3 diff -upr a/grsecurity/gracl_cap.c c/grsecurity/gracl_cap.c
4 --- a/grsecurity/gracl_cap.c 2007-12-01 00:54:57.312774500 +0000
5 +++ c/grsecurity/gracl_cap.c 2007-12-01 01:09:34.923621750 +0000
6 @@ -110,3 +110,19 @@ gr_is_capable_nolog(const int cap)
11 +gr_log_cap_pid(const int cap, const pid_t pid)
13 + struct task_struct *p;
15 + if (gr_acl_is_enabled()) {
16 + read_lock(&tasklist_lock);
17 + p = find_task_by_vpid(pid);
20 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, p, captab_log[cap]);
22 + read_unlock(&tasklist_lock);
26 --- a/grsecurity/grsec_sock.c 2008-03-24 00:24:22.482633101 +0100
27 +++ c/grsecurity/grsec_sock.c 2008-03-24 00:27:01.971671763 +0100
29 gr_cap_rtnetlink(struct sock *sock)
31 #ifdef CONFIG_GRKERNSEC
32 + struct acl_subject_label *curracl;
33 + kernel_cap_t cap_dropp = __cap_empty_set, cap_mask = __cap_empty_set;
35 if (!gr_acl_is_enabled())
37 - else if (sock->sk_protocol == NETLINK_ISCSI &&
38 - cap_raised(current_cap(), CAP_SYS_ADMIN) &&
39 - gr_is_capable(CAP_SYS_ADMIN))
40 - return current_cap();
41 - else if (sock->sk_protocol == NETLINK_AUDIT &&
42 - cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
43 - gr_is_capable(CAP_AUDIT_WRITE) &&
44 - cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
45 - gr_is_capable(CAP_AUDIT_CONTROL))
46 - return current_cap();
47 - else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
48 - gr_is_capable(CAP_NET_ADMIN))
49 - return current_cap();
51 - return __cap_empty_set;
53 + curracl = current->acl;
55 + cap_dropp = curracl->cap_lower;
56 + cap_mask = curracl->cap_mask;
58 + while ((curracl = curracl->parent_subject)) {
59 + cap_dropp = cap_combine(cap_dropp,
60 + cap_intersect(curracl->cap_lower,
61 + cap_drop(cap_mask, curracl->cap_mask)));
62 + cap_mask = cap_combine(cap_mask, curracl->cap_mask);
64 + return cap_drop(current_cap(),
65 + cap_intersect(cap_dropp, cap_mask));
70 diff -upr a/include/linux/grsecurity.h c/include/linux/grsecurity.h
71 --- a/include/linux/grsecurity.h 2007-12-01 00:54:57.224769000 +0000
72 +++ c/include/linux/grsecurity.h 2007-12-01 01:09:34.923621750 +0000
73 @@ -76,6 +76,7 @@ void gr_log_semrm(const uid_t uid, const
74 void gr_log_shmget(const int err, const int shmflg, const size_t size);
75 void gr_log_shmrm(const uid_t uid, const uid_t cuid);
76 void gr_log_textrel(struct vm_area_struct *vma);
77 +void gr_log_cap_pid(const int cap, pid_t pid);
79 int gr_handle_follow_link(const struct inode *parent,
80 const struct inode *inode,
81 diff -upr a/security/commoncap.c c/security/commoncap.c
82 --- a/security/commoncap.c 2007-12-01 00:54:57.300773750 +0000
83 +++ c/security/commoncap.c 2007-12-01 01:09:34.923621750 +0000
86 int cap_netlink_recv(struct sk_buff *skb, int cap)
88 - if (!cap_raised(NETLINK_CB(skb).eff_cap, cap))
89 + if (!cap_raised(NETLINK_CB(skb).eff_cap, cap)) {
90 +#ifdef CONFIG_GRKERNSEC
91 + gr_log_cap_pid(cap, NETLINK_CREDS(skb)->pid);
99 === cap_dac_ succession with capable_nolog
101 diff -upr a/fs./namei.c a/fs/namei.c
102 --- a/fs./namei.c 2008-04-05 01:23:49.741310000 +0200
103 +++ a/fs/namei.c 2008-04-05 14:36:39.350275977 +0200
104 @@ -215,6 +215,13 @@ int generic_permission(struct inode *ino
108 + * Searching includes executable on directories, else just read.
110 + if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
111 + if (capable_nolog(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH))
115 * Read/write DACs are always overridable.
116 * Executable DACs are overridable if at least one exec bit is set.
118 @@ -223,13 +230,6 @@ int generic_permission(struct inode *ino
119 if (capable(CAP_DAC_OVERRIDE))
123 - * Searching includes executable on directories, else just read.
125 - if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
126 - if (capable(CAP_DAC_READ_SEARCH))
132 @@ -498,13 +498,13 @@ static int exec_permission_lite(struct i
136 - if ((inode->i_mode & S_IXUGO) && capable(CAP_DAC_OVERRIDE))
137 + if (S_ISDIR(inode->i_mode) && capable_nolog(CAP_DAC_OVERRIDE))
140 - if (S_ISDIR(inode->i_mode) && capable(CAP_DAC_OVERRIDE))
141 + if (S_ISDIR(inode->i_mode) && capable(CAP_DAC_READ_SEARCH))
144 - if (S_ISDIR(inode->i_mode) && capable(CAP_DAC_READ_SEARCH))
145 + if ((inode->i_mode & S_IXUGO) && capable(CAP_DAC_OVERRIDE))
150 --- linux-2.6.30/kernel/vserver/context.c~ 2009-07-31 12:07:52.365267958 +0200
151 +++ linux-2.6.30/kernel/vserver/context.c 2009-07-31 12:43:04.991723596 +0200
153 // preconfig fs entries
154 for (index = 0; index < VX_SPACES; index++) {
155 write_lock(&init_fs.lock);
157 + atomic_inc(&init_fs.users);
158 write_unlock(&init_fs.lock);
159 new->vx_fs[index] = &init_fs;
163 fs = xchg(&vxi->vx_fs[index], NULL);
164 write_lock(&fs->lock);
165 - kill = !--fs->users;
166 + kill = !atomic_dec_return(&fs->users);
167 write_unlock(&fs->lock);
170 --- linux-2.6.30/kernel/vserver/space.c~ 2009-07-31 12:07:52.398601243 +0200
171 +++ linux-2.6.30/kernel/vserver/space.c 2009-07-31 12:47:48.638394441 +0200
173 if (mask & CLONE_FS) {
174 write_lock(&fs_cur->lock);
176 - kill = !--fs_cur->users;
177 + kill = !atomic_dec_return(&fs_cur->users);
178 write_unlock(&fs_cur->lock);
182 if (mask & CLONE_FS) {
183 write_lock(&fs_vxi->lock);
184 vxi->vx_fs[index] = fs;
185 - kill = !--fs_vxi->users;
186 + kill = !atomic_dec_return(&fs_vxi->users);
187 write_unlock(&fs_vxi->lock);