summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohn Johansen <john.johansen@canonical.com>2013-08-14 11:27:32 -0700
committerJohn Johansen <john.johansen@canonical.com>2013-08-14 11:42:07 -0700
commit84f1f787421cd83bb7dfb34d584586f6a5fe7baa (patch)
treefbb958c9f7950f64feea732c7d78d0831120d540
parent29b3822f1e132aa0f115f69730d6e4182df153d4 (diff)
apparmor: export set of capabilities supported by the apparmor module
Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
-rw-r--r--security/apparmor/Makefile6
-rw-r--r--security/apparmor/apparmorfs.c1
-rw-r--r--security/apparmor/capability.c5
-rw-r--r--security/apparmor/include/capability.h4
4 files changed, 15 insertions, 1 deletions
diff --git a/security/apparmor/Makefile b/security/apparmor/Makefile
index 5706b74c857f..0831e049072d 100644
--- a/security/apparmor/Makefile
+++ b/security/apparmor/Makefile
@@ -18,7 +18,11 @@ quiet_cmd_make-caps = GEN $@
cmd_make-caps = echo "static const char *const capability_names[] = {" > $@ ;\
sed $< >>$@ -r -n -e '/CAP_FS_MASK/d' \
-e 's/^\#define[ \t]+CAP_([A-Z0-9_]+)[ \t]+([0-9]+)/[\2] = "\L\1",/p';\
- echo "};" >> $@
+ echo "};" >> $@ ;\
+ echo -n '\#define AA_FS_CAPS_MASK "' >> $@ ;\
+ sed $< -r -n -e '/CAP_FS_MASK/d' \
+ -e 's/^\#define[ \t]+CAP_([A-Z0-9_]+)[ \t]+([0-9]+)/\L\1/p' | \
+ tr '\n' ' ' | sed -e 's/ $$/"\n/' >> $@
# Build a lower case string table of rlimit names.
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 7a26608a5666..d708a55d072f 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -773,6 +773,7 @@ static struct aa_fs_entry aa_fs_entry_features[] = {
AA_FS_DIR("file", aa_fs_entry_file),
AA_FS_FILE_U64("capability", VFS_CAP_FLAGS_MASK),
AA_FS_DIR("rlimit", aa_fs_entry_rlimit),
+ AA_FS_DIR("caps", aa_fs_entry_caps),
{ }
};
diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c
index 887a5e948945..84d1f5f53877 100644
--- a/security/apparmor/capability.c
+++ b/security/apparmor/capability.c
@@ -27,6 +27,11 @@
*/
#include "capability_names.h"
+struct aa_fs_entry aa_fs_entry_caps[] = {
+ AA_FS_FILE_STRING("mask", AA_FS_CAPS_MASK),
+ { }
+};
+
struct audit_cache {
struct aa_profile *profile;
kernel_cap_t caps;
diff --git a/security/apparmor/include/capability.h b/security/apparmor/include/capability.h
index c24d2959ea02..2e7c9d6a2f3b 100644
--- a/security/apparmor/include/capability.h
+++ b/security/apparmor/include/capability.h
@@ -17,6 +17,8 @@
#include <linux/sched.h>
+#include "apparmorfs.h"
+
struct aa_profile;
/* aa_caps - confinement data for capabilities
@@ -34,6 +36,8 @@ struct aa_caps {
kernel_cap_t extended;
};
+extern struct aa_fs_entry aa_fs_entry_caps[];
+
int aa_capable(struct task_struct *task, struct aa_profile *profile, int cap,
int audit);