nfsd: nfsd should drop CAP_MKNOD for non-root

[safe/jmp/linux-2.6] / include / linux / capability.h

diff --git a/include/linux/capability.h b/include/linux/capability.h
index 5b8a132..4864a43 100644 (file)
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -69,10 +69,6 @@ typedef struct __user_cap_data_struct {
 #define VFS_CAP_U32             VFS_CAP_U32_2
 #define VFS_CAP_REVISION       VFS_CAP_REVISION_2
 
 #define VFS_CAP_U32             VFS_CAP_U32_2
 #define VFS_CAP_REVISION       VFS_CAP_REVISION_2
 

-#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
-extern int file_caps_enabled;
-#endif
-

 struct vfs_cap_data {
        __le32 magic_etc;            /* Little endian */
        struct {
 struct vfs_cap_data {
        __le32 magic_etc;            /* Little endian */
        struct {


@@ -96,6 +92,10 @@ struct vfs_cap_data {
 #define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
 #define _KERNEL_CAPABILITY_U32S    _LINUX_CAPABILITY_U32S_3
 
 #define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
 #define _KERNEL_CAPABILITY_U32S    _LINUX_CAPABILITY_U32S_3
 

+#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+extern int file_caps_enabled;
+#endif
+

 typedef struct kernel_cap_struct {
        __u32 cap[_KERNEL_CAPABILITY_U32S];
 } kernel_cap_t;
 typedef struct kernel_cap_struct {
        __u32 cap[_KERNEL_CAPABILITY_U32S];
 } kernel_cap_t;


@@ -393,8 +393,10 @@ struct cpu_vfs_cap_data {
 # define CAP_FULL_SET     ((kernel_cap_t){{ ~0, ~0 }})
 # define CAP_INIT_EFF_SET ((kernel_cap_t){{ ~CAP_TO_MASK(CAP_SETPCAP), ~0 }})
 # define CAP_FS_SET       ((kernel_cap_t){{ CAP_FS_MASK_B0, CAP_FS_MASK_B1 } })
 # define CAP_FULL_SET     ((kernel_cap_t){{ ~0, ~0 }})
 # define CAP_INIT_EFF_SET ((kernel_cap_t){{ ~CAP_TO_MASK(CAP_SETPCAP), ~0 }})
 # define CAP_FS_SET       ((kernel_cap_t){{ CAP_FS_MASK_B0, CAP_FS_MASK_B1 } })

-# define CAP_NFSD_SET     ((kernel_cap_t){{ CAP_FS_MASK_B0|CAP_TO_MASK(CAP_SYS_RESOURCE), \
-                                       CAP_FS_MASK_B1 } })
+# define CAP_NFSD_SET     ((kernel_cap_t){{ CAP_FS_MASK_B0 \
+                                           | CAP_TO_MASK(CAP_SYS_RESOURCE) \
+                                           | CAP_TO_MASK(CAP_MKNOD), \
+                                           CAP_FS_MASK_B1 } })

 
 #endif /* _KERNEL_CAPABILITY_U32S != 2 */
 
 
 #endif /* _KERNEL_CAPABILITY_U32S != 2 */
 


@@ -529,7 +531,7 @@ extern const kernel_cap_t __cap_init_eff_set;
  *
  * Note that this does not set PF_SUPERPRIV on the task.
  */
  *
  * Note that this does not set PF_SUPERPRIV on the task.
  */

-#define has_capability(t, cap) (security_task_capable((t), (cap)) == 0)
+#define has_capability(t, cap) (security_real_capable((t), (cap)) == 0)

 
 /**
  * has_capability_noaudit - Determine if a task has a superior capability available (unaudited)
 
 /**
  * has_capability_noaudit - Determine if a task has a superior capability available (unaudited)


@@ -543,7 +545,7 @@ extern const kernel_cap_t __cap_init_eff_set;
  * Note that this does not set PF_SUPERPRIV on the task.
  */
 #define has_capability_noaudit(t, cap) \
  * Note that this does not set PF_SUPERPRIV on the task.
  */
 #define has_capability_noaudit(t, cap) \

-       (security_task_capable_noaudit((t), (cap)) == 0)
+       (security_real_capable_noaudit((t), (cap)) == 0)

 
 extern int capable(int cap);
 
 
 extern int capable(int cap);