[PATCH -v2] capabilities: define get_vfs_caps_from_disk when file caps are not enabled

[PATCH -v2] capabilities: define get_vfs_caps_from_disk when file caps are not enabled

[Eric Paris]

When CONFIG_SECURITY_FILE_CAPABILITIES is not set the audit system may
try to call into the capabilities function vfs_cap_from_file.  This
patch defines that function so kernels can build and work.

Signed-off-by: Eric Paris <eparis@redhat.com>

---

james morris didn't like the fact I was clearing the cpu_caps struct.
So this patch makes the error handling better so I don't need to.
(actually I didn't need to fix the error handling since this audit
function is only called when fcaps are enabled and we already got the
xattr data once, but still, this is the right fix)

 kernel/auditsc.c     |   11 +++++++----
 security/commoncap.c |    5 +++++
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index cef3423..90b0544 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2556,6 +2556,13 @@ void __audit_log_bprm_fcaps(struct linux_binprm *bprm, kernel_cap_t *pP, kernel_
 	struct audit_context *context = current->audit_context;
 	struct cpu_vfs_cap_data vcaps;
 	struct dentry *dentry;
+	int ret;
+
+	dentry = dget(bprm->file->f_dentry);
+	ret = get_vfs_caps_from_disk(dentry, &vcaps);
+	dput(dentry);
+	if (ret)
+		return;
 
 	ax = kmalloc(sizeof(*ax), GFP_KERNEL);
 	if (!ax)
@@ -2565,10 +2572,6 @@ void __audit_log_bprm_fcaps(struct linux_binprm *bprm, kernel_cap_t *pP, kernel_
 	ax->d.next = context->aux;
 	context->aux = (void *)ax;
 
-	dentry = dget(bprm->file->f_dentry);
-	get_vfs_caps_from_disk(dentry, &vcaps);
-	dput(dentry);
-
 	ax->fcap.permitted = vcaps.permitted;
 	ax->fcap.inheritable = vcaps.inheritable;
 	ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
diff --git a/security/commoncap.c b/security/commoncap.c
index 0b88160..22b9270 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -337,6 +337,11 @@ int cap_inode_killpriv(struct dentry *dentry)
 	return 0;
 }
 
+int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
+{
+	return -ENODATA;
+}
+
 static inline int get_file_caps(struct linux_binprm *bprm)
 {
 	bprm_clear_caps(bprm);

Re: [PATCH -v2] capabilities: define get_vfs_caps_from_disk when file caps are not enabled

[James Morris]

On Fri, 14 Nov 2008, Eric Paris wrote:

> When CONFIG_SECURITY_FILE_CAPABILITIES is not set the audit system may
> try to call into the capabilities function vfs_cap_from_file.  This
> patch defines that function so kernels can build and work.
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>

This needs to be a patch against the 'next' branch of the security-testing 
tree.

> 
> ---
> 
> james morris didn't like the fact I was clearing the cpu_caps struct.
> So this patch makes the error handling better so I don't need to.
> (actually I didn't need to fix the error handling since this audit
> function is only called when fcaps are enabled and we already got the
> xattr data once, but still, this is the right fix)
> 
>  kernel/auditsc.c     |   11 +++++++----
>  security/commoncap.c |    5 +++++
>  2 files changed, 12 insertions(+), 4 deletions(-)
> 
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index cef3423..90b0544 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2556,6 +2556,13 @@ void __audit_log_bprm_fcaps(struct linux_binprm *bprm, kernel_cap_t *pP, kernel_
>  	struct audit_context *context = current->audit_context;
>  	struct cpu_vfs_cap_data vcaps;
>  	struct dentry *dentry;
> +	int ret;
> +
> +	dentry = dget(bprm->file->f_dentry);
> +	ret = get_vfs_caps_from_disk(dentry, &vcaps);
> +	dput(dentry);
> +	if (ret)
> +		return;
>  
>  	ax = kmalloc(sizeof(*ax), GFP_KERNEL);
>  	if (!ax)
> @@ -2565,10 +2572,6 @@ void __audit_log_bprm_fcaps(struct linux_binprm *bprm, kernel_cap_t *pP, kernel_
>  	ax->d.next = context->aux;
>  	context->aux = (void *)ax;
>  
> -	dentry = dget(bprm->file->f_dentry);
> -	get_vfs_caps_from_disk(dentry, &vcaps);
> -	dput(dentry);
> -
>  	ax->fcap.permitted = vcaps.permitted;
>  	ax->fcap.inheritable = vcaps.inheritable;
>  	ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
> diff --git a/security/commoncap.c b/security/commoncap.c
> index 0b88160..22b9270 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -337,6 +337,11 @@ int cap_inode_killpriv(struct dentry *dentry)
>  	return 0;
>  }
>  
> +int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
> +{
> +	return -ENODATA;
> +}
> +
>  static inline int get_file_caps(struct linux_binprm *bprm)
>  {
>  	bprm_clear_caps(bprm);
> 
> 

-- 
James Morris
<jmorris@namei.org>