51 |
51 |
52 #define XATTR_CAPS_SUFFIX "capability" |
52 #define XATTR_CAPS_SUFFIX "capability" |
53 #define XATTR_NAME_CAPS XATTR_SECURITY_PREFIX XATTR_CAPS_SUFFIX |
53 #define XATTR_NAME_CAPS XATTR_SECURITY_PREFIX XATTR_CAPS_SUFFIX |
54 |
54 |
55 #define VFS_CAP_REVISION_MASK 0xFF000000 |
55 #define VFS_CAP_REVISION_MASK 0xFF000000 |
|
56 #define VFS_CAP_REVISION_SHIFT 24 |
56 #define VFS_CAP_FLAGS_MASK ~VFS_CAP_REVISION_MASK |
57 #define VFS_CAP_FLAGS_MASK ~VFS_CAP_REVISION_MASK |
57 #define VFS_CAP_FLAGS_EFFECTIVE 0x000001 |
58 #define VFS_CAP_FLAGS_EFFECTIVE 0x000001 |
58 |
59 |
59 #define VFS_CAP_REVISION_1 0x01000000 |
60 #define VFS_CAP_REVISION_1 0x01000000 |
60 #define VFS_CAP_U32_1 1 |
61 #define VFS_CAP_U32_1 1 |
65 #define XATTR_CAPS_SZ_2 (sizeof(__le32)*(1 + 2*VFS_CAP_U32_2)) |
66 #define XATTR_CAPS_SZ_2 (sizeof(__le32)*(1 + 2*VFS_CAP_U32_2)) |
66 |
67 |
67 #define XATTR_CAPS_SZ XATTR_CAPS_SZ_2 |
68 #define XATTR_CAPS_SZ XATTR_CAPS_SZ_2 |
68 #define VFS_CAP_U32 VFS_CAP_U32_2 |
69 #define VFS_CAP_U32 VFS_CAP_U32_2 |
69 #define VFS_CAP_REVISION VFS_CAP_REVISION_2 |
70 #define VFS_CAP_REVISION VFS_CAP_REVISION_2 |
70 |
|
71 |
71 |
72 struct vfs_cap_data { |
72 struct vfs_cap_data { |
73 __le32 magic_etc; /* Little endian */ |
73 __le32 magic_etc; /* Little endian */ |
74 struct { |
74 struct { |
75 __le32 permitted; /* Little endian */ |
75 __le32 permitted; /* Little endian */ |
90 #else |
90 #else |
91 |
91 |
92 #define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3 |
92 #define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3 |
93 #define _KERNEL_CAPABILITY_U32S _LINUX_CAPABILITY_U32S_3 |
93 #define _KERNEL_CAPABILITY_U32S _LINUX_CAPABILITY_U32S_3 |
94 |
94 |
|
95 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES |
|
96 extern int file_caps_enabled; |
|
97 #endif |
|
98 |
95 typedef struct kernel_cap_struct { |
99 typedef struct kernel_cap_struct { |
96 __u32 cap[_KERNEL_CAPABILITY_U32S]; |
100 __u32 cap[_KERNEL_CAPABILITY_U32S]; |
97 } kernel_cap_t; |
101 } kernel_cap_t; |
|
102 |
|
103 /* exact same as vfs_cap_data but in cpu endian and always filled completely */ |
|
104 struct cpu_vfs_cap_data { |
|
105 __u32 magic_etc; |
|
106 kernel_cap_t permitted; |
|
107 kernel_cap_t inheritable; |
|
108 }; |
98 |
109 |
99 #define _USER_CAP_HEADER_SIZE (sizeof(struct __user_cap_header_struct)) |
110 #define _USER_CAP_HEADER_SIZE (sizeof(struct __user_cap_header_struct)) |
100 #define _KERNEL_CAP_T_SIZE (sizeof(kernel_cap_t)) |
111 #define _KERNEL_CAP_T_SIZE (sizeof(kernel_cap_t)) |
101 |
112 |
102 #endif |
113 #endif |
380 |
391 |
381 # define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }}) |
392 # define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }}) |
382 # define CAP_FULL_SET ((kernel_cap_t){{ ~0, ~0 }}) |
393 # define CAP_FULL_SET ((kernel_cap_t){{ ~0, ~0 }}) |
383 # define CAP_INIT_EFF_SET ((kernel_cap_t){{ ~CAP_TO_MASK(CAP_SETPCAP), ~0 }}) |
394 # define CAP_INIT_EFF_SET ((kernel_cap_t){{ ~CAP_TO_MASK(CAP_SETPCAP), ~0 }}) |
384 # define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0, CAP_FS_MASK_B1 } }) |
395 # define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0, CAP_FS_MASK_B1 } }) |
385 # define CAP_NFSD_SET ((kernel_cap_t){{ CAP_FS_MASK_B0|CAP_TO_MASK(CAP_SYS_RESOURCE), \ |
396 # define CAP_NFSD_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \ |
386 CAP_FS_MASK_B1 } }) |
397 | CAP_TO_MASK(CAP_SYS_RESOURCE) \ |
|
398 | CAP_TO_MASK(CAP_MKNOD), \ |
|
399 CAP_FS_MASK_B1 } }) |
387 |
400 |
388 #endif /* _KERNEL_CAPABILITY_U32S != 2 */ |
401 #endif /* _KERNEL_CAPABILITY_U32S != 2 */ |
389 |
402 |
390 #define CAP_INIT_INH_SET CAP_EMPTY_SET |
403 #define CAP_INIT_INH_SET CAP_EMPTY_SET |
391 |
404 |
452 return 0; |
465 return 0; |
453 } |
466 } |
454 return 1; |
467 return 1; |
455 } |
468 } |
456 |
469 |
|
470 /* |
|
471 * Check if "a" is a subset of "set". |
|
472 * return 1 if ALL of the capabilities in "a" are also in "set" |
|
473 * cap_issubset(0101, 1111) will return 1 |
|
474 * return 0 if ANY of the capabilities in "a" are not in "set" |
|
475 * cap_issubset(1111, 0101) will return 0 |
|
476 */ |
457 static inline int cap_issubset(const kernel_cap_t a, const kernel_cap_t set) |
477 static inline int cap_issubset(const kernel_cap_t a, const kernel_cap_t set) |
458 { |
478 { |
459 kernel_cap_t dest; |
479 kernel_cap_t dest; |
460 dest = cap_drop(a, set); |
480 dest = cap_drop(a, set); |
461 return cap_isclear(dest); |
481 return cap_isclear(dest); |
498 } |
518 } |
499 |
519 |
500 extern const kernel_cap_t __cap_empty_set; |
520 extern const kernel_cap_t __cap_empty_set; |
501 extern const kernel_cap_t __cap_full_set; |
521 extern const kernel_cap_t __cap_full_set; |
502 extern const kernel_cap_t __cap_init_eff_set; |
522 extern const kernel_cap_t __cap_init_eff_set; |
503 |
|
504 kernel_cap_t cap_set_effective(const kernel_cap_t pE_new); |
|
505 |
523 |
506 /** |
524 /** |
507 * has_capability - Determine if a task has a superior capability available |
525 * has_capability - Determine if a task has a superior capability available |
508 * @t: The task in question |
526 * @t: The task in question |
509 * @cap: The capability to be tested for |
527 * @cap: The capability to be tested for |
511 * Return true if the specified task has the given superior capability |
529 * Return true if the specified task has the given superior capability |
512 * currently in effect, false if not. |
530 * currently in effect, false if not. |
513 * |
531 * |
514 * Note that this does not set PF_SUPERPRIV on the task. |
532 * Note that this does not set PF_SUPERPRIV on the task. |
515 */ |
533 */ |
516 #define has_capability(t, cap) (security_capable((t), (cap)) == 0) |
534 #define has_capability(t, cap) (security_real_capable((t), (cap)) == 0) |
|
535 |
|
536 /** |
|
537 * has_capability_noaudit - Determine if a task has a superior capability available (unaudited) |
|
538 * @t: The task in question |
|
539 * @cap: The capability to be tested for |
|
540 * |
|
541 * Return true if the specified task has the given superior capability |
|
542 * currently in effect, false if not, but don't write an audit message for the |
|
543 * check. |
|
544 * |
|
545 * Note that this does not set PF_SUPERPRIV on the task. |
|
546 */ |
|
547 #define has_capability_noaudit(t, cap) \ |
|
548 (security_real_capable_noaudit((t), (cap)) == 0) |
517 |
549 |
518 extern int capable(int cap); |
550 extern int capable(int cap); |
519 |
551 |
|
552 /* audit system wants to get cap info from files as well */ |
|
553 struct dentry; |
|
554 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps); |
|
555 |
520 #endif /* __KERNEL__ */ |
556 #endif /* __KERNEL__ */ |
521 |
557 |
522 #endif /* !_LINUX_CAPABILITY_H */ |
558 #endif /* !_LINUX_CAPABILITY_H */ |