15 |
fs/Kconfig | 2 |
fs/Kconfig | 2 |
16 |
fs/Makefile | 2 |
fs/Makefile | 2 |
17 |
fs/attr.c | 19 ++++++ |
fs/attr.c | 19 ++++++ |
18 |
fs/compat.c | 15 ++++- |
fs/compat.c | 15 +++++ |
19 |
fs/exec.c | 21 ++++++- |
fs/exec.c | 21 +++++++ |
20 |
fs/fcntl.c | 9 +++ |
fs/fcntl.c | 9 +++ |
21 |
fs/ioctl.c | 11 +++ |
fs/ioctl.c | 11 +++ |
22 |
fs/namei.c | 118 ++++++++++++++++++++++++++++++++++++++++ |
fs/namei.c | 60 +++++++++++++++++++++ |
23 |
fs/namespace.c | 50 ++++++++++++++++ |
fs/namespace.c | 50 +++++++++++++++++- |
24 |
fs/open.c | 27 +++++++++ |
fs/open.c | 28 ++++++++++ |
25 |
fs/proc/Makefile | 3 + |
fs/proc/Makefile | 3 + |
26 |
fs/proc/proc_misc.c | 5 + |
fs/proc/proc_misc.c | 5 + |
27 |
include/linux/init_task.h | 4 + |
include/linux/init_task.h | 4 + |
34 |
kernel/sched.c | 7 ++ |
kernel/sched.c | 7 ++ |
35 |
kernel/signal.c | 21 +++++++ |
kernel/signal.c | 21 +++++++ |
36 |
kernel/sys.c | 21 +++++++ |
kernel/sys.c | 21 +++++++ |
37 |
kernel/sysctl.c | 111 +++++++++++++++++++++++++++++++++++++ |
kernel/sysctl.c | 111 ++++++++++++++++++++++++++++++++++++++++ |
38 |
kernel/time.c | 15 +++++ |
kernel/time.c | 15 +++++ |
39 |
net/core/datagram.c | 11 +++ |
net/core/datagram.c | 11 +++ |
40 |
net/ipv4/inet_connection_sock.c | 7 ++ |
net/ipv4/inet_connection_sock.c | 7 ++ |
42 |
net/ipv4/udp.c | 11 +++ |
net/ipv4/udp.c | 11 +++ |
43 |
net/ipv6/inet6_hashtables.c | 9 ++- |
net/ipv6/inet6_hashtables.c | 9 ++- |
44 |
net/ipv6/udp.c | 11 +++ |
net/ipv6/udp.c | 11 +++ |
45 |
net/socket.c | 43 +++++++++++++- |
net/socket.c | 43 ++++++++++++++- |
46 |
net/unix/af_unix.c | 15 +++++ |
net/unix/af_unix.c | 8 ++ |
47 |
42 files changed, 688 insertions(+), 8 deletions(-) |
42 files changed, 624 insertions(+), 8 deletions(-) |
48 |
|
|
49 |
--- linux-2.6.18-23etch1.orig/arch/alpha/kernel/ptrace.c |
--- linux-2.6.18-24.orig/arch/alpha/kernel/ptrace.c |
50 |
+++ linux-2.6.18-23etch1/arch/alpha/kernel/ptrace.c |
+++ linux-2.6.18-24/arch/alpha/kernel/ptrace.c |
51 |
@@ -20,6 +20,9 @@ |
@@ -20,6 +20,9 @@ |
52 |
#include <asm/pgtable.h> |
#include <asm/pgtable.h> |
53 |
#include <asm/system.h> |
#include <asm/system.h> |
69 |
|
|
70 |
lock_kernel(); |
lock_kernel(); |
71 |
DBG(DBG_MEM, ("request=%ld pid=%ld addr=0x%lx data=0x%lx\n", |
DBG(DBG_MEM, ("request=%ld pid=%ld addr=0x%lx data=0x%lx\n", |
72 |
--- linux-2.6.18-23etch1.orig/arch/ia64/ia32/sys_ia32.c |
--- linux-2.6.18-24.orig/arch/ia64/ia32/sys_ia32.c |
73 |
+++ linux-2.6.18-23etch1/arch/ia64/ia32/sys_ia32.c |
+++ linux-2.6.18-24/arch/ia64/ia32/sys_ia32.c |
74 |
@@ -56,6 +56,9 @@ |
@@ -56,6 +56,9 @@ |
75 |
#include <asm/types.h> |
#include <asm/types.h> |
76 |
#include <asm/uaccess.h> |
#include <asm/uaccess.h> |
92 |
|
|
93 |
lock_kernel(); |
lock_kernel(); |
94 |
if (request == PTRACE_TRACEME) { |
if (request == PTRACE_TRACEME) { |
95 |
--- linux-2.6.18-23etch1.orig/arch/ia64/kernel/ptrace.c |
--- linux-2.6.18-24.orig/arch/ia64/kernel/ptrace.c |
96 |
+++ linux-2.6.18-23etch1/arch/ia64/kernel/ptrace.c |
+++ linux-2.6.18-24/arch/ia64/kernel/ptrace.c |
97 |
@@ -28,6 +28,9 @@ |
@@ -28,6 +28,9 @@ |
98 |
#ifdef CONFIG_PERFMON |
#ifdef CONFIG_PERFMON |
99 |
#include <asm/perfmon.h> |
#include <asm/perfmon.h> |
115 |
|
|
116 |
lock_kernel(); |
lock_kernel(); |
117 |
ret = -EPERM; |
ret = -EPERM; |
118 |
--- linux-2.6.18-23etch1.orig/arch/m32r/kernel/ptrace.c |
--- linux-2.6.18-24.orig/arch/m32r/kernel/ptrace.c |
119 |
+++ linux-2.6.18-23etch1/arch/m32r/kernel/ptrace.c |
+++ linux-2.6.18-24/arch/m32r/kernel/ptrace.c |
120 |
@@ -32,6 +32,9 @@ |
@@ -32,6 +32,9 @@ |
121 |
#include <asm/system.h> |
#include <asm/system.h> |
122 |
#include <asm/processor.h> |
#include <asm/processor.h> |
138 |
|
|
139 |
lock_kernel(); |
lock_kernel(); |
140 |
if (request == PTRACE_TRACEME) { |
if (request == PTRACE_TRACEME) { |
141 |
--- linux-2.6.18-23etch1.orig/arch/mips/kernel/ptrace32.c |
--- linux-2.6.18-24.orig/arch/mips/kernel/ptrace32.c |
142 |
+++ linux-2.6.18-23etch1/arch/mips/kernel/ptrace32.c |
+++ linux-2.6.18-24/arch/mips/kernel/ptrace32.c |
143 |
@@ -35,6 +35,9 @@ |
@@ -35,6 +35,9 @@ |
144 |
#include <asm/system.h> |
#include <asm/system.h> |
145 |
#include <asm/uaccess.h> |
#include <asm/uaccess.h> |
161 |
|
|
162 |
#if 0 |
#if 0 |
163 |
printk("ptrace(r=%d,pid=%d,addr=%08lx,data=%08lx)\n", |
printk("ptrace(r=%d,pid=%d,addr=%08lx,data=%08lx)\n", |
164 |
--- linux-2.6.18-23etch1.orig/arch/powerpc/kernel/ptrace32.c |
--- linux-2.6.18-24.orig/arch/powerpc/kernel/ptrace32.c |
165 |
+++ linux-2.6.18-23etch1/arch/powerpc/kernel/ptrace32.c |
+++ linux-2.6.18-24/arch/powerpc/kernel/ptrace32.c |
166 |
@@ -32,6 +32,9 @@ |
@@ -32,6 +32,9 @@ |
167 |
#include <asm/page.h> |
#include <asm/page.h> |
168 |
#include <asm/pgtable.h> |
#include <asm/pgtable.h> |
184 |
|
|
185 |
lock_kernel(); |
lock_kernel(); |
186 |
if (request == PTRACE_TRACEME) { |
if (request == PTRACE_TRACEME) { |
187 |
--- linux-2.6.18-23etch1.orig/arch/s390/kernel/ptrace.c |
--- linux-2.6.18-24.orig/arch/s390/kernel/ptrace.c |
188 |
+++ linux-2.6.18-23etch1/arch/s390/kernel/ptrace.c |
+++ linux-2.6.18-24/arch/s390/kernel/ptrace.c |
189 |
@@ -41,6 +41,9 @@ |
@@ -41,6 +41,9 @@ |
190 |
#include <asm/system.h> |
#include <asm/system.h> |
191 |
#include <asm/uaccess.h> |
#include <asm/uaccess.h> |
207 |
lock_kernel(); |
lock_kernel(); |
208 |
if (request == PTRACE_TRACEME) { |
if (request == PTRACE_TRACEME) { |
209 |
ret = ptrace_traceme(); |
ret = ptrace_traceme(); |
210 |
--- linux-2.6.18-23etch1.orig/arch/sparc/kernel/ptrace.c |
--- linux-2.6.18-24.orig/arch/sparc/kernel/ptrace.c |
211 |
+++ linux-2.6.18-23etch1/arch/sparc/kernel/ptrace.c |
+++ linux-2.6.18-24/arch/sparc/kernel/ptrace.c |
212 |
@@ -23,6 +23,9 @@ |
@@ -23,6 +23,9 @@ |
213 |
#include <asm/pgtable.h> |
#include <asm/pgtable.h> |
214 |
#include <asm/system.h> |
#include <asm/system.h> |
232 |
|
|
233 |
lock_kernel(); |
lock_kernel(); |
234 |
#ifdef DEBUG_PTRACE |
#ifdef DEBUG_PTRACE |
235 |
--- linux-2.6.18-23etch1.orig/arch/sparc64/kernel/ptrace.c |
--- linux-2.6.18-24.orig/arch/sparc64/kernel/ptrace.c |
236 |
+++ linux-2.6.18-23etch1/arch/sparc64/kernel/ptrace.c |
+++ linux-2.6.18-24/arch/sparc64/kernel/ptrace.c |
237 |
@@ -32,6 +32,9 @@ |
@@ -32,6 +32,9 @@ |
238 |
#include <asm/spitfire.h> |
#include <asm/spitfire.h> |
239 |
#include <asm/page.h> |
#include <asm/page.h> |
257 |
|
|
258 |
if (test_thread_flag(TIF_32BIT)) { |
if (test_thread_flag(TIF_32BIT)) { |
259 |
addr &= 0xffffffffUL; |
addr &= 0xffffffffUL; |
260 |
--- linux-2.6.18-23etch1.orig/arch/x86_64/ia32/ptrace32.c |
--- linux-2.6.18-24.orig/arch/x86_64/ia32/ptrace32.c |
261 |
+++ linux-2.6.18-23etch1/arch/x86_64/ia32/ptrace32.c |
+++ linux-2.6.18-24/arch/x86_64/ia32/ptrace32.c |
262 |
@@ -26,6 +26,9 @@ |
@@ -26,6 +26,9 @@ |
263 |
#include <asm/i387.h> |
#include <asm/i387.h> |
264 |
#include <asm/fpu32.h> |
#include <asm/fpu32.h> |
280 |
|
|
281 |
switch (request) { |
switch (request) { |
282 |
case PTRACE_TRACEME: |
case PTRACE_TRACEME: |
283 |
--- linux-2.6.18-23etch1.orig/fs/Kconfig |
--- linux-2.6.18-24.orig/fs/Kconfig |
284 |
+++ linux-2.6.18-23etch1/fs/Kconfig |
+++ linux-2.6.18-24/fs/Kconfig |
285 |
@@ -1931,5 +1931,7 @@ endmenu |
@@ -1931,5 +1931,7 @@ endmenu |
286 |
|
|
287 |
source "fs/nls/Kconfig" |
source "fs/nls/Kconfig" |
290 |
+ |
+ |
291 |
endmenu |
endmenu |
292 |
|
|
293 |
--- linux-2.6.18-23etch1.orig/fs/Makefile |
--- linux-2.6.18-24.orig/fs/Makefile |
294 |
+++ linux-2.6.18-23etch1/fs/Makefile |
+++ linux-2.6.18-24/fs/Makefile |
295 |
@@ -102,3 +102,5 @@ obj-$(CONFIG_HOSTFS) += hostfs/ |
@@ -102,3 +102,5 @@ obj-$(CONFIG_HOSTFS) += hostfs/ |
296 |
obj-$(CONFIG_HPPFS) += hppfs/ |
obj-$(CONFIG_HPPFS) += hppfs/ |
297 |
obj-$(CONFIG_DEBUG_FS) += debugfs/ |
obj-$(CONFIG_DEBUG_FS) += debugfs/ |
298 |
obj-$(CONFIG_OCFS2_FS) += ocfs2/ |
obj-$(CONFIG_OCFS2_FS) += ocfs2/ |
299 |
+ |
+ |
300 |
+include $(srctree)/fs/Makefile-2.6.ccs |
+include $(srctree)/fs/Makefile-2.6.ccs |
301 |
--- linux-2.6.18-23etch1.orig/fs/attr.c |
--- linux-2.6.18-24.orig/fs/attr.c |
302 |
+++ linux-2.6.18-23etch1/fs/attr.c |
+++ linux-2.6.18-24/fs/attr.c |
303 |
@@ -15,6 +15,9 @@ |
@@ -15,6 +15,9 @@ |
304 |
#include <linux/fcntl.h> |
#include <linux/fcntl.h> |
305 |
#include <linux/quotaops.h> |
#include <linux/quotaops.h> |
339 |
if (!error) { |
if (!error) { |
340 |
if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) || |
if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) || |
341 |
(ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid)) |
(ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid)) |
342 |
--- linux-2.6.18-23etch1.orig/fs/compat.c |
--- linux-2.6.18-24.orig/fs/compat.c |
343 |
+++ linux-2.6.18-23etch1/fs/compat.c |
+++ linux-2.6.18-24/fs/compat.c |
344 |
@@ -52,6 +52,9 @@ |
@@ -52,6 +52,9 @@ |
345 |
#include <asm/uaccess.h> |
#include <asm/uaccess.h> |
346 |
#include <asm/mmu_context.h> |
#include <asm/mmu_context.h> |
384 |
if (retval >= 0) { |
if (retval >= 0) { |
385 |
free_arg_pages(bprm); |
free_arg_pages(bprm); |
386 |
|
|
387 |
--- linux-2.6.18-23etch1.orig/fs/exec.c |
--- linux-2.6.18-24.orig/fs/exec.c |
388 |
+++ linux-2.6.18-23etch1/fs/exec.c |
+++ linux-2.6.18-24/fs/exec.c |
389 |
@@ -57,6 +57,10 @@ |
@@ -57,6 +57,10 @@ |
390 |
#include <linux/kmod.h> |
#include <linux/kmod.h> |
391 |
#endif |
#endif |
435 |
if (retval >= 0) { |
if (retval >= 0) { |
436 |
free_arg_pages(bprm); |
free_arg_pages(bprm); |
437 |
|
|
438 |
--- linux-2.6.18-23etch1.orig/fs/fcntl.c |
--- linux-2.6.18-24.orig/fs/fcntl.c |
439 |
+++ linux-2.6.18-23etch1/fs/fcntl.c |
+++ linux-2.6.18-24/fs/fcntl.c |
440 |
@@ -22,6 +22,9 @@ |
@@ -22,6 +22,9 @@ |
441 |
#include <asm/poll.h> |
#include <asm/poll.h> |
442 |
#include <asm/siginfo.h> |
#include <asm/siginfo.h> |
460 |
/* O_NOATIME can only be set by the owner or superuser */ |
/* O_NOATIME can only be set by the owner or superuser */ |
461 |
if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME)) |
if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME)) |
462 |
if (current->fsuid != inode->i_uid && !capable(CAP_FOWNER)) |
if (current->fsuid != inode->i_uid && !capable(CAP_FOWNER)) |
463 |
--- linux-2.6.18-23etch1.orig/fs/ioctl.c |
--- linux-2.6.18-24.orig/fs/ioctl.c |
464 |
+++ linux-2.6.18-23etch1/fs/ioctl.c |
+++ linux-2.6.18-24/fs/ioctl.c |
465 |
@@ -15,6 +15,9 @@ |
@@ -15,6 +15,9 @@ |
466 |
|
|
467 |
#include <asm/uaccess.h> |
#include <asm/uaccess.h> |
494 |
if (error) |
if (error) |
495 |
goto out_fput; |
goto out_fput; |
496 |
|
|
497 |
--- linux-2.6.18-23etch1.orig/fs/namei.c |
--- linux-2.6.18-24.orig/fs/namei.c |
498 |
+++ linux-2.6.18-23etch1/fs/namei.c |
+++ linux-2.6.18-24/fs/namei.c |
499 |
@@ -37,6 +37,10 @@ |
@@ -37,6 +37,10 @@ |
500 |
|
|
501 |
#define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE]) |
#define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE]) |
507 |
/* [Feb-1997 T. Schoebel-Theuer] |
/* [Feb-1997 T. Schoebel-Theuer] |
508 |
* Fundamental changes in the pathname lookup mechanisms (namei) |
* Fundamental changes in the pathname lookup mechanisms (namei) |
509 |
* were necessary because of omirr. The reason is that omirr needs |
* were necessary because of omirr. The reason is that omirr needs |
510 |
@@ -1481,6 +1485,13 @@ int vfs_create(struct inode *dir, struct |
@@ -1536,6 +1540,13 @@ int may_open(struct nameidata *nd, int a |
|
error = security_inode_create(dir, dentry, mode); |
|
|
if (error) |
|
|
return error; |
|
|
+ /***** TOMOYO Linux start. *****/ |
|
|
+ if (nd) { |
|
|
+ error = ccs_check_1path_perm(TYPE_CREATE_ACL, dentry, nd->mnt); |
|
|
+ if (error) |
|
|
+ return error; |
|
|
+ } |
|
|
+ /***** TOMOYO Linux end. *****/ |
|
|
DQUOT_INIT(dir); |
|
|
error = dir->i_op->create(dir, dentry, mode, nd); |
|
|
if (!error) |
|
|
@@ -1536,6 +1547,13 @@ int may_open(struct nameidata *nd, int a |
|
511 |
if (current->fsuid != inode->i_uid && !capable(CAP_FOWNER)) |
if (current->fsuid != inode->i_uid && !capable(CAP_FOWNER)) |
512 |
return -EPERM; |
return -EPERM; |
513 |
|
|
521 |
/* |
/* |
522 |
* Ensure there are no outstanding leases on the file. |
* Ensure there are no outstanding leases on the file. |
523 |
*/ |
*/ |
524 |
@@ -1567,6 +1585,9 @@ int may_open(struct nameidata *nd, int a |
@@ -1567,6 +1578,9 @@ int may_open(struct nameidata *nd, int a |
525 |
return 0; |
return 0; |
526 |
} |
} |
527 |
|
|
531 |
/* |
/* |
532 |
* open_namei() |
* open_namei() |
533 |
* |
* |
534 |
@@ -1835,6 +1856,16 @@ asmlinkage long sys_mknodat(int dfd, con |
@@ -1650,6 +1664,11 @@ do_last: |
535 |
|
if (!path.dentry->d_inode) { |
536 |
if (S_ISDIR(mode)) |
if (!IS_POSIXACL(dir->d_inode)) |
537 |
return -EPERM; |
mode &= ~current->fs->umask; |
538 |
+ /***** TOMOYO Linux start. *****/ |
+ /***** TOMOYO Linux start. *****/ |
539 |
+ if (S_ISCHR(mode) && !ccs_capable(CCS_CREATE_CHAR_DEV)) |
+ error = ccs_check_mknod_permission(dir->d_inode, path.dentry, |
540 |
+ return -EPERM; |
+ nd->path.mnt, mode, 0); |
541 |
+ if (S_ISBLK(mode) && !ccs_capable(CCS_CREATE_BLOCK_DEV)) |
+ if (!error) |
542 |
+ return -EPERM; |
+ /***** TOMOYO Linux end. *****/ |
543 |
+ if (S_ISFIFO(mode) && !ccs_capable(CCS_CREATE_FIFO)) |
error = vfs_create(dir->d_inode, path.dentry, mode, nd); |
544 |
+ return -EPERM; |
mutex_unlock(&dir->d_inode->i_mutex); |
545 |
+ if (S_ISSOCK(mode) && !ccs_capable(CCS_CREATE_UNIX_SOCKET)) |
dput(nd->dentry); |
546 |
+ return -EPERM; |
@@ -1848,6 +1867,12 @@ asmlinkage long sys_mknodat(int dfd, con |
547 |
+ /***** TOMOYO Linux end. *****/ |
if (!IS_POSIXACL(nd.dentry->d_inode)) |
548 |
tmp = getname(filename); |
mode &= ~current->fs->umask; |
549 |
if (IS_ERR(tmp)) |
if (!IS_ERR(dentry)) { |
550 |
return PTR_ERR(tmp); |
+ /***** TOMOYO Linux start. *****/ |
551 |
@@ -1853,10 +1884,32 @@ asmlinkage long sys_mknodat(int dfd, con |
+ error = ccs_check_mknod_permission(nd.path.dentry->d_inode, |
552 |
|
+ dentry, nd.path.mnt, mode, |
553 |
|
+ new_decode_dev(dev)); |
554 |
|
+ if (!error) |
555 |
|
+ /***** TOMOYO Linux end. *****/ |
556 |
|
switch (mode & S_IFMT) { |
557 |
|
case 0: case S_IFREG: |
558 |
error = vfs_create(nd.dentry->d_inode,dentry,mode,&nd); |
error = vfs_create(nd.dentry->d_inode,dentry,mode,&nd); |
559 |
break; |
@@ -1921,6 +1946,12 @@ asmlinkage long sys_mkdirat(int dfd, con |
|
case S_IFCHR: case S_IFBLK: |
|
|
+ /***** TOMOYO Linux start. *****/ |
|
|
+ error = pre_vfs_mknod(nd.dentry->d_inode, dentry, mode); |
|
|
+ if (error) |
|
|
+ break; |
|
|
+ error = ccs_check_1path_perm(S_ISCHR(mode) ? |
|
|
+ TYPE_MKCHAR_ACL : |
|
|
+ TYPE_MKBLOCK_ACL, |
|
|
+ dentry, nd.mnt); |
|
|
+ if (error) |
|
|
+ break; |
|
|
+ /***** TOMOYO Linux end. *****/ |
|
|
error = vfs_mknod(nd.dentry->d_inode,dentry,mode, |
|
|
new_decode_dev(dev)); |
|
|
break; |
|
|
case S_IFIFO: case S_IFSOCK: |
|
|
+ /***** TOMOYO Linux start. *****/ |
|
|
+ error = pre_vfs_mknod(nd.dentry->d_inode, dentry, mode); |
|
|
+ if (error) |
|
|
+ break; |
|
|
+ error = ccs_check_1path_perm(S_ISFIFO(mode) ? |
|
|
+ TYPE_MKFIFO_ACL : |
|
|
+ TYPE_MKSOCK_ACL, |
|
|
+ dentry, nd.mnt); |
|
|
+ if (error) |
|
|
+ break; |
|
|
+ /***** TOMOYO Linux end. *****/ |
|
|
error = vfs_mknod(nd.dentry->d_inode,dentry,mode,0); |
|
|
break; |
|
|
case S_IFDIR: |
|
|
@@ -1921,6 +1974,13 @@ asmlinkage long sys_mkdirat(int dfd, con |
|
560 |
if (!IS_ERR(dentry)) { |
if (!IS_ERR(dentry)) { |
561 |
if (!IS_POSIXACL(nd.dentry->d_inode)) |
if (!IS_POSIXACL(nd.dentry->d_inode)) |
562 |
mode &= ~current->fs->umask; |
mode &= ~current->fs->umask; |
563 |
+ /***** TOMOYO Linux start. *****/ |
+ /***** TOMOYO Linux start. *****/ |
564 |
+ error = pre_vfs_mkdir(nd.dentry->d_inode, dentry); |
+ error = ccs_check_mkdir_permission(nd.dentry->d_inode, |
565 |
+ if (!error) |
+ dentry, nd.mnt, |
566 |
+ error = ccs_check_1path_perm(TYPE_MKDIR_ACL, |
+ mode); |
|
+ dentry, nd.mnt); |
|
567 |
+ if (!error) |
+ if (!error) |
568 |
+ /***** TOMOYO Linux end. *****/ |
+ /***** TOMOYO Linux end. *****/ |
569 |
error = vfs_mkdir(nd.dentry->d_inode, dentry, mode); |
error = vfs_mkdir(nd.dentry->d_inode, dentry, mode); |
570 |
dput(dentry); |
dput(dentry); |
571 |
} |
} |
572 |
@@ -2029,6 +2089,13 @@ static long do_rmdir(int dfd, const char |
@@ -2029,6 +2060,11 @@ static long do_rmdir(int dfd, const char |
573 |
dentry = lookup_hash(&nd); |
dentry = lookup_hash(&nd); |
574 |
error = PTR_ERR(dentry); |
error = PTR_ERR(dentry); |
575 |
if (!IS_ERR(dentry)) { |
if (!IS_ERR(dentry)) { |
576 |
+ /***** TOMOYO Linux start. *****/ |
+ /***** TOMOYO Linux start. *****/ |
577 |
+ error = pre_vfs_rmdir(nd.dentry->d_inode, dentry); |
+ error = ccs_check_rmdir_permission(nd.dentry->d_inode, dentry, |
578 |
+ if (!error) |
+ nd.mnt); |
|
+ error = ccs_check_1path_perm(TYPE_RMDIR_ACL, dentry, |
|
|
+ nd.mnt); |
|
579 |
+ if (!error) |
+ if (!error) |
580 |
+ /***** TOMOYO Linux end. *****/ |
+ /***** TOMOYO Linux end. *****/ |
581 |
error = vfs_rmdir(nd.dentry->d_inode, dentry); |
error = vfs_rmdir(nd.dentry->d_inode, dentry); |
582 |
dput(dentry); |
dput(dentry); |
583 |
} |
} |
584 |
@@ -2088,6 +2155,10 @@ static long do_unlinkat(int dfd, const c |
@@ -2109,6 +2145,11 @@ static long do_unlinkat(int dfd, const c |
|
struct dentry *dentry; |
|
|
struct nameidata nd; |
|
|
struct inode *inode = NULL; |
|
|
+ /***** TOMOYO Linux start. *****/ |
|
|
+ if (!ccs_capable(CCS_SYS_UNLINK)) |
|
|
+ return -EPERM; |
|
|
+ /***** TOMOYO Linux end. *****/ |
|
|
|
|
|
name = getname(pathname); |
|
|
if(IS_ERR(name)) |
|
|
@@ -2109,6 +2180,14 @@ static long do_unlinkat(int dfd, const c |
|
585 |
inode = dentry->d_inode; |
inode = dentry->d_inode; |
586 |
if (inode) |
if (inode) |
587 |
atomic_inc(&inode->i_count); |
atomic_inc(&inode->i_count); |
588 |
+ /***** TOMOYO Linux start. *****/ |
+ /***** TOMOYO Linux start. *****/ |
589 |
+ error = pre_vfs_unlink(nd.dentry->d_inode, dentry); |
+ error = ccs_check_unlink_permission(nd.dentry->d_inode, dentry, |
590 |
+ if (error) |
+ nd.mnt); |
591 |
+ goto exit2; |
+ if (!error) |
|
+ error = ccs_check_1path_perm(TYPE_UNLINK_ACL, dentry, nd.mnt); |
|
|
+ if (error) |
|
|
+ goto exit2; |
|
592 |
+ /***** TOMOYO Linux end. *****/ |
+ /***** TOMOYO Linux end. *****/ |
593 |
error = vfs_unlink(nd.dentry->d_inode, dentry); |
error = vfs_unlink(nd.dentry->d_inode, dentry); |
594 |
exit2: |
exit2: |
595 |
dput(dentry); |
dput(dentry); |
596 |
@@ -2171,6 +2250,10 @@ asmlinkage long sys_symlinkat(const char |
@@ -2187,6 +2228,12 @@ asmlinkage long sys_symlinkat(const char |
|
int error = 0; |
|
|
char * from; |
|
|
char * to; |
|
|
+ /***** TOMOYO Linux start. *****/ |
|
|
+ if (!ccs_capable(CCS_SYS_SYMLINK)) |
|
|
+ return -EPERM; |
|
|
+ /***** TOMOYO Linux end. *****/ |
|
|
|
|
|
from = getname(oldname); |
|
|
if(IS_ERR(from)) |
|
|
@@ -2187,6 +2270,13 @@ asmlinkage long sys_symlinkat(const char |
|
597 |
dentry = lookup_create(&nd, 0); |
dentry = lookup_create(&nd, 0); |
598 |
error = PTR_ERR(dentry); |
error = PTR_ERR(dentry); |
599 |
if (!IS_ERR(dentry)) { |
if (!IS_ERR(dentry)) { |
600 |
+ /***** TOMOYO Linux start. *****/ |
+ /***** TOMOYO Linux start. *****/ |
601 |
+ error = pre_vfs_symlink(nd.dentry->d_inode, dentry); |
+ error = ccs_check_symlink_permission(nd.dentry->d_inode, |
602 |
+ if (!error) |
+ dentry, nd.mnt, |
603 |
+ error = ccs_check_1path_perm(TYPE_SYMLINK_ACL, |
+ from); |
|
+ dentry, nd.mnt); |
|
604 |
+ if (!error) |
+ if (!error) |
605 |
+ /***** TOMOYO Linux end. *****/ |
+ /***** TOMOYO Linux end. *****/ |
606 |
error = vfs_symlink(nd.dentry->d_inode, dentry, from, S_IALLUGO); |
error = vfs_symlink(nd.dentry->d_inode, dentry, from, S_IALLUGO); |
607 |
dput(dentry); |
dput(dentry); |
608 |
} |
} |
609 |
@@ -2259,6 +2349,10 @@ asmlinkage long sys_linkat(int olddfd, c |
@@ -2281,6 +2328,12 @@ asmlinkage long sys_linkat(int olddfd, c |
|
struct nameidata nd, old_nd; |
|
|
int error; |
|
|
char * to; |
|
|
+ /***** TOMOYO Linux start. *****/ |
|
|
+ if (!ccs_capable(CCS_SYS_LINK)) |
|
|
+ return -EPERM; |
|
|
+ /***** TOMOYO Linux end. *****/ |
|
|
|
|
|
if ((flags & ~AT_SYMLINK_FOLLOW) != 0) |
|
|
return -EINVAL; |
|
|
@@ -2281,6 +2375,15 @@ asmlinkage long sys_linkat(int olddfd, c |
|
610 |
new_dentry = lookup_create(&nd, 0); |
new_dentry = lookup_create(&nd, 0); |
611 |
error = PTR_ERR(new_dentry); |
error = PTR_ERR(new_dentry); |
612 |
if (!IS_ERR(new_dentry)) { |
if (!IS_ERR(new_dentry)) { |
613 |
+ /***** TOMOYO Linux start. *****/ |
+ /***** TOMOYO Linux start. *****/ |
614 |
+ error = pre_vfs_link(old_nd.dentry, nd.dentry->d_inode, |
+ error = ccs_check_link_permission(old_nd.dentry, |
615 |
+ new_dentry); |
+ nd.dentry->d_inode, |
616 |
+ if (!error) |
+ new_dentry, nd.mnt); |
|
+ error = ccs_check_2path_perm(TYPE_LINK_ACL, |
|
|
+ old_nd.dentry, old_nd.mnt, |
|
|
+ new_dentry, nd.mnt); |
|
617 |
+ if (!error) |
+ if (!error) |
618 |
+ /***** TOMOYO Linux end. *****/ |
+ /***** TOMOYO Linux end. *****/ |
619 |
error = vfs_link(old_nd.dentry, nd.dentry->d_inode, new_dentry); |
error = vfs_link(old_nd.dentry, nd.dentry->d_inode, new_dentry); |
620 |
dput(new_dentry); |
dput(new_dentry); |
621 |
} |
} |
622 |
@@ -2507,6 +2610,17 @@ static int do_rename(int olddfd, const c |
@@ -2507,6 +2560,13 @@ static int do_rename(int olddfd, const c |
623 |
if (new_dentry == trap) |
if (new_dentry == trap) |
624 |
goto exit5; |
goto exit5; |
625 |
|
|
626 |
+ /***** TOMOYO Linux start. *****/ |
+ /***** TOMOYO Linux start. *****/ |
627 |
+ error = pre_vfs_rename(old_dir->d_inode, old_dentry, |
+ error = ccs_check_rename_permission(old_dir->d_inode, old_dentry, |
628 |
+ new_dir->d_inode, new_dentry); |
+ new_dir->d_inode, new_dentry, |
629 |
+ if (error) |
+ newnd.mnt); |
630 |
+ goto exit5; |
+ if (!error) |
|
+ error = ccs_check_2path_perm(TYPE_RENAME_ACL, old_dentry, oldnd.mnt, |
|
|
+ new_dentry, newnd.mnt); |
|
|
+ if (error) |
|
|
+ goto exit5; |
|
631 |
+ /***** TOMOYO Linux end. *****/ |
+ /***** TOMOYO Linux end. *****/ |
632 |
+ |
+ |
633 |
error = vfs_rename(old_dir->d_inode, old_dentry, |
error = vfs_rename(old_dir->d_inode, old_dentry, |
634 |
new_dir->d_inode, new_dentry); |
new_dir->d_inode, new_dentry); |
635 |
exit5: |
exit5: |
636 |
@@ -2529,6 +2643,10 @@ asmlinkage long sys_renameat(int olddfd, |
--- linux-2.6.18-24.orig/fs/namespace.c |
637 |
int error; |
+++ linux-2.6.18-24/fs/namespace.c |
|
char * from; |
|
|
char * to; |
|
|
+ /***** TOMOYO Linux start. *****/ |
|
|
+ if (!ccs_capable(CCS_SYS_RENAME)) |
|
|
+ return -EPERM; |
|
|
+ /***** TOMOYO Linux end. *****/ |
|
|
|
|
|
from = getname(oldname); |
|
|
if(IS_ERR(from)) |
|
|
--- linux-2.6.18-23etch1.orig/fs/namespace.c |
|
|
+++ linux-2.6.18-23etch1/fs/namespace.c |
|
638 |
@@ -25,6 +25,12 @@ |
@@ -25,6 +25,12 @@ |
639 |
#include <asm/uaccess.h> |
#include <asm/uaccess.h> |
640 |
#include <asm/unistd.h> |
#include <asm/unistd.h> |
748 |
if (error) { |
if (error) { |
749 |
path_release(&old_nd); |
path_release(&old_nd); |
750 |
goto out1; |
goto out1; |
751 |
--- linux-2.6.18-23etch1.orig/fs/open.c |
--- linux-2.6.18-24.orig/fs/open.c |
752 |
+++ linux-2.6.18-23etch1/fs/open.c |
+++ linux-2.6.18-24/fs/open.c |
753 |
@@ -30,6 +30,12 @@ |
@@ -30,6 +30,12 @@ |
754 |
#include <linux/audit.h> |
#include <linux/audit.h> |
755 |
|
|
768 |
goto dput_and_out; |
goto dput_and_out; |
769 |
|
|
770 |
+ /***** TOMOYO Linux start. *****/ |
+ /***** TOMOYO Linux start. *****/ |
771 |
+ error = ccs_check_1path_perm(TYPE_TRUNCATE_ACL, nd.dentry, nd.mnt); |
+ error = ccs_check_truncate_permission(nd.dentry, nd.mnt, length, 0); |
772 |
+ if (!error) |
+ if (!error) |
773 |
+ /***** TOMOYO Linux end. *****/ |
+ /***** TOMOYO Linux end. *****/ |
774 |
error = locks_verify_truncate(inode, NULL, length); |
error = locks_verify_truncate(inode, NULL, length); |
775 |
if (!error) { |
if (!error) { |
776 |
DQUOT_INIT(inode); |
DQUOT_INIT(inode); |
777 |
@@ -320,6 +330,11 @@ static long do_sys_ftruncate(unsigned in |
@@ -320,6 +330,12 @@ static long do_sys_ftruncate(unsigned in |
778 |
if (IS_APPEND(inode)) |
if (IS_APPEND(inode)) |
779 |
goto out_putf; |
goto out_putf; |
780 |
|
|
781 |
+ /***** TOMOYO Linux start. *****/ |
+ /***** TOMOYO Linux start. *****/ |
782 |
+ error = ccs_check_1path_perm(TYPE_TRUNCATE_ACL, dentry, file->f_vfsmnt); |
+ error = ccs_check_truncate_permission(dentry, file->f_vfsmnt, length, |
783 |
|
+ 0); |
784 |
+ if (error) |
+ if (error) |
785 |
+ goto out_putf; |
+ goto out_putf; |
786 |
+ /***** TOMOYO Linux end. *****/ |
+ /***** TOMOYO Linux end. *****/ |
787 |
error = locks_verify_truncate(inode, file, length); |
error = locks_verify_truncate(inode, file, length); |
788 |
if (!error) |
if (!error) |
789 |
error = do_truncate(dentry, length, ATTR_MTIME|ATTR_CTIME, file); |
error = do_truncate(dentry, length, ATTR_MTIME|ATTR_CTIME, file); |
790 |
@@ -608,6 +623,14 @@ asmlinkage long sys_chroot(const char __ |
@@ -608,6 +624,14 @@ asmlinkage long sys_chroot(const char __ |
791 |
error = -EPERM; |
error = -EPERM; |
792 |
if (!capable(CAP_SYS_CHROOT)) |
if (!capable(CAP_SYS_CHROOT)) |
793 |
goto dput_and_out; |
goto dput_and_out; |
802 |
|
|
803 |
set_fs_root(current->fs, nd.mnt, nd.dentry); |
set_fs_root(current->fs, nd.mnt, nd.dentry); |
804 |
set_fs_altroot(); |
set_fs_altroot(); |
805 |
@@ -1199,6 +1222,10 @@ EXPORT_SYMBOL(sys_close); |
@@ -1199,6 +1223,10 @@ EXPORT_SYMBOL(sys_close); |
806 |
*/ |
*/ |
807 |
asmlinkage long sys_vhangup(void) |
asmlinkage long sys_vhangup(void) |
808 |
{ |
{ |
813 |
if (capable(CAP_SYS_TTY_CONFIG)) { |
if (capable(CAP_SYS_TTY_CONFIG)) { |
814 |
tty_vhangup(current->signal->tty); |
tty_vhangup(current->signal->tty); |
815 |
return 0; |
return 0; |
816 |
--- linux-2.6.18-23etch1.orig/fs/proc/Makefile |
--- linux-2.6.18-24.orig/fs/proc/Makefile |
817 |
+++ linux-2.6.18-23etch1/fs/proc/Makefile |
+++ linux-2.6.18-24/fs/proc/Makefile |
818 |
@@ -13,3 +13,6 @@ proc-y += inode.o root.o base.o ge |
@@ -13,3 +13,6 @@ proc-y += inode.o root.o base.o ge |
819 |
proc-$(CONFIG_PROC_KCORE) += kcore.o |
proc-$(CONFIG_PROC_KCORE) += kcore.o |
820 |
proc-$(CONFIG_PROC_VMCORE) += vmcore.o |
proc-$(CONFIG_PROC_VMCORE) += vmcore.o |
822 |
+ |
+ |
823 |
+proc-$(CONFIG_SAKURA) += ccs_proc.o |
+proc-$(CONFIG_SAKURA) += ccs_proc.o |
824 |
+proc-$(CONFIG_TOMOYO) += ccs_proc.o |
+proc-$(CONFIG_TOMOYO) += ccs_proc.o |
825 |
--- linux-2.6.18-23etch1.orig/fs/proc/proc_misc.c |
--- linux-2.6.18-24.orig/fs/proc/proc_misc.c |
826 |
+++ linux-2.6.18-23etch1/fs/proc/proc_misc.c |
+++ linux-2.6.18-24/fs/proc/proc_misc.c |
827 |
@@ -723,4 +723,9 @@ void __init proc_misc_init(void) |
@@ -723,4 +723,9 @@ void __init proc_misc_init(void) |
828 |
if (entry) |
if (entry) |
829 |
entry->proc_fops = &proc_sysrq_trigger_operations; |
entry->proc_fops = &proc_sysrq_trigger_operations; |
834 |
+#endif |
+#endif |
835 |
+ /***** CCS end. *****/ |
+ /***** CCS end. *****/ |
836 |
} |
} |
837 |
--- linux-2.6.18-23etch1.orig/include/linux/init_task.h |
--- linux-2.6.18-24.orig/include/linux/init_task.h |
838 |
+++ linux-2.6.18-23etch1/include/linux/init_task.h |
+++ linux-2.6.18-24/include/linux/init_task.h |
839 |
@@ -128,6 +128,10 @@ extern struct group_info init_groups; |
@@ -128,6 +128,10 @@ extern struct group_info init_groups; |
840 |
.pi_lock = SPIN_LOCK_UNLOCKED, \ |
.pi_lock = SPIN_LOCK_UNLOCKED, \ |
841 |
INIT_TRACE_IRQFLAGS \ |
INIT_TRACE_IRQFLAGS \ |
847 |
} |
} |
848 |
|
|
849 |
|
|
850 |
--- linux-2.6.18-23etch1.orig/include/linux/sched.h |
--- linux-2.6.18-24.orig/include/linux/sched.h |
851 |
+++ linux-2.6.18-23etch1/include/linux/sched.h |
+++ linux-2.6.18-24/include/linux/sched.h |
852 |
@@ -25,6 +25,10 @@ |
@@ -25,6 +25,10 @@ |
853 |
#define CLONE_CHILD_SETTID 0x01000000 /* set the TID in the child */ |
#define CLONE_CHILD_SETTID 0x01000000 /* set the TID in the child */ |
854 |
#define CLONE_STOPPED 0x02000000 /* Start in stopped state */ |
#define CLONE_STOPPED 0x02000000 /* Start in stopped state */ |
871 |
}; |
}; |
872 |
|
|
873 |
static inline pid_t process_group(struct task_struct *tsk) |
static inline pid_t process_group(struct task_struct *tsk) |
874 |
--- linux-2.6.18-23etch1.orig/kernel/compat.c |
--- linux-2.6.18-24.orig/kernel/compat.c |
875 |
+++ linux-2.6.18-23etch1/kernel/compat.c |
+++ linux-2.6.18-24/kernel/compat.c |
876 |
@@ -24,6 +24,9 @@ |
@@ -24,6 +24,9 @@ |
877 |
#include <linux/migrate.h> |
#include <linux/migrate.h> |
878 |
|
|
894 |
|
|
895 |
do_settimeofday(&tv); |
do_settimeofday(&tv); |
896 |
return 0; |
return 0; |
897 |
--- linux-2.6.18-23etch1.orig/kernel/kexec.c |
--- linux-2.6.18-24.orig/kernel/kexec.c |
898 |
+++ linux-2.6.18-23etch1/kernel/kexec.c |
+++ linux-2.6.18-24/kernel/kexec.c |
899 |
@@ -26,6 +26,9 @@ |
@@ -26,6 +26,9 @@ |
900 |
#include <asm/io.h> |
#include <asm/io.h> |
901 |
#include <asm/system.h> |
#include <asm/system.h> |
917 |
|
|
918 |
/* |
/* |
919 |
* Verify we have a legal set of flags |
* Verify we have a legal set of flags |
920 |
--- linux-2.6.18-23etch1.orig/kernel/kmod.c |
--- linux-2.6.18-24.orig/kernel/kmod.c |
921 |
+++ linux-2.6.18-23etch1/kernel/kmod.c |
+++ linux-2.6.18-24/kernel/kmod.c |
922 |
@@ -148,6 +148,11 @@ static int ____call_usermodehelper(void |
@@ -148,6 +148,11 @@ static int ____call_usermodehelper(void |
923 |
/* We can run anywhere, unlike our parent keventd(). */ |
/* We can run anywhere, unlike our parent keventd(). */ |
924 |
set_cpus_allowed(current, CPU_MASK_ALL); |
set_cpus_allowed(current, CPU_MASK_ALL); |
931 |
retval = -EPERM; |
retval = -EPERM; |
932 |
if (current->fs->root) |
if (current->fs->root) |
933 |
retval = execve(sub_info->path, sub_info->argv,sub_info->envp); |
retval = execve(sub_info->path, sub_info->argv,sub_info->envp); |
934 |
--- linux-2.6.18-23etch1.orig/kernel/module.c |
--- linux-2.6.18-24.orig/kernel/module.c |
935 |
+++ linux-2.6.18-23etch1/kernel/module.c |
+++ linux-2.6.18-24/kernel/module.c |
936 |
@@ -44,6 +44,9 @@ |
@@ -44,6 +44,9 @@ |
937 |
#include <asm/semaphore.h> |
#include <asm/semaphore.h> |
938 |
#include <asm/cacheflush.h> |
#include <asm/cacheflush.h> |
967 |
/* Only one module load at a time, please */ |
/* Only one module load at a time, please */ |
968 |
if (mutex_lock_interruptible(&module_mutex) != 0) |
if (mutex_lock_interruptible(&module_mutex) != 0) |
969 |
return -EINTR; |
return -EINTR; |
970 |
--- linux-2.6.18-23etch1.orig/kernel/ptrace.c |
--- linux-2.6.18-24.orig/kernel/ptrace.c |
971 |
+++ linux-2.6.18-23etch1/kernel/ptrace.c |
+++ linux-2.6.18-24/kernel/ptrace.c |
972 |
@@ -21,6 +21,9 @@ |
@@ -21,6 +21,9 @@ |
973 |
|
|
974 |
#include <asm/pgtable.h> |
#include <asm/pgtable.h> |
990 |
lock_kernel(); |
lock_kernel(); |
991 |
if (request == PTRACE_TRACEME) { |
if (request == PTRACE_TRACEME) { |
992 |
ret = ptrace_traceme(); |
ret = ptrace_traceme(); |
993 |
--- linux-2.6.18-23etch1.orig/kernel/sched.c |
--- linux-2.6.18-24.orig/kernel/sched.c |
994 |
+++ linux-2.6.18-23etch1/kernel/sched.c |
+++ linux-2.6.18-24/kernel/sched.c |
995 |
@@ -55,6 +55,9 @@ |
@@ -55,6 +55,9 @@ |
996 |
#include <asm/tlb.h> |
#include <asm/tlb.h> |
997 |
|
|
1013 |
|
|
1014 |
/* |
/* |
1015 |
* Setpriority might change our priority at the same moment. |
* Setpriority might change our priority at the same moment. |
1016 |
--- linux-2.6.18-23etch1.orig/kernel/signal.c |
--- linux-2.6.18-24.orig/kernel/signal.c |
1017 |
+++ linux-2.6.18-23etch1/kernel/signal.c |
+++ linux-2.6.18-24/kernel/signal.c |
1018 |
@@ -28,6 +28,9 @@ |
@@ -28,6 +28,9 @@ |
1019 |
#include <asm/unistd.h> |
#include <asm/unistd.h> |
1020 |
#include <asm/siginfo.h> |
#include <asm/siginfo.h> |
1064 |
|
|
1065 |
return do_tkill(0, pid, sig); |
return do_tkill(0, pid, sig); |
1066 |
} |
} |
1067 |
--- linux-2.6.18-23etch1.orig/kernel/sys.c |
--- linux-2.6.18-24.orig/kernel/sys.c |
1068 |
+++ linux-2.6.18-23etch1/kernel/sys.c |
+++ linux-2.6.18-24/kernel/sys.c |
1069 |
@@ -36,6 +36,9 @@ |
@@ -36,6 +36,9 @@ |
1070 |
#include <asm/uaccess.h> |
#include <asm/uaccess.h> |
1071 |
#include <asm/io.h> |
#include <asm/io.h> |
1122 |
|
|
1123 |
down_write(&uts_sem); |
down_write(&uts_sem); |
1124 |
errno = -EFAULT; |
errno = -EFAULT; |
1125 |
--- linux-2.6.18-23etch1.orig/kernel/sysctl.c |
--- linux-2.6.18-24.orig/kernel/sysctl.c |
1126 |
+++ linux-2.6.18-23etch1/kernel/sysctl.c |
+++ linux-2.6.18-24/kernel/sysctl.c |
1127 |
@@ -48,6 +48,9 @@ |
@@ -48,6 +48,9 @@ |
1128 |
|
|
1129 |
#include <asm/uaccess.h> |
#include <asm/uaccess.h> |
1263 |
error = table->strategy( |
error = table->strategy( |
1264 |
table, name, nlen, |
table, name, nlen, |
1265 |
oldval, oldlenp, |
oldval, oldlenp, |
1266 |
--- linux-2.6.18-23etch1.orig/kernel/time.c |
--- linux-2.6.18-24.orig/kernel/time.c |
1267 |
+++ linux-2.6.18-23etch1/kernel/time.c |
+++ linux-2.6.18-24/kernel/time.c |
1268 |
@@ -39,6 +39,9 @@ |
@@ -39,6 +39,9 @@ |
1269 |
|
|
1270 |
#include <asm/uaccess.h> |
#include <asm/uaccess.h> |
1308 |
|
|
1309 |
/* Now we validate the data before disabling interrupts */ |
/* Now we validate the data before disabling interrupts */ |
1310 |
|
|
1311 |
--- linux-2.6.18-23etch1.orig/net/core/datagram.c |
--- linux-2.6.18-24.orig/net/core/datagram.c |
1312 |
+++ linux-2.6.18-23etch1/net/core/datagram.c |
+++ linux-2.6.18-24/net/core/datagram.c |
1313 |
@@ -56,6 +56,11 @@ |
@@ -56,6 +56,11 @@ |
1314 |
#include <net/sock.h> |
#include <net/sock.h> |
1315 |
#include <net/tcp_states.h> |
#include <net/tcp_states.h> |
1335 |
if (skb) |
if (skb) |
1336 |
return skb; |
return skb; |
1337 |
|
|
1338 |
--- linux-2.6.18-23etch1.orig/net/ipv4/inet_connection_sock.c |
--- linux-2.6.18-24.orig/net/ipv4/inet_connection_sock.c |
1339 |
+++ linux-2.6.18-23etch1/net/ipv4/inet_connection_sock.c |
+++ linux-2.6.18-24/net/ipv4/inet_connection_sock.c |
1340 |
@@ -23,6 +23,9 @@ |
@@ -23,6 +23,9 @@ |
1341 |
#include <net/route.h> |
#include <net/route.h> |
1342 |
#include <net/tcp_states.h> |
#include <net/tcp_states.h> |
1358 |
inet_bind_bucket_for_each(tb, node, &head->chain) |
inet_bind_bucket_for_each(tb, node, &head->chain) |
1359 |
if (tb->port == rover) |
if (tb->port == rover) |
1360 |
goto next; |
goto next; |
1361 |
--- linux-2.6.18-23etch1.orig/net/ipv4/inet_hashtables.c |
--- linux-2.6.18-24.orig/net/ipv4/inet_hashtables.c |
1362 |
+++ linux-2.6.18-23etch1/net/ipv4/inet_hashtables.c |
+++ linux-2.6.18-24/net/ipv4/inet_hashtables.c |
1363 |
@@ -22,6 +22,9 @@ |
@@ -22,6 +22,9 @@ |
1364 |
#include <net/inet_connection_sock.h> |
#include <net/inet_connection_sock.h> |
1365 |
#include <net/inet_hashtables.h> |
#include <net/inet_hashtables.h> |
1381 |
head = &hinfo->bhash[inet_bhashfn(port, hinfo->bhash_size)]; |
head = &hinfo->bhash[inet_bhashfn(port, hinfo->bhash_size)]; |
1382 |
spin_lock(&head->lock); |
spin_lock(&head->lock); |
1383 |
|
|
1384 |
--- linux-2.6.18-23etch1.orig/net/ipv4/udp.c |
--- linux-2.6.18-24.orig/net/ipv4/udp.c |
1385 |
+++ linux-2.6.18-23etch1/net/ipv4/udp.c |
+++ linux-2.6.18-24/net/ipv4/udp.c |
1386 |
@@ -108,6 +108,9 @@ |
@@ -108,6 +108,9 @@ |
1387 |
#include <net/inet_common.h> |
#include <net/inet_common.h> |
1388 |
#include <net/checksum.h> |
#include <net/checksum.h> |
1415 |
if (!udp_lport_inuse(result)) |
if (!udp_lport_inuse(result)) |
1416 |
break; |
break; |
1417 |
} |
} |
1418 |
--- linux-2.6.18-23etch1.orig/net/ipv6/inet6_hashtables.c |
--- linux-2.6.18-24.orig/net/ipv6/inet6_hashtables.c |
1419 |
+++ linux-2.6.18-23etch1/net/ipv6/inet6_hashtables.c |
+++ linux-2.6.18-24/net/ipv6/inet6_hashtables.c |
1420 |
@@ -21,6 +21,9 @@ |
@@ -21,6 +21,9 @@ |
1421 |
#include <net/inet_hashtables.h> |
#include <net/inet_hashtables.h> |
1422 |
#include <net/inet6_hashtables.h> |
#include <net/inet6_hashtables.h> |
1447 |
head = &hinfo->bhash[inet_bhashfn(port, hinfo->bhash_size)]; |
head = &hinfo->bhash[inet_bhashfn(port, hinfo->bhash_size)]; |
1448 |
spin_lock(&head->lock); |
spin_lock(&head->lock); |
1449 |
|
|
1450 |
--- linux-2.6.18-23etch1.orig/net/ipv6/udp.c |
--- linux-2.6.18-24.orig/net/ipv6/udp.c |
1451 |
+++ linux-2.6.18-23etch1/net/ipv6/udp.c |
+++ linux-2.6.18-24/net/ipv6/udp.c |
1452 |
@@ -58,6 +58,9 @@ |
@@ -58,6 +58,9 @@ |
1453 |
|
|
1454 |
#include <linux/proc_fs.h> |
#include <linux/proc_fs.h> |
1481 |
if (!udp_lport_inuse(result)) |
if (!udp_lport_inuse(result)) |
1482 |
break; |
break; |
1483 |
} |
} |
1484 |
--- linux-2.6.18-23etch1.orig/net/socket.c |
--- linux-2.6.18-24.orig/net/socket.c |
1485 |
+++ linux-2.6.18-23etch1/net/socket.c |
+++ linux-2.6.18-24/net/socket.c |
1486 |
@@ -94,6 +94,11 @@ |
@@ -94,6 +94,11 @@ |
1487 |
#include <net/sock.h> |
#include <net/sock.h> |
1488 |
#include <linux/netfilter.h> |
#include <linux/netfilter.h> |
1575 |
err = sock->ops->connect(sock, (struct sockaddr *) address, addrlen, |
err = sock->ops->connect(sock, (struct sockaddr *) address, addrlen, |
1576 |
sock->file->f_flags); |
sock->file->f_flags); |
1577 |
out_put: |
out_put: |
1578 |
--- linux-2.6.18-23etch1.orig/net/unix/af_unix.c |
--- linux-2.6.18-24.orig/net/unix/af_unix.c |
1579 |
+++ linux-2.6.18-23etch1/net/unix/af_unix.c |
+++ linux-2.6.18-24/net/unix/af_unix.c |
1580 |
@@ -116,6 +116,9 @@ |
@@ -116,6 +116,9 @@ |
1581 |
#include <linux/mount.h> |
#include <linux/mount.h> |
1582 |
#include <net/checksum.h> |
#include <net/checksum.h> |
1587 |
|
|
1588 |
int sysctl_unix_max_dgram_qlen = 10; |
int sysctl_unix_max_dgram_qlen = 10; |
1589 |
|
|
1590 |
@@ -764,6 +767,11 @@ static int unix_bind(struct socket *sock |
@@ -807,6 +810,11 @@ static int unix_bind(struct socket *sock |
|
err = unix_autobind(sock); |
|
|
goto out; |
|
|
} |
|
|
+ /***** TOMOYO Linux start. *****/ |
|
|
+ err = -EPERM; |
|
|
+ if (sunaddr->sun_path[0] && !ccs_capable(CCS_CREATE_UNIX_SOCKET)) |
|
|
+ goto out; |
|
|
+ /***** TOMOYO Linux end. *****/ |
|
|
|
|
|
err = unix_mkname(sunaddr, addr_len, &hash); |
|
|
if (err < 0) |
|
|
@@ -807,6 +815,13 @@ static int unix_bind(struct socket *sock |
|
1591 |
*/ |
*/ |
1592 |
mode = S_IFSOCK | |
mode = S_IFSOCK | |
1593 |
(SOCK_INODE(sock)->i_mode & ~current->fs->umask); |
(SOCK_INODE(sock)->i_mode & ~current->fs->umask); |
1594 |
+ /***** TOMOYO Linux start. *****/ |
+ /***** TOMOYO Linux start. *****/ |
1595 |
+ err = pre_vfs_mknod(nd.dentry->d_inode, dentry, mode); |
+ err = ccs_check_mknod_permission(nd.dentry->d_inode, dentry, |
1596 |
+ if (!err) |
+ nd.mnt, mode, 0); |
|
+ err = ccs_check_1path_perm(TYPE_MKSOCK_ACL, dentry, |
|
|
+ nd.mnt); |
|
1597 |
+ if (!err) |
+ if (!err) |
1598 |
+ /***** TOMOYO Linux end. *****/ |
+ /***** TOMOYO Linux end. *****/ |
1599 |
err = vfs_mknod(nd.dentry->d_inode, dentry, mode, 0); |
err = vfs_mknod(nd.dentry->d_inode, dentry, mode, 0); |