syslog: distinguish between /proc/kmsg and syscalls

[pandora-kernel.git] / security / commoncap.c

diff --git a/security/commoncap.c b/security/commoncap.c
index f800fdb..677fad9 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -27,6 +27,7 @@
 #include <linux/sched.h>
 #include <linux/prctl.h>
 #include <linux/securebits.h>
+#include <linux/syslog.h>
 
 /*
  * If a non-root user executes a setuid-root binary in
@@ -888,12 +889,16 @@ error:
 /**
  * cap_syslog - Determine whether syslog function is permitted
  * @type: Function requested
+ * @from_file: Whether this request came from an open file (i.e. /proc)
  *
  * Determine whether the current process is permitted to use a particular
  * syslog function, returning 0 if permission is granted, -ve if not.
  */
-int cap_syslog(int type)
+int cap_syslog(int type, bool from_file)
 {
+       /* /proc/kmsg can open be opened by CAP_SYS_ADMIN */
+       if (type != 1 && from_file)
+               return 0;
        if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
                return -EPERM;
        return 0;