vserver 1.9.5.x5

[linux-2.6.git] / security / commoncap.c

diff --git a/security/commoncap.c b/security/commoncap.c
index 1e7895a..f067e8a 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -24,23 +24,45 @@
 #include <linux/xattr.h>
 #include <linux/hugetlb.h>
 
+int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
+{
+       NETLINK_CB(skb).eff_cap = current->cap_effective;
+       return 0;
+}
+
+EXPORT_SYMBOL(cap_netlink_send);
+
+int cap_netlink_recv(struct sk_buff *skb)
+{
+       if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
+               return -EPERM;
+       return 0;
+}
+
+EXPORT_SYMBOL(cap_netlink_recv);
+
 int cap_capable (struct task_struct *tsk, int cap)
 {
        /* Derived from include/linux/sched.h:capable. */
-       if (cap_raised (tsk->cap_effective, cap))
+       if (cap_raised(tsk->cap_effective, cap))
                return 0;
-       else
+       return -EPERM;
+}
+
+int cap_settime(struct timespec *ts, struct timezone *tz)
+{
+       if (!capable(CAP_SYS_TIME))
                return -EPERM;
+       return 0;
 }
 
 int cap_ptrace (struct task_struct *parent, struct task_struct *child)
 {
        /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
        if (!cap_issubset (child->cap_permitted, current->cap_permitted) &&
-           !capable (CAP_SYS_PTRACE))
+           !capable(CAP_SYS_PTRACE))
                return -EPERM;
-       else
-               return 0;
+       return 0;
 }
 
 int cap_capget (struct task_struct *target, kernel_cap_t *effective,
@@ -294,85 +316,17 @@ int cap_syslog (int type)
        return 0;
 }
 
-/*
- * Check that a process has enough memory to allocate a new virtual
- * mapping. 0 means there is enough memory for the allocation to
- * succeed and -ENOMEM implies there is not.
- *
- * We currently support three overcommit policies, which are set via the
- * vm.overcommit_memory sysctl.  See Documentation/vm/overcommit-accounting
- *
- * Strict overcommit modes added 2002 Feb 26 by Alan Cox.
- * Additional code 2002 Jul 20 by Robert Love.
- */
 int cap_vm_enough_memory(long pages)
 {
-       unsigned long free, allowed;
-
-       vm_acct_memory(pages);
-
-       /*
-        * Sometimes we want to use more memory than we have
-        */
-       if (sysctl_overcommit_memory == OVERCOMMIT_ALWAYS)
-               return 0;
-
-       if (sysctl_overcommit_memory == OVERCOMMIT_GUESS) {
-               unsigned long n;
-
-               free = get_page_cache_size();
-               free += nr_swap_pages;
-
-               /*
-                * Any slabs which are created with the
-                * SLAB_RECLAIM_ACCOUNT flag claim to have contents
-                * which are reclaimable, under pressure.  The dentry
-                * cache and most inode caches should fall into this
-                */
-               free += atomic_read(&slab_reclaim_pages);
-
-               /*
-                * Leave the last 3% for root
-                */
-               if (!capable(CAP_SYS_ADMIN))
-                       free -= free / 32;
-
-               if (free > pages)
-                       return 0;
-
-               /*
-                * nr_free_pages() is very expensive on large systems,
-                * only call if we're about to fail.
-                */
-               n = nr_free_pages();
-               if (!capable(CAP_SYS_ADMIN))
-                       n -= n / 32;
-               free += n;
-
-               if (free > pages)
-                       return 0;
-               vm_unacct_memory(pages);
-               return -ENOMEM;
-       }
-
-       allowed = (totalram_pages - hugetlb_total_pages())
-               * sysctl_overcommit_ratio / 100;
-       /*
-        * Leave the last 3% for root
-        */
-       if (!capable(CAP_SYS_ADMIN))
-               allowed -= allowed / 32;
-       allowed += total_swap_pages;
-
-       if (atomic_read(&vm_committed_space) < allowed)
-               return 0;
-
-       vm_unacct_memory(pages);
+       int cap_sys_admin = 0;
 
-       return -ENOMEM;
+       if (cap_capable(current, CAP_SYS_ADMIN) == 0)
+               cap_sys_admin = 1;
+       return __vm_enough_memory(pages, cap_sys_admin);
 }
 
 EXPORT_SYMBOL(cap_capable);
+EXPORT_SYMBOL(cap_settime);
 EXPORT_SYMBOL(cap_ptrace);
 EXPORT_SYMBOL(cap_capget);
 EXPORT_SYMBOL(cap_capset_check);