proc: stats: Use arch_idle_time for idle and iowait times if available

[linux-2.6.git] / security / commoncap.c

diff --git a/security/commoncap.c b/security/commoncap.c
index 0f620c564fa876ce114739e5051b2ddb429c41d3..5cbb55ec6e43425068fe3381522f9743fbcae03a 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -28,6 +28,11 @@
 #include <linux/prctl.h>
 #include <linux/securebits.h>
 #include <linux/user_namespace.h>
+#include <linux/binfmts.h>
+
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+#include <linux/android_aid.h>
+#endif
 
 /*
  * If a non-root user executes a setuid-root binary in
@@ -56,17 +61,8 @@ int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
        return 0;
 }
 
-int cap_netlink_recv(struct sk_buff *skb, int cap)
-{
-       if (!cap_raised(current_cap(), cap))
-               return -EPERM;
-       return 0;
-}
-EXPORT_SYMBOL(cap_netlink_recv);
-
 /**
  * cap_capable - Determine whether a task has a particular effective capability
- * @tsk: The task to query
  * @cred: The credentials to use
  * @ns:  The user namespace in which we need the capability
  * @cap: The capability to check for
@@ -80,9 +76,14 @@ EXPORT_SYMBOL(cap_netlink_recv);
  * cap_has_capability() returns 0 when a task has a capability, but the
  * kernel's capable() and has_capability() returns 1 for this case.
  */
-int cap_capable(struct task_struct *tsk, const struct cred *cred,
-               struct user_namespace *targ_ns, int cap, int audit)
+int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
+               int cap, int audit)
 {
+       if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))
+               return 0;
+       if (cap == CAP_NET_ADMIN && in_egroup_p(AID_NET_ADMIN))
+               return 0;
+
        for (;;) {
                /* The creator of the user namespace has all caps. */
                if (targ_ns != &init_user_ns && targ_ns->creator == cred->user)
@@ -222,9 +223,8 @@ static inline int cap_inh_is_capped(void)
        /* they are so limited unless the current task has the CAP_SETPCAP
         * capability
         */
-       if (cap_capable(current, current_cred(),
-                       current_cred()->user->user_ns, CAP_SETPCAP,
-                       SECURITY_CAP_AUDIT) == 0)
+       if (cap_capable(current_cred(), current_cred()->user->user_ns,
+                       CAP_SETPCAP, SECURITY_CAP_AUDIT) == 0)
                return 0;
        return 1;
 }
@@ -479,7 +479,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
 {
        const struct cred *old = current_cred();
        struct cred *new = bprm->cred;
-       bool effective, has_cap;
+       bool effective, has_cap = false;
        int ret;
 
        effective = false;
@@ -874,7 +874,7 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                     & (new->securebits ^ arg2))                        /*[1]*/
                    || ((new->securebits & SECURE_ALL_LOCKS & ~arg2))   /*[2]*/
                    || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS))   /*[3]*/
-                   || (cap_capable(current, current_cred(),
+                   || (cap_capable(current_cred(),
                                    current_cred()->user->user_ns, CAP_SETPCAP,
                                    SECURITY_CAP_AUDIT) != 0)           /*[4]*/
                        /*
@@ -940,7 +940,7 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
 {
        int cap_sys_admin = 0;
 
-       if (cap_capable(current, current_cred(), &init_user_ns, CAP_SYS_ADMIN,
+       if (cap_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
                        SECURITY_CAP_NOAUDIT) == 0)
                cap_sys_admin = 1;
        return __vm_enough_memory(mm, pages, cap_sys_admin);
@@ -967,7 +967,7 @@ int cap_file_mmap(struct file *file, unsigned long reqprot,
        int ret = 0;
 
        if (addr < dac_mmap_min_addr) {
-               ret = cap_capable(current, current_cred(), &init_user_ns, CAP_SYS_RAWIO,
+               ret = cap_capable(current_cred(), &init_user_ns, CAP_SYS_RAWIO,
                                  SECURITY_CAP_AUDIT);
                /* set PF_SUPERPRIV if it turns out we allow the low mmap */
                if (ret == 0)