This commit was manufactured by cvs2svn to create branch 'vserver'.

[linux-2.6.git] / security / commoncap.c

diff --git a/security/commoncap.c b/security/commoncap.c
index f067e8a..a0b8d82 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -7,7 +7,7 @@
  *
  */
 
-#include <linux/config.h>
+#include <linux/capability.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -32,9 +32,9 @@ int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
 
 EXPORT_SYMBOL(cap_netlink_send);
 
-int cap_netlink_recv(struct sk_buff *skb)
+int cap_netlink_recv(struct sk_buff *skb, int cap)
 {
-       if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
+       if (!cap_raised(NETLINK_CB(skb).eff_cap, cap))
                return -EPERM;
        return 0;
 }
@@ -59,8 +59,8 @@ int cap_settime(struct timespec *ts, struct timezone *tz)
 int cap_ptrace (struct task_struct *parent, struct task_struct *child)
 {
        /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
-       if (!cap_issubset (child->cap_permitted, current->cap_permitted) &&
-           !capable(CAP_SYS_PTRACE))
+       if (!cap_issubset(child->cap_permitted, parent->cap_permitted) &&
+           !__capable(parent, CAP_SYS_PTRACE))
                return -EPERM;
        return 0;
 }
@@ -149,7 +149,7 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
 
        if (bprm->e_uid != current->uid || bprm->e_gid != current->gid ||
            !cap_issubset (new_permitted, current->cap_permitted)) {
-               current->mm->dumpable = 0;
+               current->mm->dumpable = suid_dumpable;
 
                if (unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
                        if (!capable(CAP_SETUID)) {
@@ -311,7 +311,8 @@ void cap_task_reparent_to_init (struct task_struct *p)
 
 int cap_syslog (int type)
 {
-       if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
+       if ((type != 3 && type != 10) &&
+               !vx_capable(CAP_SYS_ADMIN, VXC_SYSLOG))
                return -EPERM;
        return 0;
 }