LSM changes for 2.5.27

diff -Nru a/drivers/char/tty_io.c b/drivers/char/tty_io.c
@@ -1458,6 +1458,10 @@
 		if (!waitqueue_active(&tty->read_wait))
 			tty->minimum_to_wake = 1;
 		if (filp->f_owner.pid == 0) {
+			retval = security_ops->file_set_fowner(filp);
+			if (retval)
+				return retval;
+
 			filp->f_owner.pid = (-tty->pgrp) ? : current->pid;
 			filp->f_owner.uid = current->uid;
 			filp->f_owner.euid = current->euid;

diff -Nru a/fs/attr.c b/fs/attr.c
@@ -12,6 +12,7 @@
 #include <linux/dnotify.h>
 #include <linux/fcntl.h>
 #include <linux/quotaops.h>
+#include <linux/security.h>
 
 /* Taken over from the old code... */
 

@@ -151,10 +152,14 @@
 		}
 	}
 
-	if (inode->i_op && inode->i_op->setattr) 
-		error = inode->i_op->setattr(dentry, attr);
-	else {
+	if (inode->i_op && inode->i_op->setattr) {
+		error = security_ops->inode_setattr(dentry, attr);
+		if (!error)
+			error = inode->i_op->setattr(dentry, attr);
+	} else {
 		error = inode_change_ok(inode, attr);
+		if (!error)
+			error = security_ops->inode_setattr(dentry, attr);
 		if (!error) {
 			if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) ||
 			    (ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid))

diff -Nru a/fs/dnotify.c b/fs/dnotify.c
@@ -68,6 +68,7 @@
 	struct dnotify_struct **prev;
 	struct inode *inode;
 	fl_owner_t id = current->files;
+	int error;
 
 	if ((arg & ~DN_MULTISHOT) == 0) {
 		dnotify_flush(filp, id);

@@ -93,6 +94,13 @@
 		}
 		prev = &odn->dn_next;
 	}
+
+	error = security_ops->file_set_fowner(filp);
+	if (error) {
+		write_unlock(&dn_lock);
+		return error;
+	}
+
 	filp->f_owner.pid = current->pid;
 	filp->f_owner.uid = current->uid;
 	filp->f_owner.euid = current->euid;

diff -Nru a/fs/dquot.c b/fs/dquot.c
@@ -1316,6 +1316,9 @@
 	error = -EIO;
 	if (!f->f_op || !f->f_op->read || !f->f_op->write)
 		goto out_f;
+	error = security_ops->quota_on(f);
+	if (error)
+		goto out_f;
 	inode = f->f_dentry->d_inode;
 	error = -EACCES;
 	if (!S_ISREG(inode->i_mode))

diff -Nru a/fs/fcntl.c b/fs/fcntl.c
@@ -11,6 +11,7 @@
 #include <linux/smp_lock.h>
 #include <linux/slab.h>
 #include <linux/iobuf.h>
+#include <linux/security.h>
 
 #include <asm/poll.h>
 #include <asm/siginfo.h>

@@ -305,6 +306,13 @@
 			break;
 		case F_SETOWN:
 			lock_kernel();
+
+			err = security_ops->file_set_fowner(filp);
+			if (err) {
+				unlock_kernel();
+				break;
+			}
+
 			filp->f_owner.pid = arg;
 			filp->f_owner.uid = current->uid;
 			filp->f_owner.euid = current->euid;

@@ -353,6 +361,12 @@
 	if (!filp)
 		goto out;
 
+	err = security_ops->file_fcntl(filp, cmd, arg);
+	if (err) {
+		fput(filp);
+		return err;
+	}
+
 	err = do_fcntl(fd, cmd, arg, filp);
 
  	fput(filp);

@@ -371,6 +385,13 @@
 	if (!filp)
 		goto out;
 
+	err = security_ops->file_fcntl(filp, cmd, arg);
+	if (err) {
+		fput(filp);
+		return err;
+	}
+	err = -EBADF;
+	
 	switch (cmd) {
 		case F_GETLK64:
 			err = fcntl_getlk64(filp, (struct flock64 *) arg);

@@ -409,6 +430,10 @@
 	    (fown->euid ^ p->suid) && (fown->euid ^ p->uid) &&
 	    (fown->uid ^ p->suid) && (fown->uid ^ p->uid))
 		return;
+
+	if (security_ops->file_send_sigiotask(p, fown, fd, reason))
+		return;
+
 	switch (fown->signum) {
 		siginfo_t si;
 		default:

diff -Nru a/fs/file_table.c b/fs/file_table.c
@@ -13,6 +13,7 @@
 #include <linux/smp_lock.h>
 #include <linux/iobuf.h>
 #include <linux/fs.h>
+#include <linux/security.h>
 
 /* sysctl tunables... */
 struct files_stat_struct files_stat = {0, 0, NR_FILE};

@@ -43,6 +44,12 @@
 		files_stat.nr_free_files--;
 	new_one:
 		memset(f, 0, sizeof(*f));
+		if (security_ops->file_alloc_security(f)) {
+			list_add(&f->f_list, &free_list);
+			files_stat.nr_free_files++;
+			file_list_unlock();
+			return NULL;
+		}
 		atomic_set(&f->f_count,1);
 		f->f_version = ++event;
 		f->f_uid = current->fsuid;

@@ -117,6 +124,7 @@
 
 	if (file->f_op && file->f_op->release)
 		file->f_op->release(inode, file);
+	security_ops->file_free_security(file);
 	fops_put(file->f_op);
 	if (file->f_mode & FMODE_WRITE)
 		put_write_access(inode);

@@ -149,6 +157,7 @@
 void put_filp(struct file *file)
 {
 	if(atomic_dec_and_test(&file->f_count)) {
+		security_ops->file_free_security(file);
 		file_list_lock();
 		list_del(&file->f_list);
 		list_add(&file->f_list, &free_list);

diff -Nru a/fs/inode.c b/fs/inode.c
@@ -16,6 +16,7 @@
 #include <linux/backing-dev.h>
 #include <linux/wait.h>
 #include <linux/hash.h>
+#include <linux/security.h>
 
 /*
  * This is needed for the following functions:

@@ -100,6 +101,14 @@
 	if (inode) {
 		struct address_space * const mapping = &inode->i_data;
 
+		inode->i_security = NULL;
+		if (security_ops->inode_alloc_security(inode)) {
+			if (inode->i_sb->s_op->destroy_inode)
+				inode->i_sb->s_op->destroy_inode(inode);
+			else
+				kmem_cache_free(inode_cachep, (inode));
+			return NULL;
+		}
 		inode->i_sb = sb;
 		inode->i_dev = sb->s_dev;
 		inode->i_blkbits = sb->s_blocksize_bits;

@@ -137,6 +146,7 @@
 {
 	if (inode_has_buffers(inode))
 		BUG();
+	security_ops->inode_free_security(inode);
 	if (inode->i_sb->s_op->destroy_inode)
 		inode->i_sb->s_op->destroy_inode(inode);
 	else

@@ -792,6 +802,8 @@
 
 	if (inode->i_data.nrpages)
 		truncate_inode_pages(&inode->i_data, 0);
+
+	security_ops->inode_delete(inode);
 
 	if (op && op->delete_inode) {
 		void (*delete)(struct inode *) = op->delete_inode;

diff -Nru a/fs/ioctl.c b/fs/ioctl.c
@@ -8,6 +8,7 @@
 #include <linux/smp_lock.h>
 #include <linux/file.h>
 #include <linux/fs.h>
+#include <linux/security.h>
 
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>

@@ -57,6 +58,13 @@
 	if (!filp)
 		goto out;
 	error = 0;
+
+	error = security_ops->file_ioctl(filp, cmd, arg);
+        if (error) {
+                fput(filp);
+                goto out;
+        }
+
 	lock_kernel();
 	switch (cmd) {
 		case FIOCLEX:

diff -Nru a/fs/locks.c b/fs/locks.c
@@ -1309,6 +1309,11 @@
 	fl->fl_next = *before;
 	*before = fl;
 	list_add(&fl->fl_link, &file_lock_list);
+
+	error = security_ops->file_set_fowner(filp);
+	if (error)
+		goto out_unlock;
+
 	filp->f_owner.pid = current->pid;
 	filp->f_owner.uid = current->uid;
 	filp->f_owner.euid = current->euid;

@@ -1354,6 +1359,11 @@
 	if (error < 0)
 		goto out_putf;
 
+	error = security_ops->file_lock(filp, cmd,
+					(cmd & LOCK_NB) ? 0 : 1);
+	if (error)
+		goto out_putf;
+
 	error = flock_lock_file(filp, lock,
 				(cmd & (LOCK_UN | LOCK_NB)) ? 0 : 1);
 

@@ -1484,6 +1494,11 @@
 		goto out;
 	}
 
+	error = security_ops->file_lock(filp, file_lock->fl_type,
+	                                cmd == F_SETLKW);
+	if (error)
+		goto out;
+
 	if (filp->f_op && filp->f_op->lock != NULL) {
 		error = filp->f_op->lock(filp, cmd, file_lock);
 		if (error < 0)

@@ -1602,6 +1617,11 @@
 		error = -EINVAL;
 		goto out;
 	}
+
+	error = security_ops->file_lock(filp, file_lock->fl_type,
+					cmd == F_SETLKW64);
+	if (error)
+		goto out;
 
 	if (filp->f_op && filp->f_op->lock != NULL) {
 		error = filp->f_op->lock(filp, cmd, file_lock);

283 lines not on this page · raw message

diff -Nru a/fs/namespace.c b/fs/namespace.c
@@ -288,6 +288,10 @@
 	struct super_block * sb = mnt->mnt_sb;
 	int retval = 0;
 
+	retval = security_ops->sb_umount(mnt, flags);
+	if (retval)
+		return retval;
+
 	/*
 	 * If we may have to abort operations to get out of this
 	 * mount, and they will themselves hold resources we must

@@ -337,6 +341,7 @@
 		DQUOT_OFF(sb);
 		acct_auto_close(sb);
 		unlock_kernel();
+		security_ops->sb_umount_close(mnt);
 		spin_lock(&dcache_lock);
 	}
 	retval = -EBUSY;

@@ -346,6 +351,8 @@
 		retval = 0;
 	}
 	spin_unlock(&dcache_lock);
+	if (retval)
+		security_ops->sb_umount_busy(mnt);
 	up_write(&current->namespace->sem);
 	return retval;
 }

@@ -463,6 +470,10 @@
 	if (IS_DEADDIR(nd->dentry->d_inode))
 		goto out_unlock;
 
+	err = security_ops->sb_check_sb(mnt, nd);
+	if (err)
+		goto out_unlock;
+
 	spin_lock(&dcache_lock);
 	if (IS_ROOT(nd->dentry) || !d_unhashed(nd->dentry)) {
 		struct list_head head;

@@ -475,6 +486,8 @@
 	spin_unlock(&dcache_lock);
 out_unlock:
 	up(&nd->dentry->d_inode->i_sem);
+	if (!err)
+		security_ops->sb_post_addmount(mnt, nd);
 	return err;
 }
 

@@ -544,6 +557,8 @@
 	if (!err)
 		nd->mnt->mnt_flags=mnt_flags;
 	up_write(&sb->s_umount);
+	if (!err)
+		security_ops->sb_post_remount(nd->mnt, flags, data);
 	return err;
 }
 

@@ -726,6 +741,10 @@
 	if (retval)
 		return retval;
 
+	retval = security_ops->sb_mount(dev_name, &nd, type_page, flags, data_page);
+	if (retval)
+		goto dput_out;
+
 	if (flags & MS_REMOUNT)
 		retval = do_remount(&nd, flags & ~MS_REMOUNT, mnt_flags,
 				    data_page);

@@ -736,6 +755,7 @@
 	else
 		retval = do_add_mount(&nd, type_page, flags, mnt_flags,
 				      dev_name, data_page);
+dput_out:
 	path_release(&nd);
 	return retval;
 }

@@ -919,6 +939,12 @@
 	if (error)
 		goto out1;
 
+	error = security_ops->sb_pivotroot(&old_nd, &new_nd);
+	if (error) {
+		path_release(&old_nd);
+		goto out1;
+	}
+
 	read_lock(&current->fs->lock);
 	user_nd.mnt = mntget(current->fs->rootmnt);
 	user_nd.dentry = dget(current->fs->root);

@@ -963,6 +989,7 @@
 	attach_mnt(new_nd.mnt, &root_parent);
 	spin_unlock(&dcache_lock);
 	chroot_fs_refs(&user_nd, &new_nd);
+	security_ops->sb_post_pivotroot(&user_nd, &new_nd);
 	error = 0;
 	path_release(&root_parent);
 	path_release(&parent_nd);

diff -Nru a/fs/open.c b/fs/open.c
@@ -17,6 +17,7 @@
 #include <linux/iobuf.h>
 #include <linux/namei.h>
 #include <linux/backing-dev.h>
+#include <linux/security.h>
 
 #include <asm/uaccess.h>
 

@@ -30,6 +31,9 @@
 		retval = -ENOSYS;
 		if (sb->s_op && sb->s_op->statfs) {
 			memset(buf, 0, sizeof(struct statfs));
+			retval = security_ops->sb_statfs(sb);
+			if (retval)
+				return retval;
 			retval = sb->s_op->statfs(sb, buf);
 		}
 	}

diff -Nru a/fs/proc/base.c b/fs/proc/base.c
@@ -406,7 +406,7 @@
 };
 
 #define MAY_PTRACE(p) \
-(p==current||(p->parent==current&&(p->ptrace & PT_PTRACED)&&p->state==TASK_STOPPED))
+(p==current||(p->parent==current&&(p->ptrace & PT_PTRACED)&&p->state==TASK_STOPPED&&security_ops->ptrace(current,p)==0))
 
 
 static int mem_open(struct inode* inode, struct file* file)

diff -Nru a/fs/quota.c b/fs/quota.c
@@ -12,6 +12,7 @@
 #include <asm/uaccess.h>
 #include <linux/kernel.h>
 #include <linux/smp_lock.h>
+#include <linux/security.h>
 
 /* Check validity of quotactl */
 static int check_quotactl_valid(struct super_block *sb, int type, int cmd, qid_t id)

@@ -96,7 +97,8 @@
 	else if (cmd != Q_GETFMT && cmd != Q_SYNC && cmd != Q_GETINFO && cmd != Q_XGETQSTAT)
 		if (!capable(CAP_SYS_ADMIN))
 			return -EPERM;
-	return 0;
+
+	return security_ops->quotactl (cmd, type, id, sb);
 }
 
 /* Resolve device pathname to superblock */

87 lines not on this page · raw message

diff -Nru a/fs/readdir.c b/fs/readdir.c
@@ -20,6 +20,11 @@
 	int res = -ENOTDIR;
 	if (!file->f_op || !file->f_op->readdir)
 		goto out;
+
+	res = security_ops->file_permission(file, MAY_READ);
+	if (res)
+		goto out;
+
 	down(&inode->i_sem);
 	res = -ENOENT;
 	if (!IS_DEADDIR(inode)) {

diff -Nru a/fs/stat.c b/fs/stat.c
@@ -12,6 +12,7 @@
 #include <linux/highuid.h>
 #include <linux/fs.h>
 #include <linux/namei.h>
+#include <linux/security.h>
 
 #include <asm/uaccess.h>
 

@@ -36,6 +37,11 @@
 int vfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
 {
 	struct inode *inode = dentry->d_inode;
+	int retval;
+
+	retval = security_ops->inode_getattr(mnt, dentry);
+	if (retval)
+		return retval;
 
 	if (inode->i_op->getattr)
 		return inode->i_op->getattr(mnt, dentry, stat);

@@ -232,8 +238,11 @@
 
 		error = -EINVAL;
 		if (inode->i_op && inode->i_op->readlink) {
-			UPDATE_ATIME(inode);
-			error = inode->i_op->readlink(nd.dentry, buf, bufsiz);
+			error = security_ops->inode_readlink(nd.dentry);
+			if (!error) {
+				UPDATE_ATIME(inode);
+				error = inode->i_op->readlink(nd.dentry, buf, bufsiz);
+			}
 		}
 		path_release(&nd);
 	}

diff -Nru a/fs/super.c b/fs/super.c
@@ -31,6 +31,8 @@
 #include <linux/buffer_head.h>		/* for fsync_super() */
 #include <asm/uaccess.h>
 
+#include <linux/security.h>
+
 void get_filesystem(struct file_system_type *fs);
 void put_filesystem(struct file_system_type *fs);
 struct file_system_type *get_fs_type(const char *name);

@@ -49,6 +51,11 @@
 	struct super_block *s = kmalloc(sizeof(struct super_block),  GFP_USER);
 	if (s) {
 		memset(s, 0, sizeof(struct super_block));
+		if (security_ops->sb_alloc_security(s)) {
+			kfree(s);
+			s = NULL;
+			goto out;
+		}
 		INIT_LIST_HEAD(&s->s_dirty);
 		INIT_LIST_HEAD(&s->s_io);
 		INIT_LIST_HEAD(&s->s_locked_inodes);

@@ -67,6 +74,7 @@
 		s->dq_op = sb_dquot_ops;
 		s->s_qcop = sb_quotactl_ops;
 	}
+out:
 	return s;
 }
 

@@ -78,6 +86,7 @@
  */
 static inline void destroy_super(struct super_block *s)
 {
+	security_ops->sb_free_security(s);
 	kfree(s);
 }
 

diff -Nru a/fs/xattr.c b/fs/xattr.c
@@ -85,11 +85,16 @@
 
 	error = -EOPNOTSUPP;
 	if (d->d_inode->i_op && d->d_inode->i_op->setxattr) {
+		error = security_ops->inode_setxattr(d, kname, kvalue,
+				size, flags);
+		if (error)
+			goto out;
 		down(&d->d_inode->i_sem);
 		error = d->d_inode->i_op->setxattr(d, kname, kvalue, size, flags);
 		up(&d->d_inode->i_sem);
 	}
 
+out:
 	xattr_free(kvalue, size);
 	return error;
 }

@@ -158,6 +163,9 @@
 
 	error = -EOPNOTSUPP;
 	if (d->d_inode->i_op && d->d_inode->i_op->getxattr) {
+		error = security_ops->inode_getxattr(d, kname);
+		if (error)
+			goto out;
 		down(&d->d_inode->i_sem);
 		error = d->d_inode->i_op->getxattr(d, kname, kvalue, size);
 		up(&d->d_inode->i_sem);

@@ -166,6 +174,7 @@
 	if (kvalue && error > 0)
 		if (copy_to_user(value, kvalue, error))
 			error = -EFAULT;
+out:
 	xattr_free(kvalue, size);
 	return error;
 }

@@ -227,6 +236,9 @@
 
 	error = -EOPNOTSUPP;
 	if (d->d_inode->i_op && d->d_inode->i_op->listxattr) {
+		error = security_ops->inode_listxattr(d);
+		if (error)
+			goto out;
 		down(&d->d_inode->i_sem);
 		error = d->d_inode->i_op->listxattr(d, klist, size);
 		up(&d->d_inode->i_sem);

@@ -235,6 +247,7 @@
 	if (klist && error > 0)
 		if (copy_to_user(list, klist, error))
 			error = -EFAULT;
+out:
 	xattr_free(klist, size);
 	return error;
 }

@@ -298,10 +311,14 @@
 
 	error = -EOPNOTSUPP;
 	if (d->d_inode->i_op && d->d_inode->i_op->removexattr) {
+		error = security_ops->inode_removexattr(d, kname);
+		if (error)
+			goto out;
 		down(&d->d_inode->i_sem);
 		error = d->d_inode->i_op->removexattr(d, kname);
 		up(&d->d_inode->i_sem);
 	}
+out:
 	return error;
 }
 

diff -Nru a/include/linux/fs.h b/include/linux/fs.h
@@ -72,6 +72,7 @@
 #define MAY_EXEC 1
 #define MAY_WRITE 2
 #define MAY_READ 4
+#define MAY_APPEND 8
 
 #define FMODE_READ 1
 #define FMODE_WRITE 2

@@ -396,6 +397,7 @@
 	unsigned char		i_sock;
 
 	atomic_t		i_writecount;
+	void			*i_security;
 	__u32			i_generation;
 	union {
 		void				*generic_ip;

@@ -426,6 +428,7 @@
 	int pid;		/* pid or -pgrp where SIGIO should be sent */
 	uid_t uid, euid;	/* uid/euid of process setting the owner */
 	int signum;		/* posix.1b rt signal to be delivered on IO */
+	void *security;
 };
 
 static inline void inode_add_bytes(struct inode *inode, loff_t bytes)

@@ -489,6 +492,7 @@
 	struct file_ra_state	f_ra;
 
 	unsigned long		f_version;
+	void			*f_security;
 
 	/* needed for tty driver, and maybe others */
 	void			*private_data;

@@ -642,6 +646,7 @@
 	int			s_count;
 	int			s_syncing;
 	atomic_t		s_active;
+	void                    *s_security;
 
 	struct list_head	s_dirty;	/* dirty inodes */
 	struct list_head	s_io;		/* parked for writeback */

457 lines not on this page · raw message

diff -Nru a/init/do_mounts.c b/init/do_mounts.c
@@ -845,6 +845,7 @@
 	sys_umount("/dev", 0);
 	sys_mount(".", "/", NULL, MS_MOVE, NULL);
 	sys_chroot(".");
+	security_ops->sb_post_mountroot();
 	mount_devfs_fs ();
 }
 

diff -Nru a/kernel/acct.c b/kernel/acct.c
@@ -195,6 +195,7 @@
 {
 	struct file *file = NULL;
 	char *tmp;
+	int error;
 
 	if (!capable(CAP_SYS_PACCT))
 		return -EPERM;

@@ -220,6 +221,10 @@
 			return (-EIO);
 		}
 	}
+
+	error = security_ops->acct(file);
+	if (error)
+		return error;
 
 	spin_lock(&acct_globals.lock);
 	acct_file_reopen(file);

diff -Nru a/mm/filemap.c b/mm/filemap.c
@@ -21,6 +21,7 @@
 #include <linux/iobuf.h>
 #include <linux/hash.h>
 #include <linux/writeback.h>
+#include <linux/security.h>
 /*
  * This is needed for the following functions:
  *  - try_to_release_page

@@ -1143,6 +1144,10 @@
 	if (retval)
 		goto fput_in;
 
+	retval = security_ops->file_permission (in_file, MAY_READ);
+	if (retval)
+		goto fput_in;
+
 	/*
 	 * Get output file, and verify that it is ok..
 	 */

@@ -1157,6 +1162,10 @@
 		goto fput_out;
 	out_inode = out_file->f_dentry->d_inode;
 	retval = locks_verify_area(FLOCK_VERIFY_WRITE, out_inode, out_file, out_file->f_pos, count);
+	if (retval)
+		goto fput_out;
+
+	retval = security_ops->file_permission (out_file, MAY_WRITE);
 	if (retval)
 		goto fput_out;
 

diff -Nru a/mm/mmap.c b/mm/mmap.c
@@ -14,6 +14,7 @@
 #include <linux/file.h>
 #include <linux/fs.h>
 #include <linux/personality.h>
+#include <linux/security.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgalloc.h>

@@ -475,6 +476,10 @@
 		}
 	}
 
+	error = security_ops->file_mmap(file, prot, flags);
+	if (error)
+		return error;
+		
 	/* Clear old maps */
 	error = -ENOMEM;
 munmap_back:

diff -Nru a/mm/mprotect.c b/mm/mprotect.c
@@ -10,6 +10,7 @@
 #include <linux/mman.h>
 #include <linux/fs.h>
 #include <linux/highmem.h>
+#include <linux/security.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgalloc.h>

@@ -305,6 +306,10 @@
 			error = -EACCES;
 			goto out;
 		}
+
+		error = security_ops->file_mprotect(vma, prot);
+		if (error)
+			goto out;
 
 		if (vma->vm_end > end) {
 			error = mprotect_fixup(vma, &prev, nstart, end, newflags);

diff -Nru a/net/core/scm.c b/net/core/scm.c
@@ -22,6 +22,7 @@
 #include <linux/net.h>
 #include <linux/interrupt.h>
 #include <linux/netdevice.h>
+#include <linux/security.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>

@@ -216,6 +217,9 @@
 	for (i=0, cmfptr=(int*)CMSG_DATA(cm); i<fdmax; i++, cmfptr++)
 	{
 		int new_fd;
+		err = security_ops->file_receive(fp[i]);
+		if (err)
+			break;
 		err = get_unused_fd();
 		if (err < 0)
 			break;

394 lines not on this page · raw message

398 lines not on this page · raw message

diff -Nru a/security/dummy.c b/security/dummy.c
@@ -197,40 +197,40 @@
 }
 
 struct security_operations dummy_security_ops = {
-	ptrace:				dummy_ptrace,
-	capget:				dummy_capget,
-	capset_check:			dummy_capset_check,
-	capset_set:			dummy_capset_set,
-	capable:			dummy_capable,
-	sys_security:			dummy_sys_security,
+	.ptrace =			dummy_ptrace,
+	.capget =			dummy_capget,
+	.capset_check =			dummy_capset_check,
+	.capset_set =			dummy_capset_set,
+	.capable =			dummy_capable,
+	.sys_security =			dummy_sys_security,
 	
-	bprm_alloc_security:		dummy_bprm_alloc_security,
-	bprm_free_security:		dummy_bprm_free_security,
-	bprm_compute_creds:		dummy_bprm_compute_creds,
-	bprm_set_security:		dummy_bprm_set_security,
-	bprm_check_security:		dummy_bprm_check_security,
+	.bprm_alloc_security =		dummy_bprm_alloc_security,
+	.bprm_free_security =		dummy_bprm_free_security,
+	.bprm_compute_creds =		dummy_bprm_compute_creds,
+	.bprm_set_security =		dummy_bprm_set_security,
+	.bprm_check_security =		dummy_bprm_check_security,
 
-	task_create:			dummy_task_create,
-	task_alloc_security:		dummy_task_alloc_security,
-	task_free_security:		dummy_task_free_security,
-	task_setuid:			dummy_task_setuid,
-	task_post_setuid:		dummy_task_post_setuid,
-	task_setgid:			dummy_task_setgid,
-	task_setpgid:			dummy_task_setpgid,
-	task_getpgid:			dummy_task_getpgid,
-	task_getsid:			dummy_task_getsid,
-	task_setgroups:			dummy_task_setgroups,
-	task_setnice:			dummy_task_setnice,
-	task_setrlimit:			dummy_task_setrlimit,
-	task_setscheduler:		dummy_task_setscheduler,
-	task_getscheduler:		dummy_task_getscheduler,
-	task_wait:			dummy_task_wait,
-	task_kill:			dummy_task_kill,
-	task_prctl:			dummy_task_prctl,
-	task_kmod_set_label:		dummy_task_kmod_set_label,
-	task_reparent_to_init:		dummy_task_reparent_to_init,
+	.task_create =			dummy_task_create,
+	.task_alloc_security =		dummy_task_alloc_security,
+	.task_free_security =		dummy_task_free_security,
+	.task_setuid =			dummy_task_setuid,
+	.task_post_setuid =		dummy_task_post_setuid,
+	.task_setgid =			dummy_task_setgid,
+	.task_setpgid =			dummy_task_setpgid,
+	.task_getpgid =			dummy_task_getpgid,
+	.task_getsid =			dummy_task_getsid,
+	.task_setgroups =		dummy_task_setgroups,
+	.task_setnice =			dummy_task_setnice,
+	.task_setrlimit =		dummy_task_setrlimit,
+	.task_setscheduler =		dummy_task_setscheduler,
+	.task_getscheduler =		dummy_task_getscheduler,
+	.task_wait =			dummy_task_wait,
+	.task_kill =			dummy_task_kill,
+	.task_prctl =			dummy_task_prctl,
+	.task_kmod_set_label =		dummy_task_kmod_set_label,
+	.task_reparent_to_init =	dummy_task_reparent_to_init,
 	
-	register_security:		dummy_register,
-	unregister_security:		dummy_unregister,
+	.register_security =		dummy_register,
+	.unregister_security =		dummy_unregister,
 };
 

diff -Nru a/security/capability.c b/security/capability.c
@@ -706,61 +706,61 @@
 	.bprm_set_security =		cap_bprm_set_security,
 	.bprm_check_security =		cap_bprm_check_security,
 
-	sb_alloc_security:		cap_sb_alloc_security,
-	sb_free_security:		cap_sb_free_security,
-	sb_statfs:			cap_sb_statfs,
-	sb_mount:			cap_mount,
-	sb_check_sb:			cap_check_sb,
-	sb_umount:			cap_umount,
-	sb_umount_close:		cap_umount_close,
-	sb_umount_busy:			cap_umount_busy,
-	sb_post_remount:		cap_post_remount,
-	sb_post_mountroot:		cap_post_mountroot,
-	sb_post_addmount:		cap_post_addmount,
-	sb_pivotroot:			cap_pivotroot,
-	sb_post_pivotroot:		cap_post_pivotroot,
+	.sb_alloc_security =		cap_sb_alloc_security,
+	.sb_free_security =		cap_sb_free_security,
+	.sb_statfs =			cap_sb_statfs,
+	.sb_mount =			cap_mount,
+	.sb_check_sb =			cap_check_sb,
+	.sb_umount =			cap_umount,
+	.sb_umount_close =		cap_umount_close,
+	.sb_umount_busy =		cap_umount_busy,
+	.sb_post_remount =		cap_post_remount,
+	.sb_post_mountroot =		cap_post_mountroot,
+	.sb_post_addmount =		cap_post_addmount,
+	.sb_pivotroot =			cap_pivotroot,
+	.sb_post_pivotroot =		cap_post_pivotroot,
 	
-	inode_alloc_security:		cap_inode_alloc_security,
-	inode_free_security:		cap_inode_free_security,
-	inode_create:			cap_inode_create,
-	inode_post_create:		cap_inode_post_create,
-	inode_link:			cap_inode_link,
-	inode_post_link:		cap_inode_post_link,
-	inode_unlink:			cap_inode_unlink,
-	inode_symlink:			cap_inode_symlink,
-	inode_post_symlink:		cap_inode_post_symlink,
-	inode_mkdir:			cap_inode_mkdir,
-	inode_post_mkdir:		cap_inode_post_mkdir,
-	inode_rmdir:			cap_inode_rmdir,
-	inode_mknod:			cap_inode_mknod,
-	inode_post_mknod:		cap_inode_post_mknod,
-	inode_rename:			cap_inode_rename,
-	inode_post_rename:		cap_inode_post_rename,
-	inode_readlink:			cap_inode_readlink,
-	inode_follow_link:		cap_inode_follow_link,
-	inode_permission:		cap_inode_permission,
-	inode_permission_lite:		cap_inode_permission_lite,
-	inode_setattr:			cap_inode_setattr,
-	inode_getattr:			cap_inode_getattr,
-	inode_post_lookup:		cap_post_lookup,
-	inode_delete:			cap_delete,
-	inode_setxattr:			cap_inode_setxattr,
-	inode_getxattr:			cap_inode_getxattr,
-	inode_listxattr:		cap_inode_listxattr,
-	inode_removexattr:		cap_inode_removexattr,
+	.inode_alloc_security =		cap_inode_alloc_security,
+	.inode_free_security =		cap_inode_free_security,
+	.inode_create =			cap_inode_create,
+	.inode_post_create =		cap_inode_post_create,
+	.inode_link =			cap_inode_link,
+	.inode_post_link =		cap_inode_post_link,
+	.inode_unlink =			cap_inode_unlink,
+	.inode_symlink =		cap_inode_symlink,
+	.inode_post_symlink =		cap_inode_post_symlink,
+	.inode_mkdir =			cap_inode_mkdir,
+	.inode_post_mkdir =		cap_inode_post_mkdir,
+	.inode_rmdir =			cap_inode_rmdir,
+	.inode_mknod =			cap_inode_mknod,
+	.inode_post_mknod =		cap_inode_post_mknod,
+	.inode_rename =			cap_inode_rename,
+	.inode_post_rename =		cap_inode_post_rename,
+	.inode_readlink =		cap_inode_readlink,
+	.inode_follow_link =		cap_inode_follow_link,
+	.inode_permission =		cap_inode_permission,
+	.inode_permission_lite =	cap_inode_permission_lite,
+	.inode_setattr =		cap_inode_setattr,
+	.inode_getattr =		cap_inode_getattr,
+	.inode_post_lookup =		cap_post_lookup,
+	.inode_delete =			cap_delete,
+	.inode_setxattr =		cap_inode_setxattr,
+	.inode_getxattr =		cap_inode_getxattr,
+	.inode_listxattr =		cap_inode_listxattr,
+	.inode_removexattr =		cap_inode_removexattr,
 	
-	file_permission:		cap_file_permission,
-	file_alloc_security:		cap_file_alloc_security,
-	file_free_security:		cap_file_free_security,
-	file_llseek:			cap_file_llseek,
-	file_ioctl:			cap_file_ioctl,
-	file_mmap:			cap_file_mmap,
-	file_mprotect:			cap_file_mprotect,
-	file_lock:			cap_file_lock,
-	file_fcntl:			cap_file_fcntl,
-	file_set_fowner:		cap_file_set_fowner,
-	file_send_sigiotask:		cap_file_send_sigiotask,
-	file_receive:			cap_file_receive,
+	.file_permission =		cap_file_permission,
+	.file_alloc_security =		cap_file_alloc_security,
+	.file_free_security =		cap_file_free_security,
+	.file_llseek =			cap_file_llseek,
+	.file_ioctl =			cap_file_ioctl,
+	.file_mmap =			cap_file_mmap,
+	.file_mprotect =		cap_file_mprotect,
+	.file_lock =			cap_file_lock,
+	.file_fcntl =			cap_file_fcntl,
+	.file_set_fowner =		cap_file_set_fowner,
+	.file_send_sigiotask =		cap_file_send_sigiotask,
+	.file_receive =			cap_file_receive,
 
 	.task_create =			cap_task_create,
 	.task_alloc_security =		cap_task_alloc_security,

124 lines not on this page · raw message

diff -Nru a/security/dummy.c b/security/dummy.c
@@ -508,7 +508,7 @@
 	.capget =			dummy_capget,
 	.capset_check =			dummy_capset_check,
 	.capset_set =			dummy_capset_set,
-	.acct =				dummy_act,
+	.acct =				dummy_acct,
 	.capable =			dummy_capable,
 	.sys_security =			dummy_sys_security,
 	.quotactl =			dummy_quotactl,