diff options
| author | Roman Shaposhnikov <x0166637@ti.com> | 2012-06-13 23:00:26 +0300 |
|---|---|---|
| committer | Roman Shaposhnikov <x0166637@ti.com> | 2012-06-13 23:00:26 +0300 |
| commit | 4efa29b240cc7dd0584ad3d2f6a446e6034e0a78 (patch) | |
| tree | 741e8a369da867cd29c112a5f9fc4dfe596b67cd /security | |
| parent | 0f2c8a7c9c04e388f585a79a7e609d8427e68e08 (diff) | |
| download | kernel_samsung_espresso10-4efa29b240cc7dd0584ad3d2f6a446e6034e0a78.zip kernel_samsung_espresso10-4efa29b240cc7dd0584ad3d2f6a446e6034e0a78.tar.gz kernel_samsung_espresso10-4efa29b240cc7dd0584ad3d2f6a446e6034e0a78.tar.bz2 | |
Merge latest changes from google kernel/common.git
Kernel version updated to 3.0.31
Change-Id: Ifbd7150801f3beeec9cbaa566f249d8019ef9348
Signed-off-by: Roman Shaposhnikov <x0166637@ti.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/commoncap.c | 6 | ||||
| -rw-r--r-- | security/tomoyo/mount.c | 38 |
2 files changed, 26 insertions, 18 deletions
diff --git a/security/commoncap.c b/security/commoncap.c index 1322b6a..ccfe568 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -28,6 +28,7 @@ #include <linux/prctl.h> #include <linux/securebits.h> #include <linux/user_namespace.h> +#include <linux/personality.h> #ifdef CONFIG_ANDROID_PARANOID_NETWORK #include <linux/android_aid.h> @@ -519,6 +520,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) } skip: + /* if we have fs caps, clear dangerous personality flags */ + if (!cap_issubset(new->cap_permitted, old->cap_permitted)) + bprm->per_clear |= PER_CLEAR_ON_SETID; + + /* Don't let someone trace a set[ug]id/setpcap binary with the revised * credentials unless they have the appropriate permit */ diff --git a/security/tomoyo/mount.c b/security/tomoyo/mount.c index 9fc2e15..892494a 100644 --- a/security/tomoyo/mount.c +++ b/security/tomoyo/mount.c @@ -205,30 +205,32 @@ int tomoyo_mount_permission(char *dev_name, struct path *path, char *type, if (flags & MS_REMOUNT) { type = TOMOYO_MOUNT_REMOUNT_KEYWORD; flags &= ~MS_REMOUNT; - } - if (flags & MS_MOVE) { - type = TOMOYO_MOUNT_MOVE_KEYWORD; - flags &= ~MS_MOVE; - } - if (flags & MS_BIND) { + } else if (flags & MS_BIND) { type = TOMOYO_MOUNT_BIND_KEYWORD; flags &= ~MS_BIND; - } - if (flags & MS_UNBINDABLE) { - type = TOMOYO_MOUNT_MAKE_UNBINDABLE_KEYWORD; - flags &= ~MS_UNBINDABLE; - } - if (flags & MS_PRIVATE) { + } else if (flags & MS_SHARED) { + if (flags & (MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) + return -EINVAL; + type = TOMOYO_MOUNT_MAKE_SHARED_KEYWORD; + flags &= ~MS_SHARED; + } else if (flags & MS_PRIVATE) { + if (flags & (MS_SHARED | MS_SLAVE | MS_UNBINDABLE)) + return -EINVAL; type = TOMOYO_MOUNT_MAKE_PRIVATE_KEYWORD; flags &= ~MS_PRIVATE; - } - if (flags & MS_SLAVE) { + } else if (flags & MS_SLAVE) { + if (flags & (MS_SHARED | MS_PRIVATE | MS_UNBINDABLE)) + return -EINVAL; type = TOMOYO_MOUNT_MAKE_SLAVE_KEYWORD; flags &= ~MS_SLAVE; - } - if (flags & MS_SHARED) { - type = TOMOYO_MOUNT_MAKE_SHARED_KEYWORD; - flags &= ~MS_SHARED; + } else if (flags & MS_UNBINDABLE) { + if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE)) + return -EINVAL; + type = TOMOYO_MOUNT_MAKE_UNBINDABLE_KEYWORD; + flags &= ~MS_UNBINDABLE; + } else if (flags & MS_MOVE) { + type = TOMOYO_MOUNT_MOVE_KEYWORD; + flags &= ~MS_MOVE; } if (!type) type = "<NULL>"; |