linux-sg2042/security/selinux
Satyam Sharma 3bd858ab1c Introduce is_owner_or_cap() to wrap CAP_FOWNER use with fsuid check
Introduce is_owner_or_cap() macro in fs.h, and convert over relevant
users to it. This is done because we want to avoid bugs in the future
where we check for only effective fsuid of the current task against a
file's owning uid, without simultaneously checking for CAP_FOWNER as
well, thus violating its semantics.
[ XFS uses special macros and structures, and in general looked ...
untouchable, so we leave it alone -- but it has been looked over. ]

The (current->fsuid != inode->i_uid) check in generic_permission() and
exec_permission_lite() is left alone, because those operations are
covered by CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH. Similarly operations
falling under the purview of CAP_CHOWN and CAP_LEASE are also left alone.

Signed-off-by: Satyam Sharma <ssatyam@cse.iitk.ac.in>
Cc: Al Viro <viro@ftp.linux.org.uk>
Acked-by: Serge E. Hallyn <serge@hallyn.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-17 12:00:03 -07:00
..
include security: Protection for exploiting null dereference using mmap 2007-07-11 22:52:29 -04:00
ss SELinux: allow preemption between transition permission checks 2007-07-11 22:52:25 -04:00
Kconfig Fix trivial typos in Kconfig* files 2007-05-09 07:12:20 +02:00
Makefile SELinux: extract the NetLabel SELinux support from the security server 2007-04-26 01:35:48 -04:00
avc.c SELinux: Use %lu for inode->i_no when printing avc 2007-07-11 22:52:27 -04:00
exports.c [PATCH] selinux: rename selinux_ctxid_to_string 2006-09-26 08:48:52 -07:00
hooks.c Introduce is_owner_or_cap() to wrap CAP_FOWNER use with fsuid check 2007-07-17 12:00:03 -07:00
netif.c [PATCH] SELinux: convert to kzalloc 2005-10-30 17:37:11 -08:00
netlabel.c Revert "SELinux: use SECINITSID_NETMSG instead of SECINITSID_UNLABELED for NetLabel" 2007-07-13 16:53:18 -07:00
netlink.c [NETLINK]: Switch cb_lock spinlock to mutex and allow to override it 2007-04-25 22:29:03 -07:00
nlmsgtab.c Audit: add TTY input auditing 2007-07-16 09:05:47 -07:00
selinuxfs.c selinux: add selinuxfs structure for object class discovery 2007-07-11 22:52:20 -04:00
xfrm.c SELinux: peer secid consolidation for external network labeling 2006-12-02 21:24:14 -08:00