Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 84f1f787 authored by John Johansen's avatar John Johansen
Browse files

apparmor: export set of capabilities supported by the apparmor module 



Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
Acked-by: default avatarSeth Arnold <seth.arnold@canonical.com>
parent 29b3822f

security/apparmor/Makefile

+5 −1
Original line number Diff line number Diff line
@@ -18,7 +18,11 @@ quiet_cmd_make-caps = GEN $@ 
cmd_make-caps = echo "static const char *const capability_names[] = {" > $@ ;\

	sed $< >>$@ -r -n -e '/CAP_FS_MASK/d' \

	-e 's/^\#define[ \t]+CAP_([A-Z0-9_]+)[ \t]+([0-9]+)/[\2] = "\L\1",/p';\

	echo "};" >> $@

	echo "};" >> $@ ;\

	echo -n '\#define AA_FS_CAPS_MASK "' >> $@ ;\

	sed $< -r -n -e '/CAP_FS_MASK/d' \

	    -e 's/^\#define[ \t]+CAP_([A-Z0-9_]+)[ \t]+([0-9]+)/\L\1/p' | \

	     tr '\n' ' ' | sed -e 's/ $$/"\n/' >> $@





# Build a lower case string table of rlimit names.

security/apparmor/apparmorfs.c

+1 −0
Original line number Diff line number Diff line
@@ -773,6 +773,7 @@ static struct aa_fs_entry aa_fs_entry_features[] = { 
	AA_FS_DIR("file",			aa_fs_entry_file),

	AA_FS_FILE_U64("capability",		VFS_CAP_FLAGS_MASK),

	AA_FS_DIR("rlimit",			aa_fs_entry_rlimit),

	AA_FS_DIR("caps",			aa_fs_entry_caps),

	{ }

};

security/apparmor/capability.c

+5 −0
Original line number Diff line number Diff line
@@ -27,6 +27,11 @@ 
 */

#include "capability_names.h"



struct aa_fs_entry aa_fs_entry_caps[] = {

	AA_FS_FILE_STRING("mask", AA_FS_CAPS_MASK),

	{ }

};



struct audit_cache {

	struct aa_profile *profile;

	kernel_cap_t caps;

security/apparmor/include/capability.h

+4 −0
Original line number Diff line number Diff line
@@ -17,6 +17,8 @@ 


#include <linux/sched.h>



#include "apparmorfs.h"



struct aa_profile;



/* aa_caps - confinement data for capabilities
@@ -34,6 +36,8 @@ struct aa_caps { 
	kernel_cap_t extended;

};



extern struct aa_fs_entry aa_fs_entry_caps[];



int aa_capable(struct task_struct *task, struct aa_profile *profile, int cap,

	       int audit);