3 |
fs/compat.c | 3 ++- |
fs/compat.c | 3 ++- |
4 |
fs/compat_ioctl.c | 3 +++ |
fs/compat_ioctl.c | 3 +++ |
5 |
fs/exec.c | 3 ++- |
fs/exec.c | 3 ++- |
6 |
fs/fcntl.c | 4 ++++ |
fs/fcntl.c | 5 +++++ |
7 |
fs/ioctl.c | 3 +++ |
fs/ioctl.c | 3 +++ |
8 |
fs/namei.c | 37 +++++++++++++++++++++++++++++++++++++ |
fs/namei.c | 37 +++++++++++++++++++++++++++++++++++++ |
9 |
fs/namespace.c | 9 +++++++++ |
fs/namespace.c | 9 +++++++++ |
31 |
net/unix/af_unix.c | 10 ++++++++++ |
net/unix/af_unix.c | 10 ++++++++++ |
32 |
security/Kconfig | 2 ++ |
security/Kconfig | 2 ++ |
33 |
security/Makefile | 3 +++ |
security/Makefile | 3 +++ |
34 |
31 files changed, 242 insertions(+), 10 deletions(-) |
31 files changed, 243 insertions(+), 10 deletions(-) |
35 |
|
|
36 |
--- linux-2.6.32-44.2.el6.orig/fs/compat.c |
--- linux-2.6.32-44.2.el6.orig/fs/compat.c |
37 |
+++ linux-2.6.32-44.2.el6/fs/compat.c |
+++ linux-2.6.32-44.2.el6/fs/compat.c |
100 |
|
|
101 |
void set_close_on_exec(unsigned int fd, int flag) |
void set_close_on_exec(unsigned int fd, int flag) |
102 |
{ |
{ |
103 |
@@ -156,6 +157,9 @@ static int setfl(int fd, struct file * f |
@@ -430,6 +431,8 @@ SYSCALL_DEFINE3(fcntl, unsigned int, fd, |
104 |
if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode)) |
goto out; |
105 |
return -EPERM; |
|
106 |
|
err = security_file_fcntl(filp, cmd, arg); |
107 |
+ if (((arg ^ filp->f_flags) & O_APPEND) && ccs_rewrite_permission(filp)) |
+ if (!err) |
108 |
+ return -EPERM; |
+ err = ccs_fcntl_permission(filp, cmd, arg); |
109 |
+ |
if (err) { |
110 |
/* O_NOATIME can only be set by the owner or superuser */ |
fput(filp); |
111 |
if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME)) |
return err; |
112 |
if (!is_owner_or_cap(inode)) |
@@ -455,6 +458,8 @@ SYSCALL_DEFINE3(fcntl64, unsigned int, f |
113 |
|
goto out; |
114 |
|
|
115 |
|
err = security_file_fcntl(filp, cmd, arg); |
116 |
|
+ if (!err) |
117 |
|
+ err = ccs_fcntl_permission(filp, cmd, arg); |
118 |
|
if (err) { |
119 |
|
fput(filp); |
120 |
|
return err; |
121 |
--- linux-2.6.32-44.2.el6.orig/fs/ioctl.c |
--- linux-2.6.32-44.2.el6.orig/fs/ioctl.c |
122 |
+++ linux-2.6.32-44.2.el6/fs/ioctl.c |
+++ linux-2.6.32-44.2.el6/fs/ioctl.c |
123 |
@@ -18,6 +18,7 @@ |
@@ -18,6 +18,7 @@ |