3 diff -upr a/grsecurity/gracl_cap.c c/grsecurity/gracl_cap.c
4 --- a/grsecurity/gracl_cap.c 2007-12-01 00:54:57.312774500 +0000
5 +++ c/grsecurity/gracl_cap.c 2007-12-01 01:09:34.923621750 +0000
6 @@ -110,3 +110,19 @@ gr_is_capable_nolog(const int cap)
11 +gr_log_cap_pid(const int cap, const pid_t pid)
13 + struct task_struct *p;
15 + if (gr_acl_is_enabled()) {
16 + read_lock(&tasklist_lock);
17 + p = find_task_by_vpid(pid);
20 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, p, captab_log[cap]);
22 + read_unlock(&tasklist_lock);
26 --- a/grsecurity/grsec_sock.c 2008-03-24 00:24:22.482633101 +0100
27 +++ c/grsecurity/grsec_sock.c 2008-03-24 00:27:01.971671763 +0100
29 gr_cap_rtnetlink(struct sock *sock)
31 #ifdef CONFIG_GRKERNSEC
32 + struct acl_subject_label *curracl;
33 + kernel_cap_t cap_dropp = __cap_empty_set, cap_mask = __cap_empty_set;
35 if (!gr_acl_is_enabled())
37 - else if (sock->sk_protocol == NETLINK_ISCSI &&
38 - cap_raised(current_cap(), CAP_SYS_ADMIN) &&
39 - gr_is_capable(CAP_SYS_ADMIN))
40 - return current_cap();
41 - else if (sock->sk_protocol == NETLINK_AUDIT &&
42 - cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
43 - gr_is_capable(CAP_AUDIT_WRITE) &&
44 - cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
45 - gr_is_capable(CAP_AUDIT_CONTROL))
46 - return current_cap();
47 - else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
48 - gr_is_capable(CAP_NET_ADMIN))
49 - return current_cap();
51 - return __cap_empty_set;
53 + curracl = current->acl;
55 + cap_dropp = curracl->cap_lower;
56 + cap_mask = curracl->cap_mask;
58 + while ((curracl = curracl->parent_subject)) {
59 + cap_dropp = cap_combine(cap_dropp,
60 + cap_intersect(curracl->cap_lower,
61 + cap_drop(cap_mask, curracl->cap_mask)));
62 + cap_mask = cap_combine(cap_mask, curracl->cap_mask);
64 + return cap_drop(current_cap(),
65 + cap_intersect(cap_dropp, cap_mask));
70 diff -upr a/include/linux/grsecurity.h c/include/linux/grsecurity.h
71 --- a/include/linux/grsecurity.h 2007-12-01 00:54:57.224769000 +0000
72 +++ c/include/linux/grsecurity.h 2007-12-01 01:09:34.923621750 +0000
73 @@ -76,6 +76,7 @@ void gr_log_semrm(const uid_t uid, const
74 void gr_log_shmget(const int err, const int shmflg, const size_t size);
75 void gr_log_shmrm(const uid_t uid, const uid_t cuid);
76 void gr_log_textrel(struct vm_area_struct *vma);
77 +void gr_log_cap_pid(const int cap, pid_t pid);
79 int gr_handle_follow_link(const struct inode *parent,
80 const struct inode *inode,
81 diff -upr a/security/commoncap.c c/security/commoncap.c
82 --- a/security/commoncap.c 2007-12-01 00:54:57.300773750 +0000
83 +++ c/security/commoncap.c 2007-12-01 01:09:34.923621750 +0000
86 int cap_netlink_recv(struct sk_buff *skb, int cap)
88 - if (!cap_raised(NETLINK_CB(skb).eff_cap, cap))
89 + if (!cap_raised(NETLINK_CB(skb).eff_cap, cap)) {
90 +#ifdef CONFIG_GRKERNSEC
91 + gr_log_cap_pid(cap, NETLINK_CREDS(skb)->pid);
99 === cap_dac_ succession with capable_nolog
101 diff -upr a/fs./namei.c a/fs/namei.c
102 --- a/fs./namei.c 2008-04-05 01:23:49.741310000 +0200
103 +++ a/fs/namei.c 2008-04-05 14:36:39.350275977 +0200
104 @@ -215,6 +215,13 @@ int generic_permission(struct inode *ino
108 + * Searching includes executable on directories, else just read.
110 + if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
111 + if (capable_nolog(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH))
115 * Read/write DACs are always overridable.
116 * Executable DACs are overridable if at least one exec bit is set.
118 @@ -223,13 +230,6 @@ int generic_permission(struct inode *ino
119 if (capable(CAP_DAC_OVERRIDE))
123 - * Searching includes executable on directories, else just read.
125 - if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
126 - if (capable(CAP_DAC_READ_SEARCH))
132 @@ -498,13 +498,13 @@ static int exec_permission_lite(struct i
136 - if ((inode->i_mode & S_IXUGO) && capable(CAP_DAC_OVERRIDE))
137 + if (S_ISDIR(inode->i_mode) && capable_nolog(CAP_DAC_OVERRIDE))
140 - if (S_ISDIR(inode->i_mode) && capable(CAP_DAC_OVERRIDE))
141 + if (S_ISDIR(inode->i_mode) && capable(CAP_DAC_READ_SEARCH))
144 - if (S_ISDIR(inode->i_mode) && capable(CAP_DAC_READ_SEARCH))
145 + if ((inode->i_mode & S_IXUGO) && capable(CAP_DAC_OVERRIDE))