7 |
fs/compat.c | 3 ++- |
fs/compat.c | 3 ++- |
8 |
fs/compat_ioctl.c | 3 +++ |
fs/compat_ioctl.c | 3 +++ |
9 |
fs/exec.c | 10 +++++++++- |
fs/exec.c | 10 +++++++++- |
10 |
fs/fcntl.c | 4 ++++ |
fs/fcntl.c | 5 +++++ |
11 |
fs/ioctl.c | 3 +++ |
fs/ioctl.c | 3 +++ |
12 |
fs/namei.c | 36 ++++++++++++++++++++++++++++++++++++ |
fs/namei.c | 36 ++++++++++++++++++++++++++++++++++++ |
13 |
fs/namespace.c | 9 +++++++++ |
fs/namespace.c | 9 +++++++++ |
36 |
net/unix/af_unix.c | 9 +++++++++ |
net/unix/af_unix.c | 9 +++++++++ |
37 |
security/Kconfig | 2 ++ |
security/Kconfig | 2 ++ |
38 |
security/Makefile | 3 +++ |
security/Makefile | 3 +++ |
39 |
34 files changed, 250 insertions(+), 10 deletions(-) |
34 files changed, 251 insertions(+), 10 deletions(-) |
40 |
|
|
41 |
--- linux-2.6.27-17.46.orig/arch/ia64/ia32/sys_ia32.c |
--- linux-2.6.27-17.46.orig/arch/ia64/ia32/sys_ia32.c |
42 |
+++ linux-2.6.27-17.46/arch/ia64/ia32/sys_ia32.c |
+++ linux-2.6.27-17.46/arch/ia64/ia32/sys_ia32.c |
164 |
|
|
165 |
void set_close_on_exec(unsigned int fd, int flag) |
void set_close_on_exec(unsigned int fd, int flag) |
166 |
{ |
{ |
167 |
@@ -155,6 +156,9 @@ static int setfl(int fd, struct file * f |
@@ -344,6 +345,8 @@ SYSCALL_DEFINE3(fcntl, unsigned int, fd, |
168 |
if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode)) |
goto out; |
|
return -EPERM; |
|
169 |
|
|
170 |
+ if (((arg ^ filp->f_flags) & O_APPEND) && ccs_rewrite_permission(filp)) |
err = security_file_fcntl(filp, cmd, arg); |
171 |
+ return -EPERM; |
+ if (!err) |
172 |
+ |
+ err = ccs_fcntl_permission(filp, cmd, arg); |
173 |
/* O_NOATIME can only be set by the owner or superuser */ |
if (err) { |
174 |
if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME)) |
fput(filp); |
175 |
if (!is_owner_or_cap(inode)) |
return err; |
176 |
|
@@ -369,6 +372,8 @@ SYSCALL_DEFINE3(fcntl64, unsigned int, f |
177 |
|
goto out; |
178 |
|
|
179 |
|
err = security_file_fcntl(filp, cmd, arg); |
180 |
|
+ if (!err) |
181 |
|
+ err = ccs_fcntl_permission(filp, cmd, arg); |
182 |
|
if (err) { |
183 |
|
fput(filp); |
184 |
|
return err; |
185 |
--- linux-2.6.27-17.46.orig/fs/ioctl.c |
--- linux-2.6.27-17.46.orig/fs/ioctl.c |
186 |
+++ linux-2.6.27-17.46/fs/ioctl.c |
+++ linux-2.6.27-17.46/fs/ioctl.c |
187 |
@@ -15,6 +15,7 @@ |
@@ -15,6 +15,7 @@ |