CRED: Separate task security context from task_struct
[linux-2.6.git] / security / commoncap.c
1 /* Common capabilities, needed by capability.o and root_plug.o
2  *
3  *      This program is free software; you can redistribute it and/or modify
4  *      it under the terms of the GNU General Public License as published by
5  *      the Free Software Foundation; either version 2 of the License, or
6  *      (at your option) any later version.
7  *
8  */
9
10 #include <linux/capability.h>
11 #include <linux/audit.h>
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/kernel.h>
15 #include <linux/security.h>
16 #include <linux/file.h>
17 #include <linux/mm.h>
18 #include <linux/mman.h>
19 #include <linux/pagemap.h>
20 #include <linux/swap.h>
21 #include <linux/skbuff.h>
22 #include <linux/netlink.h>
23 #include <linux/ptrace.h>
24 #include <linux/xattr.h>
25 #include <linux/hugetlb.h>
26 #include <linux/mount.h>
27 #include <linux/sched.h>
28 #include <linux/prctl.h>
29 #include <linux/securebits.h>
30
31 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
32 {
33         NETLINK_CB(skb).eff_cap = current_cap();
34         return 0;
35 }
36
37 int cap_netlink_recv(struct sk_buff *skb, int cap)
38 {
39         if (!cap_raised(NETLINK_CB(skb).eff_cap, cap))
40                 return -EPERM;
41         return 0;
42 }
43
44 EXPORT_SYMBOL(cap_netlink_recv);
45
46 /*
47  * NOTE WELL: cap_capable() cannot be used like the kernel's capable()
48  * function.  That is, it has the reverse semantics: cap_capable()
49  * returns 0 when a task has a capability, but the kernel's capable()
50  * returns 1 for this case.
51  */
52 int cap_capable(struct task_struct *tsk, int cap, int audit)
53 {
54         /* Derived from include/linux/sched.h:capable. */
55         if (cap_raised(tsk->cred->cap_effective, cap))
56                 return 0;
57         return -EPERM;
58 }
59
60 int cap_settime(struct timespec *ts, struct timezone *tz)
61 {
62         if (!capable(CAP_SYS_TIME))
63                 return -EPERM;
64         return 0;
65 }
66
67 int cap_ptrace_may_access(struct task_struct *child, unsigned int mode)
68 {
69         /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
70         if (cap_issubset(child->cred->cap_permitted,
71                          current->cred->cap_permitted))
72                 return 0;
73         if (capable(CAP_SYS_PTRACE))
74                 return 0;
75         return -EPERM;
76 }
77
78 int cap_ptrace_traceme(struct task_struct *parent)
79 {
80         if (cap_issubset(current->cred->cap_permitted,
81                          parent->cred->cap_permitted))
82                 return 0;
83         if (has_capability(parent, CAP_SYS_PTRACE))
84                 return 0;
85         return -EPERM;
86 }
87
88 int cap_capget (struct task_struct *target, kernel_cap_t *effective,
89                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
90 {
91         struct cred *cred = target->cred;
92
93         /* Derived from kernel/capability.c:sys_capget. */
94         *effective   = cred->cap_effective;
95         *inheritable = cred->cap_inheritable;
96         *permitted   = cred->cap_permitted;
97         return 0;
98 }
99
100 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
101
102 static inline int cap_inh_is_capped(void)
103 {
104         /*
105          * Return 1 if changes to the inheritable set are limited
106          * to the old permitted set. That is, if the current task
107          * does *not* possess the CAP_SETPCAP capability.
108          */
109         return (cap_capable(current, CAP_SETPCAP, SECURITY_CAP_AUDIT) != 0);
110 }
111
112 static inline int cap_limit_ptraced_target(void) { return 1; }
113
114 #else /* ie., ndef CONFIG_SECURITY_FILE_CAPABILITIES */
115
116 static inline int cap_inh_is_capped(void) { return 1; }
117 static inline int cap_limit_ptraced_target(void)
118 {
119         return !capable(CAP_SETPCAP);
120 }
121
122 #endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
123
124 int cap_capset_check(const kernel_cap_t *effective,
125                      const kernel_cap_t *inheritable,
126                      const kernel_cap_t *permitted)
127 {
128         const struct cred *cred = current->cred;
129
130         if (cap_inh_is_capped()
131             && !cap_issubset(*inheritable,
132                              cap_combine(cred->cap_inheritable,
133                                          cred->cap_permitted))) {
134                 /* incapable of using this inheritable set */
135                 return -EPERM;
136         }
137         if (!cap_issubset(*inheritable,
138                            cap_combine(cred->cap_inheritable,
139                                        cred->cap_bset))) {
140                 /* no new pI capabilities outside bounding set */
141                 return -EPERM;
142         }
143
144         /* verify restrictions on target's new Permitted set */
145         if (!cap_issubset (*permitted,
146                            cap_combine (cred->cap_permitted,
147                                         cred->cap_permitted))) {
148                 return -EPERM;
149         }
150
151         /* verify the _new_Effective_ is a subset of the _new_Permitted_ */
152         if (!cap_issubset (*effective, *permitted)) {
153                 return -EPERM;
154         }
155
156         return 0;
157 }
158
159 void cap_capset_set(const kernel_cap_t *effective,
160                     const kernel_cap_t *inheritable,
161                     const kernel_cap_t *permitted)
162 {
163         struct cred *cred = current->cred;
164
165         cred->cap_effective   = *effective;
166         cred->cap_inheritable = *inheritable;
167         cred->cap_permitted   = *permitted;
168 }
169
170 static inline void bprm_clear_caps(struct linux_binprm *bprm)
171 {
172         cap_clear(bprm->cap_post_exec_permitted);
173         bprm->cap_effective = false;
174 }
175
176 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
177
178 int cap_inode_need_killpriv(struct dentry *dentry)
179 {
180         struct inode *inode = dentry->d_inode;
181         int error;
182
183         if (!inode->i_op || !inode->i_op->getxattr)
184                return 0;
185
186         error = inode->i_op->getxattr(dentry, XATTR_NAME_CAPS, NULL, 0);
187         if (error <= 0)
188                 return 0;
189         return 1;
190 }
191
192 int cap_inode_killpriv(struct dentry *dentry)
193 {
194         struct inode *inode = dentry->d_inode;
195
196         if (!inode->i_op || !inode->i_op->removexattr)
197                return 0;
198
199         return inode->i_op->removexattr(dentry, XATTR_NAME_CAPS);
200 }
201
202 static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
203                                           struct linux_binprm *bprm)
204 {
205         unsigned i;
206         int ret = 0;
207
208         if (caps->magic_etc & VFS_CAP_FLAGS_EFFECTIVE)
209                 bprm->cap_effective = true;
210         else
211                 bprm->cap_effective = false;
212
213         CAP_FOR_EACH_U32(i) {
214                 __u32 permitted = caps->permitted.cap[i];
215                 __u32 inheritable = caps->inheritable.cap[i];
216
217                 /*
218                  * pP' = (X & fP) | (pI & fI)
219                  */
220                 bprm->cap_post_exec_permitted.cap[i] =
221                         (current->cred->cap_bset.cap[i] & permitted) |
222                         (current->cred->cap_inheritable.cap[i] & inheritable);
223
224                 if (permitted & ~bprm->cap_post_exec_permitted.cap[i]) {
225                         /*
226                          * insufficient to execute correctly
227                          */
228                         ret = -EPERM;
229                 }
230         }
231
232         /*
233          * For legacy apps, with no internal support for recognizing they
234          * do not have enough capabilities, we return an error if they are
235          * missing some "forced" (aka file-permitted) capabilities.
236          */
237         return bprm->cap_effective ? ret : 0;
238 }
239
240 int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
241 {
242         struct inode *inode = dentry->d_inode;
243         __u32 magic_etc;
244         unsigned tocopy, i;
245         int size;
246         struct vfs_cap_data caps;
247
248         memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
249
250         if (!inode || !inode->i_op || !inode->i_op->getxattr)
251                 return -ENODATA;
252
253         size = inode->i_op->getxattr((struct dentry *)dentry, XATTR_NAME_CAPS, &caps,
254                                    XATTR_CAPS_SZ);
255         if (size == -ENODATA || size == -EOPNOTSUPP) {
256                 /* no data, that's ok */
257                 return -ENODATA;
258         }
259         if (size < 0)
260                 return size;
261
262         if (size < sizeof(magic_etc))
263                 return -EINVAL;
264
265         cpu_caps->magic_etc = magic_etc = le32_to_cpu(caps.magic_etc);
266
267         switch ((magic_etc & VFS_CAP_REVISION_MASK)) {
268         case VFS_CAP_REVISION_1:
269                 if (size != XATTR_CAPS_SZ_1)
270                         return -EINVAL;
271                 tocopy = VFS_CAP_U32_1;
272                 break;
273         case VFS_CAP_REVISION_2:
274                 if (size != XATTR_CAPS_SZ_2)
275                         return -EINVAL;
276                 tocopy = VFS_CAP_U32_2;
277                 break;
278         default:
279                 return -EINVAL;
280         }
281
282         CAP_FOR_EACH_U32(i) {
283                 if (i >= tocopy)
284                         break;
285                 cpu_caps->permitted.cap[i] = le32_to_cpu(caps.data[i].permitted);
286                 cpu_caps->inheritable.cap[i] = le32_to_cpu(caps.data[i].inheritable);
287         }
288         return 0;
289 }
290
291 /* Locate any VFS capabilities: */
292 static int get_file_caps(struct linux_binprm *bprm)
293 {
294         struct dentry *dentry;
295         int rc = 0;
296         struct cpu_vfs_cap_data vcaps;
297
298         bprm_clear_caps(bprm);
299
300         if (!file_caps_enabled)
301                 return 0;
302
303         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
304                 return 0;
305
306         dentry = dget(bprm->file->f_dentry);
307
308         rc = get_vfs_caps_from_disk(dentry, &vcaps);
309         if (rc < 0) {
310                 if (rc == -EINVAL)
311                         printk(KERN_NOTICE "%s: get_vfs_caps_from_disk returned %d for %s\n",
312                                 __func__, rc, bprm->filename);
313                 else if (rc == -ENODATA)
314                         rc = 0;
315                 goto out;
316         }
317
318         rc = bprm_caps_from_vfs_caps(&vcaps, bprm);
319
320 out:
321         dput(dentry);
322         if (rc)
323                 bprm_clear_caps(bprm);
324
325         return rc;
326 }
327
328 #else
329 int cap_inode_need_killpriv(struct dentry *dentry)
330 {
331         return 0;
332 }
333
334 int cap_inode_killpriv(struct dentry *dentry)
335 {
336         return 0;
337 }
338
339 static inline int get_file_caps(struct linux_binprm *bprm)
340 {
341         bprm_clear_caps(bprm);
342         return 0;
343 }
344 #endif
345
346 int cap_bprm_set_security (struct linux_binprm *bprm)
347 {
348         int ret;
349
350         ret = get_file_caps(bprm);
351
352         if (!issecure(SECURE_NOROOT)) {
353                 /*
354                  * To support inheritance of root-permissions and suid-root
355                  * executables under compatibility mode, we override the
356                  * capability sets for the file.
357                  *
358                  * If only the real uid is 0, we do not set the effective
359                  * bit.
360                  */
361                 if (bprm->e_uid == 0 || current_uid() == 0) {
362                         /* pP' = (cap_bset & ~0) | (pI & ~0) */
363                         bprm->cap_post_exec_permitted = cap_combine(
364                                 current->cred->cap_bset,
365                                 current->cred->cap_inheritable);
366                         bprm->cap_effective = (bprm->e_uid == 0);
367                         ret = 0;
368                 }
369         }
370
371         return ret;
372 }
373
374 void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
375 {
376         struct cred *cred = current->cred;
377
378         if (bprm->e_uid != cred->uid || bprm->e_gid != cred->gid ||
379             !cap_issubset(bprm->cap_post_exec_permitted,
380                           cred->cap_permitted)) {
381                 set_dumpable(current->mm, suid_dumpable);
382                 current->pdeath_signal = 0;
383
384                 if (unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
385                         if (!capable(CAP_SETUID)) {
386                                 bprm->e_uid = cred->uid;
387                                 bprm->e_gid = cred->gid;
388                         }
389                         if (cap_limit_ptraced_target()) {
390                                 bprm->cap_post_exec_permitted = cap_intersect(
391                                         bprm->cap_post_exec_permitted,
392                                         cred->cap_permitted);
393                         }
394                 }
395         }
396
397         cred->suid = cred->euid = cred->fsuid = bprm->e_uid;
398         cred->sgid = cred->egid = cred->fsgid = bprm->e_gid;
399
400         /* For init, we want to retain the capabilities set
401          * in the init_task struct. Thus we skip the usual
402          * capability rules */
403         if (!is_global_init(current)) {
404                 cred->cap_permitted = bprm->cap_post_exec_permitted;
405                 if (bprm->cap_effective)
406                         cred->cap_effective = bprm->cap_post_exec_permitted;
407                 else
408                         cap_clear(cred->cap_effective);
409         }
410
411         /*
412          * Audit candidate if current->cap_effective is set
413          *
414          * We do not bother to audit if 3 things are true:
415          *   1) cap_effective has all caps
416          *   2) we are root
417          *   3) root is supposed to have all caps (SECURE_NOROOT)
418          * Since this is just a normal root execing a process.
419          *
420          * Number 1 above might fail if you don't have a full bset, but I think
421          * that is interesting information to audit.
422          */
423         if (!cap_isclear(cred->cap_effective)) {
424                 if (!cap_issubset(CAP_FULL_SET, cred->cap_effective) ||
425                     (bprm->e_uid != 0) || (cred->uid != 0) ||
426                     issecure(SECURE_NOROOT))
427                         audit_log_bprm_fcaps(bprm, &cred->cap_permitted,
428                                              &cred->cap_effective);
429         }
430
431         cred->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
432 }
433
434 int cap_bprm_secureexec (struct linux_binprm *bprm)
435 {
436         const struct cred *cred = current->cred;
437
438         if (cred->uid != 0) {
439                 if (bprm->cap_effective)
440                         return 1;
441                 if (!cap_isclear(bprm->cap_post_exec_permitted))
442                         return 1;
443         }
444
445         return (cred->euid != cred->uid ||
446                 cred->egid != cred->gid);
447 }
448
449 int cap_inode_setxattr(struct dentry *dentry, const char *name,
450                        const void *value, size_t size, int flags)
451 {
452         if (!strcmp(name, XATTR_NAME_CAPS)) {
453                 if (!capable(CAP_SETFCAP))
454                         return -EPERM;
455                 return 0;
456         } else if (!strncmp(name, XATTR_SECURITY_PREFIX,
457                      sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
458             !capable(CAP_SYS_ADMIN))
459                 return -EPERM;
460         return 0;
461 }
462
463 int cap_inode_removexattr(struct dentry *dentry, const char *name)
464 {
465         if (!strcmp(name, XATTR_NAME_CAPS)) {
466                 if (!capable(CAP_SETFCAP))
467                         return -EPERM;
468                 return 0;
469         } else if (!strncmp(name, XATTR_SECURITY_PREFIX,
470                      sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
471             !capable(CAP_SYS_ADMIN))
472                 return -EPERM;
473         return 0;
474 }
475
476 /* moved from kernel/sys.c. */
477 /* 
478  * cap_emulate_setxuid() fixes the effective / permitted capabilities of
479  * a process after a call to setuid, setreuid, or setresuid.
480  *
481  *  1) When set*uiding _from_ one of {r,e,s}uid == 0 _to_ all of
482  *  {r,e,s}uid != 0, the permitted and effective capabilities are
483  *  cleared.
484  *
485  *  2) When set*uiding _from_ euid == 0 _to_ euid != 0, the effective
486  *  capabilities of the process are cleared.
487  *
488  *  3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
489  *  capabilities are set to the permitted capabilities.
490  *
491  *  fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should 
492  *  never happen.
493  *
494  *  -astor 
495  *
496  * cevans - New behaviour, Oct '99
497  * A process may, via prctl(), elect to keep its capabilities when it
498  * calls setuid() and switches away from uid==0. Both permitted and
499  * effective sets will be retained.
500  * Without this change, it was impossible for a daemon to drop only some
501  * of its privilege. The call to setuid(!=0) would drop all privileges!
502  * Keeping uid 0 is not an option because uid 0 owns too many vital
503  * files..
504  * Thanks to Olaf Kirch and Peter Benie for spotting this.
505  */
506 static inline void cap_emulate_setxuid (int old_ruid, int old_euid,
507                                         int old_suid)
508 {
509         struct cred *cred = current->cred;
510
511         if ((old_ruid == 0 || old_euid == 0 || old_suid == 0) &&
512             (cred->uid != 0 && cred->euid != 0 && cred->suid != 0) &&
513             !issecure(SECURE_KEEP_CAPS)) {
514                 cap_clear (cred->cap_permitted);
515                 cap_clear (cred->cap_effective);
516         }
517         if (old_euid == 0 && cred->euid != 0) {
518                 cap_clear (cred->cap_effective);
519         }
520         if (old_euid != 0 && cred->euid == 0) {
521                 cred->cap_effective = cred->cap_permitted;
522         }
523 }
524
525 int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid,
526                           int flags)
527 {
528         struct cred *cred = current->cred;
529
530         switch (flags) {
531         case LSM_SETID_RE:
532         case LSM_SETID_ID:
533         case LSM_SETID_RES:
534                 /* Copied from kernel/sys.c:setreuid/setuid/setresuid. */
535                 if (!issecure (SECURE_NO_SETUID_FIXUP)) {
536                         cap_emulate_setxuid (old_ruid, old_euid, old_suid);
537                 }
538                 break;
539         case LSM_SETID_FS:
540                 {
541                         uid_t old_fsuid = old_ruid;
542
543                         /* Copied from kernel/sys.c:setfsuid. */
544
545                         /*
546                          * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
547                          *          if not, we might be a bit too harsh here.
548                          */
549
550                         if (!issecure (SECURE_NO_SETUID_FIXUP)) {
551                                 if (old_fsuid == 0 && cred->fsuid != 0) {
552                                         cred->cap_effective =
553                                                 cap_drop_fs_set(
554                                                         cred->cap_effective);
555                                 }
556                                 if (old_fsuid != 0 && cred->fsuid == 0) {
557                                         cred->cap_effective =
558                                                 cap_raise_fs_set(
559                                                     cred->cap_effective,
560                                                     cred->cap_permitted);
561                                 }
562                         }
563                         break;
564                 }
565         default:
566                 return -EINVAL;
567         }
568
569         return 0;
570 }
571
572 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
573 /*
574  * Rationale: code calling task_setscheduler, task_setioprio, and
575  * task_setnice, assumes that
576  *   . if capable(cap_sys_nice), then those actions should be allowed
577  *   . if not capable(cap_sys_nice), but acting on your own processes,
578  *      then those actions should be allowed
579  * This is insufficient now since you can call code without suid, but
580  * yet with increased caps.
581  * So we check for increased caps on the target process.
582  */
583 static int cap_safe_nice(struct task_struct *p)
584 {
585         if (!cap_issubset(p->cred->cap_permitted,
586                           current->cred->cap_permitted) &&
587             !capable(CAP_SYS_NICE))
588                 return -EPERM;
589         return 0;
590 }
591
592 int cap_task_setscheduler (struct task_struct *p, int policy,
593                            struct sched_param *lp)
594 {
595         return cap_safe_nice(p);
596 }
597
598 int cap_task_setioprio (struct task_struct *p, int ioprio)
599 {
600         return cap_safe_nice(p);
601 }
602
603 int cap_task_setnice (struct task_struct *p, int nice)
604 {
605         return cap_safe_nice(p);
606 }
607
608 /*
609  * called from kernel/sys.c for prctl(PR_CABSET_DROP)
610  * done without task_capability_lock() because it introduces
611  * no new races - i.e. only another task doing capget() on
612  * this task could get inconsistent info.  There can be no
613  * racing writer bc a task can only change its own caps.
614  */
615 static long cap_prctl_drop(unsigned long cap)
616 {
617         if (!capable(CAP_SETPCAP))
618                 return -EPERM;
619         if (!cap_valid(cap))
620                 return -EINVAL;
621         cap_lower(current->cred->cap_bset, cap);
622         return 0;
623 }
624
625 #else
626 int cap_task_setscheduler (struct task_struct *p, int policy,
627                            struct sched_param *lp)
628 {
629         return 0;
630 }
631 int cap_task_setioprio (struct task_struct *p, int ioprio)
632 {
633         return 0;
634 }
635 int cap_task_setnice (struct task_struct *p, int nice)
636 {
637         return 0;
638 }
639 #endif
640
641 int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
642                    unsigned long arg4, unsigned long arg5, long *rc_p)
643 {
644         struct cred *cred = current->cred;
645         long error = 0;
646
647         switch (option) {
648         case PR_CAPBSET_READ:
649                 if (!cap_valid(arg2))
650                         error = -EINVAL;
651                 else
652                         error = !!cap_raised(cred->cap_bset, arg2);
653                 break;
654 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
655         case PR_CAPBSET_DROP:
656                 error = cap_prctl_drop(arg2);
657                 break;
658
659         /*
660          * The next four prctl's remain to assist with transitioning a
661          * system from legacy UID=0 based privilege (when filesystem
662          * capabilities are not in use) to a system using filesystem
663          * capabilities only - as the POSIX.1e draft intended.
664          *
665          * Note:
666          *
667          *  PR_SET_SECUREBITS =
668          *      issecure_mask(SECURE_KEEP_CAPS_LOCKED)
669          *    | issecure_mask(SECURE_NOROOT)
670          *    | issecure_mask(SECURE_NOROOT_LOCKED)
671          *    | issecure_mask(SECURE_NO_SETUID_FIXUP)
672          *    | issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED)
673          *
674          * will ensure that the current process and all of its
675          * children will be locked into a pure
676          * capability-based-privilege environment.
677          */
678         case PR_SET_SECUREBITS:
679                 if ((((cred->securebits & SECURE_ALL_LOCKS) >> 1)
680                      & (cred->securebits ^ arg2))                  /*[1]*/
681                     || ((cred->securebits & SECURE_ALL_LOCKS
682                          & ~arg2))                                    /*[2]*/
683                     || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS)) /*[3]*/
684                     || (cap_capable(current, CAP_SETPCAP, SECURITY_CAP_AUDIT) != 0)) { /*[4]*/
685                         /*
686                          * [1] no changing of bits that are locked
687                          * [2] no unlocking of locks
688                          * [3] no setting of unsupported bits
689                          * [4] doing anything requires privilege (go read about
690                          *     the "sendmail capabilities bug")
691                          */
692                         error = -EPERM;  /* cannot change a locked bit */
693                 } else {
694                         cred->securebits = arg2;
695                 }
696                 break;
697         case PR_GET_SECUREBITS:
698                 error = cred->securebits;
699                 break;
700
701 #endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
702
703         case PR_GET_KEEPCAPS:
704                 if (issecure(SECURE_KEEP_CAPS))
705                         error = 1;
706                 break;
707         case PR_SET_KEEPCAPS:
708                 if (arg2 > 1) /* Note, we rely on arg2 being unsigned here */
709                         error = -EINVAL;
710                 else if (issecure(SECURE_KEEP_CAPS_LOCKED))
711                         error = -EPERM;
712                 else if (arg2)
713                         cred->securebits |= issecure_mask(SECURE_KEEP_CAPS);
714                 else
715                         cred->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
716                 break;
717
718         default:
719                 /* No functionality available - continue with default */
720                 return 0;
721         }
722
723         /* Functionality provided */
724         *rc_p = error;
725         return 1;
726 }
727
728 void cap_task_reparent_to_init (struct task_struct *p)
729 {
730         struct cred *cred = p->cred;
731
732         cap_set_init_eff(cred->cap_effective);
733         cap_clear(cred->cap_inheritable);
734         cap_set_full(cred->cap_permitted);
735         p->cred->securebits = SECUREBITS_DEFAULT;
736 }
737
738 int cap_syslog (int type)
739 {
740         if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
741                 return -EPERM;
742         return 0;
743 }
744
745 int cap_vm_enough_memory(struct mm_struct *mm, long pages)
746 {
747         int cap_sys_admin = 0;
748
749         if (cap_capable(current, CAP_SYS_ADMIN, SECURITY_CAP_NOAUDIT) == 0)
750                 cap_sys_admin = 1;
751         return __vm_enough_memory(mm, pages, cap_sys_admin);
752 }
753