mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-01-12 15:08:05 +07:00
c1a85a00ea
This patch provides a general mechanism for passing flags to the security_capable LSM hook. It replaces the specific 'audit' flag that is used to tell security_capable whether it should log an audit message for the given capability check. The reason for generalizing this flag passing is so we can add an additional flag that signifies whether security_capable is being called by a setid syscall (which is needed by the proposed SafeSetID LSM). Signed-off-by: Micah Morton <mortonm@chromium.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: James Morris <james.morris@microsoft.com>
51 lines
1.2 KiB
C
51 lines
1.2 KiB
C
/*
|
|
* AppArmor security module
|
|
*
|
|
* This file contains AppArmor capability mediation definitions.
|
|
*
|
|
* Copyright (C) 1998-2008 Novell/SUSE
|
|
* Copyright 2009-2013 Canonical Ltd.
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License as
|
|
* published by the Free Software Foundation, version 2 of the
|
|
* License.
|
|
*/
|
|
|
|
#ifndef __AA_CAPABILITY_H
|
|
#define __AA_CAPABILITY_H
|
|
|
|
#include <linux/sched.h>
|
|
|
|
#include "apparmorfs.h"
|
|
|
|
struct aa_label;
|
|
|
|
/* aa_caps - confinement data for capabilities
|
|
* @allowed: capabilities mask
|
|
* @audit: caps that are to be audited
|
|
* @denied: caps that are explicitly denied
|
|
* @quiet: caps that should not be audited
|
|
* @kill: caps that when requested will result in the task being killed
|
|
* @extended: caps that are subject finer grained mediation
|
|
*/
|
|
struct aa_caps {
|
|
kernel_cap_t allow;
|
|
kernel_cap_t audit;
|
|
kernel_cap_t denied;
|
|
kernel_cap_t quiet;
|
|
kernel_cap_t kill;
|
|
kernel_cap_t extended;
|
|
};
|
|
|
|
extern struct aa_sfs_entry aa_sfs_entry_caps[];
|
|
|
|
int aa_capable(struct aa_label *label, int cap, unsigned int opts);
|
|
|
|
static inline void aa_free_cap_rules(struct aa_caps *caps)
|
|
{
|
|
/* NOP */
|
|
}
|
|
|
|
#endif /* __AA_CAPBILITY_H */
|