summaryrefslogtreecommitdiff
path: root/security/commoncap.c
diff options
context:
space:
mode:
authorEric Paris <eparis@redhat.com>2010-11-15 18:36:29 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2010-11-15 15:40:01 -0800
commit12b3052c3ee8f508b2c7ee4ddd63ed03423409d8 (patch)
treeb97d0f209f363cfad94ce9d075312274e349da89 /security/commoncap.c
parent6800e4c0ea3e96cf78953b8b5743381cb1bb9e37 (diff)
downloadlinux-3.10-12b3052c3ee8f508b2c7ee4ddd63ed03423409d8.tar.gz
linux-3.10-12b3052c3ee8f508b2c7ee4ddd63ed03423409d8.tar.bz2
linux-3.10-12b3052c3ee8f508b2c7ee4ddd63ed03423409d8.zip
capabilities/syslog: open code cap_syslog logic to fix build failure
The addition of CONFIG_SECURITY_DMESG_RESTRICT resulted in a build failure when CONFIG_PRINTK=n. This is because the capabilities code which used the new option was built even though the variable in question didn't exist. The patch here fixes this by moving the capabilities checks out of the LSM and into the caller. All (known) LSMs should have been calling the capabilities hook already so it actually makes the code organization better to eliminate the hook altogether. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'security/commoncap.c')
-rw-r--r--security/commoncap.c21
1 files changed, 0 insertions, 21 deletions
diff --git a/security/commoncap.c b/security/commoncap.c
index 04b80f9912b..64c2ed9c901 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -27,7 +27,6 @@
#include <linux/sched.h>
#include <linux/prctl.h>
#include <linux/securebits.h>
-#include <linux/syslog.h>
/*
* If a non-root user executes a setuid-root binary in
@@ -884,26 +883,6 @@ error:
}
/**
- * cap_syslog - Determine whether syslog function is permitted
- * @type: Function requested
- * @from_file: Whether this request came from an open file (i.e. /proc)
- *
- * Determine whether the current process is permitted to use a particular
- * syslog function, returning 0 if permission is granted, -ve if not.
- */
-int cap_syslog(int type, bool from_file)
-{
- if (type != SYSLOG_ACTION_OPEN && from_file)
- return 0;
- if (dmesg_restrict && !capable(CAP_SYS_ADMIN))
- return -EPERM;
- if ((type != SYSLOG_ACTION_READ_ALL &&
- type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN))
- return -EPERM;
- return 0;
-}
-
-/**
* cap_vm_enough_memory - Determine whether a new virtual mapping is permitted
* @mm: The VM space in which the new mapping is to be made
* @pages: The size of the mapping