CRED: Neuter sys_capset()

Take away the ability for sys_capset() to affect processes other than current. This means that current will not need to lock its own credentials when reading them against interference by other processes. This has effectively been the case for a while anyway, since: (1) Without LSM enabled, sys_capset() is disallowed. (2) With file-based capabilities, sys_capset() is neutered. Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Acked-by: Andrew G. Morgan <morgan@kernel.org> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: James Morris <jmorris@namei.org>

CRED: Neuter sys_capset()
Take away the ability for sys_capset() to affect processes other than current. This means that current will not need to lock its own credentials when reading them against interference by other processes. This has effectively been the case for a while anyway, since: (1) Without LSM enabled, sys_capset() is disallowed. (2) With file-based capabilities, sys_capset() is neutered. Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Acked-by: Andrew G. Morgan <morgan@kernel.org> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: James Morris <jmorris@namei.org>
David Howells · James Morris
1 parent 8bbf4976b5
Showing 6 changed files with 61 additions and 283 deletions Side-by-side Diff
fs/open.c
include/linux/security.h
kernel/capability.c
security/commoncap.c
security/security.c
security/selinux/hooks.c
@@ -441,17 +441,7 @@
 	current->fsgid = current->gid;
  
 	if (!issecure(SECURE_NO_SETUID_FIXUP)) {
-		/*
-		 * Clear the capabilities if we switch to a non-root user
-		 */
-#ifndef CONFIG_SECURITY_FILE_CAPABILITIES
-		/*
-		 * FIXME: There is a race here against sys_capset.  The
-		 * capabilities can change yet we will restore the old
-		 * value below.  We should hold task_capabilities_lock,
-		 * but we cannot because user_path_at can sleep.
-		 */
-#endif /* ndef CONFIG_SECURITY_FILE_CAPABILITIES */
+		/* Clear the capabilities if we switch to a non-root user */
 		if (current->uid)
 			old_cap = cap_set_effective(__cap_empty_set);
 		else
@@ -53,8 +53,8 @@
 extern int cap_ptrace_may_access(struct task_struct *child, unsigned int mode);
 extern int cap_ptrace_traceme(struct task_struct *parent);
 extern int cap_capget(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
-extern int cap_capset_check(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
-extern void cap_capset_set(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
+extern int cap_capset_check(kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
+extern void cap_capset_set(kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
 extern int cap_bprm_set_security(struct linux_binprm *bprm);
 extern void cap_bprm_apply_creds(struct linux_binprm *bprm, int unsafe);
 extern int cap_bprm_secureexec(struct linux_binprm *bprm);
  
@@ -1191,24 +1191,14 @@
  *	Return 0 if the capability sets were successfully obtained.
  * @capset_check:
  *	Check permission before setting the @effective, @inheritable, and
- *	@permitted capability sets for the @target process.
- *	Caveat:  @target is also set to current if a set of processes is
- *	specified (i.e. all processes other than current and init or a
- *	particular process group).  Hence, the capset_set hook may need to
- *	revalidate permission to the actual target process.
- *	@target contains the task_struct structure for target process.
+ *	@permitted capability sets for the current process.
  *	@effective contains the effective capability set.
  *	@inheritable contains the inheritable capability set.
  *	@permitted contains the permitted capability set.
  *	Return 0 if permission is granted.
  * @capset_set:
  *	Set the @effective, @inheritable, and @permitted capability sets for
- *	the @target process.  Since capset_check cannot always check permission
- *	to the real @target process, this hook may also perform permission
- *	checking to determine if the current process is allowed to set the
- *	capability sets of the @target process.  However, this hook has no way
- *	of returning an error due to the structure of the sys_capset code.
- *	@target contains the task_struct structure for target process.
+ *	the current process.
  *	@effective contains the effective capability set.
  *	@inheritable contains the inheritable capability set.
  *	@permitted contains the permitted capability set.
  
@@ -1303,12 +1293,10 @@
 	int (*capget) (struct task_struct *target,
 		       kernel_cap_t *effective,
 		       kernel_cap_t *inheritable, kernel_cap_t *permitted);
-	int (*capset_check) (struct task_struct *target,
-			     kernel_cap_t *effective,
+	int (*capset_check) (kernel_cap_t *effective,
 			     kernel_cap_t *inheritable,
 			     kernel_cap_t *permitted);
-	void (*capset_set) (struct task_struct *target,
-			    kernel_cap_t *effective,
+	void (*capset_set) (kernel_cap_t *effective,
 			    kernel_cap_t *inheritable,
 			    kernel_cap_t *permitted);
 	int (*capable) (struct task_struct *tsk, int cap, int audit);
  
@@ -1572,12 +1560,10 @@
 		    kernel_cap_t *effective,
 		    kernel_cap_t *inheritable,
 		    kernel_cap_t *permitted);
-int security_capset_check(struct task_struct *target,
-			  kernel_cap_t *effective,
+int security_capset_check(kernel_cap_t *effective,
 			  kernel_cap_t *inheritable,
 			  kernel_cap_t *permitted);
-void security_capset_set(struct task_struct *target,
-			 kernel_cap_t *effective,
+void security_capset_set(kernel_cap_t *effective,
 			 kernel_cap_t *inheritable,
 			 kernel_cap_t *permitted);
 int security_capable(struct task_struct *tsk, int cap);
  
  
  
@@ -1769,20 +1755,18 @@
 	return cap_capget(target, effective, inheritable, permitted);
 }
  
-static inline int security_capset_check(struct task_struct *target,
-					 kernel_cap_t *effective,
-					 kernel_cap_t *inheritable,
-					 kernel_cap_t *permitted)
+static inline int security_capset_check(kernel_cap_t *effective,
+					kernel_cap_t *inheritable,
+					kernel_cap_t *permitted)
 {
-	return cap_capset_check(target, effective, inheritable, permitted);
+	return cap_capset_check(effective, inheritable, permitted);
 }
  
-static inline void security_capset_set(struct task_struct *target,
-					kernel_cap_t *effective,
-					kernel_cap_t *inheritable,
-					kernel_cap_t *permitted)
+static inline void security_capset_set(kernel_cap_t *effective,
+				       kernel_cap_t *inheritable,
+				       kernel_cap_t *permitted)
 {
-	cap_capset_set(target, effective, inheritable, permitted);
+	cap_capset_set(effective, inheritable, permitted);
 }
  
 static inline int security_capable(struct task_struct *tsk, int cap)
@@ -127,161 +127,7 @@
 	return 0;
 }
  
-#ifndef CONFIG_SECURITY_FILE_CAPABILITIES
-
 /*
- * Without filesystem capability support, we nominally support one process
- * setting the capabilities of another
- */
-static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,
-				     kernel_cap_t *pIp, kernel_cap_t *pPp)
-{
-	struct task_struct *target;
-	int ret;
-
-	spin_lock(&task_capability_lock);
-	read_lock(&tasklist_lock);
-
-	if (pid && pid != task_pid_vnr(current)) {
-		target = find_task_by_vpid(pid);
-		if (!target) {
-			ret = -ESRCH;
-			goto out;
-		}
-	} else
-		target = current;
-
-	ret = security_capget(target, pEp, pIp, pPp);
-
-out:
-	read_unlock(&tasklist_lock);
-	spin_unlock(&task_capability_lock);
-
-	return ret;
-}
-
-/*
- * cap_set_pg - set capabilities for all processes in a given process
- * group.  We call this holding task_capability_lock and tasklist_lock.
- */
-static inline int cap_set_pg(int pgrp_nr, kernel_cap_t *effective,
-			     kernel_cap_t *inheritable,
-			     kernel_cap_t *permitted)
-{
-	struct task_struct *g, *target;
-	int ret = -EPERM;
-	int found = 0;
-	struct pid *pgrp;
-
-	spin_lock(&task_capability_lock);
-	read_lock(&tasklist_lock);
-
-	pgrp = find_vpid(pgrp_nr);
-	do_each_pid_task(pgrp, PIDTYPE_PGID, g) {
-		target = g;
-		while_each_thread(g, target) {
-			if (!security_capset_check(target, effective,
-						   inheritable, permitted)) {
-				security_capset_set(target, effective,
-						    inheritable, permitted);
-				ret = 0;
-			}
-			found = 1;
-		}
-	} while_each_pid_task(pgrp, PIDTYPE_PGID, g);
-
-	read_unlock(&tasklist_lock);
-	spin_unlock(&task_capability_lock);
-
-	if (!found)
-		ret = 0;
-	return ret;
-}
-
-/*
- * cap_set_all - set capabilities for all processes other than init
- * and self.  We call this holding task_capability_lock and tasklist_lock.
- */
-static inline int cap_set_all(kernel_cap_t *effective,
-			      kernel_cap_t *inheritable,
-			      kernel_cap_t *permitted)
-{
-	struct task_struct *g, *target;
-	int ret = -EPERM;
-	int found = 0;
-
-	spin_lock(&task_capability_lock);
-	read_lock(&tasklist_lock);
-
-	do_each_thread(g, target) {
-		if (target == current
-		    || is_container_init(target->group_leader))
-			continue;
-		found = 1;
-		if (security_capset_check(target, effective, inheritable,
-					  permitted))
-			continue;
-		ret = 0;
-		security_capset_set(target, effective, inheritable, permitted);
-	} while_each_thread(g, target);
-
-	read_unlock(&tasklist_lock);
-	spin_unlock(&task_capability_lock);
-
-	if (!found)
-		ret = 0;
-
-	return ret;
-}
-
-/*
- * Given the target pid does not refer to the current process we
- * need more elaborate support... (This support is not present when
- * filesystem capabilities are configured.)
- */
-static inline int do_sys_capset_other_tasks(pid_t pid, kernel_cap_t *effective,
-					    kernel_cap_t *inheritable,
-					    kernel_cap_t *permitted)
-{
-	struct task_struct *target;
-	int ret;
-
-	if (!capable(CAP_SETPCAP))
-		return -EPERM;
-
-	if (pid == -1)	          /* all procs other than current and init */
-		return cap_set_all(effective, inheritable, permitted);
-
-	else if (pid < 0)                    /* all procs in process group */
-		return cap_set_pg(-pid, effective, inheritable, permitted);
-
-	/* target != current */
-	spin_lock(&task_capability_lock);
-	read_lock(&tasklist_lock);
-
-	target = find_task_by_vpid(pid);
-	if (!target)
-		ret = -ESRCH;
-	else {
-		ret = security_capset_check(target, effective, inheritable,
-					    permitted);
-
-		/* having verified that the proposed changes are legal,
-		   we now put them into effect. */
-		if (!ret)
-			security_capset_set(target, effective, inheritable,
-					    permitted);
-	}
-
-	read_unlock(&tasklist_lock);
-	spin_unlock(&task_capability_lock);
-
-	return ret;
-}
-
-#else /* ie., def CONFIG_SECURITY_FILE_CAPABILITIES */
-
-/*
  * If we have configured with filesystem capability support, then the
  * only thing that can change the capabilities of the current process
  * is the current process. As such, we can't be in this code at the
@@ -315,22 +161,6 @@
 }
  
 /*
- * With filesystem capability support configured, the kernel does not
- * permit the changing of capabilities in one process by another
- * process. (CAP_SETPCAP has much less broad semantics when configured
- * this way.)
- */
-static inline int do_sys_capset_other_tasks(pid_t pid,
-					    kernel_cap_t *effective,
-					    kernel_cap_t *inheritable,
-					    kernel_cap_t *permitted)
-{
-	return -EPERM;
-}
-
-#endif /* ie., ndef CONFIG_SECURITY_FILE_CAPABILITIES */
-
-/*
  * Atomically modify the effective capabilities returning the original
  * value. No permission check is performed here - it is assumed that the
  * caller is permitted to set the desired effective capabilities.
  
  
@@ -424,17 +254,15 @@
  * @data: pointer to struct that contains the effective, permitted,
  *	and inheritable capabilities
  *
- * Set capabilities for a given process, all processes, or all
- * processes in a given process group.
+ * Set capabilities for the current process only.  The ability to any other
+ * process(es) has been deprecated and removed.
  *
  * The restrictions on setting capabilities are specified as:
  *
- * [pid is for the 'target' task.  'current' is the calling task.]
+ * I: any raised capabilities must be a subset of the old permitted
+ * P: any raised capabilities must be a subset of the old permitted
+ * E: must be set to a subset of new permitted
  *
- * I: any raised capabilities must be a subset of the (old current) permitted
- * P: any raised capabilities must be a subset of the (old current) permitted
- * E: must be set to a subset of (new target) permitted
- *
  * Returns 0 on success and < 0 on error.
  */
 asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
  
  
@@ -452,10 +280,13 @@
 	if (get_user(pid, &header->pid))
 		return -EFAULT;
  
+	/* may only affect current now */
+	if (pid != 0 && pid != task_pid_vnr(current))
+		return -EPERM;
+
 	if (copy_from_user(&kdata, data, tocopy
-			   * sizeof(struct __user_cap_data_struct))) {
+			   * sizeof(struct __user_cap_data_struct)))
 		return -EFAULT;
-	}
  
 	for (i = 0; i < tocopy; i++) {
 		effective.cap[i] = kdata[i].effective;
  
@@ -473,32 +304,20 @@
 	if (ret)
 		return ret;
  
-	if (pid && (pid != task_pid_vnr(current)))
-		ret = do_sys_capset_other_tasks(pid, &effective, &inheritable,
-						&permitted);
-	else {
-		/*
-		 * This lock is required even when filesystem
-		 * capability support is configured - it protects the
-		 * sys_capget() call from returning incorrect data in
-		 * the case that the targeted process is not the
-		 * current one.
-		 */
-		spin_lock(&task_capability_lock);
+	/* This lock is required even when filesystem capability support is
+	 * configured - it protects the sys_capget() call from returning
+	 * incorrect data in the case that the targeted process is not the
+	 * current one.
+	 */
+	spin_lock(&task_capability_lock);
  
-		ret = security_capset_check(current, &effective, &inheritable,
-					    &permitted);
-		/*
-		 * Having verified that the proposed changes are
-		 * legal, we now put them into effect.
-		 */
-		if (!ret)
-			security_capset_set(current, &effective, &inheritable,
-					    &permitted);
-		spin_unlock(&task_capability_lock);
-	}
-
-
+	ret = security_capset_check(&effective, &inheritable, &permitted);
+	/* Having verified that the proposed changes are legal, we now put them
+	 * into effect.
+	 */
+	if (!ret)
+		security_capset_set(&effective, &inheritable, &permitted);
+	spin_unlock(&task_capability_lock);
 	return ret;
 }
  
@@ -96,15 +96,6 @@
  
 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
  
-static inline int cap_block_setpcap(struct task_struct *target)
-{
-	/*
-	 * No support for remote process capability manipulation with
-	 * filesystem capability support.
-	 */
-	return (target != current);
-}
-
 static inline int cap_inh_is_capped(void)
 {
 	/*
@@ -119,7 +110,6 @@
  
 #else /* ie., ndef CONFIG_SECURITY_FILE_CAPABILITIES */
  
-static inline int cap_block_setpcap(struct task_struct *t) { return 0; }
 static inline int cap_inh_is_capped(void) { return 1; }
 static inline int cap_limit_ptraced_target(void)
 {
  
  
  
@@ -128,21 +118,18 @@
  
 #endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
  
-int cap_capset_check (struct task_struct *target, kernel_cap_t *effective,
+int cap_capset_check (kernel_cap_t *effective,
 		      kernel_cap_t *inheritable, kernel_cap_t *permitted)
 {
-	if (cap_block_setpcap(target)) {
-		return -EPERM;
-	}
 	if (cap_inh_is_capped()
 	    && !cap_issubset(*inheritable,
-			     cap_combine(target->cap_inheritable,
+			     cap_combine(current->cap_inheritable,
 					 current->cap_permitted))) {
 		/* incapable of using this inheritable set */
 		return -EPERM;
 	}
 	if (!cap_issubset(*inheritable,
-			   cap_combine(target->cap_inheritable,
+			   cap_combine(current->cap_inheritable,
 				       current->cap_bset))) {
 		/* no new pI capabilities outside bounding set */
 		return -EPERM;
@@ -150,7 +137,7 @@
  
 	/* verify restrictions on target's new Permitted set */
 	if (!cap_issubset (*permitted,
-			   cap_combine (target->cap_permitted,
+			   cap_combine (current->cap_permitted,
 					current->cap_permitted))) {
 		return -EPERM;
 	}
  
@@ -163,12 +150,12 @@
 	return 0;
 }
  
-void cap_capset_set (struct task_struct *target, kernel_cap_t *effective,
+void cap_capset_set (kernel_cap_t *effective,
 		     kernel_cap_t *inheritable, kernel_cap_t *permitted)
 {
-	target->cap_effective = *effective;
-	target->cap_inheritable = *inheritable;
-	target->cap_permitted = *permitted;
+	current->cap_effective = *effective;
+	current->cap_inheritable = *inheritable;
+	current->cap_permitted = *permitted;
 }
  
 static inline void bprm_clear_caps(struct linux_binprm *bprm)
@@ -145,20 +145,18 @@
 	return security_ops->capget(target, effective, inheritable, permitted);
 }
  
-int security_capset_check(struct task_struct *target,
-			   kernel_cap_t *effective,
-			   kernel_cap_t *inheritable,
-			   kernel_cap_t *permitted)
+int security_capset_check(kernel_cap_t *effective,
+			  kernel_cap_t *inheritable,
+			  kernel_cap_t *permitted)
 {
-	return security_ops->capset_check(target, effective, inheritable, permitted);
+	return security_ops->capset_check(effective, inheritable, permitted);
 }
  
-void security_capset_set(struct task_struct *target,
-			  kernel_cap_t *effective,
-			  kernel_cap_t *inheritable,
-			  kernel_cap_t *permitted)
+void security_capset_set(kernel_cap_t *effective,
+			 kernel_cap_t *inheritable,
+			 kernel_cap_t *permitted)
 {
-	security_ops->capset_set(target, effective, inheritable, permitted);
+	security_ops->capset_set(effective, inheritable, permitted);
 }
  
 int security_capable(struct task_struct *tsk, int cap)
@@ -1790,22 +1790,22 @@
 	return secondary_ops->capget(target, effective, inheritable, permitted);
 }
  
-static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
+static int selinux_capset_check(kernel_cap_t *effective,
 				kernel_cap_t *inheritable, kernel_cap_t *permitted)
 {
 	int error;
  
-	error = secondary_ops->capset_check(target, effective, inheritable, permitted);
+	error = secondary_ops->capset_check(effective, inheritable, permitted);
 	if (error)
 		return error;
  
-	return task_has_perm(current, target, PROCESS__SETCAP);
+	return task_has_perm(current, current, PROCESS__SETCAP);
 }
  
-static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
+static void selinux_capset_set(kernel_cap_t *effective,
 			       kernel_cap_t *inheritable, kernel_cap_t *permitted)
 {
-	secondary_ops->capset_set(target, effective, inheritable, permitted);
+	secondary_ops->capset_set(effective, inheritable, permitted);
 }
  
 static int selinux_capable(struct task_struct *tsk, int cap, int audit)
...	...	@@ -441,17 +441,7 @@
441	441	current->fsgid = current->gid;
442	442
443	443	if (!issecure(SECURE_NO_SETUID_FIXUP)) {
444		- /*
445		- * Clear the capabilities if we switch to a non-root user
446		- */
447		-#ifndef CONFIG_SECURITY_FILE_CAPABILITIES
448		- /*
449		- * FIXME: There is a race here against sys_capset. The
450		- * capabilities can change yet we will restore the old
451		- * value below. We should hold task_capabilities_lock,
452		- * but we cannot because user_path_at can sleep.
453		- */
454		-#endif /* ndef CONFIG_SECURITY_FILE_CAPABILITIES */
	444	+ /* Clear the capabilities if we switch to a non-root user */
455	445	if (current->uid)
456	446	old_cap = cap_set_effective(__cap_empty_set);
457	447	else
...	...	@@ -53,8 +53,8 @@
53	53	extern int cap_ptrace_may_access(struct task_struct *child, unsigned int mode);
54	54	extern int cap_ptrace_traceme(struct task_struct *parent);
55	55	extern int cap_capget(struct task_struct target, kernel_cap_t effective, kernel_cap_t inheritable, kernel_cap_t permitted);
56		-extern int cap_capset_check(struct task_struct target, kernel_cap_t effective, kernel_cap_t inheritable, kernel_cap_t permitted);
57		-extern void cap_capset_set(struct task_struct target, kernel_cap_t effective, kernel_cap_t inheritable, kernel_cap_t permitted);
	56	+extern int cap_capset_check(kernel_cap_t effective, kernel_cap_t inheritable, kernel_cap_t *permitted);
	57	+extern void cap_capset_set(kernel_cap_t effective, kernel_cap_t inheritable, kernel_cap_t *permitted);
58	58	extern int cap_bprm_set_security(struct linux_binprm *bprm);
59	59	extern void cap_bprm_apply_creds(struct linux_binprm *bprm, int unsafe);
60	60	extern int cap_bprm_secureexec(struct linux_binprm *bprm);
61	61
...	...	@@ -1191,24 +1191,14 @@
1191	1191	* Return 0 if the capability sets were successfully obtained.
1192	1192	* @capset_check:
1193	1193	* Check permission before setting the @effective, @inheritable, and
1194		- * @permitted capability sets for the @target process.
1195		- * Caveat: @target is also set to current if a set of processes is
1196		- * specified (i.e. all processes other than current and init or a
1197		- * particular process group). Hence, the capset_set hook may need to
1198		- * revalidate permission to the actual target process.
1199		- * @target contains the task_struct structure for target process.
	1194	+ * @permitted capability sets for the current process.
1200	1195	* @effective contains the effective capability set.
1201	1196	* @inheritable contains the inheritable capability set.
1202	1197	* @permitted contains the permitted capability set.
1203	1198	* Return 0 if permission is granted.
1204	1199	* @capset_set:
1205	1200	* Set the @effective, @inheritable, and @permitted capability sets for
1206		- * the @target process. Since capset_check cannot always check permission
1207		- * to the real @target process, this hook may also perform permission
1208		- * checking to determine if the current process is allowed to set the
1209		- * capability sets of the @target process. However, this hook has no way
1210		- * of returning an error due to the structure of the sys_capset code.
1211		- * @target contains the task_struct structure for target process.
	1201	+ * the current process.
1212	1202	* @effective contains the effective capability set.
1213	1203	* @inheritable contains the inheritable capability set.
1214	1204	* @permitted contains the permitted capability set.
1215	1205
...	...	@@ -1303,12 +1293,10 @@
1303	1293	int (capget) (struct task_struct target,
1304	1294	kernel_cap_t *effective,
1305	1295	kernel_cap_t inheritable, kernel_cap_t permitted);
1306		- int (capset_check) (struct task_struct target,
1307		- kernel_cap_t *effective,
	1296	+ int (capset_check) (kernel_cap_t effective,
1308	1297	kernel_cap_t *inheritable,
1309	1298	kernel_cap_t *permitted);
1310		- void (capset_set) (struct task_struct target,
1311		- kernel_cap_t *effective,
	1299	+ void (capset_set) (kernel_cap_t effective,
1312	1300	kernel_cap_t *inheritable,
1313	1301	kernel_cap_t *permitted);
1314	1302	int (capable) (struct task_struct tsk, int cap, int audit);
1315	1303
...	...	@@ -1572,12 +1560,10 @@
1572	1560	kernel_cap_t *effective,
1573	1561	kernel_cap_t *inheritable,
1574	1562	kernel_cap_t *permitted);
1575		-int security_capset_check(struct task_struct *target,
1576		- kernel_cap_t *effective,
	1563	+int security_capset_check(kernel_cap_t *effective,
1577	1564	kernel_cap_t *inheritable,
1578	1565	kernel_cap_t *permitted);
1579		-void security_capset_set(struct task_struct *target,
1580		- kernel_cap_t *effective,
	1566	+void security_capset_set(kernel_cap_t *effective,
1581	1567	kernel_cap_t *inheritable,
1582	1568	kernel_cap_t *permitted);
1583	1569	int security_capable(struct task_struct *tsk, int cap);
1584	1570
1585	1571
1586	1572
...	...	@@ -1769,20 +1755,18 @@
1769	1755	return cap_capget(target, effective, inheritable, permitted);
1770	1756	}
1771	1757
1772		-static inline int security_capset_check(struct task_struct *target,
1773		- kernel_cap_t *effective,
1774		- kernel_cap_t *inheritable,
1775		- kernel_cap_t *permitted)
	1758	+static inline int security_capset_check(kernel_cap_t *effective,
	1759	+ kernel_cap_t *inheritable,
	1760	+ kernel_cap_t *permitted)
1776	1761	{
1777		- return cap_capset_check(target, effective, inheritable, permitted);
	1762	+ return cap_capset_check(effective, inheritable, permitted);
1778	1763	}
1779	1764
1780		-static inline void security_capset_set(struct task_struct *target,
1781		- kernel_cap_t *effective,
1782		- kernel_cap_t *inheritable,
1783		- kernel_cap_t *permitted)
	1765	+static inline void security_capset_set(kernel_cap_t *effective,
	1766	+ kernel_cap_t *inheritable,
	1767	+ kernel_cap_t *permitted)
1784	1768	{
1785		- cap_capset_set(target, effective, inheritable, permitted);
	1769	+ cap_capset_set(effective, inheritable, permitted);
1786	1770	}
1787	1771
1788	1772	static inline int security_capable(struct task_struct *tsk, int cap)
...	...	@@ -127,161 +127,7 @@
127	127	return 0;
128	128	}
129	129
130		-#ifndef CONFIG_SECURITY_FILE_CAPABILITIES
131		-
132	130	/*
133		- * Without filesystem capability support, we nominally support one process
134		- * setting the capabilities of another
135		- */
136		-static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,
137		- kernel_cap_t pIp, kernel_cap_t pPp)
138		-{
139		- struct task_struct *target;
140		- int ret;
141		-
142		- spin_lock(&task_capability_lock);
143		- read_lock(&tasklist_lock);
144		-
145		- if (pid && pid != task_pid_vnr(current)) {
146		- target = find_task_by_vpid(pid);
147		- if (!target) {
148		- ret = -ESRCH;
149		- goto out;
150		- }
151		- } else
152		- target = current;
153		-
154		- ret = security_capget(target, pEp, pIp, pPp);
155		-
156		-out:
157		- read_unlock(&tasklist_lock);
158		- spin_unlock(&task_capability_lock);
159		-
160		- return ret;
161		-}
162		-
163		-/*
164		- * cap_set_pg - set capabilities for all processes in a given process
165		- * group. We call this holding task_capability_lock and tasklist_lock.
166		- */
167		-static inline int cap_set_pg(int pgrp_nr, kernel_cap_t *effective,
168		- kernel_cap_t *inheritable,
169		- kernel_cap_t *permitted)
170		-{
171		- struct task_struct g, target;
172		- int ret = -EPERM;
173		- int found = 0;
174		- struct pid *pgrp;
175		-
176		- spin_lock(&task_capability_lock);
177		- read_lock(&tasklist_lock);
178		-
179		- pgrp = find_vpid(pgrp_nr);
180		- do_each_pid_task(pgrp, PIDTYPE_PGID, g) {
181		- target = g;
182		- while_each_thread(g, target) {
183		- if (!security_capset_check(target, effective,
184		- inheritable, permitted)) {
185		- security_capset_set(target, effective,
186		- inheritable, permitted);
187		- ret = 0;
188		- }
189		- found = 1;
190		- }
191		- } while_each_pid_task(pgrp, PIDTYPE_PGID, g);
192		-
193		- read_unlock(&tasklist_lock);
194		- spin_unlock(&task_capability_lock);
195		-
196		- if (!found)
197		- ret = 0;
198		- return ret;
199		-}
200		-
201		-/*
202		- * cap_set_all - set capabilities for all processes other than init
203		- * and self. We call this holding task_capability_lock and tasklist_lock.
204		- */
205		-static inline int cap_set_all(kernel_cap_t *effective,
206		- kernel_cap_t *inheritable,
207		- kernel_cap_t *permitted)
208		-{
209		- struct task_struct g, target;
210		- int ret = -EPERM;
211		- int found = 0;
212		-
213		- spin_lock(&task_capability_lock);
214		- read_lock(&tasklist_lock);
215		-
216		- do_each_thread(g, target) {
217		- if (target == current
218		- \|\| is_container_init(target->group_leader))
219		- continue;
220		- found = 1;
221		- if (security_capset_check(target, effective, inheritable,
222		- permitted))
223		- continue;
224		- ret = 0;
225		- security_capset_set(target, effective, inheritable, permitted);
226		- } while_each_thread(g, target);
227		-
228		- read_unlock(&tasklist_lock);
229		- spin_unlock(&task_capability_lock);
230		-
231		- if (!found)
232		- ret = 0;
233		-
234		- return ret;
235		-}
236		-
237		-/*
238		- * Given the target pid does not refer to the current process we
239		- * need more elaborate support... (This support is not present when
240		- * filesystem capabilities are configured.)
241		- */
242		-static inline int do_sys_capset_other_tasks(pid_t pid, kernel_cap_t *effective,
243		- kernel_cap_t *inheritable,
244		- kernel_cap_t *permitted)
245		-{
246		- struct task_struct *target;
247		- int ret;
248		-
249		- if (!capable(CAP_SETPCAP))
250		- return -EPERM;
251		-
252		- if (pid == -1) /* all procs other than current and init */
253		- return cap_set_all(effective, inheritable, permitted);
254		-
255		- else if (pid < 0) /* all procs in process group */
256		- return cap_set_pg(-pid, effective, inheritable, permitted);
257		-
258		- /* target != current */
259		- spin_lock(&task_capability_lock);
260		- read_lock(&tasklist_lock);
261		-
262		- target = find_task_by_vpid(pid);
263		- if (!target)
264		- ret = -ESRCH;
265		- else {
266		- ret = security_capset_check(target, effective, inheritable,
267		- permitted);
268		-
269		- /* having verified that the proposed changes are legal,
270		- we now put them into effect. */
271		- if (!ret)
272		- security_capset_set(target, effective, inheritable,
273		- permitted);
274		- }
275		-
276		- read_unlock(&tasklist_lock);
277		- spin_unlock(&task_capability_lock);
278		-
279		- return ret;
280		-}
281		-
282		-#else /* ie., def CONFIG_SECURITY_FILE_CAPABILITIES */
283		-
284		-/*
285	131	* If we have configured with filesystem capability support, then the
286	132	* only thing that can change the capabilities of the current process
287	133	* is the current process. As such, we can't be in this code at the
...	...	@@ -315,22 +161,6 @@
315	161	}
316	162
317	163	/*
318		- * With filesystem capability support configured, the kernel does not
319		- * permit the changing of capabilities in one process by another
320		- * process. (CAP_SETPCAP has much less broad semantics when configured
321		- * this way.)
322		- */
323		-static inline int do_sys_capset_other_tasks(pid_t pid,
324		- kernel_cap_t *effective,
325		- kernel_cap_t *inheritable,
326		- kernel_cap_t *permitted)
327		-{
328		- return -EPERM;
329		-}
330		-
331		-#endif /* ie., ndef CONFIG_SECURITY_FILE_CAPABILITIES */
332		-
333		-/*
334	164	* Atomically modify the effective capabilities returning the original
335	165	* value. No permission check is performed here - it is assumed that the
336	166	* caller is permitted to set the desired effective capabilities.
337	167
338	168
...	...	@@ -424,17 +254,15 @@
424	254	* @data: pointer to struct that contains the effective, permitted,
425	255	* and inheritable capabilities
426	256	*
427		- * Set capabilities for a given process, all processes, or all
428		- * processes in a given process group.
	257	+ * Set capabilities for the current process only. The ability to any other
	258	+ * process(es) has been deprecated and removed.
429	259	*
430	260	* The restrictions on setting capabilities are specified as:
431	261	*
432		- * [pid is for the 'target' task. 'current' is the calling task.]
	262	+ * I: any raised capabilities must be a subset of the old permitted
	263	+ * P: any raised capabilities must be a subset of the old permitted
	264	+ * E: must be set to a subset of new permitted
433	265	*
434		- * I: any raised capabilities must be a subset of the (old current) permitted
435		- * P: any raised capabilities must be a subset of the (old current) permitted
436		- * E: must be set to a subset of (new target) permitted
437		- *
438	266	* Returns 0 on success and < 0 on error.
439	267	*/
440	268	asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
441	269
442	270
...	...	@@ -452,10 +280,13 @@
452	280	if (get_user(pid, &header->pid))
453	281	return -EFAULT;
454	282
	283	+ /* may only affect current now */
	284	+ if (pid != 0 && pid != task_pid_vnr(current))
	285	+ return -EPERM;
	286	+
455	287	if (copy_from_user(&kdata, data, tocopy
456		- * sizeof(struct __user_cap_data_struct))) {
	288	+ * sizeof(struct __user_cap_data_struct)))
457	289	return -EFAULT;
458		- }
459	290
460	291	for (i = 0; i < tocopy; i++) {
461	292	effective.cap[i] = kdata[i].effective;
462	293
...	...	@@ -473,32 +304,20 @@
473	304	if (ret)
474	305	return ret;
475	306
476		- if (pid && (pid != task_pid_vnr(current)))
477		- ret = do_sys_capset_other_tasks(pid, &effective, &inheritable,
478		- &permitted);
479		- else {
480		- /*
481		- * This lock is required even when filesystem
482		- * capability support is configured - it protects the
483		- * sys_capget() call from returning incorrect data in
484		- * the case that the targeted process is not the
485		- * current one.
486		- */
487		- spin_lock(&task_capability_lock);
	307	+ /* This lock is required even when filesystem capability support is
	308	+ * configured - it protects the sys_capget() call from returning
	309	+ * incorrect data in the case that the targeted process is not the
	310	+ * current one.
	311	+ */
	312	+ spin_lock(&task_capability_lock);
488	313
489		- ret = security_capset_check(current, &effective, &inheritable,
490		- &permitted);
491		- /*
492		- * Having verified that the proposed changes are
493		- * legal, we now put them into effect.
494		- */
495		- if (!ret)
496		- security_capset_set(current, &effective, &inheritable,
497		- &permitted);
498		- spin_unlock(&task_capability_lock);
499		- }
500		-
501		-
	314	+ ret = security_capset_check(&effective, &inheritable, &permitted);
	315	+ /* Having verified that the proposed changes are legal, we now put them
	316	+ * into effect.
	317	+ */
	318	+ if (!ret)
	319	+ security_capset_set(&effective, &inheritable, &permitted);
	320	+ spin_unlock(&task_capability_lock);
502	321	return ret;
503	322	}
504	323
...	...	@@ -96,15 +96,6 @@
96	96
97	97	#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
98	98
99		-static inline int cap_block_setpcap(struct task_struct *target)
100		-{
101		- /*
102		- * No support for remote process capability manipulation with
103		- * filesystem capability support.
104		- */
105		- return (target != current);
106		-}
107		-
108	99	static inline int cap_inh_is_capped(void)
109	100	{
110	101	/*
...	...	@@ -119,7 +110,6 @@
119	110
120	111	#else /* ie., ndef CONFIG_SECURITY_FILE_CAPABILITIES */
121	112
122		-static inline int cap_block_setpcap(struct task_struct *t) { return 0; }
123	113	static inline int cap_inh_is_capped(void) { return 1; }
124	114	static inline int cap_limit_ptraced_target(void)
125	115	{
126	116
127	117
128	118
...	...	@@ -128,21 +118,18 @@
128	118
129	119	#endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
130	120
131		-int cap_capset_check (struct task_struct target, kernel_cap_t effective,
	121	+int cap_capset_check (kernel_cap_t *effective,
132	122	kernel_cap_t inheritable, kernel_cap_t permitted)
133	123	{
134		- if (cap_block_setpcap(target)) {
135		- return -EPERM;
136		- }
137	124	if (cap_inh_is_capped()
138	125	&& !cap_issubset(*inheritable,
139		- cap_combine(target->cap_inheritable,
	126	+ cap_combine(current->cap_inheritable,
140	127	current->cap_permitted))) {
141	128	/* incapable of using this inheritable set */
142	129	return -EPERM;
143	130	}
144	131	if (!cap_issubset(*inheritable,
145		- cap_combine(target->cap_inheritable,
	132	+ cap_combine(current->cap_inheritable,
146	133	current->cap_bset))) {
147	134	/* no new pI capabilities outside bounding set */
148	135	return -EPERM;
...	...	@@ -150,7 +137,7 @@
150	137
151	138	/* verify restrictions on target's new Permitted set */
152	139	if (!cap_issubset (*permitted,
153		- cap_combine (target->cap_permitted,
	140	+ cap_combine (current->cap_permitted,
154	141	current->cap_permitted))) {
155	142	return -EPERM;
156	143	}
157	144
...	...	@@ -163,12 +150,12 @@
163	150	return 0;
164	151	}
165	152
166		-void cap_capset_set (struct task_struct target, kernel_cap_t effective,
	153	+void cap_capset_set (kernel_cap_t *effective,
167	154	kernel_cap_t inheritable, kernel_cap_t permitted)
168	155	{
169		- target->cap_effective = *effective;
170		- target->cap_inheritable = *inheritable;
171		- target->cap_permitted = *permitted;
	156	+ current->cap_effective = *effective;
	157	+ current->cap_inheritable = *inheritable;
	158	+ current->cap_permitted = *permitted;
172	159	}
173	160
174	161	static inline void bprm_clear_caps(struct linux_binprm *bprm)
...	...	@@ -145,20 +145,18 @@
145	145	return security_ops->capget(target, effective, inheritable, permitted);
146	146	}
147	147
148		-int security_capset_check(struct task_struct *target,
149		- kernel_cap_t *effective,
150		- kernel_cap_t *inheritable,
151		- kernel_cap_t *permitted)
	148	+int security_capset_check(kernel_cap_t *effective,
	149	+ kernel_cap_t *inheritable,
	150	+ kernel_cap_t *permitted)
152	151	{
153		- return security_ops->capset_check(target, effective, inheritable, permitted);
	152	+ return security_ops->capset_check(effective, inheritable, permitted);
154	153	}
155	154
156		-void security_capset_set(struct task_struct *target,
157		- kernel_cap_t *effective,
158		- kernel_cap_t *inheritable,
159		- kernel_cap_t *permitted)
	155	+void security_capset_set(kernel_cap_t *effective,
	156	+ kernel_cap_t *inheritable,
	157	+ kernel_cap_t *permitted)
160	158	{
161		- security_ops->capset_set(target, effective, inheritable, permitted);
	159	+ security_ops->capset_set(effective, inheritable, permitted);
162	160	}
163	161
164	162	int security_capable(struct task_struct *tsk, int cap)
...	...	@@ -1790,22 +1790,22 @@
1790	1790	return secondary_ops->capget(target, effective, inheritable, permitted);
1791	1791	}
1792	1792
1793		-static int selinux_capset_check(struct task_struct target, kernel_cap_t effective,
	1793	+static int selinux_capset_check(kernel_cap_t *effective,
1794	1794	kernel_cap_t inheritable, kernel_cap_t permitted)
1795	1795	{
1796	1796	int error;
1797	1797
1798		- error = secondary_ops->capset_check(target, effective, inheritable, permitted);
	1798	+ error = secondary_ops->capset_check(effective, inheritable, permitted);
1799	1799	if (error)
1800	1800	return error;
1801	1801
1802		- return task_has_perm(current, target, PROCESS__SETCAP);
	1802	+ return task_has_perm(current, current, PROCESS__SETCAP);
1803	1803	}
1804	1804
1805		-static void selinux_capset_set(struct task_struct target, kernel_cap_t effective,
	1805	+static void selinux_capset_set(kernel_cap_t *effective,
1806	1806	kernel_cap_t inheritable, kernel_cap_t permitted)
1807	1807	{
1808		- secondary_ops->capset_set(target, effective, inheritable, permitted);
	1808	+ secondary_ops->capset_set(effective, inheritable, permitted);
1809	1809	}
1810	1810
1811	1811	static int selinux_capable(struct task_struct *tsk, int cap, int audit)