15 |
fs/compat.c | 3 ++- |
fs/compat.c | 3 ++- |
16 |
fs/compat_ioctl.c | 3 +++ |
fs/compat_ioctl.c | 3 +++ |
17 |
fs/exec.c | 11 ++++++++++- |
fs/exec.c | 11 ++++++++++- |
18 |
fs/fcntl.c | 4 ++++ |
fs/fcntl.c | 5 +++++ |
19 |
fs/ioctl.c | 3 +++ |
fs/ioctl.c | 3 +++ |
20 |
fs/namei.c | 30 +++++++++++++++++++++++++++++- |
fs/namei.c | 30 +++++++++++++++++++++++++++++- |
21 |
fs/namespace.c | 9 +++++++++ |
fs/namespace.c | 9 +++++++++ |
45 |
net/unix/af_unix.c | 9 +++++++++ |
net/unix/af_unix.c | 9 +++++++++ |
46 |
security/Kconfig | 2 ++ |
security/Kconfig | 2 ++ |
47 |
security/Makefile | 3 +++ |
security/Makefile | 3 +++ |
48 |
43 files changed, 277 insertions(+), 11 deletions(-) |
43 files changed, 278 insertions(+), 11 deletions(-) |
49 |
|
|
50 |
--- linux-2.6.23.17.orig/arch/alpha/kernel/ptrace.c |
--- linux-2.6.23.17.orig/arch/alpha/kernel/ptrace.c |
51 |
+++ linux-2.6.23.17/arch/alpha/kernel/ptrace.c |
+++ linux-2.6.23.17/arch/alpha/kernel/ptrace.c |
330 |
|
|
331 |
void fastcall set_close_on_exec(unsigned int fd, int flag) |
void fastcall set_close_on_exec(unsigned int fd, int flag) |
332 |
{ |
{ |
333 |
@@ -213,6 +214,9 @@ static int setfl(int fd, struct file * f |
@@ -392,6 +393,8 @@ asmlinkage long sys_fcntl(unsigned int f |
334 |
if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode)) |
goto out; |
|
return -EPERM; |
|
335 |
|
|
336 |
+ if (((arg ^ filp->f_flags) & O_APPEND) && ccs_rewrite_permission(filp)) |
err = security_file_fcntl(filp, cmd, arg); |
337 |
+ return -EPERM; |
+ if (!err) |
338 |
+ |
+ err = ccs_fcntl_permission(filp, cmd, arg); |
339 |
/* O_NOATIME can only be set by the owner or superuser */ |
if (err) { |
340 |
if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME)) |
fput(filp); |
341 |
if (!is_owner_or_cap(inode)) |
return err; |
342 |
|
@@ -416,6 +419,8 @@ asmlinkage long sys_fcntl64(unsigned int |
343 |
|
goto out; |
344 |
|
|
345 |
|
err = security_file_fcntl(filp, cmd, arg); |
346 |
|
+ if (!err) |
347 |
|
+ err = ccs_fcntl_permission(filp, cmd, arg); |
348 |
|
if (err) { |
349 |
|
fput(filp); |
350 |
|
return err; |
351 |
--- linux-2.6.23.17.orig/fs/ioctl.c |
--- linux-2.6.23.17.orig/fs/ioctl.c |
352 |
+++ linux-2.6.23.17/fs/ioctl.c |
+++ linux-2.6.23.17/fs/ioctl.c |
353 |
@@ -15,6 +15,7 @@ |
@@ -15,6 +15,7 @@ |