--- v31
+++ v27
@@ -28,7 +28,7 @@
.../ABI/testing/procfs-attr-lsm_display | 22 +++
Documentation/security/lsm.rst | 14 ++
fs/proc/base.c | 1 +
- include/linux/security.h | 17 ++
+ include/linux/lsm_hooks.h | 17 ++
security/apparmor/include/apparmor.h | 3 +-
security/apparmor/lsm.c | 32 ++++
security/security.c | 166 ++++++++++++++++--
@@ -89,10 +89,10 @@
+module for which the ``/proc/pid/attr/current`` interface will
+apply. This interface can be written to.
diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 13eda8de2998..50dbe5612a26 100644
+index 3851bfcdba56..10de522f3112 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
-@@ -2828,6 +2828,7 @@ static const struct pid_entry attr_dir_stuff[] = {
+@@ -2807,6 +2807,7 @@ static const struct pid_entry attr_dir_stuff[] = {
ATTR(NULL, "fscreate", 0666),
ATTR(NULL, "keycreate", 0666),
ATTR(NULL, "sockcreate", 0666),
@@ -100,13 +100,13 @@
#ifdef CONFIG_SECURITY_SMACK
DIR("smack", 0555,
proc_smack_attr_dir_inode_ops, proc_smack_attr_dir_ops),
-diff --git a/include/linux/security.h b/include/linux/security.h
-index 3b653fe331dd..872e543d37dd 100644
---- a/include/linux/security.h
-+++ b/include/linux/security.h
-@@ -219,6 +219,23 @@ static inline u32 lsmblob_value(const struct lsmblob *blob)
- return 0;
- }
+diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
+index c61a16f0a5bc..d2c4bc94d47f 100644
+--- a/include/linux/lsm_hooks.h
++++ b/include/linux/lsm_hooks.h
+@@ -1686,4 +1686,21 @@ static inline void security_delete_hooks(struct security_hook_list *hooks,
+
+ extern int lsm_inode_alloc(struct inode *inode);
+/**
+ * lsm_task_ilsm - the "interface_lsm" for this task
@@ -125,9 +125,7 @@
+ return LSMBLOB_INVALID;
+}
+
- /* These functions are in security/commoncap.c */
- extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
- int cap, unsigned int opts);
+ #endif /* ! __LINUX_LSM_HOOKS_H */
diff --git a/security/apparmor/include/apparmor.h b/security/apparmor/include/apparmor.h
index 1fbabdb565a8..b1622fcb4394 100644
--- a/security/apparmor/include/apparmor.h
@@ -144,7 +142,7 @@
/* Control parameters settable through module/boot flags */
extern enum audit_mode aa_g_audit;
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
-index 24241db8ec54..5ed40fd93ce9 100644
+index 392e25940d1f..4237536106aa 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -621,6 +621,25 @@ static int apparmor_getprocattr(struct task_struct *task, char *name,
@@ -194,10 +192,10 @@
if (args[size - 1] != '\0') {
/* null terminate */
diff --git a/security/security.c b/security/security.c
-index 0e17620a60e2..1d734d9579f1 100644
+index c2a5c50e913b..fe18c8d8bc22 100644
--- a/security/security.c
+++ b/security/security.c
-@@ -78,7 +78,16 @@ static struct kmem_cache *lsm_file_cache;
+@@ -77,7 +77,16 @@ static struct kmem_cache *lsm_file_cache;
static struct kmem_cache *lsm_inode_cache;
char *lsm_names;
@@ -215,7 +213,7 @@
/* Boot-time LSM user choice */
static __initdata const char *chosen_lsm_order;
-@@ -672,6 +681,8 @@ int lsm_inode_alloc(struct inode *inode)
+@@ -671,6 +680,8 @@ int lsm_inode_alloc(struct inode *inode)
*/
static int lsm_task_alloc(struct task_struct *task)
{
@@ -224,7 +222,7 @@
if (blob_sizes.lbs_task == 0) {
task->security = NULL;
return 0;
-@@ -680,6 +691,15 @@ static int lsm_task_alloc(struct task_struct *task)
+@@ -679,6 +690,15 @@ static int lsm_task_alloc(struct task_struct *task)
task->security = kzalloc(blob_sizes.lbs_task, GFP_KERNEL);
if (task->security == NULL)
return -ENOMEM;
@@ -240,7 +238,7 @@
return 0;
}
-@@ -1736,14 +1756,26 @@ int security_file_open(struct file *file)
+@@ -1734,14 +1754,26 @@ int security_file_open(struct file *file)
int security_task_alloc(struct task_struct *task, unsigned long clone_flags)
{
@@ -270,7 +268,7 @@
}
void security_task_free(struct task_struct *task)
-@@ -2175,23 +2207,110 @@ int security_getprocattr(struct task_struct *p, const char *lsm, char *name,
+@@ -2173,23 +2205,110 @@ int security_getprocattr(struct task_struct *p, const char *lsm, char *name,
char **value)
{
struct security_hook_list *hp;
@@ -381,7 +379,7 @@
return hp->hook.setprocattr(name, value, size);
}
return LSM_RET_DEFAULT(setprocattr);
-@@ -2211,15 +2330,15 @@ EXPORT_SYMBOL(security_ismaclabel);
+@@ -2209,15 +2328,15 @@ EXPORT_SYMBOL(security_ismaclabel);
int security_secid_to_secctx(struct lsmblob *blob, char **secdata, u32 *seclen)
{
struct security_hook_list *hp;
@@ -402,7 +400,7 @@
}
return LSM_RET_DEFAULT(secid_to_secctx);
-@@ -2230,16 +2349,15 @@ int security_secctx_to_secid(const char *secdata, u32 seclen,
+@@ -2228,16 +2347,15 @@ int security_secctx_to_secid(const char *secdata, u32 seclen,
struct lsmblob *blob)
{
struct security_hook_list *hp;
@@ -423,7 +421,7 @@
}
return 0;
}
-@@ -2247,7 +2365,14 @@ EXPORT_SYMBOL(security_secctx_to_secid);
+@@ -2245,7 +2363,14 @@ EXPORT_SYMBOL(security_secctx_to_secid);
void security_release_secctx(char *secdata, u32 seclen)
{
@@ -439,7 +437,7 @@
}
EXPORT_SYMBOL(security_release_secctx);
-@@ -2388,8 +2513,15 @@ EXPORT_SYMBOL(security_sock_rcv_skb);
+@@ -2386,8 +2511,15 @@ EXPORT_SYMBOL(security_sock_rcv_skb);
int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
int __user *optlen, unsigned len)
{
@@ -458,10 +456,10 @@
int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb,
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index c295b1035bc6..824a6e4fb126 100644
+index 0133b142e938..dba867721336 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
-@@ -6441,6 +6441,17 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
+@@ -6510,6 +6510,17 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
/*
* Basic control over ability to set these attributes at all.
*/
@@ -480,7 +478,7 @@
error = avc_has_perm(&selinux_state,
mysid, mysid, SECCLASS_PROCESS,
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
-index 35aac62a662e..46a7cfaf392d 100644
+index 62d19bccf3de..8f4b0dd6dd78 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -53,7 +53,7 @@ struct security_class_mapping secclass_map[] = {
@@ -493,10 +491,10 @@
{ "ipc_info", "syslog_read", "syslog_mod",
"syslog_console", "module_request", "module_load", NULL } },
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
-index 9c44327d8ea7..1069ba7abf40 100644
+index 5c10ad27be37..7aa7ea38f627 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
-@@ -3517,6 +3517,13 @@ static int smack_setprocattr(const char *name, void *value, size_t size)
+@@ -3508,6 +3508,13 @@ static int smack_setprocattr(const char *name, void *value, size_t size)
struct smack_known_list_elem *sklep;
int rc;
@@ -511,5 +509,5 @@
return -EPERM;
--
-2.31.1
+2.29.2