capabilities: define get_vfs_caps_from_disk when file caps are not enabled

When CONFIG_SECURITY_FILE_CAPABILITIES is not set the audit system may try to call into the capabilities function vfs_cap_from_file. This patch defines that function so kernels can build and work.

Signed-off-by Eric Paris <[email protected]>

---

james morris didn't like the fact I was clearing the cpu_caps struct. So this patch makes the error handling better so I don't need to. (actually I didn't need to fix the error handling since this audit function is only called when fcaps are enabled and we already got the xattr data once, but still, this is the right fix)

 kernel/auditsc.c     |   11 +++++++----
 security/commoncap.c |    5 +++++
 2 files changed, 12 insertions(+), 4 deletions(-)

kernel/auditsc.c +7 -4

index cef3423..90b0544 100644
@@ -2556,6 +2556,13 @@ void __audit_log_bprm_fcaps(struct linux_binprm *bprm, kernel_cap_t *pP, kernel_
 	struct audit_context *context = current->audit_context;
 	struct cpu_vfs_cap_data vcaps;
 	struct dentry *dentry;
+	int ret;
+
+	dentry = dget(bprm->file->f_dentry);
+	ret = get_vfs_caps_from_disk(dentry, &vcaps);
+	dput(dentry);
+	if (ret)
+		return;
 
 	ax = kmalloc(sizeof(*ax), GFP_KERNEL);
 	if (!ax)

@@ -2565,10 +2572,6 @@ void __audit_log_bprm_fcaps(struct linux_binprm *bprm, kernel_cap_t *pP, kernel_
 	ax->d.next = context->aux;
 	context->aux = (void *)ax;
 
-	dentry = dget(bprm->file->f_dentry);
-	get_vfs_caps_from_disk(dentry, &vcaps);
-	dput(dentry);
-
 	ax->fcap.permitted = vcaps.permitted;
 	ax->fcap.inheritable = vcaps.inheritable;
 	ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);

security/commoncap.c +5 -0

index 0b88160..22b9270 100644
@@ -337,6 +337,11 @@ int cap_inode_killpriv(struct dentry *dentry)
 	return 0;
 }
 
+int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
+{
+	return -ENODATA;
+}
+
 static inline int get_file_caps(struct linux_binprm *bprm)
 {
 	bprm_clear_caps(bprm);