2.5.75

 security

diff -Nru a/security/capability.c b/security/capability.c
--- a/security/capability.c   Thu Jul 10 13:16:27 2003
+++ b/security/capability.c   Thu Jul 10 13:16:27 2003
@@ -15,6 +15,9 @@
 #include <linux/security.h>
 #include <linux/file.h>
 #include <linux/mm.h>
+#include <linux/mman.h>
+#include <linux/pagemap.h>
+#include <linux/swap.h>
 #include <linux/smp_lock.h>
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
@@ -275,6 +278,65 @@
    return 0;
 }
 
+/*
+ * Check that a process has enough memory to allocate a new virtual
+ * mapping. 0 means there is enough memory for the allocation to
+ * succeed and -ENOMEM implies there is not.
+ *
+ * We currently support three overcommit policies, which are set via the
+ * vm.overcommit_memory sysctl.  See Documentation/vm/overcommit-acounting
+ *
+ * Strict overcommit modes added 2002 Feb 26 by Alan Cox.
+ * Additional code 2002 Jul 20 by Robert Love.
+ */
+int cap_vm_enough_memory(long pages)
+{
+   unsigned long free, allowed;
+
+   vm_acct_memory(pages);
+
+        /*
+    * Sometimes we want to use more memory than we have
+    */
+   if (sysctl_overcommit_memory == 1)
+      return 0;
+
+   if (sysctl_overcommit_memory == 0) {
+      free = get_page_cache_size();
+      free += nr_free_pages();
+      free += nr_swap_pages;
+
+      /*
+       * Any slabs which are created with the
+       * SLAB_RECLAIM_ACCOUNT flag claim to have contents
+       * which are reclaimable, under pressure.  The dentry
+       * cache and most inode caches should fall into this
+       */
+      free += atomic_read(&slab_reclaim_pages);
+
+      /*
+       * Leave the last 3% for root
+       */
+      if (!capable(CAP_SYS_ADMIN))
+         free -= free / 32;
+
+      if (free > pages)
+         return 0;
+      vm_unacct_memory(pages);
+      return -ENOMEM;
+   }
+
+   allowed = totalram_pages * sysctl_overcommit_ratio / 100;
+   allowed += total_swap_pages;
+
+   if (atomic_read(&vm_committed_space) < allowed)
+      return 0;
+
+   vm_unacct_memory(pages);
+
+   return -ENOMEM;
+}
+
 EXPORT_SYMBOL(cap_capable);
 EXPORT_SYMBOL(cap_ptrace);
 EXPORT_SYMBOL(cap_capget);
@@ -286,6 +348,7 @@
 EXPORT_SYMBOL(cap_task_post_setuid);
 EXPORT_SYMBOL(cap_task_reparent_to_init);
 EXPORT_SYMBOL(cap_syslog);
+EXPORT_SYMBOL(cap_vm_enough_memory);
 
 #ifdef CONFIG_SECURITY
 
@@ -307,6 +370,8 @@
    .task_reparent_to_init =   cap_task_reparent_to_init,
 
    .syslog =                       cap_syslog,
+
+   .vm_enough_memory =             cap_vm_enough_memory,
 };
 
 #if defined(CONFIG_SECURITY_CAPABILITIES_MODULE)