17 |
fs/compat.c | 6 -- |
fs/compat.c | 6 -- |
18 |
fs/compat_ioctl.c | 9 +--- |
fs/compat_ioctl.c | 9 +--- |
19 |
fs/exec.c | 19 +++----- |
fs/exec.c | 19 +++----- |
20 |
fs/fcntl.c | 9 +--- |
fs/fcntl.c | 12 ++--- |
21 |
fs/ioctl.c | 9 +--- |
fs/ioctl.c | 9 +--- |
22 |
fs/namei.c | 86 ++++++++++++---------------------------- |
fs/namei.c | 86 ++++++++++++---------------------------- |
23 |
fs/namespace.c | 47 ++++----------------- |
fs/namespace.c | 47 ++++----------------- |
49 |
net/unix/af_unix.c | 19 ++++---- |
net/unix/af_unix.c | 19 ++++---- |
50 |
security/Kconfig | 2 |
security/Kconfig | 2 |
51 |
security/Makefile | 3 + |
security/Makefile | 3 + |
52 |
49 files changed, 262 insertions(+), 523 deletions(-) |
49 files changed, 264 insertions(+), 524 deletions(-) |
53 |
|
|
54 |
--- linux-2.6.23-12.orig/arch/alpha/kernel/ptrace.c |
--- linux-2.6.23-12.orig/arch/alpha/kernel/ptrace.c |
55 |
+++ linux-2.6.23-12/arch/alpha/kernel/ptrace.c |
+++ linux-2.6.23-12/arch/alpha/kernel/ptrace.c |
516 |
|
|
517 |
void fastcall set_close_on_exec(unsigned int fd, int flag) |
void fastcall set_close_on_exec(unsigned int fd, int flag) |
518 |
{ |
{ |
519 |
@@ -216,9 +214,8 @@ static int setfl(int fd, struct file * f |
@@ -216,10 +214,6 @@ static int setfl(int fd, struct file * f |
520 |
if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode)) |
if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode)) |
521 |
return -EPERM; |
return -EPERM; |
522 |
|
|
523 |
- /***** TOMOYO Linux start. *****/ |
- /***** TOMOYO Linux start. *****/ |
524 |
- if (((arg ^ filp->f_flags) & O_APPEND) && CheckReWritePermission(filp)) return -EPERM; |
- if (((arg ^ filp->f_flags) & O_APPEND) && CheckReWritePermission(filp)) return -EPERM; |
525 |
- /***** TOMOYO Linux end. *****/ |
- /***** TOMOYO Linux end. *****/ |
526 |
+ if (((arg ^ filp->f_flags) & O_APPEND) && ccs_rewrite_permission(filp)) |
- |
|
+ return -EPERM; |
|
|
|
|
527 |
/* O_NOATIME can only be set by the owner or superuser */ |
/* O_NOATIME can only be set by the owner or superuser */ |
528 |
if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME)) |
if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME)) |
529 |
|
if (!is_owner_or_cap(inode)) |
530 |
|
@@ -399,6 +393,8 @@ asmlinkage long sys_fcntl(unsigned int f |
531 |
|
goto out; |
532 |
|
|
533 |
|
err = security_file_fcntl(filp, cmd, arg); |
534 |
|
+ if (!err) |
535 |
|
+ err = ccs_fcntl_permission(filp, cmd, arg); |
536 |
|
if (err) { |
537 |
|
fput(filp); |
538 |
|
return err; |
539 |
|
@@ -423,6 +419,8 @@ asmlinkage long sys_fcntl64(unsigned int |
540 |
|
goto out; |
541 |
|
|
542 |
|
err = security_file_fcntl(filp, cmd, arg); |
543 |
|
+ if (!err) |
544 |
|
+ err = ccs_fcntl_permission(filp, cmd, arg); |
545 |
|
if (err) { |
546 |
|
fput(filp); |
547 |
|
return err; |
548 |
--- linux-2.6.23-12.orig/fs/ioctl.c |
--- linux-2.6.23-12.orig/fs/ioctl.c |
549 |
+++ linux-2.6.23-12/fs/ioctl.c |
+++ linux-2.6.23-12/fs/ioctl.c |
550 |
@@ -15,9 +15,7 @@ |
@@ -15,9 +15,7 @@ |