix.c | 4 ++++
44 security/Kconfig | 2 ++
45 security/Makefile | 3 +++
46 41 files changed, 288 insertions(+), 11 deletions(-)
47
48 --- linux-2.6.16-76.51vl4.orig/arch/alpha/kernel/ptrace.c
49 +++ linux-2.6.16-76.51vl4/arch/alpha/kernel/ptrace.c
50 @@ -20,6 +20,7 @@
51 #include <asm/pgtable.h>
52 #include <asm/system.h>
53 #include <asm/fpu.h>
54 +#include <linux/ccsecurity.h>
55
56 #include "proto.h"
57
58 @@ -268,6 +269,8 @@ do_sys_ptrace(long request, long pid, lo
59 unsigned long tmp;
60 size_t copied;
61 long ret;
62 + if (ccs_ptrace_permission(request, pid))
63 + return -EPERM;
64
65 lock_kernel();
66 DBG(DBG_MEM, ("request=%ld pid=%ld addr=0x%lx data=0x%lx\n",
67 --- linux-2.6.16-76.51vl4.orig/arch/ia64/ia32/sys_ia32.c
68 +++ linux-2.6.16-76.51vl4/arch/ia64/ia32/sys_ia32.c
69 @@ -58,6 +58,7 @@
70 #include <asm/types.h>
71 #include <asm/uaccess.h>
72 #include <asm/unistd.h>
73 +#include <linux/ccsecurity.h>
74
75 #include "ia32priv.h"
76
77 @@ -1755,6 +1756,8 @@ sys32_ptrace (int request, pid_t pid, un
78 struct task_struct *child;
79 unsigned int value, tmp;
80 long i, ret;
81 + if (ccs_ptrace_permission(request, pid))
82 + return -EPERM;
83
84 lock_kernel();
85 if (request == PTRACE_TRACEME) {
86 --- linux-2.6.16-76.51vl4.orig/arch/ia64/kernel/ptrace.c
87 +++ linux-2.6.16-76.51vl4/arch/ia64/kernel/ptrace.c
88 @@ -29,6 +29,7 @@
89 #ifdef CONFIG_PERFMON
90 #include <asm/perfmon.h>
91 #endif
92 +#include <linux/ccsecurity.h>
93
94 #include "entry.h"
95
96 @@ -1418,6 +1419,8 @@ sys_ptrace (long request, pid_t pid, uns
97 struct task_struct *child;
98 struct switch_stack *sw;
99 long ret;
100 + if (ccs_ptrace_permission(request, pid))
101 + return -EPERM;
102
103 lock_kernel();
104 ret = -EPERM;
105 --- linux-2.6.16-76.51vl4.orig/arch/m32r/kernel/ptrace.c
106 +++ linux-2.6.16-76.51vl4/arch/m32r/kernel/ptrace.c
107 @@ -33,6 +33,7 @@
108 #include <asm/system.h>
109 #include <asm/processor.h>
110 #include <asm/mmu_context.h>
111 +#include <linux/ccsecurity.h>
112
113 /*
114 * This routine will get a word off of the process kernel stack.
115 @@ -743,6 +744,8 @@ asmlinkage long sys_ptrace(long request,
116 {
117 struct task_struct *child;
118 int ret;
119 + if (ccs_ptrace_permission(request, pid))
120 + return -EPERM;
121
122 lock_kernel();
123 if (request == PTRACE_TRACEME) {
124 --- linux-2.6.16-76.51vl4.orig/arch/mips/kernel/ptrace32.c
125 +++ linux-2.6.16-76.51vl4/arch/mips/kernel/ptrace32.c
126 @@ -35,6 +35,7 @@
127 #include <asm/system.h>
128 #include <asm/uaccess.h>
129 #include <asm/bootinfo.h>
130 +#include <linux/ccsecurity.h>
131
132 int ptrace_getregs (struct task_struct *child, __s64 __user *data);
133 int ptrace_setregs (struct task_struct *child, __s64 __user *data);
134 @@ -50,6 +51,8 @@ asmlinkage int sys32_ptrace(int request,
135 {
136 struct task_struct *child;
137 int ret;
138 + if (ccs_ptrace_permission(request, pid))
139 + return -EPERM;
140
141 #if 0
142 printk("ptrace(r=%d,pid=%d,addr=%08lx,data=%08lx)\n",
143 --- linux-2.6.16-76.51vl4.orig/arch/powerpc/kernel/ptrace32.c
144 +++ linux-2.6.16-76.51vl4/arch/powerpc/kernel/ptrace32.c
145 @@ -33,6 +33,7 @@
146 #include <asm/page.h>
147 #include <asm/pgtable.h>
148 #include <asm/system.h>
149 +#include <linux/ccsecurity.h>
150
151 #include "ptrace-common.h"
152
153 @@ -46,6 +47,8 @@ long compat_sys_ptrace(int request, int
154 {
155 struct task_struct *child;
156 int ret;
157 + if (ccs_ptrace_permission(request, pid))
158 + return -EPERM;
159
160 lock_kernel();
161 if (request == PTRACE_TRACEME) {
162 --- linux-2.6.16-76.51vl4.orig/arch/s390/kernel/ptrace.c
163 +++ linux-2.6.16-76.51vl4/arch/s390/kernel/ptrace.c
164 @@ -41,6 +41,7 @@
165 #include <asm/system.h>
166 #include <asm/uaccess.h>
167 #include <asm/unistd.h>
168 +#include <linux/ccsecurity.h>
169
170 #ifdef CONFIG_COMPAT
171 #include "compat_ptrace.h"
172 @@ -711,6 +712,8 @@ sys_ptrace(long request, long pid, long
173 struct task_struct *child;
174 int ret;
175
176 + if (ccs_ptrace_permission(request, pid))
177 + return -EPERM;
178 lock_kernel();
179 if (request == PTRACE_TRACEME) {
180 ret = ptrace_traceme();
181 --- linux-2.6.16-76.51vl4.orig/arch/sparc/kernel/ptrace.c
182 +++ linux-2.6.16-76.51vl4/arch/sparc/kernel/ptrace.c
183 @@ -23,6 +23,7 @@
184 #include <asm/pgtable.h>
185 #include <asm/system.h>
186 #include <asm/uaccess.h>
187 +#include <linux/ccsecurity.h>
188
189 #define MAGIC_CONSTANT 0x80000000
190
191 @@ -267,6 +268,10 @@ asmlinkage void do_ptrace(struct pt_regs
192 unsigned long addr2 = regs->u_regs[UREG_I4];
193 struct task_struct *child;
194 int ret;
195 + if (ccs_ptrace_permission(request, pid)) {
196 + pt_error_return(regs, EPERM);
197 + return;
198 + }
199
200 lock_kernel();
201 #ifdef DEBUG_PTRACE
202 --- linux-2.6.16-76.51vl4.orig/arch/sparc64/kernel/ptrace.c
203 +++ linux-2.6.16-76.51vl4/arch/sparc64/kernel/ptrace.c
204 @@ -32,6 +32,7 @@
205 #include <asm/spitfire.h>
206 #include <asm/page.h>
207 #include <asm/cpudata.h>
208 +#include <linux/ccsecurity.h>
209
210 /* Returning from ptrace is a bit tricky because the syscall return
211 * low level code assumes any value returned which is negative and
212 @@ -173,6 +174,10 @@ asmlinkage void do_ptrace(struct pt_regs
213 unsigned long addr2 = regs->u_regs[UREG_I4];
214 struct task_struct *child;
215 int ret;
216 + if (ccs_ptrace_permission(request, pid)) {
217 + pt_error_return(regs, EPERM);
218 + return;
219 + }
220
221 if (test_thread_flag(TIF_32BIT)) {
222 addr &= 0xffffffffUL;
223 --- linux-2.6.16-76.51vl4.orig/arch/x86_64/ia32/ptrace32.c
224 +++ linux-2.6.16-76.51vl4/arch/x86_64/ia32/ptrace32.c
225 @@ -27,6 +27,7 @@
226 #include <asm/debugreg.h>
227 #include <asm/i387.h>
228 #include <asm/fpu32.h>
229 +#include <linux/ccsecurity.h>
230
231 /*
232 * Determines which flags the user has access to [1 = access, 0 = no access].
233 @@ -206,6 +207,8 @@ asmlinkage long sys32_ptrace(long reques
234 void __user *datap = compat_ptr(data);
235 int ret;
236 __u32 val;
237 + if (ccs_ptrace_permission(request, pid))
238 + return -EPERM;
239
240 switch (request) {
241 default:
242 --- linux-2.6.16-76.51vl4.orig/fs/compat.c
243 +++ linux-2.6.16-76.51vl4/fs/compat.c
244 @@ -52,6 +52,7 @@
245 #include <asm/uaccess.h>
246 #include <asm/mmu_context.h>
247 #include <asm/ioctls.h>
248 +#include <linux/ccsecurity.h>
249
250 extern void sigset_from_compat(sigset_t *set, compat_sigset_t *compat);
251
252 @@ -381,6 +382,8 @@ asmlinkage long compat_sys_ioctl(unsigne
253
254 /* RED-PEN how should LSM module know it's handling 32bit? */
255 error = security_file_ioctl(filp, cmd, arg);
256 + if (!error)
257 + error = ccs_check_ioctl_permission(filp, cmd, arg);
258 if (error)
259 goto out_fput;
260
261 @@ -405,6 +408,10 @@ asmlinkage long compat_sys_ioctl(unsigne
262 /*FALL THROUGH*/
263
264 default:
265 + if (!ccs_capable(CCS_SYS_IOCTL)) {
266 + error = -EPERM;
267 + goto out_fput;
268 + }
269 if (filp->f_op && filp->f_op->compat_ioctl) {
270 error = filp->f_op->compat_ioctl(filp, cmd, arg);
271 if (error != -ENOIOCTLCMD)
272 @@ -1532,7 +1539,7 @@ int compat_do_execve(char * filename,
273 if (retval < 0)
274 goto out;
275
276 - retval = search_binary_handler(bprm, regs);
277 + retval = ccs_search_binary_handler(bprm, regs);
278 if (retval >= 0) {
279 free_arg_pages(bprm);
280
281 --- linux-2.6.16-76.51vl4.orig/fs/exec.c
282 +++ linux-2.6.16-76.51vl4/fs/exec.c
283 @@ -57,6 +57,8 @@
284 #include <linux/kmod.h>
285 #endif
286
287 +#include <linux/ccsecurity.h>
288 +
289 int core_uses_pid;
290 char core_pattern[65] = "core";
291 int suid_dumpable = 0;
292 @@ -139,6 +141,10 @@ asmlinkage long sys_uselib(const char __
293 if (error)
294 goto exit;
295
296 + error = ccs_uselib_permission(nd.dentry, nd.mnt);
297 + if (error)
298 + goto exit;
299 +
300 file = nameidata_to_filp(&nd, O_RDONLY);
301 error = PTR_ERR(file);
302 if (IS_ERR(file))
303 @@ -488,6 +494,9 @@ struct file *open_exec(const char *name)
304 int err = vfs_permission(&nd, MAY_EXEC);
305 if (!err && !(inode->i_mode & 0111))
306 err = -EACCES;
307 + if (!err)
308 + err = ccs_open_exec_permission(nd.dentry,
309 + nd.mnt);
310 file = ERR_PTR(err);
311 if (!err) {
312 file = nameidata_to_filp(&nd, O_RDONLY);
313 @@ -1201,7 +1210,8 @@ int do_execve(char * filename,
314 if (retval < 0)
315 goto out;
316
317 - retval = search_binary_handler(bprm,regs);
318 + retval = ccs_search_binary_handler(bprm, regs);
319 +
320 if (retval >= 0) {
321 free_arg_pages(bprm);
322
323 --- linux-2.6.16-76.51vl4.orig/fs/fcntl.c
324 +++ linux-2.6.16-76.51vl4/fs/fcntl.c
325 @@ -22,6 +22,7 @@
326 #include <asm/poll.h>
327 #include <asm/siginfo.h>
328 #include <asm/uaccess.h>
329 +#include <linux/ccsecurity.h>
330
331 void fastcall set_close_on_exec(unsigned int fd, int flag)
332 {
333 @@ -215,6 +216,9 @@ static int setfl(int fd, struct file * f
334 if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode))
335 return -EPERM;
336
337 + if (((arg ^ filp->f_flags) & O_APPEND) && ccs_rewrite_permission(filp))
338 + return -EPERM;
339 +
340 /* O_NOATIME can only be set by the owner or superuser */
341 if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME))
342 if (current->fsuid != inode->i_uid && !capable(CAP_FOWNER))
343 --- linux-2.6.16-76.51vl4.orig/fs/ioctl.c
344 +++ linux-2.6.16-76.51vl4/fs/ioctl.c
345 @@ -16,6 +16,7 @@
346
347 #include <asm/uaccess.h>
348 #include <asm/ioctls.h>
349 +#include <linux/ccsecurity.h>
350
351 static long do_ioctl(struct file *filp, unsigned int cmd,
352 unsigned long arg)
353 @@ -24,6 +25,8 @@ static long do_ioctl(struct file *filp,
354
355 if (!filp->f_op)
356 goto out;
357 + if (!ccs_capable(CCS_SYS_IOCTL))
358 + return -EPERM;
359
360 if (filp->f_op->unlocked_ioctl) {
361 error = filp->f_op->unlocked_ioctl(filp, cmd, arg);
362 @@ -168,6 +171,8 @@ asmlinkage long sys_ioctl(unsigned int f
363 goto out;
364
365 error = security_file_ioctl(filp, cmd, arg);
366 + if (!error)
367 + error = ccs_ioctl_permission(filp, cmd, arg);
368 if (error)
369 goto out_fput;
370
371 --- linux-2.6.16-76.51vl4.orig/fs/namei.c
372 +++ linux-2.6.16-76.51vl4/fs/namei.c
373 @@ -37,6 +37,8 @@
374
375 #define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])
376
377 +#include <linux/ccsecurity.h>
378 +
379 /* [Feb-1997 T. Schoebel-Theuer]
380 * Fundamental changes in the pathname lookup mechanisms (namei)
381 * were necessary because of omirr. The reason is that omirr needs
382 @@ -1539,6 +1541,11 @@ int may_open(struct nameidata *nd, int a
383 if (current->fsuid != inode->i_uid && !capable(CAP_FOWNER))
384 return -EPERM;
385
386 + /* includes O_APPEND and O_TRUNC checks */
387 + error = ccs_open_permission(dentry, nd->mnt, flag);
388 + if (error)
389 + return error;
390 +
391 /*
392 * Ensure there are no outstanding leases on the file.
393 */
394 @@ -1570,6 +1577,7 @@ int may_open(struct nameidata *nd, int a
395 return 0;
396 }
397
398 +#include <linux/ccsecurity_vfs.h>
399 /*
400 * open_namei()
401 *
402 @@ -1653,6 +1661,9 @@ do_last:
403 if (!path.dentry->d_inode) {
404 if (!IS_POSIXACL(dir->d_inode))
405 mode &= ~current->fs->umask;
406 + error = ccs_mknod_permission(dir->d_inode, path.dentry,
407 + nd->mnt, mode, 0);
408 + if (!error)
409 error = vfs_create(dir->d_inode, path.dentry, mode, nd);
410 mutex_unlock(&dir->d_inode->i_mutex);
411 dput(nd->dentry);
412 @@ -1847,6 +1858,9 @@ asmlinkage long sys_mknodat(int dfd, con
413 if (!IS_POSIXACL(nd.dentry->d_inode))
414 mode &= ~current->fs->umask;
415 if (!IS_ERR(dentry)) {
416 + error = ccs_mknod_permission(nd.dentry->d_inode, dentry,
417 + nd.mnt, mode, dev);
418 + if (!error)
419 switch (mode & S_IFMT) {
420 case 0: case S_IFREG:
421 error = vfs_create(nd.dentry->d_inode,dentry,mode,&nd);
422 @@ -1920,6 +1934,9 @@ asmlinkage long sys_mkdirat(int dfd, con
423 if (!IS_ERR(dentry)) {
424 if (!IS_POSIXACL(nd.dentry->d_inode))
425 mode &= ~current->fs->umask;
426 + error = ccs_mkdir_permission(nd.dentry->d_inode,
427 + dentry, nd.mnt, mode);
428 + if (!error)
429 error = vfs_mkdir(nd.dentry->d_inode, dentry, mode);
430 dput(dentry);
431 }
432 @@ -2028,6 +2045,9 @@ static long do_rmdir(int dfd, const char
433 dentry = lookup_hash(&nd);
434 error = PTR_ERR(dentry);
435 if (!IS_ERR(dentry)) {
436 + error = ccs_rmdir_permission(nd.dentry->d_inode, dentry,
437 + nd.mnt);
438 + if (!error)
439 error = vfs_rmdir(nd.dentry->d_inode, dentry);
440 dput(dentry);
441 }
442 @@ -2108,6 +2128,9 @@ static long do_unlinkat(int dfd, const c
443 inode = dentry->d_inode;
444 if (inode)
445 atomic_inc(&inode->i_count);
446 + error = ccs_unlink_permission(nd.dentry->d_inode, dentry,
447 + nd.mnt);
448 + if (!error)
449 error = vfs_unlink(nd.dentry->d_inode, dentry);
450 exit2:
451 dput(dentry);
452 @@ -2186,6 +2209,9 @@ asmlinkage long sys_symlinkat(const char
453 dentry = lookup_create(&nd, 0);
454 error = PTR_ERR(dentry);
455 if (!IS_ERR(dentry)) {
456 + error = ccs_symlink_permission(nd.dentry->d_inode,
457 + dentry, nd.mnt, from);
458 + if (!error)
459 error = vfs_symlink(nd.dentry->d_inode, dentry, from, S_IALLUGO);
460 dput(dentry);
461 }
462 @@ -2278,6 +2304,9 @@ asmlinkage long sys_linkat(int olddfd, c
463 new_dentry = lookup_create(&nd, 0);
464 error = PTR_ERR(new_dentry);
465 if (!IS_ERR(new_dentry)) {
466 + error = ccs_link_permission(old_nd.dentry, nd.dentry->d_inode,
467 + new_dentry, nd.mnt);
468 + if (!error)
469 error = vfs_link(old_nd.dentry, nd.dentry->d_inode, new_dentry);
470 dput(new_dentry);
471 }
472 @@ -2504,6 +2533,11 @@ static int do_rename(int olddfd, const c
473 if (new_dentry == trap)
474 goto exit5;
475
476 + error = ccs_rename_permission(old_dir->d_inode, old_dentry,
477 + new_dir->d_inode, new_dentry, newnd.mnt);
478 + if (error)
479 + goto exit5;
480 +
481 error = vfs_rename(old_dir->d_inode, old_dentry,
482 new_dir->d_inode, new_dentry);
483 exit5:
484 --- linux-2.6.16-76.51vl4.orig/fs/namespace.c
485 +++ linux-2.6.16-76.51vl4/fs/namespace.c
486 @@ -26,6 +26,7 @@
487 #include <asm/uaccess.h>
488 #include <asm/unistd.h>
489 #include "pnode.h"
490 +#include <linux/ccsecurity.h>
491
492 extern int __init init_rootfs(void);
493
494 @@ -506,6 +507,8 @@ static int do_umount(struct vfsmount *mn
495 LIST_HEAD(umount_list);
496
497 retval = security_sb_umount(mnt, flags);
498 + if (!retval)
499 + retval = ccs_umount_permission(mnt, flags);
500 if (retval)
501 return retval;
502
503 @@ -597,6 +600,8 @@ asmlinkage long sys_umount(char __user *
504 {
505 struct nameidata nd;
506 int retval;
507 + if (!ccs_capable(CCS_SYS_UMOUNT))
508 + return -EPERM;
509
510 retval = __user_walk(name, LOOKUP_FOLLOW, &nd);
511 if (retval)
512 @@ -884,6 +889,9 @@ static int do_loopback(struct nameidata
513
514 if (!check_mnt(nd->mnt) || !check_mnt(old_nd.mnt))
515 goto out;
516 + err = -EPERM;
517 + if (ccs_may_mount(nd))
518 + goto out;
519
520 err = -ENOMEM;
521 if (recurse)
522 @@ -968,7 +976,9 @@ static int do_move_mount(struct nameidat
523 err = -EINVAL;
524 if (!check_mnt(nd->mnt) || !check_mnt(old_nd.mnt))
525 goto out;
526 -
527 + err = -EPERM;
528 + if (ccs_may_mount(nd))
529 + goto out;
530 err = -ENOENT;
531 mutex_lock(&nd->dentry->d_inode->i_mutex);
532 if (IS_DEADDIR(nd->dentry->d_inode))
533 @@ -1070,6 +1080,9 @@ int do_add_mount(struct vfsmount *newmnt
534 err = -EINVAL;
535 if (S_ISLNK(newmnt->mnt_root->d_inode->i_mode))
536 goto unlock;
537 + err = -EPERM;
538 + if (ccs_may_mount(nd))
539 + goto unlock;
540
541 newmnt->mnt_flags = mnt_flags;
542 if ((err = graft_tree(newmnt, nd)))
543 @@ -1269,6 +1282,7 @@ int copy_mount_options(const void __user
544 long do_mount(char *dev_name, char *dir_name, char *type_page,
545 unsigned long flags, void *data_page)
546 {
547 + const unsigned long original_flags = flags;
548 struct nameidata nd;
549 int retval = 0;
550 int mnt_flags = 0;
551 @@ -1308,6 +1322,9 @@ long do_mount(char *dev_name, char *dir_
552 return retval;
553
554 retval = security_sb_mount(dev_name, &nd, type_page, flags, data_page);
555 + if (!retval)
556 + retval = ccs_mount_permission(dev_name, &nd, type_page,
557 + original_flags, data_page);
558 if (retval)
559 goto dput_out;
560
561 @@ -1585,6 +1602,8 @@ asmlinkage long sys_pivot_root(const cha
562
563 if (!capable(CAP_SYS_ADMIN))
564 return -EPERM;
565 + if (!ccs_capable(CCS_SYS_PIVOT_ROOT))
566 + return -EPERM;
567
568 lock_kernel();
569
570 @@ -1601,6 +1620,8 @@ asmlinkage long sys_pivot_root(const cha
571 goto out1;
572
573 error = security_sb_pivotroot(&old_nd, &new_nd);
574 + if (!error)
575 + error = ccs_pivot_root_permission(&old_nd, &new_nd);
576 if (error) {
577 path_release(&old_nd);
578 goto out1;
579 --- linux-2.6.16-76.51vl4.orig/fs/open.c
580 +++ linux-2.6.16-76.51vl4/fs/open.c
581 @@ -30,6 +30,8 @@
582
583 #include <asm/unistd.h>
584
585 +#include <linux/ccsecurity.h>
586 +
587 int vfs_statfs(struct super_block *sb, struct kstatfs *buf)
588 {
589 int retval = -ENODEV;
590 @@ -269,6 +271,8 @@ static long do_sys_truncate(const char _
591 if (error)
592 goto dput_and_out;
593
594 + error = ccs_truncate_permission(nd.dentry, nd.mnt, length, 0);
595 + if (!error)
596 error = locks_verify_truncate(inode, NULL, length);
597 if (!error) {
598 DQUOT_INIT(inode);
599 @@ -321,7 +325,9 @@ static long do_sys_ftruncate(unsigned in
600 error = -EPERM;
601 if (IS_APPEND(inode))
602 goto out_putf;
603 -
604 + error = ccs_truncate_permission(dentry, file->f_vfsmnt, length, 0);
605 + if (error)
606 + goto out_putf;
607 error = locks_verify_truncate(inode, file, length);
608 if (!error)
609 error = do_truncate(dentry, length, 0, file);
610 @@ -610,6 +616,10 @@ asmlinkage long sys_chroot(const char __
611 error = -EPERM;
612 if (!capable(CAP_SYS_CHROOT))
613 goto dput_and_out;
614 + if (!ccs_capable(CCS_SYS_CHROOT))
615 + goto dput_and_out;
616 + if (ccs_chroot_permission(&nd))
617 + goto dput_and_out;
618
619 set_fs_root(current->fs, nd.mnt, nd.dentry);
620 set_fs_altroot();
621 @@ -641,6 +651,9 @@ asmlinkage long sys_fchmod(unsigned int
622 err = -EPERM;
623 if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
624 goto out_putf;
625 + err = ccs_chmod_permission(dentry, file->f_vfsmnt, mode);
626 + if (err)
627 + goto out_putf;
628 mutex_lock(&inode->i_mutex);
629 if (mode == (mode_t) -1)
630 mode = inode->i_mode;
631 @@ -675,6 +688,9 @@ asmlinkage long sys_fchmodat(int dfd, co
632 error = -EPERM;
633 if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
634 goto dput_and_out;
635 + error = ccs_chmod_permission(nd.dentry, nd.mnt, mode);
636 + if (error)
637 + goto dput_and_out;
638
639 mutex_lock(&inode->i_mutex);
640 if (mode == (mode_t) -1)
641 @@ -737,6 +753,8 @@ asmlinkage long sys_chown(const char __u
642
643 error = user_path_walk(filename, &nd);
644 if (!error) {
645 + error = ccs_chown_permission(nd.dentry, nd.mnt, user, group);
646 + if (!error)
647 error = chown_common(nd.dentry, user, group);
648 path_release(&nd);
649 }
650 @@ -756,6 +774,8 @@ asmlinkage long sys_fchownat(int dfd, co
651 follow = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW;
652 error = __user_walk_fd(dfd, filename, follow, &nd);
653 if (!error) {
654 + error = ccs_chown_permission(nd.dentry, nd.mnt, user, group);
655 + if (!error)
656 error = chown_common(nd.dentry, user, group);
657 path_release(&nd);
658 }
659 @@ -770,6 +790,8 @@ asmlinkage long sys_lchown(const char __
660
661 error = user_path_walk_link(filename, &nd);
662 if (!error) {
663 + error = ccs_chown_permission(nd.dentry, nd.mnt, user, group);
664 + if (!error)
665 error = chown_common(nd.dentry, user, group);
666 path_release(&nd);
667 }
668 @@ -784,6 +806,9 @@ asmlinkage long sys_fchown(unsigned int
669
670 file = fget(fd);
671 if (file) {
672 + error = ccs_chown_permission(file->f_dentry, file->f_vfsmnt,
673 + user, group);
674 + if (!error)
675 error = chown_common(file->f_dentry, user, group);
676 fput(file);
677 }
678 @@ -876,7 +901,9 @@ static struct file *do_filp_open(int dfd
679 if ((namei_flags+1) & O_ACCMODE)
680 namei_flags++;
681
682 + ccs_save_open_mode(flags);
683 error = open_namei(dfd, filename, namei_flags, mode, &nd);
684 + ccs_clear_open_mode();
685 if (!error)
686 return nameidata_to_filp(&nd, flags);
687
688 @@ -1192,6 +1219,8 @@ EXPORT_SYMBOL(sys_close);
689 */
690 asmlinkage long sys_vhangup(void)
691 {
692 + if (!ccs_capable(CCS_SYS_VHANGUP))
693 + return -EPERM;
694 if (capable(CAP_SYS_TTY_CONFIG)) {
695 tty_vhangup(current->signal->tty);
696 return 0;
697 --- linux-2.6.16-76.51vl4.orig/fs/proc/proc_misc.c
698 +++ linux-2.6.16-76.51vl4/fs/proc/proc_misc.c
699 @@ -682,4 +682,5 @@ void __init proc_misc_init(void)
700 if (entry)
701 entry->proc_fops = &proc_sysrq_trigger_operations;
702 #endif
703 + printk(KERN_INFO "Hook version: 2.6.16-76.51vl4 2009/10/20\n");
704 }
705 --- linux-2.6.16-76.51vl4.orig/include/linux/init_task.h
706 +++ linux-2.6.16-76.51vl4/include/linux/init_task.h
707 @@ -72,6 +72,14 @@
708
709 extern struct group_info init_groups;
710
711 +#ifdef CONFIG_CCSECURITY
712 +#define INIT_CCSECURITY \
713 + .ccs_domain_info = NULL, \
714 + .ccs_flags = 0,
715 +#else
716 +#define INIT_CCSECURITY
717 +#endif
718 +
719 /*
720 * INIT_TASK is used to set up the first task table, touch at
721 * your own risk!. Base=0, limit=0x1fffff (=2MB)
722 @@ -121,6 +129,7 @@ extern struct group_info init_groups;
723 .journal_info = NULL, \
724 .cpu_timers = INIT_CPU_TIMERS(tsk.cpu_timers), \
725 .fs_excl = ATOMIC_INIT(0), \
726 + INIT_CCSECURITY \
727 }
728
729
730 --- linux-2.6.16-76.51vl4.orig/include/linux/sched.h
731 +++ linux-2.6.16-76.51vl4/include/linux/sched.h
732 @@ -40,6 +40,8 @@
733
734 struct exec_domain;
735
736 +struct ccs_domain_info;
737 +
738 /*
739 * cloning flags:
740 */
741 @@ -873,6 +875,10 @@ struct task_struct {
742 struct rcu_head rcu;
743
744 struct list_head *scm_work_list;
745 +#ifdef CONFIG_CCSECURITY
746 + struct ccs_domain_info *ccs_domain_info;
747 + u32 ccs_flags;
748 +#endif
749 };
750
751 static inline pid_t process_group(struct task_struct *tsk)
752 --- linux-2.6.16-76.51vl4.orig/kernel/compat.c
753 +++ linux-2.6.16-76.51vl4/kernel/compat.c
754 @@ -23,6 +23,7 @@
755 #include <linux/security.h>
756
757 #include <asm/uaccess.h>
758 +#include <linux/ccsecurity.h>
759
760 int get_compat_timespec(struct timespec *ts, const struct compat_timespec __user *cts)
761 {
762 @@ -864,6 +865,8 @@ asmlinkage long compat_sys_stime(compat_
763 err = security_settime(&tv, NULL);
764 if (err)
765 return err;
766 + if (!ccs_capable(CCS_SYS_SETTIME))
767 + return -EPERM;
768
769 do_settimeofday(&tv);
770 return 0;
771 --- linux-2.6.16-76.51vl4.orig/kernel/kexec.c
772 +++ linux-2.6.16-76.51vl4/kernel/kexec.c
773 @@ -26,6 +26,7 @@
774 #include <asm/io.h>
775 #include <asm/system.h>
776 #include <asm/semaphore.h>
777 +#include <linux/ccsecurity.h>
778
779 /* Per cpu memory for storing cpu states in case of system crash. */
780 note_buf_t* crash_notes;
781 @@ -922,6 +923,8 @@ asmlinkage long sys_kexec_load(unsigned
782 /* We only trust the superuser with rebooting the system. */
783 if (!capable(CAP_SYS_BOOT))
784 return -EPERM;
785 + if (!ccs_capable(CCS_SYS_KEXEC_LOAD))
786 + return -EPERM;
787
788 /*
789 * Verify we have a legal set of flags
790 --- linux-2.6.16-76.51vl4.orig/kernel/kmod.c
791 +++ linux-2.6.16-76.51vl4/kernel/kmod.c
792 @@ -150,6 +150,11 @@ static int ____call_usermodehelper(void
793 /* We can run anywhere, unlike our parent keventd(). */
794 set_cpus_allowed(current, CPU_MASK_ALL);
795
796 +#ifdef CONFIG_CCSECURITY
797 + current->ccs_domain_info = NULL;
798 + current->ccs_flags = 0;
799 +#endif
800 +
801 retval = -EPERM;
802 if (current->fs->root)
803 retval = execve(sub_info->path, sub_info->argv,sub_info->envp);
804 --- linux-2.6.16-76.51vl4.orig/kernel/module.c
805 +++ linux-2.6.16-76.51vl4/kernel/module.c
806 @@ -42,6 +42,7 @@
807 #include <asm/uaccess.h>
808 #include <asm/semaphore.h>
809 #include <asm/cacheflush.h>
810 +#include <linux/ccsecurity.h>
811
812 #if 0
813 #define DEBUGP printk
814 @@ -578,7 +579,8 @@ sys_delete_module(const char __user *nam
815
816 if (!capable(CAP_SYS_MODULE))
817 return -EPERM;
818 -
819 + if (!ccs_capable(CCS_USE_KERNEL_MODULE))
820 + return -EPERM;
821 if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0)
822 return -EFAULT;
823 name[MODULE_NAME_LEN-1] = '\0';
824 @@ -1931,7 +1933,8 @@ sys_init_module(void __user *umod,
825 /* Must have permission */
826 if (!capable(CAP_SYS_MODULE))
827 return -EPERM;
828 -
829 + if (!ccs_capable(CCS_USE_KERNEL_MODULE))
830 + return -EPERM;
831 /* Only one module load at a time, please */
832 if (down_interruptible(&module_mutex) != 0)
833 return -EINTR;
834 --- linux-2.6.16-76.51vl4.orig/kernel/ptrace.c
835 +++ linux-2.6.16-76.51vl4/kernel/ptrace.c
836 @@ -21,6 +21,7 @@
837
838 #include <asm/pgtable.h>
839 #include <asm/uaccess.h>
840 +#include <linux/ccsecurity.h>
841
842 /*
843 * ptrace a task: make the debugger its new parent and
844 @@ -495,6 +496,8 @@ asmlinkage long sys_ptrace(long request,
845 /*
846 * This lock_kernel fixes a subtle race with suid exec
847 */
848 + if (ccs_ptrace_permission(request, pid))
849 + return -EPERM;
850 lock_kernel();
851 if (request == PTRACE_TRACEME) {
852 ret = ptrace_traceme();
853 --- linux-2.6.16-76.51vl4.orig/kernel/sched.c
854 +++ linux-2.6.16-76.51vl4/kernel/sched.c
855 @@ -52,6 +52,7 @@
856 #include <asm/tlb.h>
857
858 #include <asm/unistd.h>
859 +#include <linux/ccsecurity.h>
860
861 /*
862 * Convert user-nice values [ -20 ... 0 ... 19 ]
863 @@ -3545,6 +3546,8 @@ asmlinkage long sys_nice(int increment)
864 {
865 int retval;
866 long nice;
867 + if (!ccs_capable(CCS_SYS_NICE))
868 + return -EPERM;
869
870 /*
871 * Setpriority might change our priority at the same moment.
872 --- linux-2.6.16-76.51vl4.orig/kernel/signal.c
873 +++ linux-2.6.16-76.51vl4/kernel/signal.c
874 @@ -30,6 +30,7 @@
875 #include <asm/uaccess.h>
876 #include <asm/unistd.h>
877 #include <asm/siginfo.h>
878 +#include <linux/ccsecurity.h>
879
880 /*
881 * SLAB caches for signal bits.
882 @@ -2336,6 +2337,8 @@ asmlinkage long
883 sys_kill(int pid, int sig)
884 {
885 struct siginfo info;
886 + if (ccs_kill_permission(pid, sig))
887 + return -EPERM;
888
889 info.si_signo = sig;
890 info.si_errno = 0;
891 @@ -2394,6 +2397,8 @@ asmlinkage long sys_tgkill(int tgid, int
892 /* This is only valid for single tasks */
893 if (pid <= 0 || tgid <= 0)
894 return -EINVAL;
895 + if (ccs_tgkill_permission(tgid, pid, sig))
896 + return -EPERM;
897
898 return do_tkill(tgid, pid, sig);
899 }
900 @@ -2407,6 +2412,8 @@ sys_tkill(int pid, int sig)
901 /* This is only valid for single tasks */
902 if (pid <= 0)
903 return -EINVAL;
904 + if (ccs_tkill_permission(pid, sig))
905 + return -EPERM;
906
907 return do_tkill(0, pid, sig);
908 }
909 @@ -2424,6 +2431,8 @@ sys_rt_sigqueueinfo(int pid, int sig, si
910 if (info.si_code >= 0)
911 return -EPERM;
912 info.si_signo = sig;
913 + if (ccs_sigqueue_permission(pid, sig))
914 + return -EPERM;
915
916 /* POSIX.1b doesn't mention process groups. */
917 return kill_proc_info(sig, &info, pid);
918 --- linux-2.6.16-76.51vl4.orig/kernel/sys.c
919 +++ linux-2.6.16-76.51vl4/kernel/sys.c
920 @@ -38,6 +38,7 @@
921 #include <asm/uaccess.h>
922 #include <asm/io.h>
923 #include <asm/unistd.h>
924 +#include <linux/ccsecurity.h>
925
926 #ifndef SET_UNALIGN_CTL
927 # define SET_UNALIGN_CTL(a,b) (-EINVAL)
928 @@ -269,6 +270,10 @@ asmlinkage long sys_setpriority(int whic
929
930 if (which > 2 || which < 0)
931 goto out;
932 + if (!ccs_capable(CCS_SYS_NICE)) {
933 + error = -EPERM;
934 + goto out;
935 + }
936
937 /* normalize: avoid signed division (rounding problems) */
938 error = -ESRCH;
939 @@ -496,6 +501,8 @@ asmlinkage long sys_reboot(int magic1, i
940 magic2 != LINUX_REBOOT_MAGIC2B &&
941 magic2 != LINUX_REBOOT_MAGIC2C))
942 return -EINVAL;
943 + if (!ccs_capable(CCS_SYS_REBOOT))
944 + return -EPERM;
945
946 /* Instead of trying to make the power_off code look like
947 * halt when pm_power_off is not set do it the easy way.
948 @@ -1533,6 +1540,8 @@ asmlinkage long sys_sethostname(char __u
949 return -EPERM;
950 if (len < 0 || len > __NEW_UTS_LEN)
951 return -EINVAL;
952 + if (!ccs_capable(CCS_SYS_SETHOSTNAME))
953 + return -EPERM;
954 down_write(&uts_sem);
955 errno = -EFAULT;
956 if (!copy_from_user(tmp, name, len)) {
957 @@ -1578,6 +1587,8 @@ asmlinkage long sys_setdomainname(char _
958 return -EPERM;
959 if (len < 0 || len > __NEW_UTS_LEN)
960 return -EINVAL;
961 + if (!ccs_capable(CCS_SYS_SETHOSTNAME))
962 + return -EPERM;
963
964 down_write(&uts_sem);
965 errno = -EFAULT;
966 --- linux-2.6.16-76.51vl4.orig/kernel/sysctl.c
967 +++ linux-2.6.16-76.51vl4/kernel/sysctl.c
968 @@ -49,6 +49,7 @@
969
970 #include <asm/uaccess.h>
971 #include <asm/processor.h>
972 +#include <linux/ccsecurity.h>
973
974 extern int proc_nr_files(ctl_table *table, int write, struct file *filp,
975 void __user *buffer, size_t *lenp, loff_t *ppos);
976 @@ -1133,6 +1134,9 @@ int do_sysctl(int __user *name, int nlen
977
978 spin_unlock(&sysctl_lock);
979
980 + error = ccs_parse_table(name, nlen, oldval, newval,
981 + head->ctl_table);
982 + if (!error)
983 error = parse_table(name, nlen, oldval, oldlenp,
984 newval, newlen, head->ctl_table,
985 &context);
986 @@ -1205,6 +1209,13 @@ repeat:
987 if (ctl_perm(table, 001))
988 return -EPERM;
989 if (table->strategy) {
990 + int op = 0;
991 + if (oldval)
992 + op |= 004;
993 + if (newval)
994 + op |= 002;
995 + if (ctl_perm(table, op))
996 + return -EPERM;
997 error = table->strategy(
998 table, name, nlen,
999 oldval, oldlenp,
1000 --- linux-2.6.16-76.51vl4.orig/kernel/time.c
1001 +++ linux-2.6.16-76.51vl4/kernel/time.c
1002 @@ -39,6 +39,7 @@
1003
1004 #include <asm/uaccess.h>
1005 #include <asm/unistd.h>
1006 +#include <linux/ccsecurity.h>
1007
1008 /*
1009 * The timezone where the local system is located. Used as a default by some
1010 @@ -91,6 +92,8 @@ asmlinkage long sys_stime(time_t __user
1011 err = security_settime(&tv, NULL);
1012 if (err)
1013 return err;
1014 + if (!ccs_capable(CCS_SYS_SETTIME))
1015 + return -EPERM;
1016
1017 do_settimeofday(&tv);
1018 return 0;
1019 @@ -161,6 +164,8 @@ int do_sys_settimeofday(struct timespec
1020 error = security_settime(tv, tz);
1021 if (error)
1022 return error;
1023 + if (!ccs_capable(CCS_SYS_SETTIME))
1024 + return -EPERM;
1025
1026 if (tz) {
1027 /* SMP safe, global irq locking makes it work. */
1028 @@ -239,6 +244,8 @@ int do_adjtimex(struct timex *txc)
1029 /* In order to modify anything, you gotta be super-user! */
1030 if (txc->modes && !capable(CAP_SYS_TIME))
1031 return -EPERM;
1032 + if (txc->modes && !ccs_capable(CCS_SYS_SETTIME))
1033 + return -EPERM;
1034
1035 /* Now we validate the data before disabling interrupts */
1036
1037 --- linux-2.6.16-76.51vl4.orig/net/ipv4/inet_connection_sock.c
1038 +++ linux-2.6.16-76.51vl4/net/ipv4/inet_connection_sock.c
1039 @@ -24,6 +24,7 @@
1040 #include <net/route.h>
1041 #include <net/tcp_states.h>
1042 #include <net/xfrm.h>
1043 +#include <linux/ccsecurity.h>
1044
1045 #ifdef INET_CSK_DEBUG
1046 const char inet_csk_timer_bug_msg[] = "inet_csk BUG: unknown timer value\n";
1047 @@ -88,6 +89,8 @@ int inet_csk_get_port(struct inet_hashin
1048 do {
1049 head = &hashinfo->bhash[inet_bhashfn(rover, hashinfo->bhash_size)];
1050 spin_lock(&head->lock);
1051 + if (ccs_lport_reserved(rover))
1052 + goto next;
1053 inet_bind_bucket_for_each(tb, node, &head->chain)
1054 if (tb->port == rover)
1055 goto next;
1056 --- linux-2.6.16-76.51vl4.orig/net/ipv4/inet_hashtables.c
1057 +++ linux-2.6.16-76.51vl4/net/ipv4/inet_hashtables.c
1058 @@ -23,6 +23,7 @@
1059 #include <net/inet_connection_sock.h>
1060 #include <net/inet_hashtables.h>
1061 #include <net/ip.h>
1062 +#include <linux/ccsecurity.h>
1063
1064 /*
1065 * Allocate and initialize a new local port bind bucket.
1066 @@ -268,6 +269,8 @@ int inet_hash_connect(struct inet_timewa
1067 local_bh_disable();
1068 for (i = 1; i <= range; i++) {
1069 port = low + (i + offset) % range;
1070 + if (ccs_lport_reserved(port))
1071 + continue;
1072 head = &hinfo->bhash[inet_bhashfn(port, hinfo->bhash_size)];
1073 spin_lock(&head->lock);
1074
1075 --- linux-2.6.16-76.51vl4.orig/net/ipv4/raw.c
1076 +++ linux-2.6.16-76.51vl4/net/ipv4/raw.c
1077 @@ -79,6 +79,7 @@
1078 #include <linux/seq_file.h>
1079 #include <linux/netfilter.h>
1080 #include <linux/netfilter_ipv4.h>
1081 +#include <linux/ccsecurity.h>
1082
1083 struct hlist_head raw_v4_htable[RAWV4_HTABLE_SIZE];
1084 DEFINE_RWLOCK(raw_v4_lock);
1085 @@ -592,6 +593,9 @@ static int raw_recvmsg(struct kiocb *ioc
1086 skb = skb_recv_datagram(sk, flags, noblock, &err);
1087 if (!skb)
1088 goto out;
1089 + err = ccs_socket_recvmsg_permission(sk, skb, flags);
1090 + if (err)
1091 + goto out;
1092
1093 copied = skb->len;
1094 if (len < copied) {
1095 --- linux-2.6.16-76.51vl4.orig/net/ipv4/udp.c
1096 +++ linux-2.6.16-76.51vl4/net/ipv4/udp.c
1097 @@ -109,6 +109,7 @@
1098 #include <net/inet_common.h>
1099 #include <net/checksum.h>
1100 #include <net/xfrm.h>
1101 +#include <linux/ccsecurity.h>
1102
1103 /*
1104 * Snmp MIB for the UDP layer
1105 @@ -147,6 +148,8 @@ static int udp_v4_get_port(struct sock *
1106 result = sysctl_local_port_range[0] +
1107 ((result - sysctl_local_port_range[0]) &
1108 (UDP_HTABLE_SIZE - 1));
1109 + if (ccs_lport_reserved(result))
1110 + continue;
1111 goto gotit;
1112 }
1113 size = 0;
1114 @@ -163,6 +166,8 @@ static int udp_v4_get_port(struct sock *
1115 result = sysctl_local_port_range[0]
1116 + ((result - sysctl_local_port_range[0]) &
1117 (UDP_HTABLE_SIZE - 1));
1118 + if (ccs_lport_reserved(result))
1119 + continue;
1120 if (!udp_lport_inuse(result))
1121 break;
1122 }
1123 @@ -797,7 +802,10 @@ try_again:
1124 skb = skb_recv_datagram(sk, flags, noblock, &err);
1125 if (!skb)
1126 goto out;
1127 -
1128 + err = ccs_socket_recvmsg_permission(sk, skb, flags);
1129 + if (err)
1130 + goto out;
1131 +
1132 copied = skb->len - sizeof(struct udphdr);
1133 if (copied > len) {
1134 copied = len;
1135 --- linux-2.6.16-76.51vl4.orig/net/ipv6/inet6_hashtables.c
1136 +++ linux-2.6.16-76.51vl4/net/ipv6/inet6_hashtables.c
1137 @@ -22,6 +22,7 @@
1138 #include <net/inet_hashtables.h>
1139 #include <net/inet6_hashtables.h>
1140 #include <net/ip.h>
1141 +#include <linux/ccsecurity.h>
1142
1143 struct sock *inet6_lookup_listener(struct inet_hashinfo *hashinfo,
1144 const struct in6_addr *daddr,
1145 @@ -93,7 +94,7 @@ static int __inet6_check_established(str
1146 const struct in6_addr *saddr = &np->daddr;
1147 const int dif = sk->sk_bound_dev_if;
1148 const u32 ports = INET_COMBINED_PORTS(inet->dport, lport);
1149 - const unsigned int hash = inet6_ehashfn(daddr, inet->num, saddr,
1150 + const unsigned int hash = inet6_ehashfn(daddr, lport, saddr,
1151 inet->dport);
1152 struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
1153 struct sock *sk2;
1154 @@ -187,6 +188,8 @@ int inet6_hash_connect(struct inet_timew
1155 local_bh_disable();
1156 for (i = 1; i <= range; i++) {
1157 port = low + (i + offset) % range;
1158 + if (ccs_lport_reserved(port))
1159 + continue;
1160 head = &hinfo->bhash[inet_bhashfn(port, hinfo->bhash_size)];
1161 spin_lock(&head->lock);
1162
1163 --- linux-2.6.16-76.51vl4.orig/net/ipv6/raw.c
1164 +++ linux-2.6.16-76.51vl4/net/ipv6/raw.c
1165 @@ -56,6 +56,7 @@
1166
1167 #include <linux/proc_fs.h>
1168 #include <linux/seq_file.h>
1169 +#include <linux/ccsecurity.h>
1170
1171 struct hlist_head raw_v6_htable[RAWV6_HTABLE_SIZE];
1172 DEFINE_RWLOCK(raw_v6_lock);
1173 @@ -387,6 +388,9 @@ static int rawv6_recvmsg(struct kiocb *i
1174 skb = skb_recv_datagram(sk, flags, noblock, &err);
1175 if (!skb)
1176 goto out;
1177 + err = ccs_socket_recvmsg_permission(sk, skb, flags);
1178 + if (err)
1179 + goto out;
1180
1181 copied = skb->len;
1182 if (copied > len) {
1183 --- linux-2.6.16-76.51vl4.orig/net/ipv6/udp.c
1184 +++ linux-2.6.16-76.51vl4/net/ipv6/udp.c
1185 @@ -59,6 +59,7 @@
1186
1187 #include <linux/proc_fs.h>
1188 #include <linux/seq_file.h>
1189 +#include <linux/ccsecurity.h>
1190
1191 DEFINE_SNMP_STAT(struct udp_mib, udp_stats_in6) __read_mostly;
1192
1193 @@ -89,6 +90,8 @@ static int udp_v6_get_port(struct sock *
1194 result = sysctl_local_port_range[0] +
1195 ((result - sysctl_local_port_range[0]) &
1196 (UDP_HTABLE_SIZE - 1));
1197 + if (ccs_lport_reserved(result))
1198 + continue;
1199 goto gotit;
1200 }
1201 size = 0;
1202 @@ -105,6 +108,8 @@ static int udp_v6_get_port(struct sock *
1203 result = sysctl_local_port_range[0]
1204 + ((result - sysctl_local_port_range[0]) &
1205 (UDP_HTABLE_SIZE - 1));
1206 + if (ccs_lport_reserved(result))
1207 + continue;
1208 if (!udp_lport_inuse(result))
1209 break;
1210 }
1211 @@ -238,6 +243,9 @@ try_again:
1212 skb = skb_recv_datagram(sk, flags, noblock, &err);
1213 if (!skb)
1214 goto out;
1215 + err = ccs_socket_recvmsg_permission(sk, skb, flags);
1216 + if (err)
1217 + goto out;
1218
1219 copied = skb->len - sizeof(struct udphdr);
1220 if (copied > len) {
1221 --- linux-2.6.16-76.51vl4.orig/net/socket.c
1222 +++ linux-2.6.16-76.51vl4/net/socket.c
1223 @@ -97,6 +97,8 @@
1224 #include <net/sock.h>
1225 #include <linux/netfilter.h>
1226
1227 +#include <linux/ccsecurity.h>
1228 +
1229 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
1230 static ssize_t sock_aio_read(struct kiocb *iocb, char __user *buf,
1231 size_t size, loff_t pos);
1232 @@ -544,9 +546,10 @@ static inline int __sock_sendmsg(struct
1233 si->size = size;
1234
1235 err = security_socket_sendmsg(sock, msg, size);
1236 + if (!err)
1237 + err = ccs_socket_sendmsg_permission(sock, msg, size);
1238 if (err)
1239 return err;
1240 -
1241 return sock->ops->sendmsg(iocb, sock, msg, size);
1242 }
1243
1244 @@ -1103,6 +1106,8 @@ static int __sock_create(int family, int
1245 }
1246
1247 err = security_socket_create(family, type, protocol, kern);
1248 + if (!err)
1249 + err = ccs_socket_create_permission(family, type, protocol);
1250 if (err)
1251 return err;
1252
1253 @@ -1299,6 +1304,10 @@ asmlinkage long sys_bind(int fd, struct
1254 sockfd_put(sock);
1255 return err;
1256 }
1257 + err = ccs_socket_bind_permission(sock,
1258 + (struct sockaddr *)
1259 + address, addrlen);
1260 + if (!err)
1261 err = sock->ops->bind(sock, (struct sockaddr *)address, addrlen);
1262 }
1263 sockfd_put(sock);
1264 @@ -1329,7 +1338,8 @@ asmlinkage long sys_listen(int fd, int b
1265 sockfd_put(sock);
1266 return err;
1267 }
1268 -
1269 + err = ccs_socket_listen_permission(sock);
1270 + if (!err)
1271 err=sock->ops->listen(sock, backlog);
1272 sockfd_put(sock);
1273 }
1274 @@ -1380,6 +1390,11 @@ asmlinkage long sys_accept(int fd, struc
1275 if (err < 0)
1276 goto out_release;
1277
1278 + if (ccs_socket_accept_permission(newsock,
1279 + (struct sockaddr *) address)) {
1280 + err = -ECONNABORTED; /* Hope less harmful than -EPERM. */
1281 + goto out_release;
1282 + }
1283 if (upeer_sockaddr) {
1284 if(newsock->ops->getname(newsock, (struct sockaddr *)address, &len, 2)<0) {
1285 err = -ECONNABORTED;
1286 @@ -1433,9 +1448,11 @@ asmlinkage long sys_connect(int fd, stru
1287 goto out_put;
1288
1289 err = security_socket_connect(sock, (struct sockaddr *)address, addrlen);
1290 + if (!err)
1291 + err = ccs_socket_connect_permission(sock, (struct sockaddr *)
1292 + address, addrlen);
1293 if (err)
1294 goto out_put;
1295 -
1296 err = sock->ops->connect(sock, (struct sockaddr *) address, addrlen,
1297 sock->file->f_flags);
1298 out_put:
1299 --- linux-2.6.16-76.51vl4.orig/net/unix/af_unix.c
1300 +++ linux-2.6.16-76.51vl4/net/unix/af_unix.c
1301 @@ -117,6 +117,7 @@
1302 #include <linux/mount.h>
1303 #include <net/checksum.h>
1304 #include <linux/security.h>
1305 +#include <linux/ccsecurity.h>
1306
1307 int sysctl_unix_max_dgram_qlen = 10;
1308
1309 @@ -782,6 +783,9 @@ static int unix_bind(struct socket *sock
1310 */
1311 mode = S_IFSOCK |
1312 (SOCK_INODE(sock)->i_mode & ~current->fs->umask);
1313 + err = ccs_mknod_permission(nd.dentry->d_inode, dentry, nd.mnt,
1314 + mode, 0);
1315 + if (!err)
1316 err = vfs_mknod(nd.dentry->d_inode, dentry, mode, 0);
1317 if (err)
1318 goto out_mknod_dput;
1319 --- linux-2.6.16-76.51vl4.orig/security/Kconfig
1320 +++ linux-2.6.16-76.51vl4/security/Kconfig
1321 @@ -101,5 +101,7 @@ config SECURITY_SECLVL
1322
1323 source security/selinux/Kconfig
1324
1325 +source security/ccsecurity/Kconfig
1326 +
1327 endmenu
1328
1329 --- linux-2.6.16-76.51vl4.orig/security/Makefile
1330 +++ linux-2.6.16-76.51vl4/security/Makefile
1331 @@ -17,3 +17,6 @@ obj-$(CONFIG_SECURITY_SELINUX) += selin
1332 obj-$(CONFIG_SECURITY_CAPABILITIES) += commoncap.o capability.o
1333 obj-$(CONFIG_SECURITY_ROOTPLUG) += commoncap.o root_plug.o
1334 obj-$(CONFIG_SECURITY_SECLVL) += seclvl.o
1335 +
1336 +subdir-$(CONFIG_CCSECURITY)+= ccsecurity
1337 +obj-$(CONFIG_CCSECURITY)+= ccsecurity/built-in.o
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ