30 |
fs/attr.c | 11 --- |
fs/attr.c | 11 --- |
31 |
fs/compat.c | 13 ++-- |
fs/compat.c | 13 ++-- |
32 |
fs/exec.c | 58 ++----------------- |
fs/exec.c | 58 ++----------------- |
33 |
fs/fcntl.c | 9 +-- |
fs/fcntl.c | 12 +--- |
34 |
fs/ioctl.c | 9 +-- |
fs/ioctl.c | 9 +-- |
35 |
fs/namei.c | 108 ++++++++++--------------------------- |
fs/namei.c | 108 ++++++++++--------------------------- |
36 |
fs/namespace.c | 54 +++--------------- |
fs/namespace.c | 54 +++--------------- |
56 |
net/unix/af_unix.c | 23 +++---- |
net/unix/af_unix.c | 23 +++---- |
57 |
security/Kconfig | 2 |
security/Kconfig | 2 |
58 |
security/Makefile | 3 + |
security/Makefile | 3 + |
59 |
56 files changed, 314 insertions(+), 520 deletions(-) |
56 files changed, 316 insertions(+), 521 deletions(-) |
60 |
|
|
61 |
--- linux-2.6.8-20.orig/arch/alpha/kernel/ptrace.c |
--- linux-2.6.8-20.orig/arch/alpha/kernel/ptrace.c |
62 |
+++ linux-2.6.8-20/arch/alpha/kernel/ptrace.c |
+++ linux-2.6.8-20/arch/alpha/kernel/ptrace.c |
739 |
|
|
740 |
void fastcall set_close_on_exec(unsigned int fd, int flag) |
void fastcall set_close_on_exec(unsigned int fd, int flag) |
741 |
{ |
{ |
742 |
@@ -228,9 +226,8 @@ static int setfl(int fd, struct file * f |
@@ -228,10 +226,6 @@ static int setfl(int fd, struct file * f |
743 |
if (!(arg & O_APPEND) && IS_APPEND(inode)) |
if (!(arg & O_APPEND) && IS_APPEND(inode)) |
744 |
return -EPERM; |
return -EPERM; |
745 |
|
|
746 |
- /***** TOMOYO Linux start. *****/ |
- /***** TOMOYO Linux start. *****/ |
747 |
- if (!(arg & O_APPEND) && CheckReWritePermission(filp)) return -EPERM; |
- if (!(arg & O_APPEND) && CheckReWritePermission(filp)) return -EPERM; |
748 |
- /***** TOMOYO Linux end. *****/ |
- /***** TOMOYO Linux end. *****/ |
749 |
+ if (!(arg & O_APPEND) && ccs_rewrite_permission(filp)) |
- |
|
+ return -EPERM; |
|
|
|
|
750 |
/* O_NOATIME can only be set by the owner or superuser */ |
/* O_NOATIME can only be set by the owner or superuser */ |
751 |
if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME)) |
if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME)) |
752 |
|
if (current->fsuid != inode->i_uid && !capable(CAP_FOWNER)) |
753 |
|
@@ -381,6 +375,8 @@ asmlinkage long sys_fcntl(int fd, unsign |
754 |
|
goto out; |
755 |
|
|
756 |
|
err = security_file_fcntl(filp, cmd, arg); |
757 |
|
+ if (!err) |
758 |
|
+ err = ccs_fcntl_permission(filp, cmd, arg); |
759 |
|
if (err) { |
760 |
|
fput(filp); |
761 |
|
return err; |
762 |
|
@@ -405,6 +401,8 @@ asmlinkage long sys_fcntl64(unsigned int |
763 |
|
goto out; |
764 |
|
|
765 |
|
err = security_file_fcntl(filp, cmd, arg); |
766 |
|
+ if (!err) |
767 |
|
+ err = ccs_fcntl_permission(filp, cmd, arg); |
768 |
|
if (err) { |
769 |
|
fput(filp); |
770 |
|
return err; |
771 |
--- linux-2.6.8-20.orig/fs/ioctl.c |
--- linux-2.6.8-20.orig/fs/ioctl.c |
772 |
+++ linux-2.6.8-20/fs/ioctl.c |
+++ linux-2.6.8-20/fs/ioctl.c |
773 |
@@ -14,9 +14,7 @@ |
@@ -14,9 +14,7 @@ |