leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

apparmor: export set of capabilities supported by the apparmor module

Browse Source 
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
This commit is contained in:
John Johansen
2013-08-14 11:27:32 -07:00
parent 29b3822f1e
commit 84f1f78742
4 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
security/apparmor/Makefile
View File

@@ -18,7 +18,11 @@ quiet_cmd_make-caps = GEN $@
cmd_make-caps = echo "static const char *const capability_names[] = {" > $@ ;\ cmd_make-caps = echo "static const char *const capability_names[] = {" > $@ ;\
sed $< >>$@ -r -n -e '/CAP_FS_MASK/d' \ sed $< >>$@ -r -n -e '/CAP_FS_MASK/d' \
-e 's/^\#define[ \t]+CAP_([A-Z0-9_]+)[ \t]+([0-9]+)/[\2] = "\L\1",/p';\ -e 's/^\#define[ \t]+CAP_([A-Z0-9_]+)[ \t]+([0-9]+)/[\2] = "\L\1",/p';\
echo "};" >> $@ echo "};" >> $@ ;\
echo -n '\#define AA_FS_CAPS_MASK "' >> $@ ;\
sed $< -r -n -e '/CAP_FS_MASK/d' \
-e 's/^\#define[ \t]+CAP_([A-Z0-9_]+)[ \t]+([0-9]+)/\L\1/p' | \
tr '\n' ' ' | sed -e 's/ $$/"\n/' >> $@
# Build a lower case string table of rlimit names. # Build a lower case string table of rlimit names.

1
security/apparmor/apparmorfs.c
View File

@@ -773,6 +773,7 @@ static struct aa_fs_entry aa_fs_entry_features[] = {
AA_FS_DIR("file", aa_fs_entry_file), AA_FS_DIR("file", aa_fs_entry_file),
AA_FS_FILE_U64("capability", VFS_CAP_FLAGS_MASK), AA_FS_FILE_U64("capability", VFS_CAP_FLAGS_MASK),
AA_FS_DIR("rlimit", aa_fs_entry_rlimit), AA_FS_DIR("rlimit", aa_fs_entry_rlimit),
AA_FS_DIR("caps", aa_fs_entry_caps),
{ } { }
}; };

5
security/apparmor/capability.c
View File

@@ -27,6 +27,11 @@
*/ */
#include "capability_names.h" #include "capability_names.h"
struct aa_fs_entry aa_fs_entry_caps[] = {
AA_FS_FILE_STRING("mask", AA_FS_CAPS_MASK),
{ }
};
struct audit_cache { struct audit_cache {
struct aa_profile *profile; struct aa_profile *profile;
kernel_cap_t caps; kernel_cap_t caps;

4
security/apparmor/include/capability.h
View File

@@ -17,6 +17,8 @@
#include <linux/sched.h> #include <linux/sched.h>
#include "apparmorfs.h"
struct aa_profile; struct aa_profile;
/* aa_caps - confinement data for capabilities /* aa_caps - confinement data for capabilities
@@ -34,6 +36,8 @@ struct aa_caps {
kernel_cap_t extended; kernel_cap_t extended;
}; };
extern struct aa_fs_entry aa_fs_entry_caps[];
int aa_capable(struct task_struct *task, struct aa_profile *profile, int cap, int aa_capable(struct task_struct *task, struct aa_profile *profile, int cap,
int audit); int audit);