diff options
| author | H. Peter Anvin <hpa@zytor.com> | 2008-09-04 08:08:42 -0700 |
|---|---|---|
| committer | H. Peter Anvin <hpa@zytor.com> | 2008-09-04 08:08:42 -0700 |
| commit | 7203781c98ad9147564d327de6f6513ad8fc0f4e (patch) | |
| tree | 5c29a2a04a626bf08a0d56fd8a0068b3c92ad284 /security/selinux/hooks.c | |
| parent | 671eef85a3e885dff4ce210d8774ad50a91d5967 (diff) | |
| parent | af2e1f276ff08f17192411ea3b71c13a758dfe12 (diff) | |
Merge branch 'x86/cpu' into x86/core
Conflicts:
arch/x86/kernel/cpu/feature_names.c
include/asm-x86/cpufeature.h
Diffstat (limited to 'security/selinux/hooks.c')
| -rw-r--r-- | security/selinux/hooks.c | 25 |
1 files changed, 18 insertions, 7 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 3ae9bec5a50..03fc6a81ae3 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1738,24 +1738,34 @@ static inline u32 file_to_av(struct file *file) /* Hook functions begin here. */ -static int selinux_ptrace(struct task_struct *parent, - struct task_struct *child, - unsigned int mode) +static int selinux_ptrace_may_access(struct task_struct *child, + unsigned int mode) { int rc; - rc = secondary_ops->ptrace(parent, child, mode); + rc = secondary_ops->ptrace_may_access(child, mode); if (rc) return rc; if (mode == PTRACE_MODE_READ) { - struct task_security_struct *tsec = parent->security; + struct task_security_struct *tsec = current->security; struct task_security_struct *csec = child->security; return avc_has_perm(tsec->sid, csec->sid, SECCLASS_FILE, FILE__READ, NULL); } - return task_has_perm(parent, child, PROCESS__PTRACE); + return task_has_perm(current, child, PROCESS__PTRACE); +} + +static int selinux_ptrace_traceme(struct task_struct *parent) +{ + int rc; + + rc = secondary_ops->ptrace_traceme(parent); + if (rc) + return rc; + + return task_has_perm(parent, current, PROCESS__PTRACE); } static int selinux_capget(struct task_struct *target, kernel_cap_t *effective, @@ -5346,7 +5356,8 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer) static struct security_operations selinux_ops = { .name = "selinux", - .ptrace = selinux_ptrace, + .ptrace_may_access = selinux_ptrace_may_access, + .ptrace_traceme = selinux_ptrace_traceme, .capget = selinux_capget, .capset_check = selinux_capset_check, .capset_set = selinux_capset_set, |