capabilities/syslog: open code cap_syslog logic to fix build failure

The addition of CONFIG_SECURITY_DMESG_RESTRICT resulted in a build
failure when CONFIG_PRINTK=n.  This is because the capabilities code
which used the new option was built even though the variable in question
didn't exist.

The patch here fixes this by moving the capabilities checks out of the
LSM and into the caller.  All (known) LSMs should have been calling the
capabilities hook already so it actually makes the code organization
better to eliminate the hook altogether.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/include/linux/security.h b/include/linux/security.h
index b8246a8df7d2dc2ecc864ac192d694b369dd12d6..fd4d55fb884539fa0954937b0bbf5945e8bd5a6b 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -77,7 +77,6 @@ extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
 extern int cap_task_setscheduler(struct task_struct *p);
 extern int cap_task_setioprio(struct task_struct *p, int ioprio);
 extern int cap_task_setnice(struct task_struct *p, int nice);
-extern int cap_syslog(int type, bool from_file);
 extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
 
 struct msghdr;
@@ -1388,7 +1387,7 @@ struct security_operations {
        int (*sysctl) (struct ctl_table *table, int op);
        int (*quotactl) (int cmds, int type, int id, struct super_block *sb);
        int (*quota_on) (struct dentry *dentry);
-       int (*syslog) (int type, bool from_file);
+       int (*syslog) (int type);
        int (*settime) (struct timespec *ts, struct timezone *tz);
        int (*vm_enough_memory) (struct mm_struct *mm, long pages);
 
@@ -1671,7 +1670,7 @@ int security_real_capable_noaudit(struct task_struct *tsk, int cap);
 int security_sysctl(struct ctl_table *table, int op);
 int security_quotactl(int cmds, int type, int id, struct super_block *sb);
 int security_quota_on(struct dentry *dentry);
-int security_syslog(int type, bool from_file);
+int security_syslog(int type);
 int security_settime(struct timespec *ts, struct timezone *tz);
 int security_vm_enough_memory(long pages);
 int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
@@ -1901,9 +1900,9 @@ static inline int security_quota_on(struct dentry *dentry)
        return 0;
 }
 
-static inline int security_syslog(int type, bool from_file)
+static inline int security_syslog(int type)
 {
-       return cap_syslog(type, from_file);
+       return 0;
 }
 
 static inline int security_settime(struct timespec *ts, struct timezone *tz)

diff --git a/kernel/printk.c b/kernel/printk.c
index 38e7d5868d60ccdfc8f13176f6021a4a712cdee1..9a2264fc42cafac30d9264d569e4e673e9617f19 100644 (file)
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -274,7 +274,20 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
        char c;
        int error = 0;
 
-       error = security_syslog(type, from_file);
+       /*
+        * If this is from /proc/kmsg we only do the capabilities checks
+        * at open time.
+        */
+       if (type == SYSLOG_ACTION_OPEN || !from_file) {
+               if (dmesg_restrict && !capable(CAP_SYS_ADMIN))
+                       return -EPERM;
+               if ((type != SYSLOG_ACTION_READ_ALL &&
+                    type != SYSLOG_ACTION_SIZE_BUFFER) &&
+                   !capable(CAP_SYS_ADMIN))
+                       return -EPERM;
+       }
+
+       error = security_syslog(type);
        if (error)
                return error;
 

diff --git a/security/capability.c b/security/capability.c
index 30ae00fbecd591591acb55c1431d62a1bbbac427..c773635ca3a0e1b6de3e03d46fe38dd928a62a45 100644 (file)
--- a/security/capability.c
+++ b/security/capability.c
@@ -17,6 +17,11 @@ static int cap_sysctl(ctl_table *table, int op)
        return 0;
 }
 
+static int cap_syslog(int type)
+{
+       return 0;
+}
+
 static int cap_quotactl(int cmds, int type, int id, struct super_block *sb)
 {
        return 0;

diff --git a/security/commoncap.c b/security/commoncap.c
index 04b80f9912bfc3357f1c4b51dd8877ca345df3cc..64c2ed9c90158d1b7df59eff08595566d3dc1927 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -27,7 +27,6 @@
 #include <linux/sched.h>
 #include <linux/prctl.h>
 #include <linux/securebits.h>
-#include <linux/syslog.h>
 
 /*
  * If a non-root user executes a setuid-root binary in
@@ -883,26 +882,6 @@ error:
        return error;
 }
 
-/**
- * cap_syslog - Determine whether syslog function is permitted
- * @type: Function requested
- * @from_file: Whether this request came from an open file (i.e. /proc)
- *
- * Determine whether the current process is permitted to use a particular
- * syslog function, returning 0 if permission is granted, -ve if not.
- */
-int cap_syslog(int type, bool from_file)
-{
-       if (type != SYSLOG_ACTION_OPEN && from_file)
-               return 0;
-       if (dmesg_restrict && !capable(CAP_SYS_ADMIN))
-               return -EPERM;
-       if ((type != SYSLOG_ACTION_READ_ALL &&
-            type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN))
-               return -EPERM;
-       return 0;
-}
-
 /**
  * cap_vm_enough_memory - Determine whether a new virtual mapping is permitted
  * @mm: The VM space in which the new mapping is to be made

diff --git a/security/security.c b/security/security.c
index 3ef5e2a7a741aca4b13cd08b571e0a0ca0ee7d72..1b798d3df71057720d799f5d3e1382880fde8f78 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -197,9 +197,9 @@ int security_quota_on(struct dentry *dentry)
        return security_ops->quota_on(dentry);
 }
 
-int security_syslog(int type, bool from_file)
+int security_syslog(int type)
 {
-       return security_ops->syslog(type, from_file);
+       return security_ops->syslog(type);
 }
 
 int security_settime(struct timespec *ts, struct timezone *tz)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index d9154cf90ae19cd4eb5f40d65882abb60781da3d..65fa8bf596f591d12c2e0c22bafe5824522c34ee 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1973,14 +1973,10 @@ static int selinux_quota_on(struct dentry *dentry)
        return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
 }
 
-static int selinux_syslog(int type, bool from_file)
+static int selinux_syslog(int type)
 {
        int rc;
 
-       rc = cap_syslog(type, from_file);
-       if (rc)
-               return rc;
-
        switch (type) {
        case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
        case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index bc39f4067af668874312af4187ad6f21dbdbb113..489a85afa477bbd4d833fb167b3c6e71be049d86 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -157,15 +157,11 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
  *
  * Returns 0 on success, error code otherwise.
  */
-static int smack_syslog(int type, bool from_file)
+static int smack_syslog(int typefrom_file)
 {
-       int rc;
+       int rc = 0;
        char *sp = current_security();
 
-       rc = cap_syslog(type, from_file);
-       if (rc != 0)
-               return rc;
-
        if (capable(CAP_MAC_OVERRIDE))
                return 0;